Security & Privacy

Another 26 Million Social Security Numbers Enter “The Public Domain”

By Jim Bruene Posted on
Categories: Security & Privacy

The recent revelation that the Veteran’s Administration lost the data files of more than 26 million veterans when an employee’s laptop was stolen in a burglary is just another reason for payments providers to tighten internal security standards. It’s also another reason to stop complaining that disclosure, not the loss of the files, is the real problem.

In the VA case, it took three weeks for the loss to come to the attention of the agency head. Even then, he stumbled across it. Apparently, nobody had thought the event important enough to tell him. Naturally, he was vilified before Congress. But the real problem was in cyberspace, where the number of Social Security numbers available for sale more than doubled in the weeks following the burglary.

The liabilities created by this theft—and the hundreds of others we’ve read about in the past 18 months—are not merely theoretical. The victims will be dealing with the effects for years, and financial institutions have a duty to make them whole.

–AR

Share this:

Send Post Twitter LinkedIn Facebook

PassMark Security Passes 20 Million Mark

By Jim Bruene Posted on
Categories: Bank of America, Security & Privacy

Passmark_ad_americanbankerAs we predicted almost a year ago (OBR 119), PassMark Security's two-factor authentication system is proving popular. We've heard the usability arguments, we've read the security blogs pointing out the weaknesses, and we even had doubts ourselves after using the system on our Bank of America account.

But the overriding fact of the matter is, if it's good enough for Bank of America and its 15 million users, it's good enough for anyone. While no other major U.S. bank has signed on, the announcement today that Fiserv would make the system available to its 5,000 clients, coming on the heels of the Feb. 28 endorsement from S1 Corporation with 1,000 clients, means the system may win the small and midsize markets.

As further evidence, the company recently announced several new clients including North Island Credit Union <myisland.com> (125,000 members) and Schools Financial Credit Union <schools.org> (100,000 members), who touted their pioneer status with this PR-quote-of-the-year candidate:

"…Schools Financial Credit Union will be one of the first financial institutions in the country to act on Federal Financial Institutions Examination Council guidance that strongly recommends banks and credit unions implement multi-factor authentication by the end of 2006."

Alliance_passmarkFinally, the company made a splash on the other side of the Atlantic by aligning with Alliance & Leicester <alliance-leicester.co.uk>, a major financial institution in the United Kingdom with five million customers. It's a company we've previously singled out for its flashy website and marketing prowess (NetBanker Feb. 23, 2005).

With the launch of the Alliance program last month (see screenshot right), Passmark is now in front of 20 million users worldwide, demonstrating a spectacular first year for the Silicon Valley startup.

—JB

Previous articles:
Online Banking Report: June 30, 2005, Marketing Security
NetBanker Oct. 12, 2005: Scottrade to use Passmark
NetBanker May 26, 2005: Bank of America unveils multi-factor security for consumer accounts

Share this:

Send Post Twitter LinkedIn Facebook

Keylogging Fraud Hits the Front Page

By Jim Bruene Posted on
Categories: Security & Privacy

Nyt_iconDespite the old saying that there's no such thing as bad publicity, online banking credibility took a hit today courtesy of The New York Times, page one. In the second-most-emailed article of the day, the story chronicles the threat from keyloggers around the globe. In the fourth paragraph, the article tells of a Brazilian scheme, dismantled two weeks ago, that netted $4.7 million from 200 accounts at six banks. A separate keylogging incident in France is also said to have netted $1.1 million.

Action items
While there isn't a whole lot you can do about keylogging, you should take these steps to help keep the problem in perspective:

  1. Remind customer service staff that customer accounts are protected by numerous technology safeguards, policies limiting consumer liability, and internal controls that make withdrawing money online quite difficult.
  2. Encourage customers to use triggered alerts so they know within minutes when a large withdrawal occurs.
  3. Educate customers on the benefits of safe computing, including links to resources, downloads, and so forth.
  4. Mitigate customer concern with plain-language guarantees that eliminate any customer liability for fraud perpetrated against their accounts. For a great example, see E*Trade's Compete Protection Guarantee (NB Jan 18).

For more information, read recent security articles from NetBanker or Online Banking Report (# 96/97).

—JB

Share this:

Send Post Twitter LinkedIn Facebook

News from the Online Fraud Cyberwar

By Jim Bruene Posted on
Categories: Debit Cards, Identity Theft, PandaLabs, Pay By Touch, Payment Cards, Security & Privacy, Wal-Mart

The same week that Pay By Touch settled outstanding government claims against CardSystems, news of a new computer breach that could be at least as damaging emerged from California, while keylogging made the front page of the New York Times.

Continue reading “News from the Online Fraud Cyberwar” →

Share this:

Send Post Twitter LinkedIn Facebook

E-billing at the Point of Sale for eCommerce

By Jim Bruene Posted on
Categories: Epayments, Security & Privacy

Bigals_ebilling_logoModaSolutions <modasolutions.com> and several merchant clients including Big Al’s <bigalsonline.com> online aquarium supply store and CompSource <c-source.com>, an electronics retailer, are making waves in online bill payment circles. In one of the more counterintuitive developments we’ve ever seen, Big Al’s is seeing 6 percent of its customers opt for a convoluted two-step bill payment process at checkout. To increase buyer comfort levels, the connection to online banking is reinforced through banners and copy (see the logo from Big Al’s above and the banner at CompSource below).

Secure_ebill_csource_banner_1

How it works
Rather than simply entering a credit card number or inputting checking account info to authorize a funds transfer, the SECURE-ebill system allows a customer to complete the checkout process without entering any personal payment info. The system then kicks an email to the customer summarizing the amount owed and the merchant’s contact info. Customers are then instructed to log in to their bank’s bill pay system, set up Big Al’s as a payee, and then pay the amount owed. Payments are routed through MasterCard’s RPPS for electronic settlement within 48 hours.

To summarize:

  1. Customer shops at merchant online
  2. Customer selects SECURE-ebill option during checkout (see screenshot #1 below)
  3. Email is sent to customer restating the amount due and deadline to pay (see screenshot #2 below)
  4. Customer logs in to online banking at their bank
  5. Customer sets up the merchant as a payee
  6. Customer pays the bill using online bill pay
  7. Payment is settled electronically through MasterCard RPPS
  8. Merchant ships the goods

Results
Approximately 6 percent of all Big Al orders now choose the SECURE-eBill option. Of those, nearly 40 percent are new customers. In addition, the cost to process the checks is 60 percent less than the discount rate the company would have paid had the customer paid with a credit or debit card.

At CompSource, customers are rewarded with a 5 percent savings ($25 maximum discount) at checkout when selecting the ebilling option. The company has not released results, but it must really like the system. Its website has numerous references to the 5 percent savings, including a link by each price reminding users that they could save "up to 5%."

Analysis
If you consider the time it takes to log in to your bank account, set up a new merchant, then pay the bill, it will take three to five times as long as using a credit card at checkout. However, it is slightly faster to check out using the ebill option because you avoid entering a credit card number, expiration date, and security code.

As irrational as it seems to regular online shoppers, this system evidently has considerable appeal. How else can you explain 6 percent penetration at Big Al’s with no merchandise discount? Evidently, it appeals to customers who are either concerned about entering payment info on a merchant’s website, or who somehow like the extra control they get by entering the payment into their bill pay system where they can keep closer tabs on the payment. It’s a good lesson in payment system design: Not all customers trust the most efficient system.

Merchants like it because it increases sales. And transactions cost less than credit card interchange, although the interchange savings are likely eaten up by extra customer service and reconciliation costs at the merchant.

—JB

Continue reading “E-billing at the Point of Sale for eCommerce” →

Share this:

Send Post Twitter LinkedIn Facebook

The Truth about ID Theft from Javelin Strategy

By Jim Bruene Posted on
Categories: Bank of America, Identity Theft, Metrics & Market Research, Security & Privacy, Washington Mutual, Wells Fargo

Judging by media reports, almost everyone in the civilized world has lost their identity to cyber-criminals. But while there has been an unending torrent of news about data breaches and related identity thefts, the damage has been much less drastic than that, says a study from Javelin Strategy & Research.

“The impression in the general public is that identity fraud is spiraling out of control, but what we came away with is the contrary; the growth [in the phenomenon] has been contained,” says Rubina Johannes, the Javelin research analyst who wrote the report.

Continue reading “The Truth about ID Theft from Javelin Strategy” →

Share this:

Send Post Twitter LinkedIn Facebook

Data Security Standards Set by Major Financial Institutions

By Jim Bruene Posted on
Categories: Bank of America, Citigroup, JP Morgan Chase, Security & Privacy, Wells Fargo

A consortium of six major banks and the country’s largest accounting firms said Wednesday that they were setting uniform computer-security standards, designed to ensure that the third-party computer providers they do business with are adequately protecting both their computer systems and the information those financial firms send them.

“This is good news,” says Avivah Litan, vice president and research director of Gartner Inc. “I don’t think it goes far enough, but it’s smart for them [the institutions] to do it in steps, if that’s what they’re doing. But they need to do it beyond the service providers. They need to do it themselves”

Continue reading “Data Security Standards Set by Major Financial Institutions” →

Share this:

Send Post Twitter LinkedIn Facebook

ING Direct Personalizes Emails for Security

By Jim Bruene Posted on
Categories: Alerts & Messaging, Deposits, Checking, Savings, CDs, Email Marketing, ING Direct, Security & Privacy

Ingdirect_personalized_emailING Direct <ingdirect.com> is the latest bank to move to greater personalization in order to distinguish its messages from phony phishing attempts. The bank has added the customer’s first name and masked all but the last three digits of the customer’s number (click on inset for a closer look).

The message at left was sent to customers to market ING’s latest deposit promotion: 4.75 percent APR for new money.

Ingdirect_personalized_alertThe same technique is also used for routine account alerts (see inset right).

Note: The high-impact sales pitch for its 4.75 percent deposit promotion.

Analysis
While it doesn’t prevent phishers from attempting to recreate the same look (see footnote), it’s an effective first line of defense. Besides, the personalized greeting is a friendler way to communicate with customers. Citibank has been using a similar approach for more than a year (NetBanker, May 30, 2005).

Citi_phishFootnote: Yesterday, we received a fake email that recreated the Citibank personalized area in the upper-right corner. The crooks just left blank the Email Security Zone in the upper-right corner, figuring many users won’t look that closely at the box (click on inset for a closer look).

—JB

Share this:

Send Post Twitter LinkedIn Facebook

E*Trade Bags Millions in Free Publicity

By Jim Bruene Posted on
Categories: E*Trade, Investment Products, Public Relations, Security & Privacy

Etrade_protectionguaranteeWow. It’s not often a press release rates an article in BOTH The Wall Street Journal and The New York Times. But that’s exactly what happened today when E*Trade made the relatively innocuous announcement that it wouldn’t hold its brokerage customers responsible when their accounts were defrauded.

Etrade_securityarea_1Consistent with previous innovations, the online brokerage and banking powerhouse wrapped its new message with impressive graphics and copy (see inset above-left for graphic displayed on its homepage today). Clicking on Learn More leads to an impressive security area where E*Trade touts four main protective measures (click on inset above-right for a closeup)*:

  1. Security tokens
  2. Electronic statements with paper turnoff
  3. Email alerts
  4. Antiviral and firewall software, which can be purchased through a link to Norton (60-day free trial offer); users can also run a real-time scan to check for vulnerabilities

Analysis
It just goes to show you how skittish the public has become about online security. I’d wager that most brokerage customers are sophisticated enough to realize they will eventually get their money back if it’s stolen from their account. So this is a non-event from a financial standpoint. E*Trade even admits that online fraud cost it only $2 million last year, less than the cost of one of their famous Super Bowl ads. The brokerage also said there were "fewer than 50 incidents," implying a fraud loss of approximately $40,000 per incident.

Evidently E*Trade’s marketing department prevailed over its legal counsel and actually put the company’s fraud-protection policies in writing. It’s amazing that makes headlines in 2006 and may say more about the growing need to cover your behind to fend off the class-action bar even if it means scaring off customers.

We hope this prompts other financial institutions to take similar action. One of the main functions of financial institutions is safeguarding assets. Customers, online or otherwise, shouldn’t have to guess whether certain types of fraud are covered. As any good lawyer would say, "Put it in writing."

—JB

*The screenshot displayed here is only the top portion of the security area, to download a screenshot of the entire page, click here.

Share this:

Send Post Twitter LinkedIn Facebook

Know Your Banking Customers, Especially Reporters

By Jim Bruene Posted on
Categories: Public Relations, Security & Privacy

Mark_twainRemember the old saying (usually attributed to Mark Twain), "Never pick a fight with someone who buys his ink by the barrel." An unnamed "national bank" has created an enemy of LA Times reporter Steve Lopez, who so far, has not publicly identified the bank that refused to reimburse him for the $2000 drained out of his account after an ATM-card-skimming incident. But given his location, and the hints in the article, it’s probably Wells Fargo, BofA, or WAMU. Given our personal experience with the relatively strict Wells Fargo credit card authorization guidelines, combined with the relatively small WAMU checking account base, our money is on BofA as the culprit.

In this particular case, the bank did the right thing initially, crediting the reporter’s account for the $2000. However, it reversed the amount four weeks later, sending a form letter with no explanation. In a followup call, the bank service rep told Mr. Lopez that he had not returned phone messages from bank investigators, so they concluded the disputed ATM withdrawals were "authorized and posted correctly."

Action Items
This type of bad publicity is entirely avoidable:

  1. Prevention: Your ATM system should not allow four $500 withdrawals in three days, unless the customer has a history of large cash withdrawals.
  2. Notification: All large ATM withdrawals should trigger alerts, first by email, then by phone if the withdrawals continue.
  3. Communications: Make sure you communicate the results of your ongoing investigation clearly to the customer. Customers should receive a stream of emails, letters, and phone calls keeping them apprised. If possible, all emails should be posted to the customer’s online banking account to create a paper trail.

    Most of the above steps are relatively expensive to implement if not supported by your current systems. So you might want to consider a fourth item:

  4. Flag reporter accounts: Treat reporters like VIPs, making sure their accounts are flagged, and that you bend over backwards to give them the benefit of the doubt when disputes arise.

—JB

Share this:

Send Post Twitter LinkedIn Facebook

Everbank Goes on the Offensive Against Latest Phishing Scheme

By Jim Bruene Posted on
Categories: Everbank, Phishing, Security & Privacy

Everbank_homepagel_phishwarningIf you are a smaller bank or credit union and are phished for the first time, you might consider the approach Everbank took in response to a phishing incident today.

The bank took the unusual step of sending an email to its customers warning them about the fraudulent email (click on the screenshot below for a closeup). They even included a copy of the phishing message at the bottom of the warning. Everbank_email_phishwarning_1The bank also posted a small red-outlined box on its homepage (see inset) with a link to the same email message.

Analysis
Although it may seem futile to send an email warning about a fake email, we think it’s a good idea if the phishing episodes are infrequent. The big targets such as Citibank or PayPal can’t do this, not with dozens of attacks every month; however, smaller companies should consider proactive email communications, but no more than a few times per year, otherwise customers won’t pay any attention.

Most users will realize the Everbank response is genuine, because it doesn’t ask for any customer information, especially when they compare it to the fake message at the bottom of the screen.

Yes, some customers will be even more confused. But hopefully their calls to customer service will provide you with a chance to put them at ease. There are costs associated with these anti-fraud efforts, but that’s part of the trust involved in being in the banking business.

—JB

Share this:

Send Post Twitter LinkedIn Facebook

Bank of America’s New Security Toolbar

By Jim Bruene Posted on
Categories: Bank of America, Desktop Presence, Security & Privacy

Bofa_toolbar_closeupBank of America launched a co-branded version of Earthlink’s toolbar designed to prevent users from surfing to fraudulent websites. Of note is its official name, Bank of America Toolbar Powered by Earthlink. It’s highly unusual for a bank, especially the largest consumer bank in the country, to give a partner such high billing. Our guess, although unconfirmed, is that Earthlink is paying the bank for the product placement.

In a similar manner to eBay’s toolbar released in 2002, the BofA/Earthlink version uses red, green, and yellow lights to indicate whether a website is known to be safe (green), known to be fraudulent (red), or unknown Bofa_homepage(yellow). A popup blocker is also included. The toolbar is free and can be downloaded by any Internet Explorer for Windows user, you do not have to be a customer of the bank or Earthlink. According to Earthlink, a Mac version will be available soon. The toolbar does not work in other browsers.

The toolbar was announced in a press release today, and is accessible from a small link on the right of the homepage (click on inset for a closeup).

Analysis
Bank of America’s toolbar is the first of what we expect to be a major source of differentiation during the next five years: the branded desktop presence (see OBR 85, for more information). The Scamblocker toolbar is a relatively low-tech entry into the space. More sophisticated offerings, such as Southwest Airlines Ding (NetBanker, 5 Dec), are on the way later this year, if not at BofA, then at its U.S. competitors.

—JB

Share this:

Send Post Twitter LinkedIn Facebook