Distributed Trust
Thanks to everyone who sent me an email or left a comment following my earlier post on Social Finance. It turns out there are several applications out there which offer some kind of social financial management functionality, notably Wesabe and Mint (No, not the Web analytics package.. or the credit card!
Wesabe tries to build a community around finance, offering financial tips and groups where members can exchange stories and advice. It also provides a Firefox extension which can screen-scrape your transactional data from a given bank's internet banking interface for upload into the system - from there you get a greater degree of analytics functionality. In theory, all banks are supported, suggesting some clever data analysis things going on.
Mint is entirely analytics driven, without the groups aspect, and with a much slicker "Web 2.0 style" interface. Rather than using a plug-in to gather data, you hand over your user-name and password, and the web app goes off and imports your data, one would assume using a similar method of screen-scraping, however currently only supporting US-based institutions.
Both of these applications pose an interesting question - would you trust them with not only your financial information, but your login credentials for these institutions?
From a financial institutions perspective, I can't see any support for these applications. The fact that a customer's security is being compromised takes a back seat to the fact that said institution can no longer cross-sell products and services whilst a customer is managing their account. In fact, Mint actually analyzes a user's data and recommends the best credit cards and savings accounts, which may be from a totally different financial institution.
From a marketing perspective, this is a major blow, and nullifies one of the main advantages a financial services institution when it comes to marketing to their customers - the knowledge of spending habits which allows for sophisticated targeting of content and offers. All of this information is now in the hands of the third party and may be being used to sell competing products.
If we look from the customer's perspective, its great - they are often getting a better financial management experience than the systems provided by their banks and credit card companies, especially when it comes to spend analysis; in addition there is independent financial advice on savings and investments.
The big question however is trust.Mint is not a bank, neither is Wesabe - they are start-ups and they are also not governed by the industry regulation and financial guidelines of the financial provided - would you trust them with your credentials?
I think it is something which I would be somewhat cautious about, considering my credentials would likely be stored in less-secure environment than my financial data, held by my bank.Also, assuming I give my credentials, I wouldn't really want such a company storing copies of my data. Again, I think its all about accountability in the event of data loss. If say HSBC, Barclays or American Express get hacked and my data is compromised, I would likely have a greater degree of recourse than if, say, cached copies of all my transactions were swiped off the servers of a start-up, whom really I shouldn't have gave my details too in the first place. My financial providers would probably be sympathetic, but also remind me that I should not be sharing my login credentials - something which could affect liability in the case of fraud.
So, what is the solution?
As a consumer, I want access to my data and the ability to slice and dice it however I wish. If this is provided by the financial institution or a third party, I'm not too concerned, provided that it is both secure and adds value.
I think financial institutions need to be aware of this, and also realize that often outfits such as Mint are in a better position to add the value - be it due to technological competence or because its cheaper to let someone else spend the time developing these capabilities. In addition, if a bank goes of and developers their own version of Mint, it makes the social aspect more difficult to develop, not to mention the fact that we would be looking at silos of data rather than open data - can you imagine American Express allowing Citibank and Bank of America customers to import their account data?
To enable this, the solution is simple - Open API's to banking platforms. Something which third party developers can use in order to retrieve data in a consistent manner with a well-thought out security model. As well as providing token-based authentication, a Flickr-like model could be adopted, requiring users to log in and authorize specific applications which request access to data. This could be controlled through the standard e-banking interface, adding an extra layer of security and also ensuring that customers know what they could potentially be getting into when they allow their data to be exposed in this manner.Now all we need is for one bank to stick their head out and implement something like this... In fact, there is a great opportunity to establish a standard here , which can be adopted across the industry. Also, an Open API also makes it a lot easier for a financial institution to make data available throughout its website or in other applications such as desktop widgets.We aren't going to solve the marketing loss quite so easily. This could either mean one of two things - either I need to think some more, or perhaps we are approaching the online channel in the wrong way when we consider cross-sell, especially since we are dealing with a web of data. I would welcome thoughts here.
