ING Direct Forays into Facebook Banking, Biometric Security

ING Direct Canada tends to be ahead of the curve on customer-facing technology — witness its pioneering BlackBerry 10 and Windows 8 apps released earlier this year. This week, the $40 billion-asset online bank revealed several new digital innovations, including one that lets its 1.8 million customers log in to their online banking account through Facebook, and another that allows customers to see certain account information from their mobile devices without logging in at all.

ING Direct is letting customers who opt in view account balances, history and pending transactions and receive real-time account alerts within Facebook, all in read-only mode. It plans to expand this application further to include transactions such as transfers, bill payments and email money transfers.

U.S. banks have not ventured to let customers bank through Facebook, due partly to concerns about the FFIEC's proposed rules about banks' use of social media and security questions.

But Charaka Kithulegoda, CIO of ING Direct Canada, says such concerns are overblown.

"We tend to look at everything in a simple manner," he told BTN in an interview Wednesday. "We looked at this and said, how can we do this without taking a different approach to how we do web banking?" The solution: to host ING's online banking site within Facebook, using an IFrame, (an HTML document embedded inside another HTML document on a website) that gives the customer the feeling that he is still on Facebook, when he is in fact entering the bank's website. The customer logs in with his Facebook credentials first, then logs into online banking with his usual ING Direct user name and password. Nothing really changes about the online banking technology, except the way it looks to the customer; security and compliance technology is the same.

"We looked at all the implications of doing this," Kithulegoda says. "The thing we needed to deal with was, how to deal with the stigma of being on Facebook [which has its own security issues]? How do you go through an education process to say it is as secure as online banking, and you're not doing anything differently?"

Some other non-U.S. banks are letting customers access account data through Facebook, such as Commonwealth Bank of Australia, which actually allows banking transactions through Facebook.

ING also launched this week a login-free entree to its mobile banking apps called Orange Snapshot. "We realized two years ago — which is a long time in the mobile world — that people were using mobile devices very differently from being seated in front of their screen at work or on their computer at home," Kithulegoda says. "They're using this on the move."

Using the Snapshot feature, customers who have opted in and registered their device can check balances and make email money transfers and bill payments without logging in.

"We focus on making things simple, especially on mobile devices," he says. "We're a strong believer that it's not about content, it's about context, and it's not about the transaction but the experience. How to make the experience simple and relevant on a mobile device, is the biggest challenge of people who get this right."

To add another security layer to its mobile banking apps, ING is piloting facial and voice recognition technology from CSC with a small number of employees and customers. This would complete the traditional security trifecta: something you have (the mobile device), something you know (a PIN), and something you are (your face or your voice). Somewhere you are — geolocation — may come later.