On-Line Banking: Seeking Security, Banks Turn to Internet Certification

On the Internet, no one can tell if you're a dog.

This line, from a New Yorker cartoon, belies a serious problem for banks and merchants setting up sites on the World Wide Web: There is no widely accepted method for authenticating the claims - or the identity - of those conducting business on-line.

To help solve this problem, two companies have begun certifying businesses by granting them "seals of approval" on the Web.

"There needs to be some way that consumers can easily recognize when a site is secure and when it is not secure," said Michael S. Karlin, president of the Security First Network Bank. "Consumers are afraid, even in an FDIC-approved banking situation, and they want the feeling that it is secure."

One of the first systems to offer authentication for commercial sites on the World Wide Web is TrueSite, developed by Application Programming and Development Inc. of Camp Springs, Md.

BankAmerica Corp., Mellon Bank Corp., and First Bank System Inc. are among 30 financial institutions and 2,000 businesses whose Web sites have been certified.

Though the Web provides businesses with a flexible, highly visible medium for presenting their message, on-line business has its drawbacks. A Web site user can download the entire contents of a Web page, alter it, and establish a dummy site at a new location.

TrueSite guards against such occurrences by letting certified banks and businesses put a blue check mark symbol on their home pages for an annual fee of $495, which has been waived for six months. Users clicking on the logo will be warned if it has been fraudulently copied.

"A user won't have to ask, 'Did I get to the correct site in the first place?,'" said Mark Burnett, president of Application Programming, which has annual revenues of $2 million.

"Whether consumers feel comfortable engaging in transactions on the Internet is a function of how they feel," added Jack Rogers, president of the Fairfax, Va.-based American Finance & Investment Corp. "Their perception is as important as reality."

Another certification was launched in July by the National Computer Security Association in Carlisle, Pa.

The association requires that certified companies protect their Web sites against Internet attacks by using data encryption, by maintaining detailed logs, and by establishing firewalls within the computers that host Web sites.

"You better have some confidence that a hacker doesn't have access to checking accounts," said Kevin J. Stevens, a product manager at the for- profit association, which has annual revenues of $5 million. "If banks don't take the steps to be certified and give their market some indication that they have instituted a security program, no public relations is going to resolve only one slip-up."

So far six companies have each paid upwards of $8,500 for a detailed on- site audit before getting the association's stamp of approval. Mr. Stevens declined to identify them, but said they include one of the big three auto companies.

"This is a great first step. What the NCSA has done is to put the bar up," said Security First's Mr. Karlin. He anticipates that the virtual bank will be certified within two months and hopes that the association will eventually introduce a system with several passing grades.

America Online Inc. and the Better Business Bureau are also getting into the certification business.

In conjunction with America Online's move to the New York Stock Exchange from Nasdaq, its top officials reemphasized the features of the largest on-line service and announced 10 new criteria that merchants will be required to meet.

The standards include processing orders and responding to E-mails within one day of receipt and giving on-line customers equal priority with telephone customers.

"AOL members will come to know and have confidence in people who display the seal of approval," said Michael J. Minigan, the service's vice president of interactive marketing. "It is our hope that at some point, merchants doing business on the Web would want to have the AOL seal on their Web sites."

Officials at the Better Business Bureau promote self-regulation and full disclosure of company complaints to fill cues missing from on-line commerce.

"For $30 a month, a business can design a fabulous Web page that can lead a consumer to think they are a Fortune 500 company," said spokeswoman Holly Cheriko. "The consumer is left without the cues in the traditional marketplace like being able to visit, talk to the sales clerk, and view the quality of the marketplace. They need a trusted means to determine which businesses are reliable and what commitment they have made to the consumer."

For reprint and licensing requests for this article, click here.
MORE FROM AMERICAN BANKER