Schneier on Security

Some guy in Europe • July 28, 2005 5:42 AM

Disclaimer: I work for a bank, in information security.

This is a piece of security theatre, in the parlance of Bruce.

But it’s a necessary one. Why?

Okay, all banks take precautions to prevent unauthorised transactions. We’ve taken some innovative ones that have allowed us to reduce our fraudulent transactions to two orders of magnitude less than the European average as a percentage of transaction value.

This has not led to a concordant increase in the use of our financial instruments, such as credit cards, online direct payments or checks, even though these methods can save our users a lot of time.

We also monitor – as does every bank – patterns of use across our accounts and with the credit bureaus. This allows us to search for anomalies and investigate them more thoroughly.

The principle drivers behind the low rate of fraud have been difficult to understand technical innovations, such as chip-and-pin for credit card or 4P for online and voice verification.

Explaining why these make it safer to conduct your business conveniently is hard; although the effort has been made, understanding is slow in coming and limited to the type of people who read this blog.

Extracting the anti-fraud information relevant to a specific user account, collating the feeds from the various anti-fraud systems (we have fifteen or so), organising the print jobs, standing up the call centre to handle the calls, re-tooling our back end support process to handle individual requests pertaining to the information and paying for postage all cost something – and at £7 a month I highly doubt Wells Fargo is making much cash profit.

Where they are hoping they will make their profit – as are we – is in goodwill.

By subscribing to this service, customers will understand that, yes, we are working to keep their money safe, and here’s a bit of how we do it, the bit that’s easy enough for you to understand.

Once you understand that you’re relatively safe, you’ll use more of our services. This will allow you to save some time and cost you very little. You’re better off and so are we.

Yes, everything you buy through this service we already do and more. No, we don’t charge you for it. But you don’t know what that is, and getting the information to you will cost us £7 a month. For a bit of value add, we’ll extract what we can about accounts you hold at other institutions, so long as they share it with us.

Now, that having been said, the folks inside Wells Fargo who design services and create the business cases for never had control over marketing and didn’t name the service. Some marketing weenie did that. This service is badly named. Blame marketers, who really are evil.

Wells Fargo – and every other American bank – could do more to pressure Congress to force them to adopt the European Chips and Pin standard. You, as enlightened consumers, should lobby your bank to support and industry initiative and simultaneously lobby Congress. You’re about a decade behind. Good luck.

You should also lobby your bank to adopt 4P or similar authentication for your online banking.

There are additional challenges – for example, endpoint security to ensure that customers aren’t trojaned or infected with a session hijacking virus, phishing attacks, protection against DDoS attacks and protection against bespoke viruses and trojans that target us.

We have solutions for all of these. Some are already silently in place. Some were solved by policy. Our customers never receive email from us, for example, and never have.

But the biggest problem for us is the customers and customer education and comfort level.

We’d love to roll out chip and pin readers that worked via USB so that you could purchase online without revealing your credit card information. We’d love to roll our a multi-platform integrity verification agent that would check your machine for trojans or man-in-the-middle attacks.

But customers dislike the inconvenience of a USB dongle and are prepared to sue us if their PC malfunctions as a result of the anti-trojan software.

The banking industries biggest challenge is now – and probably always will be – uncooperative, ill-educated customers.

Finally, if you don’t like Wells Fargo’s offering, don’t buy it. It’s voluntary.

Some guy in Europe • July 29, 2005 5:22 AM

@ Bruce

Bank’s shouldn’t charge to protect your money. But if the methods of protecting your money are sufficiently complicated and diverse that telling you about it is expensive, it’s fair to ask you to pay for some of that.

It’s not as if Wells Fargo doesn’t protect your money if you don’t buy this service, they just don’t go to the considerable trouble of telling you about it.