What Canadian Banks Are Doing That U.S. Banks Should Be

An article recently appeared in the Vancouver Sun regarding Canadian banks’ attempts at protecting their clients’ information (http://www.canada.com/vancouversun/news/westcoastnews/story.html?id=0130fa57-d25d-42e8-833b-b8069acb3cca&p=2). Since we talked about using multiple layers of protection in class, it seemed to be an appropriate topic. We’ve all heard about the countless scams directed at bank customers, several of which have involved the Notre Dame Credit Union, but this what is known as zero-day attacks are becoming more popular strategies. In these information security attacks, the attackers utilize the information gained within twenty-four hours. As a result, victims of these attacks have an extremely small window in which they can resolve the problem without facing some damage.

With the ever increasing number of clients making transactions online, Canadian Banks are taking greater precautions to protect the sensitive financial and personal information of their clients. In 2006, CIBC, TD Bank, BMO Bank of Montreal, Scotiabank, and RBC Royal Bank, the largest banks in Canada, spent about $4.4 billion dollars on information security. The large amount of investment these banks are making on protecting their clients’ information is predictive of the numerous layers of security used including improved sign-ins, firewalls, and encryption. An enhanced sign-in method has been developed that requires the user to not only enter the typical member number and password, but also includes customized phrases and personalized graphics which serves a dual purpose. Not only can the bank verify that the customer is who they claim to be, but it also allows the customer to verify that they are on a valid website, not a fraudulent one. In addition, most of these banks use multiple firewalls to strengthen the security. Finally, 128-bit encryption is becoming more widely used in order to protect data as it travels between the clients and the bank as well as within the bank. This results from the use of SSL (Secure Sockets Layer) which verifies that the server is that of the bank. Some banks such as BMO are putting more emphasis on signing-in. When managing their bank account, most people consistently use the same computer, so when a customer uses a different computer than usual, they are asked additional security questions to verify their identity.

In addition to the precautions that the banks are taking, they also warn their customers about protecting themselves. Banks stress that they will never ask their customers for things such as a password since they already have the information. Clients should also make sure that a sight is valid by verifying the SSL certificate. This is a good way to avoid Phishing attacks as well as searching for the bank’s URL instead following a link sent in an email.

Protecting the confidentiality of sensitive financial and personal information is becoming a major concern. Knowing that some banks are taking greater cautions to protect our information breeds confidence in those banks, but what about all the others? It makes me wonder why they are not taking the same measures to protect their clients. According to another article in The Business Journal, the U.S. Government has established laws that will require banks to protect their costumers from identity theft. However, a study found that only a third of banks meet these standards. One can only hope the government will enforce these laws and protect our valuable information. It may be difficult to find a balance between protecting clients’ information and maintaining online banking as a convenient way to making transactions, but I think most people would be willing to have to go through a few additional security measures if it meant they could be more confident in the confidentiality of their information.