Lessons learned from Citibank's data breach

Earlier this month Citigroup's credit card portfolio was hacked by criminals who apparently exploited a flaw in the browser window. This enabled them to go from one account to many others, capturing names, account numbers, emails and transaction history for roughly 360,000 customer accounts. The Ponemon Institute estimates the average cost of the data breach at $214 per compromised record, or $77 million in Citibank’s case.

Other recent high profile breaches include Sony Online Entertainment (over 100 million records) and Epsilon (they won’t say exactly how many). According to DATALOSSdb; breaches whether through hacking, loss of records or even theft of snail mail are occurring on a daily basis, and it’s not only large organizations that are targets. This month’s list includes banks, insurance and healthcare providers, utilities, government and educational organizations as well as supermarket chains.

“Growing concern about paperless” for consumers

What does this mean for businesses? It indicates that the threat of a data breach is extremely real and should be taken very seriously, but also, it requires companies to address customer concerns about doing business online. A growing fear among “paperless” consumers (and those considering eBilling) is “what if my online account is hacked, changed or deleted and I have no record of my usage or bill pay activity?”. One consumer advocate suggested that we all go back to receiving paper statements in the mail. That way we have tangible proof of all recent activity and payments.

But is going back to paper statements really a viable solution?

It’s an extreme theory, but one that resonates with some people. One of the biggest points of resistance to going electronic is that customers feel they are losing control over their bill or statement. Those that do access bills online complain that in order to manage their many accounts effectively, they need to visit each biller’s website and print or download a PDF copy of their statement from each one. Surely this is more hassle than waiting for the mail to arrive?

Winning the battle against customer resistance with robust technology

Delivering an encrypted copy of each statement directly to the customer’s email inbox is the most applicable solution in the market today. Regardless of what happens online, customers can print or save (in an encrypted format) a complete history of their relationship with their bank or biller. With its additional security features, such as including an authentication section at the top of emails and email personalization, the customer’s fears of phishing are alleviated. Customers can also decrypt, view and save documents offline, which reduces security threats of malware and spyware.

Distributing your billing / statement information to email inboxes, rather than consolidating all history and activity in one place, may serve to dilute the threat of criminals looking to hack your eBilling portal. Just as important, is winning the battle against customer resistance to going paperless, especially in the wake of increasing concern over data breaches.

Don’t let other companies’ data breaches reduce your eStatement adoption

The answer to customer’s fears of losing control over their documents is to “deliver” a tangible electronic copy of everything you send to your customers today in a more secure format than paper mail or online presentment – an encrypted attachment to an email.

Push the documents to your customers and all resistance will crumble.

Saving trees – killing the Post Office

Canada Post employees recently went on strike – after two weeks and with no end in sight, companies in Canada are using this opportunity to migrate customers to eBilling at a rapid rate. Although the driver here is actually hard cost savings, the outcome is that there will be even less paper bills and statements and hence less revenue for Canada Post, resulting in more cut-backs and downsizing. Talk about shooting yourself in the foot.

The centuries old postal system is under significant threat – but is that our problem?

Death of an institution

In the last five years, the US Postal Service has seen its mail drop by 43.1 billion pieces. No business can survive such a radical drop in demand for its services and hope to continue business as usual.

In the UK there is constant talk about privatising the Royal Mail. In fact, this has been going on for years, with downstream access already doing the bulk sorting and distribution for thousands of businesses.

What the post office always had was a monopoly on the last mile. No-one else wanted to have the headache of employing feet on the street, but the internet has created an entirely new delivery mechanism that is fast replacing traditional print and post. Of course, the consequence of this is the constantly declining volumes of corporate mail and the reality of a shrinking business model.

Every business knows that when faced with declining revenues, you need to reduce costs and cut your cloth accordingly. I guess the unions (in the case of Canada Post) and thousands of people involved in post office business models make this a difficult process.

Luddite behaviour

Unionised post office workers are the 21st century equivalent of the Luddites; their strikes are the modern day equivalent of destroying the mechanised looms that put them out of work. However, as with the Industrial revolution, there is a fundamental change afoot. Any industrial action by post office workers plays into the hands of eBilling companies and once the ‘genie is out of the bottle’, it’s hard to get it back in again - very few people go back to paper once they move to eBilling.

Post Offices around the world are reviewing their business models (we see their consultants on our website every week.) Bills and statements, once the mainstay of postal volumes, are rapidly moving to electronic delivery. For the post office to reinvent itself, it will need to embrace the connected world we now live in. It’s getting some help from ecommerce - home delivery of purchases (a possible future headline - “Amazon saves the post office”?) But is that enough?

Spare a thought for the postman

When considering eBilling, we weigh up environmental and costs savings vs. paper production and cost of distribution. The fact that the post office is now a shrinking business model is proof that many more businesses are realising the benefits and ROI associated with eBilling and are actively migrating customers from paper to electronic documents.

So while you enjoy the eBilling benefits of instant delivery, one-click payment, soft copy storage, interactive sorting and graphing and consequently saving a few trees, spare a thought for your local postman, his job is under threat. But as the cliché goes – it’s not personal, it’s just business.

Is it time to end Usernames & Passwords forever?

Do you hate usernames and passwords as much as your customers do?

Choosing and remembering multiple usernames and passwords for eBilling and self serve portals is a poor customer experience and incredibly expensive for billers. It is furthermore one of the most significant barriers to paper suppression.

Uniquely chosen usernames and passwords are intended to make websites secure, but instead, billers are simply passing the responsibility of security onto their users. In many instances, this is accompanied by predatory terms and conditions (read this blog post: Check the small print, you assume all the risk)

In truth, consumers do an extremely poor job of securing their access:

• One in ten still regularly use the word 'password'
• One in four use their mother's maiden name
• 15% use a pet's name and 10% a child's name
• Only 3% use a random password
• 30% of users have forgotten their password

Source: TNS/OneVu 2007

Customers just don't want it!

Customers are constantly telling us that the username and password process is not desirable. The December 2010, InfoTrends eBilling Report showed that 61% of consumers surveyed said that remembering multiple unique usernames and passwords remains a barrier to paperless adoption.

Not convenient for billers either

One of the biggest complaints from billers utilizing self-serve portals is the thousands of phone calls to their call centres every month from customers who have forgotten their login details. Each call costs the biller an average of $3.50 to $8.00. Online self service was meant to be cheaper and more convenient. Unfortunately in many cases it is neither. This is particularly so in circumstances where the customer rarely visits the biller's portal. This includes utilities, insurance companies and telecommunication service providers.

To date, the primary reason for customers visiting a biller's website was to make a payment. With the trend moving away from biller direct to internet banking bill pay, even this reason is dissipating.

Does eBilling have to come at the cost of customer convenience?

If username and password authentication is a poor customer experience, expensive for the biller, as well as a security risk; then how does one protect sensitive customer information and deliver on convenience, while moving to a paperless eBilling solution? Is there a way to provide an eBilling solution that is secure, cost efficient and most of all – convenient enough for the customer to turn off paper?

While it is in the interest of the biller to pull customers to their website in order to cross-sell and up-sell other goods and services, inconveniencing the customer in the process seems paradoxical.

If billers could truly deliver the bill electronically (as opposed to creating a 'fetch' scenario), they would also have a way to market to that consumer intelligently, and most importantly, in a cost effective way that is actually more convenient for the consumer.

Should additional self-service be available on the biller's website, then you can always drive them there after satisfying the primary purpose of bill delivery.

Creating the best possible customer experience:

1. Gain consent from the customer to go paperless without requiring a website registration.

2. Eliminate website registration (the number one barrier to paper suppression) by auto registering the customer at your self-serve portal and let them know that you have done so.

3. Utilize two to three simple questions to authenticate their portal access (think about when you called your bank recently, chances are they asked you 3 to 4 simple questions about yourself that only you could logically know the answers to).

4. Only ask them to choose a username and password if they are going to access the website very regularly and the question process in point 3 above is too lengthy for daily use.

For example: If I'm only visiting my insurer's website a few times a year, then asking me 2/3 simple questions is far more convenient than asking me to remember a username and password I chose 6 months ago. If I am accessing my Internet Banking more than once a week, then of course in this instance a username and password is the more convenient option.

Customers will turn off paper as long as it's convenient to do so, and while redundant authentication processes remain, eBilling adoption just won't happen.

Let's end consumer frustration and expensive customer care phone calls once and for all.