Changing a Web site's login process is inconvenient for customers, but there are ways to minimize the hassle and ways to make it worse.
Technology Credit Union learned that lesson the hard way recently, when it added authentication security software and simultaneously changed its username and password system. The San Jose credit union's upgrade forced its online banking customers to navigate a six-page enrollment process, which slowed traffic on its Web site to a crawl and overwhelmed its call center.
Though the problems have been resolved, the project raises the question of whether it is better to make several changes at once, as the credit union did, or to introduce changes in phases. Several analysts agree that one big, unpleasant transition is better than several small ones, though they also point out places where the credit union could have reduced the pain.
Victor Smilgys, Technology Credit Union's assistant vice president of e-commerce, said in an interview last week that it wanted to incorporate PassMark Security Inc.'s authentication software into its login procedure. It also needed to change the outdated login process, in which customers used their account numbers as their usernames and had to use passwords that contained only numbers. (Security experts agree that letting people choose their own username is better.)
On Nov. 16 it began requiring all of its 43,000 online banking customers to choose a new username and password. It also required people to enroll in the PassMark system by selecting an image and phrase for the site to display on future visits to verifies the site is legitimate.
"We decided to roll that out to members as one security enhancement, rather than force our members to go through two conversions," Mr. Smilgys said.
The multiple enrollment pages customers were forced to navigate when they logged in for the first time after the upgrade proved too much for Technology Credit Union's servers. The credit union has about 30,000 members who have used online banking in the past 30 days.
"We didn't anticipate the amount of extra volume on our T1 line, our Internet pipeline," Mr. Smilgys said. "Because there was a bottleneck in our pipelines, our pages were coming up slower than normal."
In a letter sent to members two months later, the credit union said it had tested the enrollment process with employees for several weeks, but once it went live for all members, the "amount of time it took for each member to go through the initial enrollment process resulted in the entire system slowing down significantly for all users."
So customers turned to the phones, which proved to be just as big a drain on the credit union's resources. Many wanted the operator to walk them through the enrollment process, which took twice as much time as the typical phone call. "Our call center got a little overwhelmed, as well," Mr. Smilgys said.
According to the letter, members were forced "to spend an excessively long time on hold," and some were disconnected.
In hindsight, Mr. Smilgys said, the upgrade might have gone more smoothly if the credit union had staggered the project, perhaps by requiring only 1,000 members to enroll each week.
Steve Klebe, the vice president of sales and business development at PassMark, of Menlo Park, Calif., said the number of screens each user must view during the enrollment process can vary according to how many images people view before selecting one.
Staggering the enrollment was just one way Technology Credit Union could have avoided overloading its infrastructure, he said; it also could have upgraded the password system and installed the PassMark software at different times.
"It's just simple math," Mr. Klebe said. "The more changes you make at once, the more people are going to get confused."
However, several analysts said they disagree with that assessment, because imposing multiple upgrades over several months could easily irritate customers.
"From a vendor's perspective, you don't want to couple the introduction of your services with other changes that you do not control, but I think from a bank's perspective, in terms of planning and in terms of execution, it's easier to couple these things together," said Dan Schatt, a senior analyst for the Boston market research firm Celent Communications LLC.
George Tubin, a senior analyst at TowerGroup Inc., a Needham, Mass., unit of MasterCard International, agreed with that assessment. "Customers are very convenience-oriented, and, generally speaking, you want to cause as little disruption as possible."
Technology Credit Union could have followed Bank of America Corp.'s lead, he said. The Charlotte banking company began offering customers PassMark's authentication software in June, making enrollment voluntary at first, which spread out the burden on its systems over a longer period. (Enrollment is now mandatory.)
Mr. Tubin also said that Technology Credit Union could have planned for the traffic by upgrading its hardware before upgrading the software. However, many banks and credit unions that are beefing up their security software in response to guidelines issued by the Federal Financial Institutions Examination Council in October may not have had time to upgrade their hardware beforehand, he said.
Installing hardware can be time-consuming, and Technology Credit Union likely did not want to delay the software rollout to accommodate new hardware, he said.
"Whenever you implement something like this, you're going to run into problems," Mr. Tubin said.
Avivah Litan, a vice president and research director at the market research company Gartner Inc., said Technology Credit Union "could have outsourced the server capacity for this particular purpose, for a short period."
Doing so would have delayed the enrollment by only a month, she said, and there would have been no need to enroll members in small groups. "Frankly, it's much easier to throw hardware at the problem than to change the application."
Chris Musto, an analyst with Keynote WebExcellence, a division of Keynote Systems Inc. of San Mateo, Calif., said limiting enrollment to 1,000 people a week is simply too slow - it would take almost a year to complete the project.
However, he said that a slightly faster enrollment effort would have helped Technology Credit Union manage its Web and phone traffic. He suggested enrolling "a thousand customers a week for a couple of weeks, until you feel like you've settled the issues, and then start rolling it out to 5,000 customers a week."
Mr. Smilgys said the slowdown lasted about two weeks, and his credit union's members are satisfied with the new security measures. It is also planning to upgrade its hardware, and it is hiring even more call center employees.
"We're getting a lot more positive feedback," he said. "Now that the enrollment process is completed, we're not having any more of these kind of issues."
