Banks on Facebook? Operational Risks, Operational Rewards
Sharing personal news and information on websites like Facebook may seem like innocent fun – but to identity thieves, it’s a gold mine. The popular social networking platform, which now has more than 50 million active members worldwide, has already gained a reputation for turning grownups into teenagers. Otherwise sensible adults can frequently be found engaging in virtual public food fights, ‘poking’ each other, and drawing graffiti on each other’s ‘wall’.
But in the course of these seemingly innocent games, Facebook users may accidentally reveal information about themselves that is of valuable interest to identity thieves. Facebook profiles often provide more than enough personal information to allow fraudsters to steal identities and establish fraudulent bank accounts. People regularly publish their name, address, email address, date of birth, phone number and relationship status here and on other social networking platforms.
Pets’ and partners’ names are frequently revealed too, providing identity thieves with a rich seam of the kind of information that banks commonly use during security checks, and that people commonly use as passwords. A 2007 survey conducted by ICM for Getsafeonline, for example, revealed that 42% of UK adults use the same two or three passwords for most online activities, with 13% using a relative or partner’s name as a password, and 10% using a pet’s name.
With 10.8 million UK residents now active on Facebook alone, customer indiscretion on social networking sites is starting to pose a valid operational risk to the banks where users hold their accounts. The Basel II Capital Accord defines operational risk as “the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events.” Identity fraud arising from social networking sites could well be classed as an ‘external event’, while failure on the part of banks to strengthen security procedures in light of the heightened risk could be viewed by regulators as an example of ‘inadequate or failed processes’.
In fact, regulators are starting to recognise the increased risk of identity theft and subsequent fraud via social networking platforms, and to demand that banks tighten their security processes accordingly. On 9 November this year, the US Federal Reserve and a number of other federal agencies mandated that all US banks with consumer accounts must implement an identity theft prevention programme by 1 November 2008.
It is clear that banks need to understand the world of online social networking in order to be aware of the risks it presents to their business. To date, however, banks have taken a somewhat head-in-the-sand approach to social networking, and to Facebook in particular. On 1 August this year, Investment News reported that several global investment banks had banned employees from accessing it at work, citing productivity reasons. But by taking this approach, the banks might actually be cutting off a very useful information source. Not only do they need to be aware of potential identity theft and phishing activities, but the networking and information sharing possibilities of this kind of site can also be very useful to all kinds of people working in the finance sector, including marketers, recruiters, compliance professionals and staff who are required to observe anti-money laundering (AML) and know your customer (KYC) regulations.
Banks including First Direct, Prudential and Halifax were initially quick to place ads on Facebook, but later withdrew them when they realised that they had appeared on pages promoting the British National Party. Perhaps because of this early finger-burning experience, banks have since been slow to exploit Facebook’s marketing and advertising opportunities, which have become rapidly more extensive and sophisticated.
A notable exception is Canadian bank TD Canada Trust, which has developed a Facebook group to help students manage their money, which at the same time functions as a promotional tool for the bank. “TD MoneyLounge was created to give students a place to talk about money. It also gives TD Canada Trust an opportunity to connect with students in their own space to better understand what they need and want from their bank,” the bank says on its group page. At the time of writing, TD MoneyLounge had attracted 11,769 members, representing a captive audience for the bank’s products and promotions and demonstrating the marketing potential of the Facebook platform.
While TD Canada Trust is one of a handful of banks currently exploiting the marketing opportunities on Facebook, even fewer appear to be using it for recruitment purposes. Over time, I think we will see banks using Facebook as a tool to attract and vet potential candidates, by setting up recruitment pages and encouraging existing employees to act as online ambassadors for the bank. Despite the site’s massive user base of recent graduates and job-changers, however, there’s no evidence yet of UK banks setting up their own recruitment operations within Facebook, although some recruitment agencies have tentatively started to set up shop there.
With the wealth of personal information now being made public online, I would not be surprised if before long we see financial institutions actively mining Facebook for AML, identity resolution, and KYC purposes. However, banks should be careful not to over-rely on this approach. The information provided on Facebook is not guaranteed to be accurate, many people appear under assumed names, and people listed as ‘friends’ may not actually be known to the owner of the profile in real life. Blacklisting an innocent person for appearing to be someone’s associate on Facebook may have all kinds of unpleasant repercussions – both for the bank and for the person involved. For AML purposes especially, official watch lists remain far more reliable than social networking sites.
Social networking platforms like Facebook are emerging, evolving and diversifying at such speed that individuals and companies alike are finding it difficult to keep pace with the change. But one thing is for certain: with millions of people now becoming used to a world where even the most personal information is freely available online, banks and their customers can no longer afford to ignore the risks and opportunities that social networking brings.