Should Social Sign-in be Used For Financial Services?
コメント
-
With supplemental insight available from other sources, social sign-in provides a wealth of insight around behaviors and trends in addition to security safeguards. Recent studies show that while consumers are concerned about privacy, they are still willing to share their social information as long as there is a benefit from this sharing. Finally, I don't think Movenbank or any financial would make social sign-in a requirement for opening a new account.
-
Chris and Jim, thanks very much for your comments.
I'm not sure it matters if consumers are willing to use social sign in or not (if there is a bank in the picture). Most banks can barely get the go ahead from compliance and legal to move ahead with a static Facebook page. Moving to social sign in would be a stratospheric leap.
-
Again, I don't see social login as a replacement for some of the current strategies, but as an enhancement. If the bank (either existent today or not) combines social login with other accepted verification tools, the value to the customer and the bank can be enhanced. As mentioned in my post on the subject last week (http://bit.ly/uPOeIr), there are still significant security and privacy issues to be resolved, but the best banks will find a way to leverage social insights for the benefit of the customer while speeding up the new account opening process. As long as there is a 50% new online account abandonment rate, there will be organizations looking for improved processes.
The idea of social login may not look like it is today, but the simplicity and value of combining social and non-social tools is invaluable
-
I have no intention of ever using any common log-in elements between general websites including social networking sites and financial sites. The reason is I want to keep hold of my money.
I take Jims point that there would be other security unique to the bank BUT the reason the additional security check is mentioned is because the doubt is already there in people's minds that the social media security may be compromised. Hence the bank's security is weakened to the extent of the common items.
-
Questions:
1) Why would a bank want to put Facebook in between itself & its customers?
2) Why would a customer even contemplate mixing banking information with the typical information that is captured on Facebook?
3) What % of bank customers either don't complete the "log-in" process because they forget their username & passwords or the sign on process is too cumbersone?
4) What about single point of failure? -
Jacob- great post and engagement here.
I commend the Movenbank team to drive customer experience as the priority.
That said, Alpha is just that and FFIEC regulations are very black and white-- in it's current state neither OAuth or Facebook will pass muster...
I think the key here is that Movenbank's bold move is a stalking horse-- conversation has begun (when was the last time a 2 paragraph post solicited this much engagement this quickly?) and that's progress. The irony is that there's much more innovation behind CRED and the overall products offered Movenbank which justify more conversation.
cheers.
-
One very important thing being overlooked in this conversation is "how is Movenbank using its social integration"? And also, if using OAuth, what protected resources are they exposing to those authenticated using Facebook or any other third party? The assumption appears to be that Movenbank is using Facebook authentication for sensitive transactions (new account registration). I doubt that, governance would have wagged a finger at the mere thought. If Movenbank is exposing only brochure information or promoting a partner (travel site, etc.), then I applaud them.
-
Something worthwhile noting that most people aren't aware of: Facebook has obtained remittance licenses in all 50 states in the US as it gears up features to compete against Amazon's Login and Pay and as it looks at mobile digital wallets. The main point here is that in order to get those remittance licenses, Facebook has to be compliant with FFIEC, PCI DSS and a plethora of other requirements. So from a Customer Identification Program perspective (commonly referred to as Know Your Customer), it can be argued that a deep check of facebook data would serve to meet CIP requirements. From a risk management perspective, the existing CIP checks that most finserv companies implement involves checking against offline IDV service providers like Lexis Nexis, Experian, Equifax etc. all of whom look at offline breadcrumb trails for user identity elements. But then all of those elements are easily available from the shadow internet today for as little as 0.50 cents per stolen ID, and $20 for a "Fullz" -- an identity with Bank account details, credit card numbers etc. worth at least $17,000 in bank balance. Email based n-boarding and CIP checks are weak because email addresses have no face to them, but social profiles do. That means that using Social Logins will result in considerably less identity fraud risk. Consider also the types of security measures that Facebook has implemented but that few people know about: multi-factor logins, out-of-band email and SMS token validation and notifications, device fingerprinting, spam and malware checks etc., which are equivalent to bank grade security.
Older people may be unaware of the benefits of using Social Logins with financial services products, but Gen Y/Millienials are fast adopting. Easier on-boarding, safer from fraud risk, social banking features. Big banks are slow to change, but things like mobile on-boarding and payments and better banking experiences from players like Moven are going to pave the way for social banking.
Word is that supplemental registration will come from Sony's Playstation Network :) All kidding aside, great post, Jacob. The balance of security / fraud issues with convenience is completely tilted one way. But the innovative spirit to simplify menial tasks is appreciated. I think the use of Facebook isn't so much to simplify sign-in, but a more concerted effort to make banking ... er, sorry, bad term, can't say "banking" anymore ... er, financial transacting more social. Instead of telling people you just ate at Subway, now you can tell people you spent $6.75 at Subway. Interesting? Maybe. Compelling? Not sure. Worth pursuing and seeing where it goes (hit or miss)? Absolutely!