Dispelling the myths around email security

In previous blogs I addressed the benefits of presenting electronic documents via self service portals / Internet banking websites vs. their inability to achieve paper suppression.

Whether you choose to deploy a 'Push' or a 'Pull solution; security and risk are key to determining a successful strategy. Today I want to address what makes a "push" eDocument delivery approach the better choice when weighing up the risk and security factors. But before I do that, let me dispel some myths about email security that I've recently heard mentioned.

Click here for a comparative on ‘Push’ vs. ‘Pull’ and how these solutions complement each other

Email security myths dispelled:

MYTH 1: Email can be stolen en-masse at an ISP: I've heard some winners in my 15 years in this industry but this takes first prize. Yes, email can be stolen at ISP's in the same way your money can be stolen at the bank by bank employees. I know a few ISP Executives who would take some affront at this accusation.

MYTH 2: Email can be stolen en-route: Email can be stolen en-route in the same way a USPS vehicle can be hijacked and your physical mail stolen. It’s possible but incredibly difficult, expensive and most importantly, a serious crime. Unlike a USPS truck however, for a fraudster to locate a specific email would be like finding a needle in a haystack the size of Montana. On top of which they then have to brute force attack the encryption (more time & money.) The result of which is then a PDF copy of one consumer’s bill or statement. The reality is that even if one knew how, it is simply commercially unfeasible to do so (far easier to simply hijack that truck or steal your mail from your postbox.)

MYTH 3: PDF attachments trigger spam filters: Simply not true. Spam triggers spam filters. And if you send spam with PDF’s then these will also be blocked.

'Push' eDocument delivery - the better choice

Striata has delivered billions of secure electronic documents for over 11 years, in 14 countries and for over 250 major Financial Services, Telecommunication, Utilities and Corporates, including 3 of the top 8 banks in the world.

From a security and risk perspective, 'Push' eDocument delivery is the better choice. As major players in this field, this is how we address it:

The Striata eDocument Delivery process has four security areas:

1. Email Address Verification – Explicit knowledge that your customer email addresses on file are accurate and current. For those who aren't; we have the Striata Email Address Verification program, which uses email and mobile phone text messaging to confirm and gather email addresses.
2. Striata eConsent – The process of gaining intelligent & compliant consent to go paperless, with just one click. Once the sender has an accurate and current email address, a highly personalized and Sender Authenticated eConsent email is sent to the consumer. There are two buttons in the email body, one to consent to go paperless and one to decline to do so – the recipient just clicks on one of them. There is no website to visit, no enrollment form, no choosing & remembering of usernames & passwords
3. Striata Sender Authentication – The recipient has intuitive knowledge that the sender is who they purport to be. Other than the various technology elements like SPF Records. DKIM etc, Striata utilizes a multi faceted approach to creating this intuitive trust. These include:

• Actual sender’s domain: The message comes from the sender’s address: for example. This should always be the actual address and not a spoofed one (if you had to do a reverse DNS lookup you would find the sender’s verifiable domain.)
• Subject line: We include the recipient's name in the Subject line
• Salutation: A full greeting is used: Dear Mr. John Smith
• Striata Authenticated: In the body of the email is a highlighted area which contains two to five partial pieces of information about the consumer. This may include physical address, account number, primary phone number etc.

4. Recipient Identification – The sender is assured that only the intended recipient has access to the secured Document content. There are two major ways (levels) that the sender is ensured that only the intended recipient can gain access to the secured information (bill, statements etc.)

• Access to the email inbox: Email accounts are very well protected by physical access to a device or in most cases through a username & password.
• Knowledge of a 'shared secret': In addition to the previous layer, Striata Secured PDF's are encrypted with a minimum of 128 bit RC4 encryption. The PDF is decrypted through recipient knowledge of a 'shared secret'. This is a partial piece of information known only to the sender and recipient. (Last 5 digits of a Social Security Number is a good example of this.)

It is very important that these two security layers are viewed hand in hand. The PDF is not in a publically accessible location and can only be decrypted by somebody who has BOTH access to the email account and who knows the 'shared secret'.

Peace of mind that the message is genuine

The combination of all of the above is what gives consumers explicit and intuitive trust (without any education) that the message is genuine.

In conclusion – when executed correctly, the processes and methodologies described above result in a security landscape that is significantly more secure than a two field password protected website. Most importantly however, is that these processes are many, many times more convenient for the end consumer, and, as we all know, convenience equals customer satisfaction.

Garin Toren
Chief Operating Officer, America
striata.com

The all important welcome email

We often say in sales and marketing that first impressions count. But no less important than first impressions are lasting impressions.

I am in the process of immigrating to the UK and have taken up services with a bank, as it is the most pressing need – I cannot get an apartment or anything else for that matter without a bank account. I have been less than impressed with the correspondence that has followed my engagement with the bank and unfortunately this is going to be the lasting impression I have of them.

Not a very memorable experience
I gave the bank my email address, but at no point was I welcomed as a new client, nor given the step-by-step guide on what to expect. To be fair I was given brochures regarding the account I opened, but they were promotional, so my immediate reaction was to throw them away as I knew what account I had opted for. Some simple, personalised emails would have made the experience a more memorable one for me and possibly created a customer for life. Here are some emails I would have been happy to receive:

• Welcome – we're so happy you've joined us. Here are the numbers you need to keep close by...
• Your card has just been dispatched
• You haven't logged into Internet Banking yet. How can we help you?

the beginning of my lifecycle with the bank. Understanding Lifecycle Messaging is key to creating masterful relationships with your clients as well as new opportunities for sales.

Simply put, a Lifecycle Messaging strategy is one that looks at key milestones in the relationship you have with your client and structures messaging to occur on those milestones. By ensuring your messaging has a clear purpose, you are able to drive your point home more effectively.
The alternative – which many companies still consider to be the norm – is to communicate only when it is convenient for you, which has no relevance to clients. No wonder clients tire of receiving most communication that comes their way.

And what are those milestones? The anniversary of the day they bought your product or signed up for your service, an upgrade notification, a birthday trigger for example. The most important thing to remember when using these triggers is to personalise and make your first communication special, rather than just sending the normal business-like email message.

The welcome message marks the start of the conversation (and there is nothing like an unexpected introduction to help move things swiftly along.)

As the start of the conversation, a welcome email is also far more likely to be opened. This gives you the perfect opportunity to get your email priority placement in the inbox, with the introduction of the smart inbox within the web email environment. Once the client has interacted with that email (opened / clicked / replied), future emails are likely to get priority placement, rather than being categorised as graymail or unimportant.

Amongst other things, the welcome message should:

• Give your clients information on what they've just signed up for and what they can expect
• Give them contact details and service details where applicable
• Serve as an instant confirmation that the email address exists and is
  valid. Should the email bounce, this is a perfect opportunity to gather
  an updated email address by sending a text, calling the
  member/subscriber or ensuring that a notification appears next time they
  log into your site

Also, since this is the first interaction with your client, you could use the opportunity to get more information from them, such as their desired frequency of communication and their likes and dislikes (depending on the communication you're sending out).

The welcome email isn't only about the start of the relationship, it also encompasses any new services the client has signed up for and should know more about. These include when and how to expect their bills, the process for insurance policies and what can be expected, etc.

These first impressions all form part of the customer's lifecycle with your company and are just as important as the live conversation you have with them. Isn't it time you thought more about making your first impression a lasting one?

I'd love to hear about a proper welcome you've received – or not!

* P.S. Google's new priority inbox is going to affect the way all your client communications are prioritised, so making sure your welcome email gets read is now going to affect the way all your client communications are prioritised...look out for a follow up blog to find out how you can get priority status for your emails.

Mia Papanicolaou
Innovative messaging specialist
striata.com

Transactional email: the glamorous marketing email's poor cousin

Let's face it . . . in the realm of Customer Lifecycle Communication; the Marketing Email is the glamorous cheerleader, while the Transactional Email is the nerdy science boff.

"What is a transactional email?" I hear you say.

A transactional email is generated automatically when someone interacts with an organisation. Based on what the interaction is, there's a follow up communication sent by email. There are plenty of examples: a confirmation, failure notification, a receipt, an invoice, a booking form.

Transactional emails are like the workhorses of customer communication. They often happen in the background, with little or no attention to their layout, design, and do not adhere to the corporate identity, nor reinforce the brand values. Someone developed the automated trigger message process, and that's the last time anyone paid attention to these emails - the result is
that they fail to provide real value to the business.

Transactional emails could do a much more productive job if treated as a valuable customer touch point. The same rules of email marketing should be applied to the nerdy cousin as to the glamorous prom queen.

Solution

Treat transactional emails as a vital part of a customer's brand experience. Make sure these communications adhere to your brand identity and digital communication guidelines.

Transactional emails include notifications that can be time critical, so keep the message size small and minimise the risk of the message being filtered by adhering to email marketing best practice.

Don't waste the opportunity to use this customer touch point for brand awareness, cross and up-selling and customer engagement (getting feedback).

Keep it simple but use the opportunity to reinforce your brand. And if you don't have the time or resources to do so, leave it to the experts!

Alison Treadaway MD,
Striata SA
striata.com