Thursday 22 July 2010

Monitoring of web traffic on an online banking site. Risk or legitimate data collection?

LloydsTSB has redesigned its online banking service web site and I tried this out for the first time yesterday. The site, as well as displaying statements with the newest transaction at the top, claimed to have introduced new features which would make it easier for the user, but my own first impressions were far from favourable.

For a start there was a new quick payments page. They had provided a drop-down list of the recipients I had already set up. Paying one or more of these just entailed making a selection from the list and then choosing the amount and confirming the password as before. A link then enabled me to return to the same page to make another payment if I wished. Initially I assumed that this drop-down list had replaced the previous page of links and since it didn't include a reference number, though unhelpfully did include an 8 zero account number for credit card companies, I had an immediate problem as I had more than one account with the same institution. These had the same sort code and zeros account number. There was no way to distinguish between the two without the reference.

After a 10 minute wait on the online banking telephone helpline I was told that the old payments page could still be reached and I could make my payment there. This was true but there was no link back to it, so the process was going to take longer than before for multiple payments. This was supposed to be an improvement? Additionally the make payment and delete recipient buttons were very close together on different lines and I could see that deleting a recipient by mistake would be all too easy.

I've focused so far on usability, but a far more serious issue for me was the fact that the site momentarily redirected to statse.webtrendslive.com en-route to each new page. I eventually discovered that LloydsTSB are collecting marketing information in this way, but not until after I had wasted a considerable amount of time talking to technicians at an anti-virus software provider. They weren't knowledgeable enough and wanted to solve a non-existent virus problem with a sledge hammer approach. I'm always wary about researching viruses on the net as malicious sites can themselves introduce viruses whilst purporting to offer software to remove them. I did find discussions of webtrendslive on various forums though and once I had realised what was happening it was easy enough to block it using a Firefox add-on.

It's a shame that when asked, LloydsTSB's helpdesk staff only said that the presence of webtrendslive in the status bar was part of the workings of their website and didn't confess it was a 3rd party site. This kind of redirect is not what you expect in online banking and doesn't lead to confidence in the security of the site. When I also explained the usability problems the new site was causing, the helpdesk also didn't seem to think that an extra click to make multiple payments was an issue. "It's only one more click" they said. I suggested a new link would help, back to the payments page. It's a pity too that the choice of display order isn't set as a user preference as I'm sure not everyone will like this feature. The helpdesk promised to pass my comments on but I'll never know if they did. It would have been good to have been able to send the feedback to the right department. Someone there might have been more interested.
 
visit counter: Add to Technorati Favorites