What Banks Tell Online Customers About Their Security
Six months after the FFIEC's rules for strong authentication took effect, we test what the country's three biggest banks tell their customers about online security.
Chase
Next I called Chase. This time I got a woman in Michigan, who at least didn't try to shunt me off onto the Internetwell, at least right away. But she seemed to interpret my every question about security as one about how, precisely, I could sign up for online banking. In fact, the first thing she did was congratulate me on being interested in the service.
When I asked how I could be assured that my transactions would be secure and private, she said that when I signed up, I would select a user name and password. "Once you're enrolled, as long as you're not giving out your user ID and password, you should be safe," she said. At least she said should and not will.
Then I asked if Chase would do any authentication beyond user name and password, like identifying my computer or giving me a one-time password device. She seemed to think that I was worried about the log-on process being burdensome or confusingand proceeded to make the process even more burdensome and confusing, with a convoluted answer about speeding up the telephone verification process. At one point, she had me so utterly baffled that she asked, "Are you O.K.?"
One thing I did manage to gleanI thinkis that there would be some kind of activation code involved if tried to log on at a library or a friend's house. Her explanation: "It's called an activation code because it's like a reset," she said. "That is for security purposes." She said this code could be sent by e-mail or text message, or that I could call in to get it. But she wouldn't or couldn't explain its purpose.
It wasn't until 10 minutes into the call that she mentioned that I might have to answer extra security questions on occasion, and again, she couldn't or didn't explain what these questions were for, or even reassure me that the measures were there to protect me. When I asked what would happen if someone else transferred money out of my account, she said, "That's not going to happen, ma'am, unless you give that information out to somebody." Then she warned me to be careful about giving out my informationto merchants, of all places.
Credit her with being a diligent salesperson, though. Throughout the process, she kept trying to get me to establish an online account, right then and there, so that the first time I went onto Chase.com, all I'd need would be that precious user name and password.
online banking



