NetBanker 2.0

Wachovia is developing user-managed security controls

In an American Banker article today (here), Wachovia says it is developing security controls that will put users in charge of some of their own security settings such as the size of a funds transfer allowed. According to John Watkins, Wachovia's Director of Online Services, the new capabilities will be available "sometime this year."

This is not a new concept. The first full-service, online-only bank in the world, Security First Network Bank offered user-set bill payment limits more than a decade ago. Other international banks, such as ABSA Bank in South Africa, have long allowed users some control over security matters.

However, in the United States user-controlled security has been slow to catch on, other than via triggered email alerts, which remain the first line of defense. For several months, Bank of America has been reminding online banking users that alerts can help them prevent fraud in their accounts.

While it's too early to speculate on what Wachovia will or won't do, the concept is a good one, and will eventually be used to some extent by all financial institutions. It's a win-win, providing users a better sense of control while reducing actual fraud losses within the bank. 

For more information:

See Online Banking Report #119, "Marketing Security," for more ideas on how to turn security concerns into a marketing advantage.

More free ID theft insurance

Texans Credit Union <texanscu.org> has added complimentary ID theft insurance and help services to their checking accounts. The new service is promoted through a somewhat confusing "Upgrade Now" call-to-action near the bottom and a large graphic (which rotates with two other spots) in the middle section of its gorgeous homepage (see screenshot below; notice how they use drop shadows to highlight the page).

Analysis
It's an OK perk, but doesn't do anything to help members prevent ID theft. To do that, members need credit report monitoring, which is available for $70 to $140 per year from the credit union's co-branded program with Identity Fraud Inc. (see screenshot below; read the full terms and conditions here).

However, it's not clear on subsequent pages whether members must take action to get the free service and which options they should choose to upgrade to credit report monitoring. We'd like it better if the credit union were more upfront about what is and is not included, and what the member must do.   

Verity Credit Union website hacked

Update (Nov. 12, 10 AM PST): Twenty-two hours later, the Verity website has been taken offline, but the blog is still running. However, there are no new posts since the original, although Verity's Shari Storm has responded to several member comments. From information in the comments, it sounds like Verity's log-in page was redirected for up to four hours on Saturday morning beginning about 6:00 AM. At least one member said they answered "screening questions" including mother's maiden name.

Seattle-based Verity Credit Union is in the midst of a major website spoof that began earlier today. The credit union is reporting that the log-in function to online banking, located on its homepage (upper-right below), has been redirected by a hacker.

Apparently, only the log-in function was hijacked. The credit union has control of its homepage and plastered a large warning over the front. The link after the warning, "more information," linked to the Verity blog for updates (see below).

It appears the log-in process is back under the credit union's control, although the warning is still there. When attempting to log in at 3:15 PM with a test name (I do not have a Verity account), I was redirected to an error message at <https://secure-veritycu.com/Common/SignOn/SignOnError.asp>, which appears to be a legitimate Verity secure page. There was no follow-up question asking for my credit card number as mentioned in the blog post (see below).

The incident was first posted to their blog at 12:02 PM today (see post below).

The silver lining
As bad as this is, Verity should be applauded for the rapid response, using both its website and blog to get the word out. Presumably, they also emailed customers, but those messages may or may not be believed in this day of rampant phishing.

You can follow the ongoing drama at the Verity blog, where customers have been redirected for the latest news. We'll keep you posted.

PayPal email: Simple steps to protect against fraud and ID theft

Despite calls for banks to stop marketing via email (see here) to help reduce fraud, PayPal, probably the most phished brand in the world, shows that the technique can still be effective. 

It requires a professional layout, good personalization, and behind-the-scenes fraud monitoring to nip phishing attempts in the bud.

Here's the latest from PayPal. Note the 30-second credit card button (bottom left) and personalized greeting at the top of the message.

Classification

Type: Marketing email with educational focus

Product: Payments with credit card cross-sell

Customer Type: Active customer

Personalization: Hello <yourname> at top of message

Header

Date received: Wed 11/1/2006 9:38 AM
From: PayPal [[email protected]]
To: Jim Bruene
Subject: Simple Steps to Protect Against Fraud and ID Theft

FFIEC multi-factor scorecard: 30 banks and credit unions disclose security solutions

There seems to be a new announcement every day about a bank or credit union intent on stalling this or that security solution to comply with the FFIEC's year-end guidelines (see previous coverage here).

However, if you drill-down through the press releases, usually initiated by vendors, details are sketchy. In fact, according to the Glenbrook Partners in-house security wizard, Linda Elliot, only 26 U.S. financial institutions have disclosed specific security solutions from a total of 13 vendors. Her most recent scorecard, as published in the consulting company's Payments News, is here.

We added another three credit unions to bring the total to 29:

Banks (22)

• American Bank (RSA)
• AMSouth Bank (vendor not disclosed)
• Associated Bancorp (Corillian)
• Bank of America (RSA/Passmark) our post
• Barclay’s (RSA)
• Citibank (Consumer: Entrust; Business: VASCO DigiPass)
• E*Trade (RSA SecurID)
• Farmer's and Merchant's Bank of Long Beach (RSA/Passmark)
• Frost Bank (RSA/Passmark)
• ING Direct (RSA)
• M&T Bank (Corillian, Cydelity)
• Nevada State Bank (RSA/Passmark)
• North Fork Bank / All Points Capital (Arcot)
• Northern Trust (Verisign)
• Silicon Valley Bank (Bharosa)
• Stonebridge Bank (RSA)
• The Bankers Bank (Digital Persona)
• United Bankers' Bank (Digital Persona)
• U.S. Bank (Entrust)
• Washington Mutual (RSA)
• Wells Fargo (Bharosa, Quova, Actimize, RSA SecureID,
  Symantec)
• Zions Bank (RSA/Passmark) our post

Credit Unions (7)

• Automotive Federal Credit Union (BioPassword)
• North Island Credit Union (RSA/Passmark) our post
• Schools Financial Credit Union (RSA/Passmark)

our post

• Desert Schools FCU (Bharosa)
• FORUM Credit Union (BioPassword)
• Parda Federal Credit Union (BioPassword)
• Stanford Federal Credit Union (RSA/Passmark) our post

FFIEC releases FAQ on enhanced security requirements

Today, the Federal Financial Institutions Examination Council (FFIEC) issued a 7-page list of questions and answers about its October 12, 2005, bestseller, Authentication in an Internet Banking Environment.

The main thing you need to know about the new document is what it does NOT say, that the year-end deadline has been extended (see Timing, Q1, p. 4, reprinted below). However, the answer does appear to provide a bit of wiggle room, saying that banks must "implement risk mitigation activities by year-end 2006." I'm sure many creative interpretations of the precise meaning of that phrase will surface. 

Q-1- What do the Agencies expect institutions to have accomplished by year-end 2006?
A-1- The Agencies expect that institutions will complete the risk assessment and will implement risk-mitigation activities by year-end 2006. The Agencies are not considering any general extension of the timing associated with this guidance.

Good luck to all.

--JB

TreasuryDirect adds virtual keyboard

A number of banks, including ING Direct <ingdirect.com> and ABSA <absa.co.za> have added virtual keypads to defeat keyloggers, but the U.S. Treasury Department's Treasury Direct <treasurydirect.org> website is the first time we've seen an entire virtual keyboard. The layout is scrambled after each login, an extremely non-user-friendly feature.

The Treasury may have added a bit more security than is necessary, especially in light of Aite Group's <aitegroup.com> latest research that online banking fraud in the United States was a scant $4 million last year (correct, that is no typo, it's MILLION as in 4 cents per U.S. household). The virtual keyboard itself would defeat most hacks; there's no need to scramble it every time.

Thanks to MyMoneyBlog for the tip. Interestingly, most of the 16 comments on the new security feature were negative because of the extra hassle.

ID theft-protection services

Today's Wall Street Journal ran a run-down of identity theft startups. Companies mentioned:

• LifeLock: Founded by Todd Davis, the Chandler, AZ-based firm has been offering its $10/mo service since April 2005. The company also protects children living in the same household for an additional $10 per year. Its plain-language guarantee featured prominently in the upper-right corner of its home page should serve as an example for financial institutions (see inset).
• TrustedID: A Redwood City, CA-based company co-founded in January by former Fair Isaac executive Scott Mitic offers protection services for $7.95/mo.
• CardCops: The Malibu, CA-based firm scans the Internet for stolen information and for $24.95/mo alerts its customers if their data has been compromised.
• Cyveillance: The Arlington, VA firm also sifts through the online world looking for stolen data. The company resells its service as Identity Guard through Intersections Inc.

Financial institutions should be partnering with credit bureaus and/or identity theft providers to provide education and protection services to banking customers. Refer to previous articles here.

-- JB

Zions launches SecurEntry powered by PassMark

Zions Bank <zionsbank.com> is one of the early entrants in the parade of banks and credit unions rolling out multi-factor authentication this year. The Utah-based bank is using the PassMark/RSA <passmarksecurity.com> system pioneered by Bank of America last year (FMW May 26, 2005).

Although there are compliance and security reasons enhancing security, the biggest benefit is marketing and PR. Just today, highly influential Wall Street Journal columnist Walt Mossberg urged readers to ignore financial institution emails saying, "...never, ever consider any email from a financial institution as legitimate." Ouch.

SecurEntry positioning
While we like the SecurEntry name, its page-dominating position on the Zions homepage (see above) is a bit over the top. Granted, they are in education mode as they race to enroll every customer within the next two months. But there's a reason why bank branches in high-crime areas use Plexiglas enclosures instead of steel bars; you don't want to make your customers afraid. The best security measures are subtle and discourage criminals without overly impacting the 99.9% of your customers who would never try to make off with the contents of the cash drawer.

It would work better to place the SecurEntry logo near the log-in area in the upper-right. That way, customers concerned about security could click-through to learn more, and customers that weren't already paranoid could go about their banking business without feeling new insecurities.

How it works
SecurEntry is a multi-factor authentication scheme identical to that used by 20 million customers of Bank of America, Stanford Credit Union, and others (see FMW April 12). The new system, launched July 11, is optional for the first two months and becomes mandatory on Sept. 8. The bank estimates it will take five minutes to enable. Zions posted a Flash and HTML demo explaining the system, a one-page Quick Reference Guide (PDF), seven-page illustrated tutorial (PDF), and 11-question FAQ. 

Off-topic: brief homepage critique
Zions' new homepage design is hard to judge. Taken individually, the modern graphics and succinct copy are excellent. However, the overall effect is way too busy, with too many elements screaming for the user's attention. The bank needs to better prioritize what they want to communicate on the homepage. The main points can be emphasized with strong graphical treatment while less-important areas are reachable through more subtle navigation, such as sub-menus.

--JB

 

Disposable debit cards

Although they've been around for years, with relatively little success, the time may be right for disposable card numbers. However, this time, the emphasis should be on debit, the payment of choice for many younger consumers.

A compelling case can be made for disposable debit which:

• is the favored payment vehicle for the under-30 crowd, and often the ONLY payment option for high school and college students
• differentiates your checking account from 16,000 other U.S. providers
• encourages more debit card usage
• cements account relationships
• adds value to online banking archives
• provides excellent PR (customer advocacy) and branding benefits

But while great strides have been made in educating consumers about credit card fraud protection, the issue is murkier on the debit side.

Consumer appeal
We were reminded of the appeal of disposable card numbers when reviewing Cambrian House <cambrianhouse.com>, a Web-based venture attempting to "open-source" the business-startup process. While we don't see that taking off, the company does maintain an interesting database of user-submitted business ideas. Of the 433 ideas listed, the most popular according to site visitors is:

Self-destructing credit cards submitted by Rohan Pinto

Essentially what Mr. Pinto is proposing is the one-time-use credit card number offered since the late 1990s by Citibank, American Express, and, more recently, Discover Card (see inset). The main difference is the name, which actually is pretty good, if it hasn't been trademarked yet (we couldn't find any business using the term in a quick Google).

--JB