What Banks Tell Online Customers About Their Security
Six months after the FFIEC's rules for strong authentication took effect, we test what the country's three biggest banks tell their customers about online security.
Citibank
My first call was to Citibank. I started with my standard question: "How can I be assured that my online banking transactions are secure and private?" The call center rep said that Citibank uses 128-bit encryption, which "verifies that you have a maximum level of security." End of answer. Pause. I asked what kinds of protections Citibank had in place for making sure that it would really be me logging onto my account. "I'm sorry," he said, "but I don't understand your question."
We had a language barrier, he and I. The call-center rep, in India, was not a native English speaker. The call went poorly, and I have no way of knowing whether this was because of our communications barrier or simply because Citibank hadn't instructed him how to answer questions about security. I repeated my question a couple times, and he finally said, "Let me look into that, ma'am." I waited on hold more than a minute, and when he came back, he told me I could go online and read all about online banking. "All the information is there, ma'am," he said politely.
I kept prodding. I asked if Citibank offered tokens or did device recognition of some sort, and he told me I could log on with a user name and password.
"At any computer where I punch in my user name and password, I'll have full access to my account?" I asked.
"Yes, ma'am, anyplace you have Internet access," he answered. He finally did say that in certain situations I would be asked extra security questions, but he wouldn't or couldn't explain when that happened or why. I asked if it was unusual for him to field calls about security, and he said yes. I finally ended the call in frustration.
online banking



