Data Needed to Verify New Internet Banking Users

Answered by:

Question:

For security purposes what minimum requirements should be set to establish an Internet home banking account relationship over the Internet, i.e. should we require the individual to input their account number, Social Security Number, date of birth, mothers maiden name, or what other info at a minimum, to establish the account? Is there any regulatory guidance on this?

Answer:

Regulators don't like the use of the social security number as a primary ID for enrolling customers in home banking or anything else. It's simply too easy to obtain someone's SSN. You need to try different combinations of ideas. One might be to send an access code via mail to the address on your files. Another would be to require that signup for internet banking be done in person at a branch (might not be workable for your bank). A third would be to put the application in "pending" until someone from the bank can call the individual and verify identity on the telephone using information from the bank's records that wouldn't readily be available to a identity thief. Of course, the telephone number used would be the one in the bank's records or in the telephone directory, not the one that might appear in the request.

First published on BankersOnline.com 11/15/04