I’m a customer of a little company called CountryWide Financial, a holding company of various financial and banking services, including insurance, mortgage, commercial loans and capital markets. Actually, they’re one of the largest financial companies in America, with many thousands of customers who trust them to safeguard personal data. Like many financial companies, CountryWide frequently changes and upgrades its security policy for handling online transactions. But the latest upgrade ensures that I will never use the CountryWide site again to handle transactions, and it’s an issue that has enormous impact for marketers who are charged with safeguarding customer relationships and brand image, if not directly responsible for customer data.
When I recently went to the CountryWide site to carry out a transaction, they stopped me at the door and introduced a new security policy. It started out in an intriguing new direction. To safeguard against phishing—situations in which an imposter hosts a lookalike site and lures customers to enter personal data which can be used to access and pillage the real account—CountryWide has instituted a personalized authentication image and statement. The idea is that the customer chooses a random image—say a tractor, or a telephone, or a leaf—and enters a random site ID phrase of their own choosing, such as “Holy Retinal Scanner, Batman!” Whenever the customer returns to the CountryWide site, they can authenticate that it is indeed CountryWide by the presence of their secret personal image and phrase. Very cool. I haven’t personally seen this concept before, and it’s kind of a cool idea. Great.
So I continue on to the next stage of the new security protocol, where I’m prompted to select a series of security questions, and to provide responses, which will be used to authenticate me in the future. Nothing really new here—how many times have I entered the name of my pet or my mother’s maiden name. But as I started to look through the security questions, it started feeling a little creepy. These weren’t the standard security questions, but an entirely new breed of questions that have some scary implications.
- What is your best friend’s first name?
- What was the name of the maid of honor at your wedding?
- What is the first name of your oldest nephew?
- What was the name of your first boyfriend/girlfriend?
- Where did you first meet your spouse?
- What is the nickname of your grandfather?
And on they go. Now I should point out that you can choose from these questions, and others a little less probing, like the name or city of your high school. But you must choose three questions, and these kinds of really personal and unique questions are prevalent. As I started to fill out one of these questions, thinking “gee, this is really specific”, I suddenly got a cold premonition. Wait a minute. I realize these are questions designed to safeguard my identity and personal data, but these companies have a really nasty habit of losing this kind of data, not to mention shifting privacy rules in ways that seem to make more and more data available for purposes I didn’t want. Not only are major breeches of customer data common, they include outrageous breeches by many of the most trusted financial institutions, including Bank of America, Citibank, Wachovia, FDIC, JP Morgan Chase—the list is literally too long to recite. And yes, CountryWide is not immune to its own security breaches.
I cannot imagine a more disturbing recipe for truly frightening levels of identity theft, than a database of information so personal and specific, that it could be used to impersonate you with a frightening level of authenticity. There are already plenty of instances of brazen identity theft, in which the perpetrators have gone as far as full-blown impersonation of their victim. Remember Frank Abagnale, the real life subject of Catch Me if You Can? What’s particularly disturbing is that the kinds of questions CountryWide is asking are not just specific and personal, many of them are permanent. Timeless. The name of your first girlfriend, where you met your spouse, will never change. Once that personal information is lost, you’ll never get a chance to recover it.
So while I applaud CountryWide for improving their security policy, and even taking creative steps to do so, I think these new measures of gathering personal information are disturbingly misguided for consumers. For many thousands of consumers, their first experience of security breach is when the institutions they trust lose their personal data through negligent loss or theft. In that regard, the first step in protecting your identity is safeguarding yourself from the probing questions of your service providers. And the marketers who manage the brands for companies like CountryWide should understand this fact better than their customers, since the backlash of losing such valuable data is far more costly than the value in collecting it.