Should a bank/financial service use external URL shortener services?

Question

Say there is a bank/financial service that wants to have hyperlinks on their secure website/domain (or even in emails they send out to customers). In some of these links there are some long/obscure URLs which link to one of their subdomains, but the long links are ugly and not very user friendly, so they want to have shorter, nicer links to put on the website or email.

• What are the risks for a bank/financial service using an external URL shortener service, e.g. Bitly, for this?
• Is it better for a bank/financial service to host this sort of short link to long link translation service on their own domain and infrastructure?

Answer 1

In some of these links there are some long/obscure URLs which link to one of their subdomains, but the long links are ugly and not very user friendly, so they want to have shorter, nicer links to put on the website or email.

Users generally don't have to type any URLs anymore since at least a few decades. In fact, if you have a look at this link, you'll see it is really long and yet you don't need to type any of it. Generally, URL shorteners are only useful if you have to transmit a URL via a medium that doesn't support hyperlinks, such as printing it on paper. And even there, QR codes are slowly getting implemented more and more to solve this exact problem.

What are the risks of using an external service to do this?

^{Source: Randall Munroe, xkcd/1698, licensed under CC-BY-NC 2.5}

By using URL shorteners, you promise that this URL will link to a trustworthy source. As long as your URL shortener of choice works and remains trustworthy, this works. However, once some time passes, that URL shortener may go out of business, and that domain will go up for sale once again. From that point on, you can't guarantee anymore if those old URLs will work (they probably won't), or what will happen if users visit them. Remember, that in the eyes of a user, this link came from you, so they will trust anything on that site to be from you - even though it might not be.

Has this happened in practice? Yes. In Windows XP, the Windows Media Player does not come with the required license to play DRM protected WMV files. Luckily for the user, Windows Media player has the URL to get the license hard-coded. Unluckily for the user, that URL does not longer point to Microsoft, but rather to a distributor for malware. Any user that still uses Windows XP and wishes to play a DRM-protected WMV file, will be redirected to malware by the built-in media player of their OS, only because of URL shorteners.

A better solution

If you distribute links only digitally, it does not matter how long URLs are. Users just click on the button and that is it. If you really need to distribute URLs in a format that is non-clickable, such as TV advertisements or print media, make your own URL shortener. If ACME Corp. offers a new product called the "Ultra-Gigatron 9001", then make the URL ac.me/ug9001. If that doesn't work, make it acme.com/ug9001. Subdomains are free, and so are path names. Just be aware that that URL needs to be up as long as you expect people to type it.

Answer 2

Is it better for a bank/financial service to host this sort of short link to long link translation service on their own domain and infrastructure?

I think the question contains the answer. For me, the answer is a resounding yes. A URL shortener should use a domain name that is owned and controlled by the 'bank'. The stakes are too high here.

In addition to the very complete answer by MechMK1, we have to keep in mind that any legitimate service, before it even goes out of business, can also get hacked (and quite likely, will be hacked), especially when it provides a springboard to a juicy target.

Consumers have been taught to be wary of phishing, and if the bank dismisses that advice by using an URL that clients are not familiar with, they will sow mistrust and confusion. You could even expect that a number of clients will report the mail as a possible spoof. Customer support is supposed to be busy enough and should not have to deal with self-inflicted problems.

To sum up, if they want a shortener it's probably not going to be as short as t.co, but could be short enough for the purpose (eg avoid line break in E-mail). If they really insist they could buy a short domain name in .com or some country code extension, but that is still not a good idea. Because anybody can buy a domain name and fake whois data. The whois data in itself does not prove that the bank indeed owns and controls the domain name. The point is, you should have a coherent and somewhat predictable brand and naming strategy. That means, stick to the domain names that are already known and trusted by your client base.

Say there is a bank/financial service that wants to have hyperlinks on their secure website/domain (or even in emails they send out to customers). In some of these links there are some long/obscure URLs which link to one of their subdomains, but the long links are ugly and not very user friendly, so they want to have shorter, nicer links to put on the website or email.

We have different use cases here. For websites, using descriptive URLs is something normal, and is usually for SEO reasons. If some URLs are too long, rewrite them or alias them. For example, try to have no more than 3 keywords in the URL and choose the most relevant. A shortener is not the answer here. But you can have subdomains.

For advertising, short names are indeed essential if consumers are going to type them. But they have to be memorable too. Shorter is not always better: www.thebank.com/invest is still more memorable than t.co/Ba21dQ22. But that's why we have QR codes: to relieve people from typing URLs.

In fact, if the 'bank' is already using subdomains, they could assign one just for redirects. And then add a short parameter in the query string like a number.

For E-mails, you don't want long URLs because they can be cut off by the line break. If you send HTML E-mail, that is not a problem really, because a long hyperlink can be embedded in a short keyword. The problem is text E-mail or E-mail clients that do not render HTML, and there are not so many nowadays.

So what kind of problem are you trying to solve ? My overall impression is that the shortener is mostly a marketing gadget, and that the right course of action is to improve what already exists. If you have ugly URls, take the time to review them, prettify them, shorten them. A short URL can be convenient but is not 'pretty'.

Answer 3

In addition to the other answers, I would like to stress that communications from a financial shall be easily verifiable for the user.

Say a customer receives an sms/email:

YOURBANK: Your purchase has been successful. More info https://bit.ly/2VBP5iK

Is this legitimate or not? Even to their IT team, that url itself provides no context, requiring them to dig into whatever urls it redirects to. And sometimes, even they would not be able to ascertain if it is legitimate or not, e.g. when the bank marketing department decides to launch a campaign at yourbank-campaign.com rather than using their domain (and thus being detected as a phishing to yourbank.com).

Even if https://bit.ly/2VBP5iK now leads to https://yourbank.com/sign-in:

• They wouldn't know who created that shortener. Even if it redirects to a legit page now, the author could later change it to a phishing page. Changing the target url between the legitimate and a phishing page would be a great way to confuse security teams.
• You are training your users that bitly links from your bank are Ok. While any miscreant could create one of those pointing to a phishing to your entity.

And if you buy a new domain (e.g. https://yourba.nk/) to use as a shortener, do place in the website root a text like

This is the official shortener from yourbank.com. All entries here lead to official services by yourbank. See https://yourbank.com/faq#shortener

With the page https://yourbank.com/faq#shortener (at the main site), linked from it confirming the same information.

You will nevertheless end up with users thinking it leads to a phishing page, some blacklist adding a url from https://yourba.nk/, etc. but having a clear domain that can be whitelisted, and the proper information readily available will help a lot.

‎

Note that while I would consider owning the shortener domain yourself a must, actually hosting the domain could be delegated to a third-party like bitly, instead of doing that in the bank infrastructure. That would share only some of the concerns other answers have mentioned (such as the shortener company getting compromised and redirecting [some of] your customers somewhere else). However, while it may be a useful service for another kind of company, for a bank the added cost of hosting a private shortener service would be negligible when compared with that of their normal page which those redirects will be targeting. So I wouldn't host it outside of my infrastructure either.

Answer 4

No matter, I hate the idea of sending sensible URL by mail!

When my financial partners do have something to communicate, I expect something like:

Some document are stored on your account at yourbank. Please use your regular login to connect your account's message box.

In case you forgot your login, use link written on your last bill or call us at number you may found at bottom of your last bill.

Using link in email lead to a lot of malicious thing like fake url using UTF-8 letters as domain, like Y0urbank.com or yⲟurbank.com (with ⲟ as ⲟ) and so on.

From there, strong url could simply figure on bank website or in my private space once logged, as simple href link.

`<a href="https:yourbank.com/complexUrl%20Holding%20Lot_of_characters">The link</a>

Answer 5

No. Nobody should. They are not under your control, and can be redirected at another party's discretion. They can also be used to compromise the recipient's/your customer's privacy. There is no legitimate need for such services. If you really really want short URLs, run your own implementation (it's trivial to do) on your own domain. Otherwise just use normal ones.

Answer 6

The URL didn't get ugly by itself

The business unit within the bank created the website. They are the ones who chose the web platform and URL. They are the ones who designed it to be a customer facing URL that is to go out in public communication.

So the marketing department needs to push back on that business unit and say "no no no, if you want this URL going out to customers, make it not 277 characters".

Then their webmaster would do whatever is required for that to happen, e.g. an internal redirector (in effect a TinyURL within the business unit).