If you are looking for a spam/spyware/phishing resource for your online customers, OnGuardOnline.gov is a good resource, especially for novice users.

The site is sponsored by The Federal Trade Commission, Dept. of Homeland Security, U.S. Dept. of Commerce, and The United State Postal Inspection Service. They also had some help from the private sector, with some content provided by Microsoft and The Internet Education Foundation www.neted.org. The site also lists a number of other partners, but does not disclose their contribution. None of the listed partners are closely associated with the financial services industry.

The main content areas cover:

• ID theft
• Spam scams
• Phishing
• Spyware
• Shopping
• P2P file sharing
• VoIP

Analysis
The information is thorough and presented in a audio-visual format that is easy to digest (click on inset to see a closeup of the homepage). The videos from Microsoft are particularly well done. And surprisingly there is no plug for the software giant, they don’t even have a logo on the site.

The interactive Flash games are a little on the hokey side, but they get their points across. The Stop-Think-Click: 7 Practices for Safer Computing is very well written and hopefully will become widely circulated in the popular press.   

Action items
Financial institutions should use the site either as a direct resource for customers or as a blueprint for the material which should be presented in a bank’s security and privacy area. The 7-point Stop-Think-Click material is especially useful to present to users.

The only slight hesitation we have about referring customers directly to OnGuardOnline.com is that it may be somewhat overly frightening. We think it’s better to cover these issues yourself so you can provide reassurances along the way as to how you are helping solve these vulnerabilities.

But for those who haven’t the resources or budget to create your own security center, this is a good reference point.

–JB

Katie Kuehner-Hebert looks at the issue of mandating consumer password changes in today’s American Banker. She cited only a single bank doing it, West Georgia National Bank <www.wgnb.com>, which recently began requiring new passwords every 45 days. None of the financial institutions we are familiar with force password changes, although NextCard did when it first launched in 1997, but later it did away with the annoying requirement.

Analysis
This is one of the least effective ways to improve security. In fact, it may have exactly the opposite effect for two reasons:

1. Customers cannot memorize a new password every 45 days, so they will have to write it down somewhere near their PC where it can be seen by others.
2. Once users begin to realize what a hassle it is logging in to your website, they will forgo online access altogether or use it much less frequently, therefore reducing the frequency of account monitoring which can reduce the impact of identity theft and other fraud.

And even the method did reduce fraud, it’s unlikely to be cost effective due to the increased burden on customer service and decreased customer satisfaction.

Offer choice
Some customers do like the idea of periodic password changes, but forget about mandatory changes. We like the M&T Bank <www.mandtbank.com>. The Buffalo-based banks allows customers to choose whether to have mandatory password changes at either 30, 60, 90, 180 or 365 days. They can also choose NOT to have a mandatory password change (click on inset for a closeup).

An even simpler way to give customers the choice is to allow customers to program an alert reminding themselves to change their password. The alert should NOT have a link back to the bank, otherwise it will look like a phishing message.

—JB

Today's American Banker reports that $365 million-asset Stonebridge Bank (West Chester, PA; $365 million) and American Bank (Allentown, PA; $500 million) are following E*Trade's move to offer hardware tokens to authenticate consumer logins.

As of May 30, Stonebridge is offering the token free-of-charge to any of its 4500 consumers who request one. The token will be mandatory for its 500 business customers. In its security FAQ, the bank says it will charge $25 annually, its out-of-pocket expense for the device, after the first year. They also charge $25 to disconnect the token during the first year and $25 to replace it within 5-7 business days, or $45 total for overnight delivery.

American Bank is sending the token to 1000 customers who said they would like one in a recent survey. There is no charge for the service. The bank expects to order another 1000 from RSA Security next month. It pays approximately $20 each, which does NOT include maintenance costs to operate the system.

Analysis
We applaud these three financial institutions for moving beyond the username/password. However, except for the most demanding customers, primarily businesses, hardware-based solutions are overkill.

The Bank of America/Passmark approach is much better. Not only is it more cost effective, it also much easier to use and also helps prevent the user from logging in at a fake site. 

—JB