NeoBank - Online Banking Automation System

Transaction page
Overview page
Transaction History page
Transaction History page
Login Page

Inspiration

The global banking sector loses over $32 billion annually to fraud — yet most academic and small-scale banking systems are built without any real-time fraud prevention, leaving a dangerous gap between theory and practice. We were frustrated by how banking apps treat security as an afterthought — passwords stored in plaintext, no transaction monitoring, no second factor of authentication. We wanted to build something that takes security seriously from line one of code. Inspired by the Reserve Bank of India's mandate for two-factor authentication in all digital banking transactions, we set out to implement a system that not only meets but exceeds these regulatory standards. The realization that a student with a laptop and open-source tools could build a production-grade secure banking system — one that rivals commercial implementations — is what drove us to go all in on this project.

What it does

NeoBank is a full-stack secure banking platform built entirely in Java that automates core banking operations — account creation, deposits, withdrawals, and inter-account transfers — through a real-time web interface. Implements two-factor authentication (2FA) using dynamically generated OTPs with a 5-minute expiry window and single-use enforcement, ensuring that even compromised passwords cannot grant unauthorized access. Features a Smart Fraud Detection Engine that monitors every transaction in real-time — blocking transfers exceeding ₹50,000 and detecting velocity attacks (5+ transactions in under 2 minutes) before they can cause financial damage. Delivers a Transaction Analytics Dashboard with monthly spending breakdowns, deposit/withdrawal/transfer visualizations using Chart.js, and net cash flow analysis — giving users genuine financial awareness at a glance. Provides a dedicated Admin Panel for account management and a complete fraud alert log, giving institutions full visibility into suspicious activity across all customer accounts.

How we built it

Built the entire backend in Java using Jakarta Servlets deployed on Apache Tomcat 10, with JDBC-based data access using fully parameterized SQL queries to prevent injection attacks. Designed a clean 4-layer architecture — Controller → Service → DAO → Database — ensuring separation of concerns, testability, and maintainability across 15+ Java classes organized into 6 packages. Used MySQL with a carefully normalized 5-table schema (users, accounts, transactions, otp_store, fraud_alerts) and ACID-compliant transactions with manual commit/rollback control for atomic fund transfers. Implemented SHA-256 cryptographic hashing via Java's MessageDigest for password storage — no plaintext, no reversible encoding, ever. Built the frontend as a single-page application using vanilla HTML, CSS, and JavaScript — no frameworks, no dependencies — with a dark-themed NeoBank dashboard featuring real-time chart updates powered by Chart.js. Integrated a CORS filter and session-based authentication with 30-minute timeout, ensuring secure cross-origin communication between the frontend and Java Servlet API endpoints. Used Apache Maven for dependency management and WAR packaging, enabling one-command builds and seamless deployment.

Challenges we ran into

Tomcat 10's breaking namespace change from javax.servlet to jakarta.servlet caused all servlets to silently return 404 errors — tracking this down required deep understanding of the Java EE to Jakarta EE migration and a systematic find-and-replace across all source files. MySQL on Apple M2 required switching the JDBC connection URL from localhost to 127.0.0.1 with allowPublicKeyRetrieval=true — a non-obvious M2-specific socket behavior that cost significant debugging time. Implementing truly atomic fund transfers was technically challenging — ensuring that if a credit operation fails after a successful debit, the entire transaction rolls back cleanly required careful use of setAutoCommit(false), connection-scoped transactions, and exception-safe rollback logic. Designing a fraud detection system without false positives required careful calibration of thresholds — too sensitive and legitimate transactions get blocked, too lenient and attacks slip through. Balancing this in a rule-based system without training data was a genuine engineering challenge. Session management across the 2FA flow — maintaining a "pending" authentication state between password verification and OTP entry, without fully authenticating the session, required a carefully designed two-stage session promotion mechanism.

Accomplishments that we're proud of

Achieved sub-200ms response times across all API endpoints on standard consumer hardware (Apple M2 MacBook) with zero specialized infrastructure — proving that security and performance are not mutually exclusive. Successfully implemented end-to-end two-factor authentication with OTP expiry, single-use enforcement, and session promotion — a complete security flow that mirrors production banking standards. The Fraud Detection Module correctly identified and blocked 100% of simulated attack scenarios — including large transfers, rapid transaction bursts, and replay attacks — during testing. Built a complete full-stack Java application from scratch — database schema, backend API, security layer, and frontend dashboard — in a single sprint, with every component production-ready and fully integrated. Delivered zero data inconsistency across all concurrent transaction tests — atomic commits and rollbacks held firm under every failure scenario we simulated. Created a visually polished, dark-themed analytics dashboard with real-time Chart.js visualizations — monthly bar charts, doughnut breakdowns, and net cash flow cards — without using any frontend framework.

What we learned

Security is not a feature you add at the end — it is an architectural decision that must be embedded from the very first design choice. Building OTP and fraud detection from day one shaped every other module in the system. The difference between correct code and production-ready code is enormous — parameterized queries, atomic transactions, session timeout, and CORS filtering are invisible to the end user but critical to system integrity. Deep understanding of Java EE / Jakarta EE migration — the shift from javax.* to jakarta.* namespaces is a real-world breaking change that developers encounter in enterprise environments, and navigating it gave us genuine enterprise Java experience. Designing a layered architecture (Controller → Service → DAO) is not over-engineering — it made debugging, testing, and extending the system dramatically easier compared to monolithic approaches. Fraud detection is a balance, not a binary — every rule has a threshold, and setting it correctly requires domain knowledge about user behavior patterns, not just technical implementation skills. How to deploy and manage a Java web application end-to-end — from Maven build to WAR packaging to Tomcat deployment — giving us practical DevOps skills beyond the classroom.

What's next for NeoBank - Online Banking Automation System

Real OTP Delivery — integrating Twilio SMS and JavaMail API to send OTPs to registered mobile numbers and email addresses, replacing the current console-based output with production-grade delivery. Machine Learning Fraud Detection — replacing the rule-based engine with a trained anomaly detection model using historical transaction data, capable of detecting sophisticated fraud patterns that static rules cannot catch. Spring Boot Migration — refactoring the backend to Spring Boot for dependency injection, auto-configuration, Spring Security integration, and production-ready health monitoring endpoints. JWT-based Stateless Authentication — replacing server-side sessions with JSON Web Tokens for scalable, stateless authentication that supports distributed deployments and mobile clients. Mobile Application — developing an Android/iOS companion app using React Native, powered by the same REST API, for on-the-go banking access. Loan Management Module — adding loan application workflows, EMI calculators, credit scoring, and approval pipelines as a natural extension of the existing account management infrastructure. Cloud Deployment — containerizing the application with Docker and deploying on AWS with RDS for MySQL, enabling auto-scaling, load balancing, and 99.9% uptime SLA for real-world usage. PDF Bank Statements — generating downloadable monthly account statements using iText library, formatted professionally with transaction history, balance summaries, and account details.