Security holes in Internet Banking and other issues SB doesn't care about

This is a copy of an email sent to SB a week ago, which has received zero reponse. The only thing that has changed is an SMS claiming one of the calls has been resolved and I would be contacted regarding it. The call has not been resolved, nor have I been contacted. ---- First off, my internet banking profile stopped working about a week after the new card was issued (Ref ********** 502), because the password “expired”. According to the consultant I spoke with (Lindiwe), this is not unusual (in which case, I should have been informed at the time the replacement card was issued), and that it was a result of the consultant issuing the card not registering the new card against my internet banking profile properly. These reasons, I might add, appear mutually exclusive – either it’s normal for the password to expire or it was a result of an improperly-loaded profile.

In any event, attempts to reset the password via the password reset screen proved fruitless, as none of my new passwords was accepted, despite meeting the requirements (no errors, or reasons for failure provided), AND THERE IS NO WAY TO EXIT THE SCREEN AND CLOSE THE INTERNET BANKING SESSION. There is a Next button (which doesn’t work if the system doesn’t like the new password), and that is it. There is no exit button, no cancel button, no logout button – nothing. The only way to exit is to close the tab, which is a security risk, as it does not necessarily immediately cancel the internet banking session. I have raised this directly with the internet banking security team, together with the fact that the security certificate on the server used to register new cards for internet banking expired more than three months ago (which has finally been fixed as of this morning, but doesn’t answer the question regarding how Standard Bank permitted a “secure” server to operate without one for more than three months, thereby rendering it insecure).

Clicking the Help button returns this: [screenshot of page saying "This feature is currently unavailable"]

As a result of being unable to assist, and my refusing to send my account details and ATM pin over an OPEN, UNSECURED internet connection, Lindiwe escalated the call to the technical team, who were obliged to respond by 28/8. This effectively meant I was locked out of internet banking for two weeks.

The response from Standard Bank has been beyond pathetic (email attached with substandard response to complaint ref ********** 721). The consultant clearly didn’t understand the issue, nor my response that the issue wasn’t about replacing the card, and couldn’t care less about providing any assistance that isn’t in his script. Incidentally, I have had absolutely no response from Standard Bank since the 25th; this call has also vanished into a black hole, never to be seen again. As far as Standard Bank seems to be concerned, the fact that a client is effectively locked out of internet banking for almost a month, due to a series of errors on the bank’s side, is no cause for concern. As a paying customer, I have an issue with that.

Fortunately, over the course of several attempts, I was finally able to reset my internet banking password, with absolutely no thanks due to Standard Bank staff. The issue, it turns out, is that the password is required to contain a minimum of SEVEN characters, not six as stated on the password reset screen.

I became aware of the next related issue when I checked my statement, and noticed my account was debited for a “pin reset” on the new card. Since the only pin reset that occurred was when the new card was activated, I am extremely annoyed about this.

I have logged a complaint (ref ********** 289) since the consultant (Octavia), while very helpful, was apparently unable to reverse the charge. The debit is clearly yet another example of the whole process around issuing replacement cards not having been communicated properly to staff, and insufficient training on how to actually execute the process. The person that assisted me had to register my card twice as a result of not doing it properly the first time, and then had to call a supervisor to assist with the internet banking registration as there are multiple accounts associated with the card.

This really isn’t good enough. Why should your customers bear the brunt of poorly thought-out, badly communicated and insufficiently trained processes? Not to mention being charged for the inconvenience.

In summary (because I understand this is a very long email with several points raised):

• The card replacement process is not well understood by anybody o There are conflicting messages regarding charges associated with the replacement o There are conflicting messages regarding what information is required in order to get a replacement card o There is still no information on Standard Bank’s website regarding this process, anywhere! o Cards with multiple accounts associated with them seem to be problematic, insofar as registering them and the associated internet banking profile is concerned o The customer is never informed that the associated internet banking password will suddenly expire without warning o The customer is not informed that there is a charge associated with creating the PIN required to actually use the card (which is ********* business practice, in my opinion, as without a PIN the customer cannot use the card, internet banking or cellphone banking) • The password reset screen: o creates a security risk as a result of not being able to log out of the internet banking session o offers no errors or explanation when a new password is rejected o contains incorrect information regarding minimum security requirements for new passwords. The minimum length is seven characters, not six. • Consultants do not seem to consider it a problem that registering a new card required ****il this morning) a customer to send account information and an ATM pin TOGETHER across an entirely unsecured connection • Standard Bank does not consider it an issue when a client is unable to access internet banking for almost a month • Support staff consider a case closed when it doesn’t meet the requirements of their script, because they didn’t bother trying to address the actual issue logged instead of what seemed the easiest option • Support staff consider it acceptable not to respond to a client for more than a week on an open ticket • There is no published process by means of which a client can escalate an outstanding call, beyond spending far too long on the telephone with yet another agent that doesn’t understand the problem.

I expect to see the following: • Reversal of the pin reset charge on my account. • An appropriate response from a senior team member regarding the complete disinterest shown by Jeff in resolving the issue as logged. The fact that I solved it myself is entirely beside the point – this was several days after I last heard from anybody regarding the ticket. • A suitable means of exiting the password reset screen safely, whether in the form of a back, cancel or logout link. • Correct information on the password reset screen regarding minimum password requirements.

I expect the following to happen, although it will be invisible to me: • A review of the certificate renewal process that allowed a key secure banking server to operate without a valid certificate for more than three months. • Updated training of support staff on security issues, including why it is a bad idea to send account information and associate PINs together across unsecured connections. • A review of the card replacement process, including training and supporting information made available to support staff on social media and in the branches; this to include issuing and linking cards with multiple accounts associated with them, and any information the client should know, such as associated charges or suddenly-expiring passwords. • A review of the internal escalation process regarding tickets that are not adequately dealt with by support staff. • A random review of closed tickets to ensure the client consented to their closure, rather than their simply being closed to make numbers look good. This is in the interests of retaining your customers, because trust me, even though I’ve been a Standard Bank customer for 35 years, I’m not the only one actively investigating the offerings of other banks as a direct result of Standard Bank’s shocking service.