Hi, I'm Tracy kitten with see you info security calm. I'm here today with Anthony Vitaly, the assistant vice president of information technology development of the telco credit union, which is based in San Francisco Anthony before we get started, can you please tell the audience a bit about your role with the telco a little bit about the credit union and its membership? Yeah, the telco is based in San Francisco Bay area. It's a community chartered credit union It has a field of membership that serves approximately a thousand large and small businesses throughout California and Illinois It began as a credit union for the Pacific telephone and telegraph company, which is where its name was drive on It was founded in 1936 with $500 in deposits and has grown over the last 70 odd years to approximately 3.7 billion assets today and has approximately 290,000 members My role here at the telco is to manage the software development process for desktop applications and online delivery solutions such as online banking, mobile banking, army membership platform, consumer management system, as well as our data warehouse and reporting system Now, the telco has been exploring innovative banking channels such as the mobile channel for nearly a decade.
How and when did credit union launches mobile banking offer? I've been with the telco now for nearly 10 years and there's always been a commitment to offer its members with access to the latest and most convenient banking services It is in that spirit we partnered with M-Shift back in 2001 to build and integrate a browser based mobile tuition M-Shift uses a screen scraping technology which allowed them to bring their product to market fast They essentially passed a user request to our site behind the scenes, we performed a transaction and M-Shift takes the response and presents it in a user-friendly fashion suitable for a mobile device It was very innovative and enabled to offer a mobile solution before many other financial institutions did at that time Okay, you kind of answered my next question which talks about financial institutions and most of them are looking at launching a mobile banking service They usually start by targeting and transitioning their online banking members and customers Now, if the telco you said about 60% of your membership currently banks online, has the telco focus its marketing for mobile banking toward those online users? Most recently, the telco's marketing efforts with regard to mobile banking have been focused on existing online banking users As it's been the most cost effective means of reaching those members who are predisposed to non-traditional banking For example, using resources other than a branch or APM, but we recognize the need to reach beyond online banking users to this subset of population That is a heavy cell phone user without ready access to a computer This is an untapped market and one which will require greater cost to acquire through print, media, statement, search, newsletter communications, et cetera And which will be a focus for Pudalco in 2011 and the final month of 2010 And so do you think Anthony that financial institutions missed the mark by solely focusing mobile banking strategies toward their online users? During the 2009 holiday season, over 60% of shoppers between ages of 18 and 34 use their mobile phone for indoor activities To do things like price comparisons, tweeting, peer feedback, and downloading coupons There are apps out there now, one of which is called Red Laser, is one of the top five paid apps in the Apple Store So people are willing to pay for this and let you scan a UPC code and give you price comparisons, another similar app called Shafti It's the top three app and Android marketplace So based on these statistics, I don't necessarily think your mobile users are a subset of your online banking users I think they can be mutually exclusive and can be segmented and targeted differently Now currently, Pudalco has about 8,000 mobile banking users, which accounts for about 3% of your overall membership Pudalco offers SMS text and the browser based mobile banking that we've been discussing Are the majority of your mobile banking members using both mobile options?
Yes, but what's been interesting is that we've been seeing a much higher growth rate in our SMS tech banking service We launched tech banking back in very early 2008 and its adoption rate has been much higher than our mobile based solution in 2001 But I would add it's probably correlated to timing every year for the past year as we say it's the year of mobile And if it isn't this year, maybe it's next year, but we're getting close Just to give you some data to back that up, if you think of the adoption of mobile phones, two thirds of the world's population has a mobile phone You basically have 4.6 billion mobile subscribers That's more than the number of people with a personal computer and adoption is eight times faster Some say that mobile isn't really happening in retail or commerce, but if you think about Shafti and Ray, the red laser example I mentioned earlier It's changing the retail landscape, so we expect our mobile adoption to continue to increase over time through both SMS and our browser based solutions And then from a security perspective, browser based mobile banking poses some security risk because of the need for users to oftentimes download applications Such as the iPhone apps for mobile banking. What considerations did Patelko take into account before deciding to offer mobile banking that requires users to download any kind of application? Well, Patelko is currently in the process of developing and launching its first downloadable app. We're still learning as we go through the process, but we are approaching it similar to our online channel Using a layered approach to security and with understanding that there are emerging threats that we still haven't seen yet With that in mind, incorporating authentication measures throughout the process is one area we focus We're looking at different types of transactions and the risk they pose since not all types of transactions pose the same type of risk In addition to authentication, there are ways we are mitigating risk by incorporating certain types of transactional limits embedded within the app Notifying the user a certain type of event through different means such as email or text We also incorporate behavior profiling and embed that within the application design We also incorporate design considerations such as how we cash, how we encrypt and how we validate user insight Okay, you've kind of answered my next question, which I know Patelko works with MShift for its mobile banking platform What other providers did you talk to and what security measures does MShift have in place to provide layers of security for Patelko and its members Such as not cashing the pages The mobile banking platform was implemented in 2001 by John Shields, BFP and Chief Technology here at Patelko It was through his leadership and vision that we partnered with MShift at the time MShift has a number of security measures in place to safeguard the mobile sessions Their platform is leveraged through your internet banking site, this means that there is no redefinition of the rules you already have in place Sensitive user information is transmitted via end to end SSL, so the transmission from handset is no different than an SSL transmission from a PC Sessions are encrypted and devices are authenticated in real time against MShift's device signature No data is stored during the conversation process, the webpage provided by internet banking is converted into a mobile page and delivered back to the handset in real time The entire process occurs within the memory space of the application and takes place in one transaction All the systems within the MShift environment are classified as needs announced And with that time between online and mobile, Patelko is now working to offer more services via the browser-based mobile devices One of those offers is the peer-to-peer payments Please give us some background as it relates to Patelko's peer-to-peer or P2P offer online And I know you use cache edges, pop-money service How the credit union plans to transition that offer to the mobile channel The mobile channel is an exciting area right now, there's a lot happening within that space When you look at the trends and the growth rate, all the innovation is happening It's an exciting opportunity and an area I remember they're interested in So I think that's kind of what sets the stage to look at our mobile banking We have a long established partnership with cache edge through a product we call To make it available through the mobile browser-based version of our mobile solution Which was powered by MShift So we were able to leverage cache edges, pop-money platform and MShift green scraping technology To deliver a fully integrated P2P solution available through our mobile channel What doors and do you expect P2P to open for mobile users?
P2P essentially enables you to send money to another individual and all you need to know is their e-mail address from a mobile number Moreover, there's no information, financial information being exchanged between a sender and a recipient So you can basically send money to anyone The way pop-money P2P works is that the sender just plugs in how much they want to send Enter an e-mail address or a mobile number and off it goes The recipient receives a notification of the money being sent And if that recipient thinks of a financial institution that also partners with pop-money They can go right into their online banking site and accept the transport Or else they can provide the routing information through pop-money's website and accept the funds that way The sender only knows the recipient accepted the money So P2P basically makes any money very convenient for mobile users And finally, Anthony, I wanted to ask, what are the top three security concerns Credit Union should consider before launching any mobile service or application? Yes, you should definitely want to consider the fact that you do not have the ability to safeguard the phone physically The phone can be stolen or lost by the end user Number two, there are emerging threats in mobile malware, phishing, and social engineering tactics Many of the vulnerabilities we see on the online channel also pertain to mobile as well Number three, you can't control a member how they use the phone, what they use for, what kind of information they store, what apps they download So it's an unknown risk you can't control, you just never know what kind of personal information they're exposing on their phone Or the type of application they're running that could compromise it Thanks for your time today, Anthony Thank you Again, we've just heard from Anthony Petali, the Assistant Vice President of Information Technology Development at Petalco Credit Union, which is based in San Francisco For seeing you in both security.com, I'm Tracy Kitten