Despite Ample Warning, Customers Liberally Use Passwords

Bank Technology News  |  February, 2010

By John Adams

Print Email Reprints Feedback

Consumer safety fears are often cited as a reason for not adopting online banking. But apparently people aren’t scared enough to take even the most simple steps to protect their own IDs—and that’s a problem for online banks looking to prevent fraud losses.  

According to new research from Trusteer, 73 percent of Internet users share their online banking password with non-financial Web applications, while 47 percent repurpose both their online banking users ID and password.

Amit Klein, CTO of Trusteer, says he’s astonished that this deep into the era of web banking and Web crime—which is splattered all over the news—people would still be carefree with password details. “That amazes me. I would have thought that people would have more sensitivity around online credentials, particularly given the bank is where they store their money,” he says.

There’s not a ton of options for banks to deal with this problem, either. Anti-phishing software that also monitors and flags abnormal use of user credentials is one tech option to thwart crooks deploying passwords and user IDs that have been stolen elsewhere. And authentication tools that use a “second device” to confirm transactions and flag suspicious money movements are another option. But neither of these choices is really preventative when it comes to password ubiquity. Consumers can still use bank password and user ID information on another site.

And education obviously isn’t doing the trick. “After ten years of education, consumers are still falling for phishing attack and are still using their online banking credentials in other places. Education [about the danger of attacks] certainly has its merit, but it’s not an adequate solution,” Klein says.

One suggestion Klein does make is to strongly encourage consumers to tier their online usernames and passwords. This means separate sets of credentials for financial sites, Websites that store information about a users identity, and a third set for less sensitive sites like online forums.