Finovate Blog

If you are looking for a spam/spyware/phishing resource for your online customers, OnGuardOnline.gov is a good resource, especially for novice users.

The site is sponsored by The Federal Trade Commission, Dept. of Homeland Security, U.S. Dept. of Commerce, and The United State Postal Inspection Service. They also had some help from the private sector, with some content provided by Microsoft and The Internet Education Foundation www.neted.org. The site also lists a number of other partners, but does not disclose their contribution. None of the listed partners are closely associated with the financial services industry.

The main content areas cover:

• ID theft
• Spam scams
• Phishing
• Spyware
• Shopping
• P2P file sharing
• VoIP

Analysis
The information is thorough and presented in a audio-visual format that is easy to digest (click on inset to see a closeup of the homepage). The videos from Microsoft are particularly well done. And surprisingly there is no plug for the software giant, they don’t even have a logo on the site.

The interactive Flash games are a little on the hokey side, but they get their points across. The Stop-Think-Click: 7 Practices for Safer Computing is very well written and hopefully will become widely circulated in the popular press.   

Action items
Financial institutions should use the site either as a direct resource for customers or as a blueprint for the material which should be presented in a bank’s security and privacy area. The 7-point Stop-Think-Click material is especially useful to present to users.

The only slight hesitation we have about referring customers directly to OnGuardOnline.com is that it may be somewhat overly frightening. We think it’s better to cover these issues yourself so you can provide reassurances along the way as to how you are helping solve these vulnerabilities.

But for those who haven’t the resources or budget to create your own security center, this is a good reference point.

–JB

Katie Kuehner-Hebert looks at the issue of mandating consumer password changes in today’s American Banker. She cited only a single bank doing it, West Georgia National Bank <www.wgnb.com>, which recently began requiring new passwords every 45 days. None of the financial institutions we are familiar with force password changes, although NextCard did when it first launched in 1997, but later it did away with the annoying requirement.

Analysis
This is one of the least effective ways to improve security. In fact, it may have exactly the opposite effect for two reasons:

1. Customers cannot memorize a new password every 45 days, so they will have to write it down somewhere near their PC where it can be seen by others.
2. Once users begin to realize what a hassle it is logging in to your website, they will forgo online access altogether or use it much less frequently, therefore reducing the frequency of account monitoring which can reduce the impact of identity theft and other fraud.

And even the method did reduce fraud, it’s unlikely to be cost effective due to the increased burden on customer service and decreased customer satisfaction.

Offer choice
Some customers do like the idea of periodic password changes, but forget about mandatory changes. We like the M&T Bank <www.mandtbank.com>. The Buffalo-based banks allows customers to choose whether to have mandatory password changes at either 30, 60, 90, 180 or 365 days. They can also choose NOT to have a mandatory password change (click on inset for a closeup).

An even simpler way to give customers the choice is to allow customers to program an alert reminding themselves to change their password. The alert should NOT have a link back to the bank, otherwise it will look like a phishing message.

—JB