Earlier today, Citibank launched a dedicated iPhone app (iTunes link) powered by mFoundry. Previously, certain Citi cardholders could use the Firethorn iPhone app, but there was no App Store listing under the Citi brand.

The app, which is free to download, is currently number 10 in the App Store Finance (free) category. It will likely rise to the top, at least briefly, as Citi customers download the app.

The app is featured on the Citi homepage today (see first screenshot below) and is front and center on the Citi Mobile landing page (second screenshot below). The bank has also posted a nine-screen demo of the app here (see inset).

Anyone that's ever used a mobile website will appreciate the Citi login screen (see inset below). A jumbo-sized numerical keypad is included below the signin area to make typing the PIN easier on the small screen.

The Citi application does the usual four functions:

• check balances
• transfer funds
• pay bills
• find Citi branches and ATMs

The bank wisely informs users that their iPhone access can be deactivated immediately in the event of a lost or stolen phone by calling its toll-free number.

With this launch, four of the 10 largest U.S. consumer banks have a dedicated presence in the Apple App Store: Bank of America, Chase, and PNC Bank.

Citibank homepage features the iPhone app (2 March 2009)

Left: Landing page for Citi Mobile (link, 2 March 2009)

The Citibank application page in the iTunes App Store (link, 2 March 2009)

Note:
1. See our Online Banking Report on Mobile Banking for more information on the market. 

Firethorn (owned by Qualcomm) has a new iPhone app called Mobile Banking for AT&T Customers. The app is currently ranked number eight in the finance category of the Apple iTunes App Store (see screenshot below). Of the transactional services, only PayPal and BofA's Mobile Banking are higher.

The application can be used to access online banking at any of the ten financial institution holding companies, and their subsidiaries, currently supported by Firethorn:

• 1st Bank (Colorado)
• America First Credit Union
• Arvest
• BancorpSouth
• Caroline First
• Mercantile Bank
• Suntrust
• Synovus
• USAA
• Wachovia (now owned by Wells Fargo)

The Firethorn application has 27 reviews so far and has scored a 4-star average (out of 5), much better than the typical finance app (see previous coverage here). The main complaint is lack of coverage for the user's bank, which is not the fault of the app.  In comparison, Bank of America's app garnered 434 reviews and a 2.5-star rating.

I downloaded the application today and, unfortunately, I don't have an account at any of the financial institutions; however, that will change next week if they hit the dates contained in the Featured Providers page.

Here are coming-soon financial institutions:

• Citi Cards (Citibank) "coming Nov. 1" (previous press release here)
• Chase Bank "coming soon"
• Regions Bank "beginning this fall"

Apparently, Citibank has been testing a new investment advisory service this summer, myFi, targeting certain Citibank credit card customers. Its first online mention appeared in a frequent-flyer forum, FlyerTalk, May 31 (here) and in the personal finance forum, FatWallet, June 13 (here). The bank has been testing mileage premiums for opening a myFi account and/or increasing spending on a Citi card.

The service consists of a Web-based investment area which will include trading and account-aggregation services later this year (see note 1), combined with telephone and in-person help from non-commissioned Citi Smith Barney advisors. The NY Times's Your Money columnist Ron Lieber tested the human portion of the offering in a Long Island branch and reported on it in his column today.

myFi's director of financial advice is Jonathon Clements, a long-time Wall Street Journal personal finance writer who recently left the paper. If he can instill his pragmatic personal finance outlook to Citi's offering, it would help differentiate it from similar offerings. Andy Sieg is managing director of the service.

The initial creative approach is to use a "financial wellness" theme. Today, the website is bare bones (screenshot below), with a few PDF files available for download. It's clearly a work in progress. The bank should slap a "beta" tag in the upper-right corner so that it's not unfairly judged as a complete offering.

Notes:
1. For more information, see our Online Banking Report on Account Aggregation.

Change Sciences, publishing under the moniker of its new Kantuit research service, just released its latest financial services website evaluation. The report uses proprietary user-experience modeling to rate, rank and compare 18 leading banking sites on how easy it is to find, select, and open a new deposit account online (see Table 1, inset).

Citibank and WaMu were ranked one and two and scored significantly better than the others. Wachovia was third, scoring about 20% higher (the lower the score, the better). Bank of America, Fifth Third and BB&T were in the next tier, finishing about 50% higher. Among mega-banks, U.S. Bank had the worst score, more than double the leaders. 

The Change Science score includes various components that show how a consumer may struggle with various aspects of the application process. These individual scores are totaled to come up with the final composite score shown in Table 1 right.

For example, Figure 1 below illustrates the scores for "Effort (expended) finding and learning about deposit accounts" with Fifth Third leading the way with a 0.1 score, compared to Peoples United Bank, the worst of the sample, scoring 19x higher at 1.9

Download an abstract of the research results here (registration required). The full report runs $4,000; a significant investment yes, but you could make that up with just a handful of additional good deposit accounts. 

In terms of website design, I find most Citibank pages to be somewhat busy. But overall, the pages usually work well due to the eye-catching graphics, appropriate use of colors, and good copywriting.  

I've had a Citibank Business AAdvantage credit card for at least a decade. Even though I don't visit the site often, maybe once every few months, I find that it's generally easy to find what I'm looking for. 

As you can see in the business card example below, the bank uses purple and green "buttons" to catch your eye, then inserts important key words within them to drive action:

1. The purple, "Fraud is not your fault" reinforces that customers are not liable for unauthorized transactions, something most people are still concerned about, even though their liability is minimal. The button leads to a page that discusses advanced fraud fighting tools such as virtual account numbers and a picture card.
2. The navy, "How much have I spent lately?" allows users to quickly drill down into a key area of concern for most card users. Although not as powerful as Wells Fargo's My Spending Report (previous coverage here), it's still a good starting point for many users.
3. Finally, the bright green, "Help prevent an identity crisis" pitches the bank's credit monitoring solutions (note 1).
   

Citibank Business Credit Card main account overview page (22 Sep 2007)

Note:

1. For more information on bank and credit union opportunities selling credit report monitoring see our most recent Online Banking Report.

Citibank continues to press its lead in mobile banking services. The banking giant not only runs print and television ads, but also claims valuable left-side real estate on Citi's homepage (see inset for closeup of section; see screenshot below for context; and see note 1).

Since Citi's homepage is relatively cluttered with banner ads, the New & Noteworthy section supported by a small mobile phone graphic should grab a significant number of clicks. The landing page is the same as reported earlier (see previous coverage here).

Note:

1. Citibank's homepage as viewed from a Seattle IP address, Aug 7, 3 PM Pacific, from a laptop that has previously visited Citibank.com but that has not accessed a Citi account.

Even though my wife tries to throw them out at least once per year, I still have every issue of Wired Magazine in a stack in my home office. It remains my favorite magazine, although I no longer devour every issue within the first 48 hours.

I still take notice when any financial services company advertises within its pages. There aren't usually many to choose from, mostly brokerages and mutual fund conglomerates. But one retail bank has consistently advertised in Wired: Citibank, who made the Wired 40  list of leading companies in 2005 and 2006, but not 2007 (see previous coverage here).

In the August issue of Wired (pp. 31-32, see inset), Citibank has a gorgeous two-page spread, featuring, drum roll please, MOBILE BANKING (see note 1). For nearly 10 years, the gold standard of online banking image advertising was the attractive 30-something guy/gal relaxing on the beach, supposedly doing their online banking from a chair (note 2).

It looks like the mobile phone is the new laptop, at least in Madison Avenue photo shoots, especially now that the iPhone is the sexiest new technology since the Palm Pilot. So expect to see plenty of advertising — print, Internet and television — showing happy 30-somethings taking care of their banking in a few seconds on their way to the beach/theatre/dinner. Sure, it's mostly fiction in 2007, but mobile will be the "sizzle" in bank advertising for years to come.

Here's the slightly truncated version of the Wired ad (sorry my scanner is only 8.5 x 14):

Notes:
1. The add also appeared across pp. 3-4 in the July issue of Wired. 

2. I go to the beach every year, and I've never seen anyone with a laptop there. Even if you forget about the possible sand and water damage, there is no way you can see the screen through the glare, without risking permanent damage to your eyes. I have a $2,000+ Thinkpad tablet, and I can barely make out the screen in the shade on my deck.   

At the Mobile Commerce Summit, we heard Citibank is running national spots featuring its mFoundry-powered mobile banking service, Citi Mobile <citibank.com/citimobile>.  (Hat tip Richard Crone).

Back in the old days, like late 2006, we would have had to request a copy of the ad from the bank. But today, everything is on YouTube, so check out the 30-second spot below (screenshot at right). 

While its not as appealing as Apple's iPhone commercials, the Citi spot does a good job demonstrating the utility of mobile banking. It features a close-in shot of a couple driving down the road with the wife making a quick forgotten payment in a few seconds, while still carrying on a conversation with her husband. It is also great branding, furthering Citi's long-term positioning as a technology leader.*

What it Means
National advertising by the big banks, as well as carriers introducing their mobile wallets later this year and next, will create considerable awareness among consumers. Although, usage will be light for the next few years, mobile commerce is NOT a fad. This is one area you should address very carefully in your upcoming budgeting process for 2008.

For more information, see our Mobile Banking Report.

----

*Citi would look even hipper if it embedded the YouTube ad in its mobile banking landing page.

The May 24 New York Times contains a generally favorable review of Citibank's new mobile phone service (article here). Writer John R. Quain also touches briefly on Bank of America's WAP service and gives Firethorn's application a spin via BancorpSouth's mobile service.

For followers of the space, there's not much new information here. But a 1,200-word article in the NY Times is significant for the mere fact that the editor's found the subject newsworthy. 

The only downside cited, and it's a HUGE one, is the cost from the carrier. In the author's test, it cost him $2.59 in data charges for what sounded like a single Citi Mobile banking session (he did not have a data plan). Ouch. 

Here's the exact passage near the end of the article:

For example, checking my balances, making a transfer and confirming a few payments totaled 244 kilobytes, plus one text message, on Citi Mobile. Total charges from AT&T: $2.59. 

Update: Drew Sievers, CEO of mFoundry, the vendor powering Citi Mobile, emailed to say that the data charges cited in the NY Times article included the initial download. Subsequent sessions, would cost just pennies each, even without a data plan. He also said that the typical user attracted to mobile banking will already have a data plan, making mobile banking essentially free, at least from the carrier.

The long-awaited launch of True Mobile Banking 2.0 (note 1) in the United States happened yesterday with Citibank beginning a limited rollout of its mFoundry-powered downloadable mobile banking service. The service is currently available to Citibank customers in Southern California with nationwide rollout this summer. However, the bank's website today merely says it's "coming soon" (see screenshot below; link here).

The new service is not mentioned on the main Citibank website, unless you use the site search feature (see note 2).

The single mobile banking page doesn't tell us much we didn't already know (see previous coverage here), other than a few minor details are revealed for the first time:

• Mobile PIN number is the same as what's used for regular phone banking; PIN numbers can be created online through a link on the mobile page
• To enroll, users enter their mobile number, carrier and phone model and a link to the downloadable application is sent via text message

A short four-screen demo (below) shows users how to activate the service once it's been downloaded:

There was lot's of new coverage on launch day, indicating that Citi made the press rounds prior to launch:

• Steve Bills from American Banker chimes in with a brief piece using consultant Richard Crone as a reality check on Citi's PR material (here)
• Eileen Alt Powell put this out on the AP Wire
• Time even picked up the story (here)

Note:

1. True Mobile Banking is defined as transactional banking directly from a mobile phone, without the need to access a website (WAP). The 2.0 means it's a second-generation technology, not to be confused with the circa 1999-2002 version 1 that worked on a limited universe of PDAs.

2. Accessed the website from a Seattle IP address via my laptop which does NOT know that I am a Citi customer.

Citibank has the top spot this morning if you Google "checking accounts" from a Seattle IP address (see below). Wachovia and US Bank are the lucky recipients of the free advertising that goes with being in the top-two organic results. Two smaller institutions purchased well-placed ads with Alaska USA Federal Credit Union landing in the number four spot on the right-side column (#7 overall) and Viking Bank at #5 on the right (#8 overall).

Citibank's landing page emphasizes the rate on its savings account, with a passing mention of EZ Checking (see screenshot below). The landing page is gorgeous, but is it missing the point by soft-pedaling what the searcher was looking for? Only Citi and its analytics team knows for sure. My guess is that it does pretty well since the bank's been using this basic design for more than a year now (see previous coverage here).   

Citibank recently posted a short FAQ (click here or view screenshot below) on its website that confirms what we had suspected about its upcoming launch of mFoundry-powered Citi Mobile (see previous coverage here and here).

Here's what we now know:

1. The service will be FREE of charge

2. It will be a downloadable app (unlike the SMS-based service in India shown above)

3. It will work on approximately 100 cellphone handsets

4. It will work across multiple wireless carriers

5. It will include bill payments and funds transfer

6. A direct link to customer service is provided

What we still don't know:

1. Will is support SMS/text messaging?

2. What login/security process will be used?

3. Will it work with all Citi checking accounts or only certain products?

4. Will it work across all major carriers?

5. Will it require a full data plan at the carriers?

As you can see from the Citibank India graphic at the top of the page, major banks offer mobile access in much of the world. But in the U.S., the Citibank launch is a major milestone as the first downloadable application that can be used on common handsets. For more information, see our latest Online Banking Report, Mobile Banking & Payments 2.0 (OBR 138/139).

Click on the screenshot right, to see the Citibank FAQ on mobile banking. Or go directly to its website here.   

Earlier this year, we wrote about how easy it is to run an online instant prize contest using ePrize (see post here). Today, we see that Citibank is using the company to power an instant-win game and billpay usage sweepstakes. They share the same creative and both run March 1 through April 30, but otherwise have little to do with each other.

The instant-win game can be played by anyone and finishes with an ad for Citi's e-Savings account. The sweepstakes rewards Citi billpay customers with automatic sweepstakes entries tied to billpay usage. Here are the specifics:  

1. Instant win: Anyone who registers with an email address and date of birth may spin the wheel up to three times each day to win won of 300 prizes awarded randomly between March 1 and April 30, 2007. The total prize pool is $15,000 with one-hundred $100 winners and two-hundred $25 prizes. At the end of each play, Citi pitches its e-Savings account with 4.75% APY and $25 signing bonus, which is slightly different than its website promotion of 4.65% and $50 bonus (see screenshots below). 

2. Usage sweepstakes: Citibank billpay customers are also entered into a sweepstakes with a single grand prize of $25,000. Each bill payment of more than $5, after the first four during the 60-day run, receives one automatic entry into the sweeps. 

The promotion is advertised on its main Banking page with a small banner (see screenshot below). A larger promotion (see inset above) appears on the Online Banking page (see note 1).

Screenshots: Citibank signup page, "spin" the wheel to play, loser's page with cross-sell of 4.75% savings account (click to enlarge)

Citibank main "banking" page with sweepstakes promo

Note:

1. Tested from a Seattle, WA IP address at 10 AM PDT. Cookies are enabled and will show multiple visits to Citibank, but no evidence of any Citibank accounts.

Advertising-monitoring firm, Mintel Comperemedia reported last week that nearly 9 out of 10 credit card solicitations in 2006 directed recipients to the Web, up sharply from 56% in 2003 (see note 1, 2). Several big mailers, namely American Express, still seem reluctant to use website response as an option, at least in the mailers we see at our house.

American Express tests must show a drop in response by offering too many choices. But if you don't have the budget of American Express, which can afford to drop a mail piece in every credit-worthy household every two or three weeks, you should add website options to your direct mail creative. That way, you can at least capture a lead at your website, even if they don't ultimately accept your credit offer. 

Total mailing volume for 2006 was 9.2 billion pieces (see note 1), or about 3 per week per credit-worthy household. Two of those were from the five largest mailers listed below which accounted for more than 60% of the volume, according to Comperemedia. JPMorgan Chase accounted for 18% on its own. 

In another data slice from Comperemedia, cited by Capital One in a Feb. 2006 investor presentation (PDF here), response rates have fallen from 1.4% in 1995 to 0.3% in 2004 (see note 3).

Here's a breakdown of the billion-piece club, and their percent change compared to 2005:  

1. Chase >>> 1.7 billion (down 4%)

2. Capital One >>> 1.2 billion (up 13%)

3. American Express >>> 1 billion

4. Citibank >>> 980 million (down 2%)

5. Bank of America/MBNA >>> 920 million (down 17%)

Other top-10 mailers: HSBC (up 25%); Discover (up 29%); Barclays Bank (190 million, up 70%)

Note:

1. Comperemedia tracks mailing volume for more than 150 large financial institutions. So the figures here do not include mailings from thousands of smaller banks and credit unions. In total, those probably account for less than 5% of the total from the top-150. 

2. Comperemedia press release is here. Interview of Comperemedia director Jenny Roock by MediaPost is here.

3. Credit card response rate slide from Capital One's investor presentation (PDF) at the Debt & Equity Conference, Feb. 2006; data from Comperemedia.

In a multi-page look at mobile banking (here), BankRate.com reporter Laura Bruce quotes Citibank's Rob Julavits as saying the bank will be:

...testing (mobile banking) in March and allowing customers to enroll in April, with a broad launch expected before midyear

That's a few months later than originally expected. The bank sent Citi Mobile disclosures to checking account customers in January indicating the service would be live in February (see article here). Citibank already provides mobile access to its credit cards in Japan (link here).

I opened my Citibank checking account statement today and out fell one of those text-only "terms and conditions" notices that are rarely read. However, the title of this one caught my attention (emphasis added):

Important Information: Introducing Citi Mobile

It's an update to the bank's terms and conditions incorporating access via web-enabled cellphone or other mobile device. The statement was mailed January 23rd and the notice carried a 2006 copyright with an "01/07" date by the item number.

There's no mention of any fees for the service, which begins in February 2007, according to the statement insert. Readers are referred to the Citibank website for a list of compatible phones, but we couldn't find anything on Citi Mobile today.

In a Google search we ran across an older Citi Wireless Services website <wireless.citi.com/wireless/homepage> with a 2001 copyright date (see screenshot below), but it discusses the previously available services such as alerts sent to mobile phones. There is no mention of the new mFoundry-powered services (see previous coverage here).

Ten years ago, we advised banks to make sure their listings in Yahoo were up to snuff. Now, the major search engines are so good, there isn't much work needed to appear at or near the top of the results for searches on your company name (see note 1). 

However, there is one important online database with massive reach that still needs manual maintenance, Wikipedia. As the sixth-busiest Internet property in the world, with 150 million monthly visitors (see note 2), you should make sure your institution's entry is both factual and up-to-date. One of Wikipedia's defining attributes is that anyone is allowed to edit the content. So there is no reason you shouldn't jump right in and change any factual errors right away. You should also consider adding info and links to missing or incomplete listings, but make sure to follow the strict guidelines prohibiting self promotion.  

Nor surprisingly, Wikipedia prohibits all forms of advertising. And they'll take down any entry deemed to be made to further sales rather than add to the world's knowledge base.

Wikipedia does allow company listings provided your company is deemed "significant" by Wikipedia. Most financial institutions should qualify. However, don't try to put a listing in for your SuperDoubleNet Gold Card. It won't fly.

Also, copy must be devoid of hype, be totally unbiased, and basically read like an encyclopedia entry (see guidelines for company listings here). That said, the online encyclopedia does allow limited use of logos and pictures, so you want to make sure your entry is attractive without being a brochure. Any violations of Wikipedia's guidelines will be quickly deleted.  

Below is the first part of the 1500-word entry for Citibank. Note the use of its current logo and an attractive branch photo. 

In comparison the entry for Boeing Employees Credit Union is just 170 words and devoid of graphics.

In addition, you might look for other Wikipedia "marketing opportunities" where your bank could be listed as a service provider or reference. Again, it has to add to the facts of an existing article, not be positioned solely for marketing purposes. Of course, this is as gray an area as you can get, so there is no harm in trying as long as you keep the edits in line with the spirit of the website.

For example, in the Wikipedia listing for "remote deposits", under the sub-heading, "usage of remote deposit," the following financial institutions are listed (see screenshot right):

• Bank of America
• Citibank
• Commerce Bank
• U.S. Bank
• USAA (Offers this feature to consumers using a common scanner)
• Pentagon Federal Credit Union (offers this feature to consumers, although the physical check must be mailed in)
• Wachovia Bank
• Wells Fargo (also offers this feature to consumers using special ATMs)

If you have a good remote deposit capture service, add your name to this list. It may or may not be accepted, but it's worth a try.

Notes:

1. You should make sure your tags and titles are up-to-date and appropriate (see previous article here). 
2. Worldwide unique visitors in Sep. 2006, according to comScore (press release here)

As mentioned last week (here), U.S. banks are starting to get more creative with their websites, with 12 of the 30 largest (note 1) injecting a bit of holiday spirit into their websites.

This year, three of the top-30 banks had major holiday themes running on their homepages; in 2004, none did. And today we viewed another nine with minor holiday sprinkles, making 12 in total. Two years ago, four banks had minor holiday-themed promotions.

We expected to see more banks marketing gift cards, one of the hottest holiday gifts, especially during the last few days before Christmas. Only four banks mentioned gift cards on their homepages on Dec. 24 (note 2):

• National City
• BB&T
• North Fork Bank
• Commerce Bank

Here is a rundown of those with major holiday themes:

1. Citibank: Citi had the best overall holiday theme as  it continued pushing its 5% e-Savings Account, with a clever 5% "ornament" hung next to traditional Christmas decorations (see screenshot below).
   
   
2. PNC Bank: Runner-up was PNC with its unique brand of holiday marketing, a tongue-in-cheek look at the cost of the items listed in the popular Christmas song, Twelve Days of Christmas. It's a holiday tradition at PNC which has been tracking the holiday index for 22 years (see screenshot below).
   
   
3. Bank of America: The largest online bank used a holiday theme, and $100 off a Dell PC, to encourage users to join the other 20 million BofA customers using its online banking. Customers hitting the bank's homepage were greeted with an animated banner displaying a wrapped package, which after two seconds changed to the Dell deal (see before and after screenshots below).
   
   Showing before and after package animation:
   
   

Other top-30 banks with holiday-oriented images on their homepages:

• Chase Bank: snow globe with 0% credit card offer
• Wells Fargo: packages
• Washington Mutual: snowball with 30-second credit card application
• Citizens Bank: packages with a debit card rewards promo
• National City: snowflakes with gift card promo
• BB&T: packages with a gift card promo
• Countrywide Bank: snow and packages with a loan promo
• North Fork Bank: Radio City promo with $15 off coupon and gift cards
• Commerce Bank: packages with gift card promo

Notes:

1. According to Online Banking Report's list of the 150 largest U.S. financial institutions as of 31 March 2006 (link here).
2. Searches conducted during late morning (EST) on Dec. 24, 2006, from a southwest Florida IP address. Although gift cards were not mentioned on US Bank's homepage on Dec. 24, we had seen them advertised on previous visits, although not necessarily on ithe homepage.

I am a sucker for holiday graphics on websites. It doesn't have to be dramatic, a few snowflakes or candy canes in the background is fine. For example, Citibank's e-Savings banner on its homepage today (see inset, click to enlarge). Just like a holiday wreath on the door of the branch, it shows your customers and employees that you have some holiday spirit.

Unlike two years ago (see prior post here), this year many banks and credit unions are running holiday promotions for gift cards and other products (see rundown here) and/or have dropped holiday sprinkles into their websites. The most dramatic is the popup from U.K.'s First Direct <firstdirect.com>. This is over-the-top, but it brings a grin, not a bad thing during the end-of-year rush.

First Direct homepage with popup showing (click to enlarge)

Close-up of popup after choosing "let it snow" option
The loud holiday music that accompanies the snow globe can be turned off with the button in the lower right. Selecting "all snowed out" or "bah humbug!" from the first screen displays a brief "seasons greeting" message before automatically closing the popup.

I spoke with mFoundry CEO/Founder Drew Sievers last week. If you want to get energized over the possibilities of mobile commerce, this is the guy to talk to.

Although mFoundry already has more than 100,000 users of its mobile application, we were most interested in its recently announced deal with Citibank. The bank is set to launch a full mobile banking application in Q1 2007 that encompasses both SMS-based banking and what we call True Mobile Banking (TMB), a banking application running on the mobile device (see definitions here).

While mFoundry's CEO cannot confirm which functions Citibank will use, the vendor's mBanking platform includes the following: 

• account inquiry
• transaction summary
• funds transfer
• bill payment
• ATM/branch locator
• password generator

The platform also supports advertising and service functions (download spec sheet here).

How it Works
The mFoundry approach uses both text messaging for alerts and simple inquires and a complete downloaded application that mimics Web-based online banking (i.e., True Mobile Banking). With True Mobile Banking, the user's phone carries a unique identifier that is registered with the bank (factor one); and before receiving data or initiating a transaction the user must log in with a password or PIN (factor two).

When the user logs in, current balance and recent transactions are automatically downloaded and displayed, satisfying most user needs within seconds. The application times-out after a certain length of time and more importantly, no data is retained on the device itself, so security is nearly perfect. If the phone is lost or stolen a call to the bank will deactivate the service, although as long as the password or PIN has not been revealed, there is little security risk. 

Analysis
As mentioned in our post three weeks ago (here), it's taken nearly a decade for me to jump on the mobile banking bandwagon. Earlier efforts were too hard to use and had limited appeal, primarily to a small group of PDA-toting geeks.

However, now that even basic mobile phones can use the service (see note 1) and top brands such as Citibank, Cingular, and MasterCard are poised to pump millions into educating the market, mobile finance should take off rapidly (see note 2). 

End Notes:

1. mFoundry says its service works across more than 200 different phones at the five major carriers, AT&T, Cingular, Sprint, T-Mobile, and Verizon. Sure enough, even our relatively inexpensive 2-year-old Sanyo is on their list of supported phones.
2. In order to download the mobile application, users select their carrier and phone type from sliding menus (see screenshot below, from mFoundry's My Mobile News).

2. The next issue of our Online Banking Report will contain a mobile banking forecast.

In its seventh annual Internet-bank "beauty contest," Global Finance Magazine <gfmag.com> named Bank of America the best consumer Internet bank in the United States and Citigroup the best corporate Internet bank. Apparently, the magazine loves Citigroup's work, naming it the best corporate Internet bank in 46 countries and best consumer Internet bank in 11 countries including Germany, United Kingdom, and Indonesia (see list of complete winners, by country, by clicking on the link at the bottom of this article). 

The magazine also named winners in specific categories. In the United States, the winners were:

Consumer Internet Banks:

Best investment management services: Bank of America

Best bill payment and presentment: Bank of America

Best online consumer credit: Wells Fargo

Best website design: Wells Fargo

Best integrated consumer bank site: Bank of America

Best information security initiatives: Bank of America

Best online deposits acquisition: TD Bank Financial Group
-

Corporate/Institutional Internet Banks:

Best online cash management: Citigroup

Best trade finance services: Citigroup

Best website design: Wells Fargo

Best integrated corporate bank site: Wells Fargo

Best information security initiatives: JPMorgan Chase

-

-

Source: Global Finance Magazine <gfmag.com>, July 8, 2006

We were impressed with Citibank’s full-page ad in Sunday’s New York Times travel section offering 25,000 miles to take a new American Airlines co-branded credit card. As usual, we looked for a link to the Web-based application and were pleased to find a large, reverse-type URL along the bottom of the ad. Unfortunately, Citi did not follow the usual convention for printed landing-page URLs, creating potential problems for applicants.

Typically, offline advertisements use a special filename after the normal domain name, such as <www.yourbank.com/special>. This allows users to go directly to the landing page explaining the special offer (see landing page below).

Instead, Citibank used the unique server name "miles5" as in: <www.miles5.citicards.com>. There are several problems with this approach. First, it’s long and not easily recalled. But the biggest problem is its non-standard format. Internet users do not expect to see an extra period in the middle of a bank's URL. So many users, myself included, may read this as a unique domain name, <miles5citicards.com>.

Normally, that would be okay. But in this case Citibank neglected to register that domain name. An identity thief could easily have registered that domain, and then taken “applications” for days or weeks before anyone caught on, possibly leaving hundreds of applicants vulnerable to identity theft after entering their personal info, including social security number, in the application.

By mid-day on Monday, almost two days after the ad first appeared in print, the domain was still unregistered. We went ahead and registered it to prove the point, and keep it safe.

Implications
The moral of this story: If you live in a glass house, make sure any transparencies are covered. Register your domain name. Citibank, which has spent millions on its anti-identity theft campaign, left itself and its customers vulnerable for the price of an $8.95 domain name. Make sure you register the domain name of any cute URLs you put out there for marketing campaigns. While you are at it, spend $60 and lock it up for 10 years. 

Memo to Citibank’s legal team: We have no commerical interest in the domain and will happily transfer it to your ownership. All we ask is reimbursement of our 9 bucks.

--JB

Score:
     Tom Brown -- 1
     Citibank -- 0

How many times have you been frustrated by your experience at a call center? Well, if you were a multi-millionaire hedge fund manager with his own blog, you could get back at the company, and then some.

Read today's extremely thorough account (transcribed verbatim from a tape recording) of Second Curve's Tom Brown as he attempts to add a PayPass contactless debit card to his Citibank account <bankstocks.com>.

A couple lessons here:

1. Flag Tom Brown, and other influential VIPs, in your customer database so they get topnotch phone service
2. Be careful with geographic-based product rollouts to avoid irritating customers
3. Simplify call center scripts

--JB

Has Google found its iPod? Not the music player, but an end-to-end ecommerce system that is safe, convenient, and above all, drop-dead simple to use. Something that does for online commerce what Apple did for digital music. That's a tall order, but we believe the search giant may have just such a hit on its hands with Google Checkout.

For more than a year, there has been a great deal of speculation about Google’s entry into the payments arena. After months of quiet testing with carefully selected beta merchant partners such as Starbucks and Buy.com, Google Checkout was officially released June 29 <checkout.google.com>. Although the reaction in online blogs was mixed, we think it's a winner. The only question is whether it's a home run or a grand slam (or World Cup equivalents, one goal or four).

Google Checkout (previously known as Google Payments or Gbuy) is an online-payments tool integrated with the user's Google account. On the surface, it's similar to PayPal, but the true strength and potential threat is its close ties to Google’s already industry-dominant search function.

At this point, Checkout's functionality is more limited than PayPal's. There is no stored value, no subscription payments, no eBay integration, no non-credit card options, no integrated debit card, or money market account. For the end-user, it's closer to a virtual wallet than a PayPal substitute. However, it goes way beyond what the ewallets of the late 1990s offered, taking control of the entire checkout process, a potentially disruptive technology in online retailing.

How it works
Searches that match a Google Checkout advertiser include a shopping cart icon embedded within the AdWords text box (see Google search on "Starbucks store" above). Users can buy products from these merchants in a few clicks without having to enter any additional information (see Google Checkout icon in lower left of the Starbucks shopping cart shown at right). This eliminates the dreaded merchant-account set-up process that causes massive shopping card abandonment problems, especially at relatively unknown merchants where privacy fears are greater.

First-time users are prompted to enter their credit card, billing, and shipping information, which Google stores in its servers (see screenshot left). Subsequent purchases can be made with a simple Google username and password. Users can store additional payment and/or shipping options at any time. Complete purchase histories can then be monitored from their Google account.

Currently, just 100 merchants are participating (see places to buy), but given the potential merchant savings, expect that to change quickly. Twenty-four of the 100 Checkout users offer a $10 discount on purchases of $20 or more (see DayDeals screenshot below).

Like PayPal, Google shields the buyer’s credit card number and other personal information beyond what is necessary for shipping purposes. However, Google also provides the option of keeping the user's email address confidential, a spam-limiting function not available via PayPal.

When a user selects the confidential option (see screenshot below), Google forwards the seller's confirmation message to the end-user.

Sellers are paid directly through their own Google Checkout account. Google has significantly undercut PayPal on pricing, at least for smaller merchants. Google's fee is 2% of the sales amount plus a flat $0.20 transaction fee compared to PayPal’s typical 2.9% plus $0.30 (PayPal has a sliding scale with higher-volume, $100k/mo and above, merchants paying 1.9% plus $0.30).

In addition, Google advertisers earn credits against their processing fees. For every dollar spent on Adwords, sellers can process $10 worth of sales with no processing charges other than the $0.20 transaction fee. It amounts to a 20% discount on AdWords spending, provided there is sufficient Google Checkout volume (i.e., at least 10 times the amount spent in AdWords).

Finally, sellers can create their own Buy Now buttons at the Google site, then drag and drop the HTML code into their websites. This allows small business sellers who are not currently ecommerce-enabled to immediately begin accepting Google Checkout.

Google is expected to provide additional data as the service matures. Having a hand in the process from product search all the way through to the purchase will allow Google to keep tabs on which ads actually result in a sale. This could mean changes to Adwords pricing or structure.

Analysis
The pitch to consumers is appealing. In addition to the privacy shields, Google promises to mediate disputes, and gives users a central place to track purchases. But the biggest consumer benefit: a common user interface for checkout, something that previous ewallets never provided. As you can see in the screenshot below, after shopping the merchant site, the contents of the cart are transferred to Google. At that point, Google takes over, offering the end-user the following options:

• Change shipping method with all costs itemized
• Add a coupon code
• Change credit card
• Change shipping address
• Shield email address from merchant
• SIgn up for promotional messages from merchant
• Links to the user's Google account
• Concise summary of the billing info, including exactly how the charge will appear on the user's credit card statement
• Concise summary of the merchant's return policy

Will consumers give up more personal information to the largest data repository on earth? Initial polls seem to suggest so. In addition, you can bet that merchants will create incentives to move credit card and/or PayPal volume to Google to save as much as 3% on card processing. For a retailer with a 10% margin, that's a potential 30% lift.

You might be thinking that free credit card processing is a short-term loss leader that will end as soon as a critical mass of merchants adopts Google's system. We don't think so. Put yourself in the shoes of a Google advertiser. You now know that you'll earn a 20% discount on your AdWords buy. Will you let that drop to the bottom line, or might you use some of that windfall to goose your bids on Google a bit? If it's an efficient market, eventually much, if not all, of the "free" card processing will flow back to Google in the form of higher bids. And since not all merchants will qualify for the 20% discount, Google might actually increase its total take due to the "discount." Brilliant.   

Citibank's role
The program should have little impact on retail banks, since at this point Google Checkout must use a bank-issued credit or signature debit card to participate. However, Citibank is paying Google to be the "preferred card" on both the Google sign-in page (click on inset above for closeup) and the credit card registration page (click on inset right). The credit card giant is hoping the $5 (or 1000 Thank-you points), will entice users to enter their Citi card into the Google wallet. The $5 bonus offer ends Aug. 1.

Retail banks might want to consider supporting the payment service with a secure gateway to various online payment alternatives so users can manage their PayPal, Google, and other accounts directly from a secure online banking area.

If you are a credit card processor, however, this could eventually pose a threat to your market share and/or margins. Even without factoring in the AdWord's credit, Google's highly publicized 2% discount rate, along with a lack of monthly fees, is a bargain, especially for small businesses. However, given the reluctance of businesses to change banking relationships, it will be years before the impact is felt.

--JB

We are huge fans of Wired magazine <wired.com>, having read just about every one of its 190 monthly issues. In fact, eight or nine years ago I used to tell friends that the goal of Online Banking Report was to translate the technology magazine into "banking terms."   

I still recommend the magazine to anyone interested in the future of digital communications, marketing, or content (that ought to cover anyone reading this). So if you're not already on board, head to its website and plunk down US$10 for an annual subscription.

Wired 40
Every year Wired publishes its list of its top 40 companies, The Wired 40. Most are large companies selected for their strategic vision, global reach, killer technology, and hunger for new ideas. The latest ranking (July issue) has Google at #1, knocking Apple from the top. The biggest surprise, New Corp. hitting the chart at #9. The company, which wasn't even ranked last year, has become an Internet giant with its purchase of MySpace last year (see NB March 16).

Here's the top 10 with last year's rank in parenthesis:

1. Google (#2)
2. Apple (#1)
3. Samsung (#3)
4. Genentech (#7)
5. Yahoo (#5)
6. Amazon.com (#6)
7. Toyota (#8)
8. General Electric (#17)
9. News Corp. (NEW)
10. SAP (#11)

As you would expect, there's not much in the way of financial services in the list. However, Citibank holds on to the number 38, down two spots from last year. Not entirely coincidental, Citi is one of the few major financial services advertisers in Wired. This month, the bank has a huge buy, with a fold-out front-cover spread pitching its "Citi identity theft solutions."

GE (#8), Yahoo (#5), Microsoft (#36), and even Google (#1) have significant retail financial services, although they account for mere slivers of the giants' overall revenues.

Like Citibank, GE elected to make an ad buy this month, pitching its high-yield deposit products on the online version of the Wired 40 list (see inset).

Falling out of the top 40 this year was TD Ameritrade which the magazine said still "ruled etrading, but what once was a disruptive technology is now a commodity."

In today's Wall Street Journal, personal finance writer Jane Kim does a roundup of what she calls "the next wave of online banking." The impetus for the article was Yodlee's new MoneyCenter that will be available to consumers in early July. I was interviewed for the article and provided several of the examples along with the market size estimate.

In addition to Yodlee, the following developments were chronicled in the article:

• Citibank's <citibank.com> 50-fold increase in online interbank transfer limits from around $2,000 to $100,000 this summer. In what may simply be a self-serving comment made to a reporter, the bank cites the demand for its new e-Savings account as an impetus for the change.
• Commerce Bank's (NJ) Virtual Private Bank <virtualprivatebank.com> for customers with $1 million or more in investable assets.
• Wells Fargo's My Spending Report, a simple integrated spending report we discussed last year. (NB Feb. 17, 2005)
• Bank of America's <bankamerica.com> account aggregation and recently expanded account alerts.
• Chase's <chase.com> next-day bill payment.

Analysis
Although most of these examples are relatively minor improvements, it's good to see the mainstream press recognizing online banking innovations. The last few years have been dominated by security concerns, and we believe it's a great sign that reporters are looking for "what's next." It would be wise to have an answer to that question when your local paper calls.

We believe the Virtual Private Bank (VPB) from Commerce and the Yodlee system deserve closer examination. We'll cover Yodlee's new product when it goes live next month. And, although we won't be able to drop a million into Commerce Bank, we'll take the VPB for a test drive later this week.

--JB

If you'd like to learn more about the future of online banking, check out the Online Banking & Bill Pay Forecast: Current, future and historical usage: 1994 to 2016 from our sister publication, The Online Banking Report.

In yet another aggressive deposit-pricing move, Citibank raised its e-Savings rate to 5%, the first major high-yield player to surpass the magic 5% mark on a savings account with a low minimum balance. IndyMac (5%, $25k min) and Countrywide (5.25%, $50k min) hit 5% before Citi, but have higher minimums.

Keep in mind, Citi's account requires a checking account, a significant part of the strategy that has attracted more than $2 billion in new money in the past three months (NB June 1).

Last night, Citibank sent selected checking-account customers an email solicitation for its 4.75% APR e-Savings account. I live outside its branch network, so Citi may have elected not to send the message to customers serviced by traditional branches.

The message was direct and to the point (click on screenshot left). Citibank even included the impressive 4.75% interest rate in the message subject. The only distracting portion of the message was a garbled first word in the second paragraph. It was probably caused by incompatibilities in software rendering of the apostrophe in the first word, "there's." To avoid this type of error, make sure you proof your message in multiple email clients.

The bank continues to engender trust in its marketing messages by including the "email security" box in the upper-right corner which includes the customer's full name and last four digits of their ATM card. The security information is prominently displayed, in a blue shaded box to make it more prominent, even if the user has images blocked (see screenshot below).

The bank also includes short text messages that appear where the images would have been displayed (alt-text tags) making the message relatively readable even for users that never download the images.

Surprisingly, the landing page for the offer was a generic product page. The campaign would be much more effective if the bank had reinforced the e-Savings benefits on the landing page like it does when it advertises online (see NB March 29). Click on the following link to see a screenshot of the landing page. --JB

Appendix

Landing page
(displayed when clicking on the "signup" button in the email).

Note: I tested the link on my laptop where I am not recognized as a customer and on my desktop that saves my username in a cookie. Both times I was served the same landing page (below).

According to remarks made by Citibank CEO Charles Prince at the Sanford Bernstein investor conference, the bank's new high-yield savings account, currently yielding 4.75% (see NetBanker May 19), is bringing in $1 billion per month in new money. He characterized the deposit total as, "the equivalent of having opened 23 new branches."

His exact quote, available via webcast (comments start at the 47:45 mark of the webcast) was, "In the first ten days after the launch, we had ten times the volume we predicted. Today, literally only a few weeks after the launch, we've raised 3 billion dollars in deposits." He also said that two-thirds of that was "new money to the institution."

These numbers are in line with the industry forecast outlined by Citibank.com director Catherine Palmieri a month ago (see NetBanker May 5) of $250 billion in 2006. If that forecast holds true, $20 billion per month into high-yield savings, Citibank is bagging 7% to 8% of the market. 

--JB

On Tuesday (5/16), Citibank raised its e-Savings rate 25 basis points to 4.75%, making it the highest savings rate at a name-brand financial institution. Only Corus Bank in Chicago has a higher APY on BankRate.com today, 4.84% with a $10,000 minimum.

More importantly, Citi continues its massive ad buy touting the rate. It was back on the top of MSN's homepage today, and the bank has bought huge parcels of BankRate.com, with some pages running three Citibank promos, top, bottom and side (see BankRate "Checking & Savings" page right). It's similar to what Emigrant Direct did last year to kick off its direct banking efforts (click here to see past NetBanker articles on deposit marketing).

Analysis
Emigrant Direct, HSBC, ING Direct, and now Citibank are all spending $10+ million per year promoting high rates (see ad spending NetBanker5/17). While high-rate offers are nothing new, the ease of finding rate deals online and transferring the funds means it will be harder to hold onto those high-balance 0.50% checking and savings account balances.

--JB

Usually, when designing targeted offers, you focus on what you know about the prospect. Where do they live? What products do they use? What's their balance? What if you wanted to offer a product only to folks you know nothing about, such as new visitors to your website?

Suppose you had a hot APY offer you wanted to make only to new customers to avoid cannibalizing that cash cow, the passbook savings account. Using cookies, you could avoid showing the offer to online banking users, minimizing their awareness of the product.

Apparently, Citibank is using this approach. In a routine visit to Citibank's website in mid-April using our laptop, we were surprised to see advertisements for its 4.50% e-Savings account dominating the website (click on inset for a closeup). When the high-yield product was announced (NetBanker March 29), many observers believed it was a stealth offer made through a new "Citibank Direct" entity.

But when we returned to the office, the offer had disappeared from the homepage. We had to click on the small "special offers" link to find it listed along with several other offers. Apparently, the cookies on our office PC, which identify us as a Citibank online banking user, triggered the website to load a different homepage. We confirmed this through testing on other PCs.

But before you use this tactic, realize it has significant drawbacks. First, it doesn't work with users who delete or disable cookies, estimated to be as high as 40%. Also, an online banking user visiting from a different location, or with a different browser, will also see your offer.

There is also the risk of your clever marketing being outed to the press and public, which may find the practice deceptive (see SmartMoney, April 2006). Finally, you may be teaching users to game your system, deleting cookies more often, entering different zip codes, and so on. This could hinder your ability to deliver targeted promotions to the customers you DO know something about.

--JB

Note: Citibank isn't shy about putting the offer on Google, where it shows as the top paid result on searches for  "Citibank" (see screenshot right).

The new headphones for my son’s eleventh birthday arrived last week with the usual advertising fliers dropped into the Amazon.com box. One of the three products caught my eye, a 4x6 glossy sheet advertising Citibank’s 4.5% e-Savings account. It looked much like their online ads with a blue-and-white theme emphasizing the APY (see right).

9

On the back, four benefits were highlighted:

• Free Online Bill Pay
• Online Fraud Protection
• Free Wireless Alerts
• Online Statements and Check Images

Notice how the 13 words of benefits included “free” twice, “online” twice, along with the positive buzzwords “wireless,” “fraud protection,” and “check images.”
9
The bank used an easy-to-remember URL <offer.Citibank.com> with offer code CSA2 (click on inset to see the Citibank offer site prior to inputting the offer code). The fine print contained the usual requirement that it was not available in Citi branches. Interestingly, the bank elected to forego the usual toll-free number option.

--JB

If you'd like to learn more about past interactive financial marketing campaigns, check out the Interactive Financial Marketing Database from our sister publication, the Online Banking Report.

In an effort to boost awareness of its 4.5% e-savings account (see NetBanker March 29), Citibank made the unusual decision to reveal its 5-year forecast for industry-wide sales of online savings accounts. In today's New York Times, Citibank.com director Catherine Palmieri made the following market size estimates:

$250 billion in 2006
$600 billion in 2010

To put the numbers in perspective, the 2006 estimate is approximately four times the total deposits of the two biggest direct banks, ING Direct and E*Trade. And it's about 4% of the total U.S. deposit market of $6 trillion.

Assuming Citibank is right and the online savings market grows at a compounded rate of 25% per year, it will represent 10% of today's total deposits or 8.5% of the total $7 trillion in total deposits 2010, assuming a 3% annual growth rate.

The article also said that HSBC Direct is on track to have 250,000 accounts by the end of this year.

Googling "online savings accounts" from a Seattle IP address today found Citibank in the number seven position. Here were the top advertisers (see inset above for closeup):

1. HSBC Direct
2. Emigrant Direct
3. Capital One
4. American Express
5. E*Trade
6. Alaska USA Credit Union (Seattle local ad)
7. Citibank Direct

--JB

Several interesting tidbits surfaced from today's presentations at BAI's SmartTactics conference in Las Vegas:

Citibank online account acquisition
In 2002, 6% of Citibank's new checking accounts were generated online; in 2005, the number was 20%.

Our comments: Keep in mind that Citi's experience is unique. It has a huge brand and relatively small branch network, so many of its new accounts have no choice but to open online, or over the phone. And part of the growth can be attributed to non-checking products, such as its high-yield savings, that REQUIRE a companion checking account.

Bank of America's SiteKey rollout
The rollout of mandatory two-factor authentication is complete, except in Oregon and Washington where it is expected to go live in June. Prior to becoming mandatory, users had a period of time where it was an optional feature; however, only 8% opted in during this phase. When the PassMark-powered system became mandatory, users were served notice during their first two logins that they needed to sign up before it became required on the third login. Only 4% signed up during the first two warnings, and 96% put it off until the third try.

Note: PassMark was acquired by RSA Security today.

Our comments: Taken together, only 12% of users opted for stronger security before it was required, far below the 60% or so that say they want more security in consumer-research studies.

Zions remote deposit-capture results
Zions Bank has grown its remote-deposit client base from 364 in January 2005 to 3,697 in January 2006, and they are adding nearly 100 clients per week. The bank has bagged more than $200 million in incremental deposits and has increased loans and fee income. The Utah bank is now looking for new business worldwide with clients in 49 states and five countries outside the United States. It has clients of all sizes, from the Fortune 500 to small businesses that use it for just one check per month.

Our comments: If you needed ammunition to move this up the priority list, keep your eye on Zions: It said that its main problem now is just keeping up with the all the requests.

Research results from Yahoo Search Marketing
A Forrester study of all U.S. banking customers (not just online bankers), commissioned by Yahoo and OgilvyOne Worldwide, found that 61% of all banking-product research is being done online vs. 5% via phone and 30% in branch. Similarly, 64% of account monitoring is now down online vs. 16% via phone and 13% in-branch. But account opening at branches still dominates at 84% of new account openings, compared to 14% online and 2% via phone. 

Yahoo also said they expect 50 million online credit card applications in the United States this year.

Our comments: Wow, time to pull out all the stops in your online account-opening initiatives.

In more direct banking news,* Citibank landed all over the media with the launch of a 4.5% no-minimum-balance savings account. A Citi checking account is required to qualify. The reason for the media attention had nothing to do with the rate, and everything to do with the channel conflict inherent in the offer.

The first line of fine print under the offer was (click on screenshot below for closeup; click on "Continue reading..." below for the full text of the mousetype):

This offer is not available at Citibank financial centers

Many stories contained an inaccurate observation that Citibank was launching an entirely new Internet bank. This inaccuracy seems to have its roots in the Reuters wire piece that first discussed the savings account offer.

The truth: This is NOT a new bank. It's NOT a new website. It's NOT even a strategic shift for Citi, which has previously made high-rate deposit offers to online customers (see OBR 120/121). This is simply a new advertising campaign targeted to online users, especially those frequenting Yahoo's homepage (click on inset to see the ad positioning).

Any of Citi's existing 2.5 million online banking customers can open the account by logging in to online banking and selecting "open an account" and following the directions. A small link in the lower right of the landing page directs existing Citi customers to these instructions.

Initial funding can be made by mail, credit card, debit card, or ACH (electronic interbank funds transfer). After the account is open, additional deposits can be made at Citi ATMs or through IN-BRANCH deposits.

Analysis
You've seen high-rate savings account offers before. There is little new here. What can you really say about a savings account once you deal with the rate and the balance requirement?

What sets Citibank apart in this instance is its near-perfect sign-up form (click on inset right). The page is dominated by a banner promising that it will "take 10 minutes & 4 simple steps." The bank backs that up by showing the four steps immediately below the banner.

1. Tell us about yourself
2. Confirm your identity
3. Fund your account
4. Provide your E-Signature

Although these steps are the same as what thousands of banks have done for years, Citi's language is exceptional in its clarity and how it addresses consumer fears. The "confirm your identity" demonstrates the bank's commitment to stopping fraud. The "provide your e-signature" lets customers know they won't have to mail some old-fashioned signature card to the bank before they can start enjoying the new rate.

The bank also uses several other devices to ensure that customers feel confident about acting on this offer:

• "We care about your privacy and security" box with link for more info (upper left)
• VeriSign clickable logo (left)
• Ability to save and complete the application later (upper left)
• Ability to print a blank application to mail in (upper left)
• Link to account details and fees (upper right)
• Link to live chat or toll-free number (right)

But we called this "near-perfect" for a reason.

There are several concerns not addressed on this page:

• Timing: How long will it take before my initial deposit starts earning 4.5%?
• Guarantee: Even though they address the need to confirm your identity, the bank doesn't come right out and guarantee the safety of the process.
• No reinforcement of account benefits: Although it's been only a few moments since the customer navigated to this page, don't let them lose sight of why they should go through the uncomfortable process of typing their personal details into a browser that may or may not be transmitting their keystrokes to Uruguay. Keep that 4.5% number right in their face.

Another weakness: navigation overload. Citi has included its full My Citi personal navigation across the top along with all the site utilities in the upper right. While this is helpful for research purposes, it tends to be distracting and will pull customers away from the savings account application.

Final Grade
Despite a few minor weaknesses, it's impressive work. Definitely scores an A and is closing in on A+.

Web address for offer: http://direct.citibank.com/CBOL/06/esavings/default.htm?

*We've started a new Direct Banking category for Financial Marketing Week, so you can easily find all the articles on the topic with a single click.

Continue reading "Citibank's 4.5% Direct Banking Savings Account" »

Since the dawn of the online credit bureau era (1997/1998), online credit report marketing has been dominated by the specialists: Experian, Equifax, TransUnion, ConsumerInfo.com (now owned by Experian), Fair Isaac, Intersections, and others.

Now, financial institutions are becoming more involved. For example, Citibank's AdWords spot pitching its Credit Monitoring Service showed up fourth overall (and second in the right-hand column) in a search today for "credit report monitoring" on Google (click on inset right for a closer view). With 84 advertisers vying for space on the first page or two of results, that's expensive real estate.

Citi's $9.95/mo service (after one free month) is powered by Intersections <intersections.com> and includes info from all three credit bureaus, daily alerts based on Equifax info, $20,000 in identity theft insurance, and other benefits (see screenshot below for a full listing).

Another surprise advertiser in the category is Wal-Mart whose ad appears in the sixth position along the right side of the search results (see inset above). The retail giant's $7.46/mo service is co-branded with TransUnion's TrueCredit (click here for screenshot).

Analysis
We are big fans of credit report monitoring, having personally used it for more than a decade. And while the service does deliver significant value, we think the single $9.95/mo price point is too high for the mass market. Granted, ten bucks is better than the $14.95/mo charged by TransUnion's TrueCredit for a similar service (see inset for an email received today). But the $120/yr is simply too much for information that can be extracted relatively easily by consumers themselves.

Better would be a multi-tiered offering: Regular/Gold/Platinum that starts at under $5/mo and peaks at $9.95/mo for an individual, $14.95/mo for a family. That way, more customers would receive the benefits of proactive monitoring while the truly paranoid could use the pricier options for added peace of mind.

Another puzzling aspect of Citi's service: it's impossible to find it through the home page. It not only lacks its own link in the product menus, but also comes up blank in searching on "credit report monitoring" or even "credit reports." You shouldn't have to use Google to find such an important service, especially at a bank that's spent tens of millions promoting itself as a safe haven against identity theft.

For more information on credit-report monitoring, see Online Banking Report #83/84. For more on pricing, see OBR #109.

--JB

Definition: loy·al  (loil) adj. Steadfast in allegiance

-

When I was a graduate student 17 years ago, I did a lot of research into so-called loyalty programs. At that time, other than the airlines and grocery stores (think S&H Green Stamps); it was a relatively new concept.

Now, just about every modern retailer has a loyalty program of one form or another, from pizza joints (our favorite spot has a “frequent pier” discount), to book stores ($25 annual fee for at 10% discount at Barnes & Noble), and even pet stores. The programs typically provide discounts, VIP services, and/or special programs for frequent customers.

-

Many financial institutions provide loyalty features such as relationship pricing, rewards for credit/debit card usage, personal bankers, and events for high-net-worth clients. But Citibank is breaking new ground with its Thank-You Points program.

-

The new rewards program has been featured in media campaigns for the past several months (thank you Citibank for focusing on the positive rather than continuing to over-publicize the identify theft problem). The program delivers points both for the depth of the Citi relationship and the amount of debit card spending. Spending on the many of the bank's credit cards, including the new Simplicity card, also count for points.

Debit card spending is straightforward, earning 1 point for every $2 spent on signature debit and 1 point for every $3 spent on PIN debit. Credit card spending earns 1 point per dollar.

Relationship points are earned for anyone having 3 or more accounts with the bank, and range from 25 points per month with 3 products and a Citibank Access checking account to 1200 points per month for someone with 7 or more products and a CitiGold Account (click on inset for more detailed information). An online tool is available to help users estimate the reward points they will accrue.

Customers are NOT automatically enrolled; they must call a toll-free number to enroll. There is no online enrollment option. Points can be redeemed by phone or through a dedicated website, <ThankYouRedemptions.com> which is currently closed for remodeling and due to reopen next week.

-

Example rewards:

• 20G iPod = 50,000 points
• round-trip coach air fare = 25,000 points
• make a wish = 25,000 minimum
• gift certificates: $5 = 1000 points; $10 = 1500 points; $25 = 3000; or $10 per thousand for larger amounts

Analysis
Loyalty programs can have a significant impact on customer retention and purchase behavior. However, the programs have three inherent problems:

1. Cost of communicating the incentives and member reward status
2. Consumer disinterest/apathy/fatigue with the program
3. Cost of the incentives

Online delivery helps solve the first two problems. With email and web-based delivery the cost to communicate the details of the loyalty program are negligible, other than the fixed cost to create the communication. Second, the program can be kept fresh with continual feedback to the user when logged in to online banking. A progress chart along and program news serves as a constant reminder of the program benefits.

However, online delivery does little itself to impact the cost of the incentives. In fact, by making it easier to track and redeem rewards, you may be actual increase incentive costs due to higher redemption levels. On the other hand, if you increase interest and awareness, you may be able to get equivalent lift from lower-cost rewards.

-

The final word: Online delivery has the potential to greatly increase the impact of bank loyalty programs. So, expect other major banks to enact programs similar to Citi's. If you have a loyalty program, you may want to look at how it's delivered online. If you are not doing anything to systematically reward your best customers, you may want to add this to your 2006/2007 plans.

-

--JB

-

Reference: Citi ThankYouRewards screenshot (links do not work)

Under the "every little bit helps" theory, Citibank's popup window when registering for online credit card access is a nice touch.

The popup (click on inset for closer view) reassures users that they are entering information into a secure site. The well-crafted verse goes like this:

Secure.
A little word that that means a lot--especially online.
Rest assured, this registration process is just that.

The window closes itself in about 10 seconds, if the user hasn't done so already.

--JB

To learn more about how to promote online security and peace of mind, check out Marketing Security: The sensitive issue of publicizing security and authorization enhancements from our sister publication, the Online Banking Report.

One neglected area of the online customer experience is logging out. Are you thanking your customer for banking online? Reinforcing that their secure session has safely ended? How about a little cross-promotion from time to time?

We've logged off more than a thousand times from dozens of financial institutions and it's never been particularly noteworthy.

However, this week Citibank's logoff screen caught our eye (click on inset for full screenshot). Not only did the bank thank us for our business, they posted an attractive promotion for its banking rewards program.

You may not have offer something quite as elaborate as the Citi program, but you can effectively use the logoff page to highlight service improvements, call attention to upcoming events, or highlight community involvement and volunteer opportunities.

--JB

JP Morgan Chase and Citibank led all banking and lending companies in online ad spending according to the most recent American Banker survey of financial services spending (May 2005).

Chase’s $50 million in online advertising was 21% of its entire advertising expense, the highest among major banks, and considerably above the 11% online share across all financial services companies. In comparison, Citi’s $49 million spent online was only 9% of its total advertising expense, slightly below the industry average.

NetBank, the 16th biggest online advertiser, was the percentage leader, funneling all but $100,000 of its $4.9 million in advertising into online initiatives. Two other major online advertisers spent more than half their money online last year: ING Direct spending 60% of its $40 million total online, and MBNA spending more than half its $14 million online.

Lending Tree, Quicken Loans, HSBC, Sovereign and East-West Mortgage all devoted about one-third of their advertising into the online channel.

Top-20 Financial Institutions Online Advertisers*
2004 Online Advertising (% of total advertising)*
1. JP Morgan Chase  $50 million (21%)
2. Citigroup              $49 million (9%)
3. American Express $28 million (9%)
4. Bank of America    $25 million (9%)
5. ING Direct            $24 million (60%)
6. Lending Tree        $22 million (31%)
7. Ameriquest           $16 million (13%)
8. Quicken Loans       $10 million (33%)
9. Wells Fargo           $9.2 million (14%)
10. HSBC                  $8.3 million (39%)
11. MBNA                  $7.0 million (51%)
12. Wachovia            $6.3 million (7%)
13. E-Loan                $6.1 million (21%)
14. NetBank              $4.8 million (98%)
15. Discover             $4.7 million (6%)
16. GM                     $3.8 million (4%)
17. Royal Bank          $3.2 million (12%)
18. Sovereign           $2.8 million (33%)
19. East-West Mtg.    $2.7 million (32%)
20. WAMU                $1.9 million (2%)

*Banking, Lending, Mortgage, or Credit Card segments only, does not include online brokerage, insurance, or investments.

If you look at the brokerage and mutual fund category, the spending accelerates. Four online brokers Ameritrade ($65 million), Scottrade ($63 million), Schwab ($58 million), and E*Trade $52 million) each outspent even the largest financial institution, and Netstock Direct ($32 million) outspent all but Citi and Chase.

Top-10 Brokerage & Mutual Funds

2004 Online Advertising (% of total advertising)

1. Ameritrade   $65 (64%)

2. Scottrade     $63 (87%)                              

3. Schwab        $58 (35%)                              

4. E*Trade        $52 (77%)                              

5. Netstock       $32 (99%)                              

6. Harrisdirect  $24 (78%)                              

7. Vanguard      $12 (31%)                              

8. TD Bank        $10 (17%)                              

9. Fidelity        $5.3 (4%)                               

10. T.Rowe Price $3.8 (5%)

Download the Excel file with more details.    

--JB                     

It's fitting that the financial company most targeted in phishing attacks, Citibank, would be the first to introduce a new email format that goes a long way towards helping users identify legitimate email messages.

The personalized emails (click on inset to enlarge) include not only the name of the recipient, but also the last 4 digits of the user's ATM card. While simple personalization with the customer name would help many users identify legitimate emails, it's far from fool-proof.

First, there's the relatively common practice of including first name and/or last names in email addresses. Also, some phishers are using direct marketing tactics and first running email addresses through various databases to append actual names and other info to the email record in order to develop a personalized pitch (see ZD-Net article).

Citibank's new email format was announced to customers through a short message on the top of the online banking screen in early May. It is also now mentioned in the bank's main FAQ page.

Analysis
This is a great first step in winning back the confidence of users. Eventually email standards will evolve so that the email client will be able to readily identify legitimate emails, but that could be years in the future.

If you are considering a similar approach, you might want to let users choose the name and identifying information that appears in the personalization box. In February, we reported on a UK security initiative that took that approach.

For more information:

• Previous NetBanker post on eBay's personalized email strategy
• Security & Privacy from Online Banking Report (#93/94)

-- JB

Editor's Note: Citibank received an OBR Best of the Web award for this and other security features in Online Banking Report #119, "Marketing Security."

We believe a strong bill payment guarantee is crucial, not only to the credibility of your epayments program, but by implication, to your entire online banking offering. CheckFree has offered its logo up for years, but your customers want to know what YOU will do for them; most would prefer to know nothing about CheckFree.

And your guarantee needs to be visible to both online banking users and those just thinking about it. One of the best ways to increase visibility is by creating a "bill-pay guarantee" icon that users can click through to learn more about it.

One of the better examples is at Citibank (inset) on its logon page. When you click on the logo, a small popup appears (click on the thumbnail below):

*

This guarantee has great copy, you can tell the marketing department was heavily involved. Rather than just reiterating the rather droll performance guarantee,* the bank also highlights several benefits:

• No hidden charges, in other words, unlike "free checking," bill pay really is free
• 24/7 service with "fast response"

*Citi's bill-pay guarantee states that payments will be processed within 24-hours and delivered to payees according to the schedule, or the bank will pay for any fees incurred.

--JB

Citibank has woken my sick-in-bed wife the last two mornings, calling to remind me to submit my paperwork to fund the new checking account I established online two weeks ago.

She's not so thrilled with the bank, but I'm impressed with its tenacity.

Here is the scorecard of bank followup efforts:

• Email = 1 (about 2 weeks after application...almost missed it, thought it was a phish)
• Mail = 1 (technically not a reminder, it was the sig card and new account kit)
• Phone = 3 (first about 1 week after application, then number 2 and 3, about 2 weeks after application

It's an impressive follow-up effort. I've applied for a number of accounts over the years and I can recall receiving only one telephone call, from Salem Five back in 1995, and that wasn't even an application, just a sales lead. The last time I tried to start a checking account, with Washington Mutual, I never heard from them, not so much as a single email or letter thanking me for my application. As far as I know it's still sitting in limbo on some backup tape.

Sorry for the delay Citibank, I really do want that iPod, so I will be sending my $2500 deposit ASAP.

Action Item
If a company with as much experience as Citibank has found it to be profitable to make follow-up phone calls on unfunded new accounts, you should consider doing it as well. However, you may have more luck than Citi does using email followups. Citibank's brand in an email message is practically worthless these days after the pounding it's received from phishers.

--JB

Forget about toasters.

Citibank is handing out iPod minis to new online banking customers provided they fund their new checking accounts with at least $2500 and pay at least two bills per month for a year.

Analysis
This raises the ante for online account acquisition. It's a pricey premium, even for Citibank, which has long been aggressive at its website, giving away eye-catching premiums such as DVD players or $100 cash.

There is no doubt that giving away the ultra-hot iPod mini will drive new accounts. But it may be over the top for a checking account offer, even by Manhattan standards.

How many 20- and 30-somethings will game the system just to qualify for the iPod? An even bigger concern is existing customers closing their accounts and reopening online in order to pick up an iPod.

But Citi knows what it is doing, and they must figure the new accounts, along with the publicity, makes the risk worthwhile. It will be interesting to see what this book of accounts looks like a year or two from now.

We think most financial institutions, at least those outside the NYC metro area, should keep premiums in the $50 to $75 range. It's enough to generate interest and applications, but not enough to create a buzz at FatWallet with people virtually salivating at the prospect of picking up low-cost iPod at the expense of a huge bank.

Aside: Kudos to Citi for posting a link to the Red Cross for tsunami relief.

If you'd like to learn more about the financial interactive marketing efforts, check out the Interactive Financial Marketing Database from our sister publication, the Online Banking Report.

Wondering whether to improve your online account opening process? In a recent American Banker article, Citibank said that 10% of its new checking accounts are opened online, and that's before they streamlined the process making it paper free. Previously, customers had to mail or fax a form with their handwritten signature.

Citibank is offering $75 for customers who open a checking account online.

Fine print:
$1,500 minimum deposit
must initiate 2 bill payments within 60 days of account opening

If I hadn’t seen it with my own eyes, I wouldn’t have believed it. At BAI’s mid-November tech fest in New Orleans, Citibank’s Catherine Palmieri took the stage and challenged the audience to get moving with interbank, also known as account-to-account transfers (A2A). She said that 75% of its online transfers were inbound and that Citi was taking money away from the other big banks and brokerages, many of whom were in the room. Although they had not marketed the program yet, Palmieri reported “thousands” of users (she declined to be more specific).

I’m not sure what motivated Citi to hype its funds transfer prowess, except perhaps as a favor for partner CashEdge,¹ who’s CEO Sanjeev Dheer, co-presented with Palmieri. Later Dheer assured me that Citigroup has no financial stake in the privately-funded company. In fact, two Citi competitors, Royal Bank and CIBC, made equity investments in CashEdge earlier this year.

As far as I’m concerned, when you make $4.8 billion dollars in the prior quarter, as Citi did in Q3, you are entitled to make any boast you want. Certainly, the A2A program is strategically the right thing to do. But we wouldn’t put much stock in the 70% to 75% inbound percentage that Citibank and other CashEdge clients have experienced.² Since Citi has no fee for
standard (3-day ACH) inbound transfers, but charges $3 for standard outbound transfers, it’s not surprising that there is more inbound activity.³

If that pricing philosophy continues, the percentage of inbound to outbound transfers through web-based A2A will likely go higher. If Bank A and B both offer free inbound ACH transfers and charge for outbound, users will gravitate to the source of free transfers. For example, they will use A when transferring from B into A. But will use B when transferring from A into B. This doesn’t bode well for significant long-term incremental fee income, unless you can differentiate your service from others through ease-of-use, pricing, or trust (see Citibank icon).

¹Or perhaps to take the sting off the recently shuttered www.C2it.com  person-to-person transfer program, though Palmieri declined to comment on C2it.

²CashEdge says that across its entire client base, inbound volume is 70% of the total. But like Citibank, many financial institutions providing free in-bound transfers and charging for outgoing.

³Citi also offers a next-day transfer option priced at $3 for inbound and $10 for outbound, see Table 1, right.

Table 1

Citibank Interbank (A2A) Price Schedule

Source: Citibank, 12/8/03

Note: Cut-off times are: Standard: 1 am the following business day;
Next Day: 3 pm; therefore, between 3 pm and 1 am, both choices have similar delivery times, you might gain a day with Next Day.

1) Citibank plans to raise the limits as they get a better handle on
    overall risk and individual customer behavior

2) Not to exceed a total of $4,000 in daily volume across both services

3) Not to exceed a total of $10,000 in monthly volume across both services

Long-term, online interbank transferring is a zero-sum game, every transfer is a deposit gain for one financial institution and a loss for another. However, short-term there are real opportunities to gain deposit share through convenient Web-based transfers. ING Direct http://www.ingdirect.com/  could be a poster child for the service. The only way you can remove funds, and the easiest way to deposit money, is via interbank funds transfer. The lack of ATM or check access hasn’t deterred U.S. consumers from opening more than one million accounts with total deposits of $14.3 billion (as of
Sep. 30, 2003) at the Internet-only bank.             

At ING Direct (USA), interbank and intrabank transfers are handled from the same “Transfer Money” tab.

The fake Citibank email (below) fooled so many users that the bank took the unusual step of posting a warning on its home page (screenshot left). Last month, Absa Bank did the same thing, to educate customers about the keylogging security breach at the South African bank.

Fake Citibank email.
(Source: Bankers Online, 8/18/03)  www.bankersonline.com/operations/custserv_infosec.html

Using our live test accounts, we changed passwords then subsequently “forgot” the new one to test how major financial institutions handle the situation. Overall, most received good marks, although everyone has room for improvement.  

Table 1

Password Scorecard

Source: Online Banking Report, 4/03
*We believe users should have at least 5 login attempts, with clear instructions before and after lockout

Testing process

1. Login with existing username and password

2. Change password or username

3. Logout

4. Use online password reset if available

5. Attempt to log back in 10 times with an incorrect password

American Express

Password Scorecard

Grade: Needs improvement

Weaknesses:
(1) Browser AutoComplete function not disabled
(2) No email confirmation of password change
(3) Account lockout too quickly, after third login try

Password structure: User defined, 6 to 8 characters with at least 1 letter and 1 number

Username structure: 5 to 20 characters with
at least 1 letter

Second password/challenge: No

IE 6 AutoComplete disabled: No

Online password change: Yes, with old password

Email confirmation of password change/reset: No

Online password reset: Yes, with card number, 4-digit card ID (on face of card), work phone number, last 4 digits of soc, and 5-digit zip code

Account lockout with excessive login attempts: Yes, after third attempt; red warning issued after attempt two

Online username retrieval: Depends, certain accounts can retrieve their username online, others must call; we were in the latter group so could not test this feature

AutoComplete is not disabled on the login screen.

User friendly: American Express warns users after their second unsuccessful login that they will be locked out after one more attempt.

Password reset, step 1: Enter userid, card number, and 4-digit code from back.

Password reset, step 2:
Enter personal info for authentication.

Bank of America Credit Card

Password Scorecard

Grade: Good

Weakness: No email confirmation of password change

Username structure: User defined, 9 to 20 numbers

Password structure: 4 to 7 characters; cannot repeat 4 or more in same sequence as username; cannot be same character repeated

Second password/challenge: No

IE 6 AutoComplete disabled: Yes

Online password change: Yes, with old password

Online password reset: No, must call

Email confirmation of password change/reset: No

Account lockout with excessive login attempts:
Yes, after 4 attempts; help section carries clear warning

Online username retrieval: No

BofA provides a helpful popup screen with each unsuccessful password attempt.

Centura Bank

Password Scorecard

Grade: Fair

Weaknesses:
(1) No email confirmation of password change
(2) No warning of account lockout
(3) No customer service link or HELP available from login screen

Username structure: Social security number (with dashes)

Password structure: 6 to 15 characters

Second password/challenge: No

IE 6 AutoComplete disabled: Yes

Password change: Online with old password; but neglected to provide an on-screen confirmation that the change occurred, an annoying usability flaw

Online password reset: No, must call; password sent via postal mail

Email confirmation of password change/reset: No

Account lockout with excessive login attempts:
Yes, after sixth unsuccessful attempt; no prior warning

Online username retrieval: Unnecessary (SSN)

Centura had the best login screen “security look and feel.” It also provides a link to disclosures, but not a single mention of customer service or online help, even after making an unsuccessful login attempt. Evidently the bank’s lawyers have been through the site, but where’s customer service?

Charter One Bank

Password Scorecard

Grade: Needs improvement

Weaknesses:

(1) Browser AutoComplete not disabled

(2) No email confirmation of password change
(3) No warning prior to account lockout
(4) No message after account lockout

(5) A bit too easy to gain read-only account access for new users; requires account number and social security number. However there is a crucial safeguard for bill payment which requires mother’s maiden name, date of birth, home phone number, and a 2-day waiting period.

Username structure: Social security number

Password structure: Must be at least 6 characters

Second password/challenge: No

IE 6 AutoComplete disabled: No

Online password change: Yes, with old password

Online password reset: No, must call

Email confirmation of password change/reset: No

Account lockout with excessive login attempts:
Yes, not sure when it happens, sometime before the tenth attempt; the bank does not provide a warning of impending lockout, nor does it let you know after you’ve been locked out, you only receive a cryptic
error message.

Online username retrieval: Unnecessary (SSN)

AutoComplete has not been disabled
at account login.

New users enroll with social security number and account number. Note the excellent use of security graphics during enrollment.

Chase Bank

Password Scorecard

Grade: Good

Weaknesses:
(1) No email confirmation of password change
(2) No warning of upcoming account lockout
(3) No message after account lockout

Username structure: User defined, must include one number

Password structure: 6 to 10 characters, 1 of which must be a number

Second password/challenge: No

IE 6 AutoComplete disabled: Yes

Online password change: Yes, with old password

Online password reset: Yes, with name, account type, account number, social security number, and two user selected challenge questions

Email confirmation of password change/reset: No

Account lockout with excessive login attempts:
Yes, sometime during the first 10 attempts; no warning message and no indication when account is lockout out, a “try again” message just keeps repeating

Online username retrieval: Yes, displayed online after entering name, account type, account number, social security number

Chase is one of the few banks offering online retrieval of forgotten usernames. After correctly entering name, account number, and social security number, the username is displayed. At that point you can login if you know your password. If not, you can retrieve your password online by answering two previously selected challenge questions. This is great from a usability standpoint, but the bank should send a confirmation via email and/or snail mail.

To reset the password, users answer two
previously established challenge questions. 

DeepGreen Bank

Password Scorecard

Grade: Needs improvement

Weaknesses:

(1) Browser AutoComplete not disabled

(2) No email confirmation of password change

(3) No minimum password length, can be a single letter or the same as the username
(4) No warning before account lockout
(5) No message after account locked out

Username structure: User defined, can be all alpha

Password structure: 1 to 14 characters, can be the same as the username or a single character

Second password/challenge: No

IE 6 AutoComplete disabled: No

Online password change: Yes, with old password and mother’s maiden name

Online password reset: Yes, with social security number and mother’s maiden name

Email confirmation of password change/reset: No

Account lockout with excessive login attempts:
Yes, but not sure when because the lockout is not disclosed until the user attempts to login with correct username/password.

Online username retrieval: No, must call, then wait
7 to 10 days to receive in the mail

A common security vulnerability: Failure to disable IE 6’s AutoComplete function.

Everbank

Password Scorecard

Grade: Needs improvement

Weaknesses:
(1) AutoComplete not disabled
(2) No email confirmation of password reset, even though it can be reset with info available to an identity thief, SSN and mother’s maiden name
(3) No email or on-screen confirmation of p/w change
(4) No warning before account lockout
(5) No help on login screen for the memory challenged

Username structure: Initially set as social security # (with dashes); can be changed online one time; 8 to 24 characters, not similar to current username, not same as password, not offensive, at least 2 numbers and 2 alphas

Password structure: 8 to 16 characters with at least one number and one letter, not similar to username, not similar to prior password, not the same reading backward and forward

Second password/challenge: No

IE 6 AutoComplete disabled: No

Password change: Online with old password; no confirmation of the change provided on-screen

Email confirmation of password change/reset: No

Online password reset: No, must call; new temp password given over the phone after providing SSN, name, address, date of birth, and mother’s maiden name

Account lockout with excessive login attempts:
Yes, after fifth attempt, must call to reactivate; no warning prior to lockout

Online username retrieval: No, must call

Everbank provides no help at login for users that forget username or password, just a lengthy warning written by the lawyers.

First USA Credit Card (Bank One)

Password Scorecard

Grade: Fair

Weaknesses:
(1) No email confirmation of password/username change or reset; especially important given relative ease of resetting username/password
(2) No warning before account lockout

Username structure: User defined, 7 to 16 characters, case sensitive

Password structure: 7 to 32 characters, case sensitive,  must have at least 1 number, may not use the same letters consecutively, cannot match username or social security number.

Second password/challenge: No

IE 6 AutoComplete disabled: Yes

Online password change: Yes, with old password

Online username change: Yes, with old password

Online password reset: Yes, with credit card #, social security #, signature panel code, and expiration date

Online username reset: Yes, with credit card number, social security number, signature panel code, and expiration date

Email confirmation of password or username change/reset: No

Account lockout with excessive login attempts: Yes, locked out after four attempts, no warning given

First USA is the only financial institution tested which allowed usernames to be reset online; nice for usability but a confirmation of the reset should be emailed and/or mailed to the cardholder.

Harris Direct (brokerage)

Password Scorecard

Grade: Good

Weakness:
(1) No email confirmation of password change (thought there is for password reset)
(2) Only 3 login attempts allowed before lockout (but can reset online relatively painlessly)

Username structure: User defined, 6 to 15 characters

Password structure: 6 to 8 characters

Second password/challenge: No

IE 6 AutoComplete disabled: Yes

Online password change: Yes, with old password

Online password reset: Yes, a new disguised password is emailed after entering username and birth date; the new password is a created from the account holder’s mother maiden name and social security number but is not disclosed in the email, e.g. the first 2 letter of mother’s maiden name plus last 4 digits of social security number.

Email confirmation of password change: No

Email confirmation of password reset: Yes, confirmation also sent via snail mail

Account lockout with excessive login attempts:
Yes, after third attempt, but can be reset online; no warning before lockout

Online username retrieval: No, must call

HarrisDirect allows online reset after your account has been locked out for excessive login attempts. It was the only company which emails a disguised new password when resetting. For good measure, they also mail an identical confirmation.                    

ING Direct

Password Scorecard

Grade: Excellent

Username structure: Account number

Password structure: 4-digit number (called PIN)

Second password/challenge: Yes, one of 5 user-specified questions asked at login (see below)

IE 6 password remember disabled: Yes

Online password change: Yes, with old password

Email confirmation of password change: Yes; confirmation also sent via postal mail

Online password reset: No, must call

Account lockout with excessive login attempts:
No (not in the first 10 attempts)

Online username retrieval: Unnecessary (acct #)

ING Direct is the only bank we know of using a challenge question at login. In addition to account number and password, one of these five rotating questions must be answered correctly:

•  first 4 digits of social security number

•  zip code of mailing address (first 5 digits)

•  birth year (4 digit)

•  last 3 digits of social security number

•  last 4 digits of social security number

We like the concept, but the implementation is weak. By simply refreshing the browser screen, the would-be thief can select which question to answer, one of which is zip code, which is trivial to ascertain. 

PayPal

Password Scorecard

Grade: Fair

Weakness:
(1) AutoComplete not disabled on the password reset screen (it is disabled on login page)
(2) Username (email address) known to others

Username structure: Email address

Password structure: 8 to 24 characters case sensitive; recommended, but not required that it include upper and lowercase and at least one number or special character

Second password/challenge: No

IE 6 AutoComplete disabled: Varies; yes, on main login screen, no on password reset screen

Online password change: Yes, with old password

Online password reset: Yes, via email; must answer secret question via email link; if unable to access original email account the new password is sent via snail mail

Email confirmation of password change/reset: Yes

Account lockout with excessive login attempts:
Yes, after 10 unsuccessful attempts; a lockout warning appears after the seventh attempt

Online username retrieval: Not necessary since username is equal to email address

PayPal is one of the few financial companies using cookies to automatically insert usernames at login. The company has used this approach since inception, so they must feel that the improved usability more than compensates for the decrease in security.

PayPal’s online password reset process requires the user to have access to the email account registered with the service. If not, users answer one of four authentication questions (top screen) and the password is mailed to a one of the previously confirmed snail mail address (bottom screen).

PayPal explains after the seventh incorrect password attempt that you have 3 more tries before lockout. This is a far more reasonable approach than many banks’ three-strikes-and-you-are-out policy.

Schwab

Password Scorecard

Grade: Fair

Weaknesses:
(1) No email confirmation of password change
(2) Account lockout too quickly, after 3 login attempts, but can be reset relatively easily online

Username structure: Account number or social security number

Password structure: 6 to 8 characters including at least one number BETWEEN the first and last characters; cannot match or be a subset of username

Second password/challenge: No

IE 6 AutoComplete disabled: Yes

Online password change: Yes, with old password

Online password reset: Yes, in one of two ways;
(a) If logging in with account number, you must provide social security number, date of birth, home phone number, and correctly pick a security in your account from a list of 10 choices including “none of the above”
(b) If logging in with a social security number, you must only provide the answer to the secret question.

Can also reset via automated phone system.

Email confirmation of password change/reset: No

Account lockout with excessive login attempts:
Yes, after 3 attempts; no warning prior to lockout

Online username retrieval: Not necessary (acct. # or soc. #)

Schwab’s unique password reset process requires the usual social security #, birth date, and telephone, plus users must correctly choose one of ten securities in the portfolio (including “none of the above”).          

US Bank

Password Scorecard

Grade: Good

Weakness: No email confirmation of password change

Username structure: User defined, 8 to 24 characters

Password structure: 8 to 24 characters

Second password/challenge: No

IE AutoComplete disabled: Yes

Online password change: Yes, with old password

Online password reset: Yes, with ATM card number and ATM PIN; new password displayed online

Email confirmation of password change/reset: No

Account lockout with excessive login attempts:
Yes, after 6 attempts; can reset online or wait 24 hours; no prior warning

Online username retrieval: No, must call

Password change screen. Note the prominent placement of what happens next.

Forgotten password can be reset online with
ATM card number and PIN.

Wells Fargo

Password Scorecard

Grade: Good

Weaknesses:
(1) No email confirmation of password change
(2) Account lockout too soon, after 3rd login try

Username structure: Social security number

Password structure: 5 to 8 characters

Second password/challenge: No

IE 6 AutoComplete disabled: Yes

Online password change: Yes, with old password

Online password reset: Yes, with statement account number and ATM PIN; those without an ATM PIN are directed to call customer service.

Email confirmation of password change/reset: No

Account lockout with excessive login attempts:
Yes, after 3 attempts; user redirected to online password reset page; no prior warning

Online username retrieval: Unnecessary (SSN)

Wells offers six options for where to go
immediately after login.

After three unsuccessful login attempts users are directed to reset their password, which can be done online with account number and PIN.    

Citibank has one of the richest online promotions going. New regular checking customers earn a 1-year free subscription to The Wall Street Journal (normally $175) with a $2,500 deposit and after making two online bill payments within 60 days. The offer expires
Dec. 31, 2002. The bill payment requirement is an interesting twist that provides a double benefit: it motivates customers to start using their new account and it cuts down on those just signing up for the freebie.

Consider a similar promotion with your local daily. It makes a valuable premium and you may be able to negotiate free print advertising as well. Most periodical publishers are facing revenue shortfalls in both advertising sales and paid subscribers. A bank giveaway could be well received and well promoted.