Is There Anything Left to Phish? Fake Wells Fargo Credit Card Authorization Notification

I hate phishing. Not only has it cost the world's financial institutions tens of millions in fraud losses, it's just about killed the email channel in terms of getting your customer's attention in a timely fashion, and it's diverted management's attention from much-needed online marketing improvements. That's much worse than the actual fraud losses. 

Like most people with widely published email addresses, I get a half-dozen phishing messages every day (note 1). I rarely give them a second look unless they purport to be from my bank. Almost all of them are placed in the junk folder by Outlook, one of the nicer services of Microsoft Office.

Phishers have to be much more creative these days. The time has past when a few paragraphs of broken English and the bank's logo could net the fraudsters a few extra coins. Now I get fake emails asking me to verify my security settings, authorize account changes, or claim a sweepstakes prize.

Wells Fargo credit card authorization phish CLICK TO ENLARGE For example, today I received a fake credit card authorization request from Wells Fargo (see inset). I'm not sure why it prompted a blog entry. Maybe because I use a Wells card or maybe because I've been talking to mobile banking execs about this very subject. But the fake was good enough to force me to take a closer look. The biggest clue is the wrong format for the USD charge, using a "comma" instead of a decimal point between the dollars and sense. But otherwise it's pretty good, and may even net a few card numbers before its taken down.

Analysis
I am optimistic that email can still be effective if financial institutions clearly personalize their messages (see samples here and here). However, gaining customer trust back, especially for security-related messages, is a long-term project. That's why we are telling financial institutions to invest in RSS/XML feeds (Online Banking Report #135/136) and/or mobile banking (Online Banking Report #138/139) in order to reach their customers in a way that is less prone to fraud, at least for now.

Notes:

1. A great online repository of phishing examples is housed at MillerSmiles.co.uk

2. There's a whole book on phishing, click on cover above to go to Amazon's description of the title.

Wachovia is Developing User-Managed Security Controls

Link to Wachovia Security Plus page In an American Banker article today (here), Wachovia says it is developing security controls that will put users in charge of some of their own security settings such as the size of a funds transfer allowed. According to John Watkins, Wachovia's Director of Online Services, the new capabilities will be available "sometime this year."

This is not a new concept. The first full-service online-only bank in the world, Security First Network Bank, offered user-set bill payment limits more than ten years ago. Other international banks, such as ABSA Bank in South Africa, have long allowed users some control over security matters.

However, in the United States user-controlled security has been slow to catch on, other than via triggered email alerts, which remain the first line of defense. For several months, Bank of America has been reminding online banking users that alerts can help them prevent fraud in their accounts. 

While it's too early to speculate on what Wachovia will or won't do, the concept is a good one, and will eventually be used to some extent by all financial institutions. It's a win-win, providing users a better sense of control while reducing actual fraud losses within the bank.  

For more information:

See Online Banking Report #119, "Marketing Security" for more ideas on how to turn security concerns into a marketing advantage.

Texans Credit Union Offers Free Identity Theft Insurance

Texans Credit Union <texanscu.org> has added complimentary ID theft insurance and help services to their checking accounts. The new service is promoted through a somewhat confusing "Upgrade Now" call-to-action near the bottom and a large graphic (which rotates with two other spots) in the middle section of its gorgeous homepage (see screenshot below; notice how they use drop shadows to highlight the page).

Texans CU home CLICK TO ENLARGE

Analysis
It's an OK perk, but doesn't do anything to help members prevent ID theft. To do that, members need credit report monitoring, which is available for $70 to $140 per year from the credit union's co-branded program with Identity Fraud Inc. (see screenshot below; read the full terms and conditions here).

However, it's not clear on subsequent pages whether members must take action to get the free service and which options they should choose to upgrade to credit report monitoring. We'd like it better if the credit union were more upfront about what is and is not included, and what the member must do.   

Verity Credit Union Website Hacked

Update (Nov. 12, 10 AM PST): Twenty-two hours later, the Verity website has been taken offline, but the blog is still running. However, there are no new posts since the original, although Verity's Shari Storm has responded to several member comments. From information in the comments, it sounds like Verity's log-in page was redirected for up to four hours on Saturday morning beginning about 6:00 AM. At least one member said they answered "screening questions" including mother's maiden name.

Seattle-based Verity Credit Union is in the midst of a major website spoof that began earlier today. The credit union is reporting that the log-in function to online banking, located on its homepage (upper-right below), has been redirected by a hacker.

Apparently, only the log-in function was hijacked. The credit union has control of its homepage and plastered a large warning over the front. The link after the warning, "more information," linked to the Verity blog for updates (see below).

Verity CU home page with warning CLICK TO ENLARGE

It appears the log-in process is back under the credit union's control, although the warning is still there. When attempting to log in at 3:15 PM with a test name (I do not have a Verity account), I was redirected to an error message at <https://secure-veritycu.com/Common/SignOn/SignOnError.asp>, which appears to be a legitimate Verity secure page. There was no follow-up question asking for my credit card number as mentioned in the blog post (see below).

The incident was first posted to their blog at 12:02 PM today (see post below).

Blog post on the hack

The silver lining
As bad as this is, Verity should be applauded for the rapid response, using both its website and blog to get the word out. Presumably, they also emailed customers, but those messages may or may not be believed in this day of rampant phishing.

You can follow the ongoing drama at the Verity blog, where customers have been redirected for the latest news. We'll keep you posted.

PayPal Email: Simple Steps to Protect Against Fraud and ID Theft

Despite calls for banks to stop marketing via email (see here) to help reduce fraud, PayPal, probably the most phished brand in the world, shows that the technique can still be effective. 

It requires a professional layout, good personalization, and behind-the-scenes fraud monitoring to nip phishing attempts in the bud.

Here's the latest from PayPal. Note the 30-second credit card button (bottom left) and personalized greeting at the top of the message.

PayPal email

Classification

Type: Marketing email with educational focus

Product: Payments with credit card cross-sell

Customer Type: Active customer

Personalization: Hello <yourname> at top of message

Header

Date received: Wed 11/1/2006 9:38 AM
From: PayPal [paypal@email.paypal.com]
To: Jim Bruene
Subject: Simple Steps to Protect Against Fraud and ID Theft

FFIEC Multi-Factor Scorecard: 30 Banks and Credit Unions Disclose Security Solutions

There seems to be a new announcement every day about a bank or credit union intent on stalling this or that security solution to comply with the FFIEC's year-end guidelines (see previous coverage here).

However, if you drill-down through the press releases, usually initiated by vendors, details are sketchy. In fact, according to the Glenbrook Partners in-house security wizard, Linda Elliot, only 26 U.S. financial institutions have disclosed specific security solutions from a total of 13 vendors. Her most recent scorecard, as published in the consulting company's Payments News, is here.

We added another three credit unions to bring the total to 29:

Banks (22)

  • American Bank (RSA)
  • AMSouth Bank (vendor not disclosed)
  • Associated Bancorp (Corillian)
  • Bank of America (RSA/Passmark) our post
  • Barclay’s (RSA)
  • Citibank (Consumer: Entrust; Business: VASCO DigiPass)
  • E*Trade (RSA SecurID)
  • Farmer's and Merchant's Bank of Long Beach (RSA/Passmark)
  • Frost Bank (RSA/Passmark)
  • ING Direct (RSA)
  • M&T Bank (Corillian, Cydelity)
  • Nevada State Bank (RSA/Passmark)
  • North Fork Bank / All Points Capital (Arcot)
  • Northern Trust (Verisign)
  • Silicon Valley Bank (Bharosa)
  • Stonebridge Bank (RSA)
  • The Bankers Bank (Digital Persona)
  • United Bankers' Bank (Digital Persona)
  • U.S. Bank (Entrust)
  • Washington Mutual (RSA)
  • Wells Fargo (Bharosa, Quova, Actimize, RSA SecureID,
    Symantec)
  • Zions Bank (RSA/Passmark) our post

Credit Unions (7)

  • Automotive Federal Credit Union (BioPassword)
  • North Island Credit Union (RSA/Passmark) our post
  • Schools Financial Credit Union (RSA/Passmark)
  • our post

  • Desert Schools FCU (Bharosa)
  • FORUM Credit Union (BioPassword)
  • Parda Federal Credit Union (BioPassword)
  • Stanford Federal Credit Union (RSA/Passmark) our post

FFIEC Releases FAQ on Enhanced Security Requirements

Ffiec_logo Today, the Federal Financial Institutions Examination Council (FFIEC) issued a 7-page list of questions and answers about its October 12, 2005, bestseller, Authentication in an Internet Banking Environment.

Bankingfraudfordummies_1 The main thing you need to know about the new document is what it does NOT say, that the year-end deadline has been extended (see Timing, Q1, p. 4, reprinted below). However, the answer does appear to provide a bit of wiggle room, saying that banks must "implement risk mitigation activities by year-end 2006." I'm sure many creative interpretations of the precise meaning of that phrase will surface. 

Q-1- What do the Agencies expect institutions to have accomplished by year-end 2006?
A-1– The Agencies expect that institutions will complete the risk assessment and will implement risk-mitigation activities by year-end 2006. The Agencies are not considering any general extension of the timing associated with this guidance.

Good luck to all.

JB

TreasuryDirect adds Virtual Keyboard

A number of banks, including ING Direct <ingdirect.com> and ABSA <absa.co.za> have added virtual keypads to defeat keyloggers, but the U.S. Treasury Department's Treasury Direct <treasurydirect.org> website is the first time we've seen an entire virtual keyboard. The layout is scrambled after each login, an extremely non-user-friendly feature.

The Treasury may have added a bit more security than is necessary, especially in light of Aite Group's <aitegroup.com> latest research that online banking fraud in the United States was a scant $4 million last year (correct, that is no typo, it's MILLION as in 4 cents per U.S. household). The virtual keyboard itself would defeat most hacks; there's no need to scramble it every time.

Treasurydirect_virtualkeyboard

Thanks to MyMoneyBlog for the tip. Interestingly, most of the 16 comments on the new security feature were negative because of the extra hassle.

The Wall Street Journal Profiles Identity Theft Protection Services

Today's Wall Street Journal ran a run-down of identity theft startups. Companies mentioned:

  • Lifelock_guaranteeLifeLock: Founded by Todd Davis, the Chandler, AZ-based firm has been offering its $10/mo service since April 2005. The company also protects children living in the same household for an additional $10 per year. Its plain-language guarantee featured prominently in the upper-right corner of its home page should serve as an example for financial institutions (see inset).
  • TrustedID: A Redwood City, CA-based company co-founded in January by former Fair Isaac executive Scott Mitic offers protection services for $7.95/mo.
  • CardCops: The Malibu, CA-based firm scans the Internet for stolen information and for $24.95/mo alerts its customers if their data has been compromised.
  • Cyveillance: The Arlington, VA firm also sifts through the online world looking for stolen data. The company resells its service as Identity Guard through Intersections Inc.

Financial institutions should be partnering with credit bureaus and/or identity theft providers to provide education and protection services to banking customers. Refer to previous articles here.

JB

Zions launches SecurEntry powered by PassMark

Zions_logo_2Zions Bank <zionsbank.com> is one of the early entrants in the parade of banks and credit unions rolling out multi-factor authentication this year. The Utah-based bank is using the PassMark/RSA <passmarksecurity.com> system pioneered by Bank of America last year (NB May 26, 2005).

Although there are compliance and security reasons enhancing security, the biggest benefit is marketing and PR. Just today, highly influential Wall Street Journal columnist Walt Mossberg urged readers to ignore financial institution emails saying, "…never, ever consider any email from a financial institution as legitimate." Ouch.

Zions_home_1

SecurEntry positioning
While we like the SecurEntry name, its page-dominating position on the Zions homepage (see above) is a bit over the top. Granted, they are in education mode as they race to enroll every customer within the next two months. But there's a reason why bank branches in high-crime areas use Plexiglas enclosures instead of steel bars; you don't want to make your customers afraid. The best security measures are subtle and discourage criminals without overly impacting the 99.9% of your customers who would never try to make off with the contents of the cash drawer.

It would work better to place the SecurEntry logo near the log-in area in the upper-right. That way, customers concerned about security could click-through to learn more, and customers that weren't already paranoid could go about their banking business without feeling new insecurities.

How it works
SecurEntry is a multi-factor authentication scheme identical to that used by 20 million customers of Bank of America, Stanford Credit Union, and others (see NB April 12). The new system, launched July 11, is optional for the first two months and becomes mandatory on Sept. 8. The bank estimates it will take five minutes to enable. Zions posted a Flash and HTML demo explaining the system, a one-page Quick Reference Guide (PDF), seven-page illustrated tutorial (PDF), and 11-question FAQ

Off-topic: brief homepage critique
Zions' new homepage design is hard to judge. Taken individually, the modern graphics and succinct copy are excellent. However, the overall effect is way too busy, with too many elements screaming for the user's attention. The bank needs to better prioritize what they want to communicate on the homepage. The main points can be emphasized with strong graphical treatment while less-important areas are reachable through more subtle navigation, such as sub-menus.

JB

 

To learn more about how to promote online security and peace of mind, check out Marketing Security: The sensitive issue of publicizing security and authorization enhancements from our sister publication, the Online Banking Report.

Disposable Debit Cards

Discover_disposablenums_cardAlthough they've been around for years, with relatively little success, the time may be right for disposable card numbers. However, this time, the emphasis should be on debit, the payment of choice for many younger consumers.

A compelling case can be made for disposable debit which:

  • is the favored payment vehicle for the under-30 crowd, and often the ONLY payment option for high school and college students
  • differentiates your checking account from 16,000 other U.S. providers
  • encourages more debit card usage
  • cements account relationships
  • adds value to online banking archives
  • provides excellent PR (customer advocacy) and branding benefits

But while great strides have been made in educating consumers about credit card fraud protection, the issue is murkier on the debit side.

Consumer appeal
We were reminded of the appeal of disposable card numbers when reviewing Cambrian House <cambrianhouse.com>, a Web-based venture attempting to "open-source" the business-startup process. While we don't see that taking off, the company does maintain an interesting database of user-submitted business ideas. Of the 433 ideas listed, the most popular according to site visitors is:

Self-destructing credit cards submitted by Rohan Pinto

Discover_disposablenumsEssentially what Mr. Pinto is proposing is the one-time-use credit card number offered since the late 1990s by Citibank, American Express, and, more recently, Discover Card (see inset). The main difference is the name, which actually is pretty good, if it hasn't been trademarked yet (we couldn't find any business using the term in a quick Google).

JB

 

 

 

 

Banking on SMS

by Pieter de Villiers, CEO of Clickatell

Clickatell_logoIn the fight against financial fraud, it's a simple technology that is proving one of the most effective deterrents, as well as being a cost-cutting tool that builds customer loyalty.  Thanks to the incredible reach of SMS, its simplicity, and the fact that it is the most accessible messaging technology in the world, banks are introducing text messaging as an added layer of security for their customers to tackle the problem of identity theft.

Case studies
Fnb_za_logo In South Africa, for example, First National Bank (FNB) <fnb.co.za> claims that its SMS service, called inContact, has not only reduced fraud by 43%, but also has brought about increases in Internet-banking security. Client retention has increased by 15%, and call center costs have been reduced. With 22 million messages sent every month to more than 1.1 million subscribers, FNB is the largest single sender of text messages in the country, responsible for 26% of all messages.

With the widespread adoption of mobile communications, it’s a fair assumption that most people with a bank account, credit and debit cards will have a mobile phone. “Contactability” is rarely an issue. With very few exceptions, a text message will reach its intended destination, and it will be read. It is a peculiarity of mobile communications that while many people will ignore a call, they will always look at a text message. It is also a private communication.

Like FNB, a growing number of banks are realizing the power of the text message, and SMS is being introduced as an added layer of security for their customers. By simply receiving a text every time a transaction takes place, money is transferred, or an account is accessed, customers have immediate visibility of their account and can alert their bank about any suspicious activity.

The “soft” benefits are enormous as well. Banks can’t operate without a high level of credibility. Customers have to trust banks to trust them with their cash, their money management and their credit. FNB’s efforts have gone a long way to building and maintaining this level of credibility and trust. In addition, SMS brings the bank closer to its customer: It shows that the bank is innovative and at the forefront of best banking practices, and it raises brand awareness. SMS is not just a technology for FNB; it’s another channel to the customer just like its branches, ATMs, the Internet and telephone banking.

Bankinter_logoThis is not just a South African trend. Spanish bank Bankinter <bankinter.com> has launched an SMS-based service to inform people each time their bankcard is used. A system warns the user via SMS of each banking operation made with the card. If the customer has not initiated the transactions, the card can be canceled immediately.

Nationalbank_aus_logoAn article in Australia’s Herald Sun Business Daily cites an internal report from the National Australia Bank (NAB) <national.com.au>. The bank is concerned that it is losing AUS$1 million (US$760,000) due to Internet banking fraud. As one of its initiatives to reverse this, the bank has launched an SMS system to provide PIN-protected access to Internet banking services. According to the report, executives at the bank predict that online fraud will be reduced by 90% once 90% of customers have signed up for the scheme.

SMS and consumer behavior
It is the very nature of SMS and mobile phone use that contributes to these success rates. People have their mobile phones with them, wherever they are, and typically welcome the SMS security initiative as it means that both the customer and the banks are responsible for account security. The proactive alert makes life far more difficult for the criminal. If the losses through fraud of the financial industry can be reduced, then ultimately the customer could benefit from lower charges.

Never intended to be a commercial product, SMS has taken the world by storm. Mass implementation by mobile operators happened in the early 1990s, and the spread of inter-network roaming agreements provided the momentum to drive SMS take-up and make it a true mass market messaging service. According to Portio Research, 761 billion SMSs were sent in 2004 – that’s more than 100 messages for every man, woman and child on the planet.  Portio estimates that worldwide SMS traffic volumes will grow to 2,379 billion in 2010.

With the benefit of hindsight, the success of SMS is not surprising. It is simply an ideal form of peer-to-peer communication: cost-effective, with exceptionally high reach. As a marketing tool it demonstrates a very high response rate of up to 82% for branded campaigns and an average of 16% for other campaigns. It is immediate, reliable and personal. Messages can be customized to appeal to individual groups. Communicators can automate message sending and receive detailed reporting on activities. It is the accidental cash cow of the cellular industry, and the strength of its very simplicity is being leveraged by increasing numbers of businesses worldwide.

***

Pieter de Villiers is the CEO of Clickatell <clickatell.com>, a mobile messaging provider that allows businesses to connect people anywhere, with any message, across any device. Clickatell is headquartered in Redwood Shores, Calif., with offices in South Africa and the United Kingdom.