Security blanket or barrier?
Thursday, April 29th, 2010
E-Commerce, particularly e-banking could become more difficult and convoluted! This may sound an odd statement given our focus on this sector and our advocacy for greater adoption of doing e-business in Financial Services. Over the past few years and increasingly so in the last 12 months, we have seen the influence of fraud and security departments beginning to negatively affect the process efficiency that should be possible with e-business.
I was one of the first people to use internet banking when Barclays moved from their PC banking application quite some years ago. As with e-mail, my love of electronic activity is borne from an inherent laziness on my part as I hated the old paper processes that took too much time and effort (‘every second counts’ as one of my hero’s Lance Armstrong would say!).
With my old internet banking process, I had my account number, a membership number, an ID number and password – a similar approach taken by many other online banking, credit card and savings companies since (to varying degrees, some still do today). However, Barclays decided to introduce the ‘pinsentry’ – a calculator-sized piece of hardware that is more suitable to Companies that do online banking – others have followed this trend. The effect on me was to reduce the number of times I access my account and to make the process of carrying out transactions, especially new payments, a real pain! Apparently, Barclay has won some security awards for their system and probably feel pleased with their decision. However, this needs to be considered in the context of customer accessibility and usability as well as security.
I am not advocating a disregard for security and I would not want to have to pick up the bill for some cyber thief clearing my bank account. In fact, when I decided to write this blog, I felt somewhat awkward at raising questions about security when I am also an advocate of protection (my past regulator experience competing with my anti-authoritarian maverick characteristics!). However, I do object to having to put up with inconvenience and cost due to criminal activity in the same way as I object to having to pay for car or burglar alarms. Apparently, criminals carry out relatively small transactions as larger size payments used to draw more attention. The problem appears to be that a set of ‘rules’ automatically detect – AND AUTOMATICALLY BLOCK – ‘suspicious’ transactions, often below £1,000. Perversely, whilst banks try to stop such thefts, they apparently do little to pursue convictions as they are not economical to do so.
In the last 12 months, we have seen personal queries and company queries increase and while this may be the price we have to pay for e-business, it cannot be right that the process is so disruptive! Examples of personal and company queries show that when the ‘fraud/security’ rules trigger a query, they now seem to use a text, or voicemail validation asking several questions to ascertain if the transaction that they have just STOPPED is legitimate. I am happy with the use of technology in this way, but at the end of the process, one may assume that the confirmation that you have just carried out results in a satisfactory ‘clearance for payment’… Sadly it doesn’t!! What you seem to have to do – because ‘that’s the way the system works sir’ – is to restart the whole electronic process and payment again (and hope the retailer/merchant has not blocked you as a ‘poor’ prospect). What this says is that the bank has protected itself and will ostensibly claim to have protected the customer, but the fact that they do not (and claim they cannot) restart the transaction for clearance shows that they are focused on their own interests and not the customer.
The pendulum swinging to greater protection is in danger of making it impractical if not impossible to do business online without having to phone the bank or card company beforehand to tell them that you are going to spend some of your money. However, even making the call is not guranteed to head-off the potential rejection as we found out with Santander just this week. When we phoned to say that a payment would be made for IT equipment with a supplier that was recently caught by the security rules of ‘suspicion’, we were told that ‘the system’ may still reject the payment if the security rules were triggered and the filenote would not necessarily stop the automated procedure. In order to access cash machines and make payments on holiday, it is now common practice [requirement] for custiomers to have to notify banks if you are going abroad (something I used to do anyway).
I personally, and we as a Company, take our banking and credit rating activities very seriously (I pay for the use of several Credit agency ID and credit alert systems). With the planned removal of cheques and reliance on electronic transaction methods, it is important that banks and other companies look at how they implement security in a way that makes it impossible or inconvenient to the criminal, not the customer. The experience of the way systems appear to have been designed to-date, seems have ignored the disruption to the customer and be oblivious to the feeling of embarrassment when ‘security rules’ block payments making it look like you have a problem. I suspect that the electronic validation technology has been tested to a degree, but how much testing has been done on the personal impact these systems have remains much less clear. Despite having complained about the experience at Santander (and received compensation), they say that they cannot [will not] change the system!
E-business is a great asset to our modern world and is breaking down barriers to new geographies and markets that would have been inaccessible or uneconomic in the past. We must be sure that the systems and processes are our servant not our master. Convenience and security need to be managed in partnership with the customer at the centre, otherwise the barriers of ‘protection’ will stop the benefits being realised for all.
Written by Mark Thelwell - Visit Website

