The Virtual Vault

Online Banking: During Incapacity and After Death

With all the attention being given to the digital afterlife, I would like to share my real world experience with accessing my mother's online banking account during her incapacity and after her death.

Luckily, my mother had enough foresight to seek out an estate planning attorney many years before her passing. This attorney created a comprehensive estate plan, which contained a will, a financial power-of-attorney, a health care power-of-attorney, a living will, and a revocable living trust. In order to fund her revocable living trust she had to change the name on her bank accounts to the name of the trust.

When she became incapacitated, I needed to write checks and transfer money between accounts...no easy feat when the bank is located over 700 miles away. So I called the bank for help. They immediately responded by freezing all of her accounts. They told me that nothing else could be done without a power-of-attorney. Once they received a copy of my mother's financial power-of-attorney, they promptly gave me a new password to her online banking account and restored check writing privileges.

When she died things became more complicated. Once again, the bank responded by freezing all of her accounts. This time they needed copies of her death certificate, will, and revocable living trust. They also required a notarized copy of an "Acceptance of Successor Trustee" form from each of the living trust’s successor trustees. Only the executor of the estate received a new password to her online banking account, which was now restricted to read-only access. Check writing privileges were restored, but each check required the signature of each successor trustee.

Overall, the bank was very cooperative, once they received the proper paperwork. I can only imagine the problems a person could have without an estate plan. A virtual safe deposit box is a secure place to store information about online bank accounts, but never assume that just because you have the password that you can access an account without the proper authority. I highly recommend that you consult an estate planning attorney concerning the details of your specific situation. You won't get a second chance once your are gone!

James Bell

Special thanks to the employees of The First National Bank of Illinois

What is "better than bank" security?

Not all computer systems are created equal. Most financial institutions do a fine job at securing your data, but some do not. Any system, including a virtual safe deposit box, that touts “better than bank security” should, at minimum, address these security design flaws:

Break in the chain of trust. Many financial institutions outsource functions, such as bank statements, to a third party. The problem occurs when an account holder is redirected from the bank web site to the third party web site. In many cases, the bank web site provides no information stating that the account holder is being redirected nor is any information given stating that the third party can be trusted. The chain of trust is broken because the account holder has no way to determine if they can trust the third party site.

Presenting secure login options on insecure pages. When an insecure (non-https) web page contains a login and password box, the user has no way of knowing if they will be sent to a legitimate web site after submitting the information. This type of login page is easily spoofed by phishing attempts. The login page should be secured by https in addition to the rest of the web site.

Contact information for security advice on insecure pages. When a failure occurs and a web page requests that you call tech support, the contact information needs to be on a web page secured by https. If not, this web page can also be spoofed with bogus contact information. In this scenario, a phone number can be set up by a hacker to collect personal information, like your social security number.

Inadequate policies for user IDs and passwords. A web site should never use social security numbers, account numbers, or email addresses as a user ID. A web site should always publish its password policy and should never permit weak passwords.

Emailing sensitive information insecurely. Email, in general, is insecure. Your email may pass through several different servers before ending up in your Inbox. A financial institution should never email account statements or password resets. Statements should be downloaded through https. Password resets should be self-serviced or given out on demand by tech support.

Improper firewall configuration. When opening ports on a firewall, a minimalist approach is best. With fewer ports open, a hacker has fewer ways to enter a system. Trojans typically send out information through an obscure open port.

To find out more, I recommend that you read this excellent survey of bank security flaws by the University of Michigan.

James Bell

Virtual safe deposit box products embrace OpenID authentication

OpenID is an open, decentralized standard for user authentication and access control, allowing users to log on to different services with the same digital identity. OpenID replaces the common login process that uses a login-name and a password, by allowing a user to log in once and gain access to the resources of multiple software systems. OpenID is central to President Obama's Gov 2.0 initiative that seeks to make government websites more open and transparent.

Skeptics of OpenID sight concerns about privacy and security. However, these matters depend on how the OpenID provider implements authentication. For example, by using Verisign PIP as your OpenID provider your PayPal Security Key can be used for mutli-factor authentication while logging into any website that supports OpenID.

Two virutal safe deposit box products now support OpenID. Estate++ and Bank2Vault, both sold by Vaulting Systems International, allow you to use either built-in authentication or OpenID authentication. Both products recommend that customers use myOpenID as their OpenID provider. myOpenID uses CallVerifID™ for multi-factor authentication. myOpenID also supports client-side certificates for Transport Layer Security (TLS) which eliminates the need for passwords.

James Bell

Sources:
OpenID
Wikipedia, the free encyclopedia

MEMORANDUM FOR THE HEADS OF EXECUTIVE DEPARTMENTS AND AGENCIES
SUBJECT: Transparency and Open Government
President Barack Obama

Obama taps OpenID for government websites
Larry Dignan
ZDNet.com

How to Use Your Paypal Security Key with OpenID
By Jason Berberich

Software vendors benefit from virtual safe deposit box API

Estate++, a subscription-based virtual safe deposit box service, has recently published a public API. The API allows software vendors to upload files directly into a subscriber's account. The API is free for software vendors, but consumers must purchase a subscription in order to generate the access identifiers needed by the API.

The API makes this service a natural add-on to many desktop products such as tax preparation software, home inventory software, legal document software, and genealogy software. The API also makes it easy to create Microsoft Office add-ins.

The API opens Estate++ up to integration with enterprise systems such as online banking, online brokerage, and credit card award programs. It's ideal for institutions pursuing green initiatives. Monthly and quarterly statements can be uploaded, eliminating the need to process paper.

This RESTful API is compatible with popular programming languages including C# and Java. Security is implemented through https and public/private access identifiers.

Software vendors can further monetize the API by selling subscriptions to Estate++ through their affiliate program, which is managed by Plimus.com.

James Bell

Virtual safe deposit box usage promotes green banking

In addition to helping bank customers organize their information, a virtual safe deposit box (VSDB) service can also help the environment.

Many banks still send paper statements to online banking customers in addition to their online statements. With a virtual safe deposit box, statements can be uploaded automatically. Search functions can help customers locate the statement they want, quickly. Banks save money by eliminating paper, envelopes, and postal expenses.

For customers who aren’t quite ready to get rid of their paper statements...electronic copies can still be printed at home, if so desired.

James Bell

Banking industry trends encourage virtual safe deposit box outsourcing

As mid-size and community banks seek to attract online banking dollars, adding more online products, services, and transactions has become a necessity in order to remain competitive. With the arrival of Wells Fargo vSafe, competitive pressures will compel many banks to offer their own version of a virtual safe deposit box.

However, the high cost of developing such a service may be prohibitive. For most, managing the build out of such a system will be a serious distraction from the organization’s core focus. Bob Laliberte, an analyst with Enterprise Strategy Group, told InternetNews.com "I absolutely believe this is just the first of many traditional companies getting into the online backup or storage space. The reality is that these companies will most likely OEM to an existing business than build it out from scratch."

Successful vendors will use a "pay as you go" pricing plan that accommodates growth and reduces cost as volume increases. By charging only for actual usage banks can accurately forecast costs and optimize profits. Pricing plans must allow a bank to be profitable by offering the same service at a discount over vSafe.

James Bell

Sources

The Future of Banking in America
By George Hanc
FDIC

Wells Fargo Banks on Online Storage
By Judy Mottl
InteretNews.com