Bank of America
My call with Bank of America also got off to a rocky start. I wanted to record all three phone calls. (Why not? The banks do it for "quality assurance purposes".) Both the Citibank and Chase representatives agreed to this without hesitation. The Bank of America rep, however, put me on hold for more than seven minutes, before coming back and saying I couldn't record the call—something something the bank only records calls for training purposes something something. Oh well. It didn't seem worth arguing.

Things got better after that. When I asked how I could be assured that my online transactions would be private and secure, the call center rep seemed to understand exactly what I was asking. First, she said that I should look for the lock at the bottom of my browser window, indicating a secure site, and noted that the encryption that Bank of America uses is "one of the highest." (Neither of these are perfect indicators of security, of course, but it's a logical place to start the conversation.) Then, she told me that, usually, the only time my account wouldn't be secure is if I gave out my user name and password, or "answered a spam e-mail" where I clicked a link and entered my user name and password. This made her the only rep to actually warn about phishing attacks; she gets extra points for not using the silly term phishing.

Next, she launched into a very plain-English description of SiteKey, Bank of America's system of allowing customers to verify that they are at the valid website by selecting a picture that will come up each time they log on. "If you don't see the picture, don't enter your password," she told me. She also explained that when I signed up for the first time, I'd have to answer three extra security questions. If I (or anyone else) ever tried to access my account from a different computer, I would first be asked a security question. If I answered correctly, I'd see my security picture and then be asked for my user name and password. If I answered it incorrectly a certain number of times, I would be locked out and have to go through extra verification at the call center to have the account unlocked.

Overall, I was impressed at how comfortable she was talking about security. It seemed to be part of the training she had gone through, and she also made several references to how she used the service herself. Call it a subtle kind of marketing if you will, but I actually liked to hear her admit, "A lot of times people say they have a hard time getting into our site as opposed to other sites, and that's because it's a very secure site."