Co-Op Bank - Making Banking Inaccessible
By @edent
· accessibility banking co-op NaBloPoMo security usability · 2 comments · 550 words · read ~416 times.
I've blogged before about how backward the Co-op bank is - sadly, they've not improved in the last few years.
I needed to close down my business bank account. I hopped on to online banking, provided all my details, went through 2FA with a physical token, remembered my mother's maiden name and began searching the site.
There was no way to close the account.
Oh well, I guess I'll give them a call. After 30 minutes on hold I was told "The account closing team leave at 4pm, sorry." It was 5 past four. They'd successfully held me off!
I rang up the next day and asked to close my account. "You'll need to write us a letter!" came the stern reply. I wasn't sure how a letter would be sufficient proof. "Aha!" they said, "You must write it on headed paper!"
My business is fully online. I simply don't have headed paper. Who does? More to the point, I don't own a printer and I can't be bothered to wander to the post office to buy a single stamp.
"That's silly," I said. "What do your disabled customers do?"
"Errr... Write a letter...?"
"So, you're telling me that you expect your customers with mobility difficulties to painfully write you an physical letter and then hobble down to the post-box?"
"Well. Umm... They could.... Ask a carer for help?"
"Do you think this fulfils your obligations under the Equality Act to provide reasonable adjustments?"
"Let me speak to a manager."
I spent a few minutes perusing other banks' closure policies. HSBC let you do everything online. NatWest is by phone - or minicom if you can't talk.
"Right! On this occaision, we will let you send us an email."
"That's very generous of you. Does it need to be on headed email paper‽"
"No. The email address is F R E D dot ..."
"Hang on... is this your personal email address?"
"Yes. Fred dot Smith at cfs.coop"
"What's cfs.coop? There's no website there."
"It's just our email sir."
... So, I sent an email to this random person - at an address with seemingly no connection to my bank account. All it took was my name, address, and company number (all public information) and my bank details (on every invoice I've sent) - and my money was transferred to a new bank account.
Putting it right
Let people cancel their accounts online. It's that simple.
If your web security is good enough to let people transfer piles of money, or set up an account - it should be secure enough to let people close an account.
Putting it right, part 2
Co-op called me up to apologise. They recognise that their accessibility needs fell far short of what is expected of them. They offered to send me £25 by way of an apology. I told them to send it directly to the charity Scope.
"Oh! I don't think we can do that, sir. But we can post you a cheque."
Give me strength!
Alex says:
Another weird thing with their online banking...
If you want to transfer a thousand pounds to a new payee you need your chip reader and two passwords/memorable things.
If on the other hand you want to transfer more than £10,000 (say for a house purchase) you can’t do that online and instead speak to a nice person who asks for your date of birth and the name and date of birth of your joint account holder. Then a manager confirms the transfer details (but no further security questions) and Bob’s your uncle!
Simon Still says:
Pre digital bank security is just as borked. Trying to change authorised signatories on a Barclays business account. Directors sign form to authorise. Barclays reject one of the directors signatures as being too different to the one they hold on file. “Can they write us a letter saying their signature has changed?”