A recent article on Forbes.com discusses a number of online bank account fraud anecdotes, and assesses the various ways the victims’ banks could have avoided the near catastrophic incidents simply by upgrading their online security systems. The article got us thinking about the best types of online account security offered by the Bank Monitor firms we track. It seems that although many firms offer basic online account verification features, like log-in security questions, images and codes, only a few take security to the next level when it comes to actual account navigation and individual online transactions.

Citibank offers perhaps the most in-depth online account protection, allowing customers to opt to be prompted for their ATM PIN before making any type of online transaction. Chase offers a somewhat similar feature, requiring clients to enter a one-time activation code when adding wire recipients, and also when account holders are logging in from an unrecognized computer. While U.S. Bank does not offer any special security codes, it provides a unique sound verification option in addition to the standard log-in security question requirements and image verification feature. U.S. Bank also requires clients to answer a security question each time they visit any page within the private site Security Center.

According to a statistic offered by Javelin Strategy & Research in the Forbes.com article, less than a tenth of banks call or text clients to confirm online transactions outside of email or private site message alerts. We find this statistic generally holds true across most Bank Monitor firms. To our knowledge, none of the firms we track actually call customers to confirm online activity. However, while no firms have called us, we were recently prompted to call Citibank for identity verification after initiating an internal transfer on the private site. The Citibank CSR we spoke with claimed that identity verification is done at random, and assured us that we would not have to call customer service every time we want to make an online transfer. Whether or not we will have to call Citibank for identity confirmation in the future, we were both annoyed by the transaction disruption and impressed by the firm’s quest to ensure we were the true account holder.

Out of the four Bank Monitor firms that offer SMS message alerts, only Chase will text clients for online activity-related purposes. Furthermore, Chase will still only text clients when a payee has been added online - not to confirm actual online transactions. Although some firms definitely offer more advanced online account protection than others, it is certain that all of the firms we track could boost their current online account security with either one-time codes, tighter security requirements to access sections of the private site or online transaction-related SMS alerts.

Clearly, this is an area that could use some improvement.

If you would like more information on our services, please click here.