Banking security

The banks care a lot about security.  Their security.  Not necessarily your security.

News flash people: when there is a situation where somebody will lose money, and the options are that the bank will lose money or you will lose money, the banks make very sure that they do not lose money.  They also ensure that their security is protected even then when that interferes with providing customer service. 

Interviewer: We're here with a farmer to talk about banking!  Farmer, what does service mean to you?

Farmer: Service?  Well that's what the bull does to the cow.

Interviewer: And that's what banking is all about!  Servicing the customer!

(Okay, it's an old joke.  But I'm an old security maven.)

The girls wanted to settle up by sending an e-transfer.  I had no objection to trying it out.  I had even sent an e-transfer in payment of a bill sometime earlier.  For not too terribly large amounts of money, the security, while pretty rudimentary, does seem to be reasonably adequate.  I do note that most people are still choosing pretty stupid passwords to protect the transfer.

So, they sent the e-transfer.  I received the email.  I opened the email.  I clicked on the "Deposit your money" button.  I chose my bank from the list available.  It opened up a screen with my banking information and my accounts.  And then ... nothing.  No option to deposit.  No instructions.  So I clicked on the transfers button on the  bank's menu.  It told me I could send money.  It told me how to request money from somebody.  It didn't provide any options to deposit the money that had opened this screen in the first place.  I clicked on an account to see if that would transfer the money.  Nope.

So I went to the bank.  I figured that it would be easy enough for them to show me how this was supposed to work.  And immediately ran into a problem.  It was easy, they said.  I just had to open the app.  Thing is, I don't do any banking on my phone.  Smartphones are the least secure platform for doing online banking.  That pretty much stymied them.

I talked to the assistant manager.  We talked about using a computer to do e-transfers.  He didn't know how it worked either.  I figured that I could show him using my email, my e-transfer, and my bank account.  Second problem.  The bank's security policy, which they probably explain on the basis of preventing infection from malware, but which is probably in reality preventing bank employees from doing non-work stuff on work time and work computers, is that bank employees cannot access their own email.  In order to enforce this policy, sites like Gmail, Outlook, Yahoo, and others, are blocked by the bank's firewall.  So, no, it is not possible to demonstrate what is happening, or what I am seeing, in regard to the e-transfer that I'm trying to do.

So, the assistant manager spent 40 minutes on the phone with Scotiabank's technical support.  (I'm glad that I wasn't the one spending 40 minutes on the phone with Scotiabank's technical support.)  He described to them everything I had told him, and, in the end, they said that this was a known problem, had affected at least 6,000 customers, and they hope they would have it fixed by Tuesday.

So we waited.  And, after the stated time, I tried again.  With exactly the same result.  Open the email.  Click the button.  Select the bank.  My banking information displays.  And there is absolutely no option to deposit the money.

So I went back to the bank.  Today, neither the manager, nor the assistant manager, nor the cashier supervisor, was available.  Another bank employee did offer to give me all of five minutes to try and address my problem.  Knowing that the bank's computers were of no use, I had brought my own.  However, this Scotiabank does not provide wifi.  So there's no way to connect to the internet and demonstrate any of this.

By this time I was not only enraged by yet another example of poor design and policy on the part of the bank, but I was into full systems analyst mode.  I tried three more browsers.  Choice of browser didn't make any difference.  I poked and prodded at various options.  To no avail.  Then I recalled what somebody had said about, "usually it asks for your password."  So I made sure that I was completely signed out of any windows looking at the bank account.  And, voila!  That was it.  The transfer won't happen, at least on Scotiabank, if you are signed on to the bank at the time you try it out.  It does nothing.  It doesn't give you an error message, it doesn't attempt anything, it doesn't explain that it needs to sign on for any reason, it just does nothing.

So, yes, e-transfers do work.  If you do it exactly the way the bank expects it to be done.  If you are trying to keep an eye on things, and see if, in fact, money does go into your account, you're out of luck.

I'm really not too thrilled with Scotiabank right now.  Not only are their e-transfers rather bizarre, but they've lost me some money recently.  In addition, their provision of information for my accounts is lacking, to say the very least.  Their Momentum savings account, for example, displays in a way that makes no logical or accounting sense.  I've been having to do some transfers of money and I have just spent about an hour doing hand calculations proving to myself that, yes, the total amounts are still there, in various parts, of various accounts.  See it all at once?  Well, maybe.  And sometimes, maybe not.  It probably depends on the phases of the moon.

I'm going to send the bank the bill for my pantoprazole.