BANK OPERATIONS UPDATE: Supporting Internal Customers

Supporting multiple locations, whether branches or discrete banks, brings a variety of challenges. From an operations and technology perspective, however, the key is to provide a consistent customer
experience across all locations. This means the ability of the teller, loan, and deposit platform systems to serve customers from any location. It further means that line speeds and server horsepower, two key components of the speed with which applications load and run on your employee's computers, must be up to par across all locations. In addition to purchasing systems and data communications capacity that are properly sized, the walking around test is necessary. That is, get out into the remote locations and watch your employees as they use their systems . . are screens slow to load and change, making it hard for employees to serve customers in a timely fashion? If so, it's time to begin addressing why, by looking at communications lines, network capabilities, and other components of adequate access times.

Contingency Planning

Contingency planning is a rare item these days: a regulatory requirement that is also a prudent business practice. You have to be sure, through analysis and testing, that you have plans and methods in place for business continuation. All contingency planning has a three pronged focus:

1. Prevention – taking steps to greatly reduce the possibility of an occurrence. This is easier for things you control (installing redundant power supplies and hard drives in your network servers) than things you don't control (weather).
   
   
2. Minimization – planning and testing will contribute to a lessening of the impact of any occurrence
   
   
3. Restoration – again, the planning and testing you've done will enhance your ability to respond and begin to restore operations.

In the context of technology planning, be sure that contingency and DR are integrated into all of your efforts.

Vendor Contracts

I continue to do a lot of work in this area, as banks often have contracts with terms and conditions that they don't fully understand, in part because they haven't carefully read what they are signing. The contracts that you have in place now are important, because they dictate what you can and can't do in terms of buying new products from third parties, or discontinuing the use of certain products, and they commit you to fees and penalties for changes and early termination that can be significant. Make sure you know exactly what you've committed to, especially with your larger contracts, such as core accounting and item processing, so that your decisions are in line with those contractual relationships. Finally, don't forget that when new contracts are considered (whether for an add-on product, or a complete renewal or new relationship) that you must carefully review those, and consider the terms and conditions so that you improve your position relative to your older contracts.

Industry Insight on Distributed Capture

http://www.orbograph.com/4611347a-a1d7-4dfd-bb82-c25c54fe2958/press-release-contents.htm

More Comments Regarding Online Security

As a follow up to last week's post about the risk of hacking attacks on Internet gaming sites, I felt it useful to expand on this topic. The customer remains the weakest link, in two main areas. First, poor password composition. An article in the March 24, 2012 edition of The Economist provides insight into just how lightly most people take password security. Almost 1 percent of a particular web site's users had selected 12345 or 123456 as their password. Others used a single letter (only takes 26 guesses) or a readily identifiable name, word, or phrase. Second, failure to maintain a secure environment on their personal computers, smart phones, and tablet devices. Recently, a customer fell victim to a scam while shopping on-line. Due to a lack of current virus protection, the customer had unknowingly been infected with a program which was watching her on-line activity. When she entered her card number to complete a transaction on a legitimate site, the rogue program produced a “pop-up” window with some VERY clever language, similar to this: “We are working with your bank to improve on-line security. Please re-enter your credit card number, expiration date, and CVV code” unfortunately, the customer did just that, and the information was gathered by a criminal who began using the card for other purchases.

Regardless of the source of, or the reason for, a particular breach, banks are generally held responsible for losses customers incur (even in the face of overwhelming evidence as to the customers' culpability) Banks must fight a battle on two fronts: Ongoing education of customers regarding safeguarding their private data is essential. At least a few will heed this advice, and act accordingly. Getting customers to keep virus protection up to date is even harder. Some banks have begun offering free access to virus protection as a part of online services. Even doing this, the software is useless if customers don't keep it up to date, so education and reminders must continue.

Second, invest in as much anti-fraud technology as you can to identify and block criminal activity, whether from debit or credit cards, ACH, or wire transfers. Since banks are ultimately held accountable for these losses, anything you can spend now to reduce your exposure is warranted . . . .to a point, of course.

Finally, remain alert. When you see evidence of one or two card fraud issues, be alert for many more, as these may in fact be “testing” transactions to verify account information and balances before larger transactions are attempted. Involve your EFT and core provider as soon as you feel there is any issue.

On Line Gaming and Payments ALERT

 I've recently encountered an issue with several of my bank clients that I think would be of interest to many of you. The company, Blizzard, that offers the popular World of Warcraft on-line game, has increasingly become a target of hackers in search of fresh credit and debit card numbers.

You may want to consider a general alert to your customer base about carefully monitoring for any unusual activity on their debit and credit cards. 

One suggestion would be to consider a pre-paid card to use only for this activity, limiting exposure to any such breach. Blizzard is not the only such gaming company with these issues, but we are presently seeing a LOT of activity around their site.

Thoughts on Using Social Media for Your Bank

By now, you are either actively involved in social media for your bank, or seriously considering it. Key social media channels today include your web site, Facebook, Twitter, and blogs. Following are three ideas to help you leverage social media, while protecting your bank from both a compliance and reputation risk perspective.

First, you have to be “all in.” Commit to the required ongoing effort to maintain timely and accurate postings across all of your media channels. Having a Twitter account, Facebook page, or web site that is only infrequently updated is as bad as a stale billboard. Doing so requires two main efforts – identifying and supporting a point person (I prefer “social media manager”) to manage the technology, and ensuring a steady flow of information from your various departments and locations that allow this individual to make frequently, pertinent posts via social media sites.

Second, address the matter of managing feedback that you receive. Unlike virtually all other forms of advertising, social media allows, even encourages, feedback. Your social media manager must have the skills, and a support group, to segregate responses into three categories. First, there are those responses that we like because they are positive toward the bank and its activities. Second, there are those that require discernment in handling . . . while the post may be negative, is it objective enough that we should deal with it from a customer relations standpoint? Some of the posts you receive may contain a specific complaint. If you can, without divulging personal data, publicly address and resolve the issue, this becomes a great opportunity to demonstrate your focus on customer service.

Finally, there will be posts that must be immediately removed, because they are obscene, offensive, or otherwise inappropriate. Examples of inappropriate posts may also include those where customers (in spite of your admonitions to the contrary) may reveal account information. Ensure that our social media manager is monitoring ALL activity, on a timely basis, by receiving email or text updates when posts are made to your sites.

As an executive, be sure that you are at least basically familiar with current and future social media channels, so that you can provide guidance and insight to your organization in these areas.