Technological changes, regulation privacy and fraud in the financial aggregation industry

1. Anastassios GENTZOGLANIS Faculty of Business Administration University of Sherbrooke, Canada anastassios.gentzoglanis@USherbrooke.ca Technological changes, regulation privacy and fraud in the financial aggregation industry

2. Financial Aggregators • Businesses (not banks), which collect data on line, group them together and present them to customers within a single interface. • A customer’s various transactions, banking, investment and credit accounts are thus aggregatedtogether and offered by financial aggregators either for fee or free. • The aggregating and storage technologies raise privacy and security concerns.

3. The Industry • Primarily targeting US market, but expanding internationally • Half a dozen firms active in Canada • Mint • Yodlee • iBank • CheckMe • Mvelopes • PocketSmith • Banks ?

4. The Regulators • Canadian regulators are not yet very active in this field. • Warnings have been issued by FCAC (Financial Consumer Agency of Canada) as to the possible threats financial aggregation may present to Canadian consumers and recommends a cautionary use of these sites in order to avoid or reduce the risks of fraud or abuse of the financial information provided to financial aggregators by the Canadian public. • OPC – funded this project  • Several jurisdictions (EU, US, Australia, UK, Canada, Japan, South Korea) have set committees to examine the privacy and fraud issues arising from the expansion of aggregator services and consider possible solutions.

5. The Technologies • Screen Scraping • Cheap and Dirty • Direct Feed • More work but more secure

6. Screen Scraping • Fast and does not need human involvement. • It uses a customer’s user name and password provided by the customer to the aggregator and automatically enters his/her accounts; • It collects the information available and displays it on a single page for the individual consumer. • There are variations of this technology – the user-driven model and the third party model – but whatever technology is used, the screen scraping technology is currently the fastest and cheapest for aggregators to use.

7. Direct Feed • Business to Business • Financial aggregators cannot access financial information unless they prove to the financial institution where individuals host their accounts that they have customers’ authorization to do so. • Financial aggregators have to possess consumers’ account numbers, passwords and user names, and after verification, access is allowed provided that the aggregator respects a standard communications protocol. • Once authorization is granted, all the financial information (banking, investment, Paypal accounts, utility accounts, etc.) is displayed on the aggregator’s web site. • Direct feed is costly for the financial aggregator, and it is slower. • Nonetheless, it is more secure and reliable.

8. The Concern • That aggregators would tend to provide the services at the lowest cost possible by using the least expensive technology, i.e., the screen scraping one and more specifically, the third party (cloud) model. • This model is the least secure and the least reliable and given that it uses extensively the cloud to store valuable information, the risks for fraud and privacy violation are higher.

9. The Project • Questionnaires and interview guides were developed and used to elicit information concerning • the attitudes of Canadians towards aggregation services • the attitudes of financial aggregators towards technology and safeguards they use to protect customers’ privacy and identity • Industry has refused to participate • From Yodlee: “There is no upside for us…” • Following are the consumer attitudes results

10. The results

11. The Survey • To verify whether differences in attitudes exist between Anglophones and Francophones, the questionnaire was translated and distributed to two different populations • Ontario • Quebec • On average, the Anglophones in the sample have a higher diploma, are wealthier and a high majority of them (66%) are females • Francophones are mainly males (63%) and their income is at the lower end since they are mostly students.

12. The preliminary results (%)

13. Participants’ Annual Income

14. Participants’ Education Level

15. Participants’ Gender

16. Trusting technology

17. Privacy Policy

18. Participants’ level of concern

19. Participants’ change in attitude

20. The choice of device-platform

21. Choosing between virtual – brick and mortar aggregators and privacy

22. The willingness to pay for privacy

23. Tentative Conclusions • Concerns exist but technology is trusted • Consumers are motivated by convenience • Anglophone and Francophone attitudes may differ • Industry refusal to cooperate very concerning • What is the balance between innovation and regulation? • Who is the lead regulator?