What security factors should I take into consideration when selecting a bank?

Question

I've gotten fed up with my bank and have made the decision to move all of my banking elsewhere. This is a rare occurrence for me and, I suspect, for other people as well. It represents an opportunity to optimize and carefully select the best bank instead of just picking the one around the corner like I did the first time round.

One factor which I put a high weight on is the security of my bank, but I'm not a security expert. I have my own views on which factors are important, but I suspect that some (or all) of them are wrong.

Thus: What security factors are important when selecting a bank?

To get things started, my guess is that I should look for include:

• Multifactor authentication
• Authentication which does not enforce low maximum levels of security (e.g. you must use your mother's maiden name for identification over the phone).
• Quick (preferably instantaneous) changes when I chose to update my authentication data (i.e. no 3-business day delays for password changes).

though there are more I can think of...

Answer 1

One of the things I would look at is what the bank says about their security. That doesn't mean they are actually doing anything about it, but if they are talking about it at least they know it is important to their customers.

I would research the security accreditations that the bank has, and the level of certification of its it staff if the information is available. I would also research customer feedback as to how their response to security incidents has been, as it isn't just about standards, but how well it is managed.

Answer 2

If you want a secure account look at yourself not the bank. Banks rely on insurance to secure deposits, their security is there to keep the premiums low and the insurance will take care of anything that gets past.

However if someone gets into your account via identity theft then the insurance will not cover the stolen funds. Therefore if you want a secure account you should detach it from yourself as much as possible.

You can use a few techniques to separate yourself from this account:

• Don't carry a cash card for the account (and definately not a contactless one) - It's much more likely your card will be skimmed than your bank will be broken into by a l33t hacker
• Opt out of paper statements - Can't forget to shred what you don't have
• Route pay slips and bills to another account and pass through funds with direct debit - This way the accounts that hold most of your funds will not appear on other systems or on related paper work.

Answer 3

Summary: Go with a big bank with a good password policy. MFA is a huge plus, but I wouldn't go to a small bank ever.

Unfortunately if you are in the US, MFA is not very prevalent in the banking industry (at least for large banks). If you can find it, I would look there. And if you find that in a big bank (top 10), please let me know. =)

Having worked for a large bank doing IT Security, I am biased, so I will not suggest a particular bank. However, I don't feel like the size of a company's IT Security groups are honestly and widely announced. I know that the banks with which I am familiar didn't announce their group sizes, and grossly over-embellished their available skill sets. I had to become intimately familiar with their organizations and have a relationship with an employee before having unfettered information about their security posture.

There are some banks which have truly good security. They are the big banks, period. Little banks may try but there are two issues. First, they don't have the money or the skill to implement security well. Second, if they have better rates than a bigger bank, it is because they are slimming their margins to unreasonable and unsustainable profits, and therefore skimping on things like security.