Take the 2-minute tour ×
User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It's 100% free, no registration required.

I'm redesigning an application and I'm researching the use of email vs username login options. Our application works with financial institutions and because of this have been told that usernames are required for additional security measures. I cannot find additional information to support this claim and have been reviewing similar questions to see if there is any information proving or disproving this approach.

Upon looking at several banking site I have realized that this seems to be the norm among financial institutions. Paypal seems to be the exception for it is easier to verify identity for money transfers or organizations when using email.


Why do most financial institutions use usernames instead of emails for login?

Are there standards that dictate this is more secure or is it a trust factor for usability?


enter image description hereenter image description hereenter image description here enter image description here

enter image description here


I've reviewed the following posts that all point toward using emails or email and usernames for login options but do not address if a username provides an additional layer of security.

share|improve this question
4  
I imagine it might be so that if a user has their password leaked by another source (website leak, phishing, etc) then the attackers cannot link it directly to the same u –  RedSirius Aug 5 at 14:55
1  
..then the attackers do not have a valid username/password combo. –  RedSirius Aug 5 at 15:01
7  
This isn't really a UX issue; the experts at Security StackExchange might be a good place to ask. –  vincebowdren Aug 5 at 16:32
3  
@Andy 's response makes total sense, but do check this thread out where they've discussed(including @Andy) why use [Email instead of Username][1]. For the lack of reputation, I'm posting it as an answer. [1]:security.stackexchange.com/questions/33269/… –  Zeus Aug 5 at 22:40
2  
I hate all the sites that want emails as usernames. You know, maybe peoples emails change or so... –  PlasmaHH Aug 6 at 9:51

6 Answers 6

up vote 25 down vote accepted

There are a number of reasons:

  1. It prevents someone causing someone elses account to be locked maliciously (if I know your email address and you bank with Barclays I can lock you out of your account by repeatedly attempting wrong passwords).
  2. As @AlexFritz indicated it makes it harder to try hacked username and password combinations from other sites on the banking site.
  3. It makes it harder to iterate through many accounts trying a few common passwords on each
  4. It increases the amount of information an attacker needs to know (essentially the user id is a bit of information you are expected to write down or otherwise record but that still extends the effective length of the password).
  5. Email addresses can and do get re-used. You don't want someone who happens to get re-allocated a used email address to be able to carry out reset password requests etc.

This all needs balancing against a user being able to remember their username. On many sites there is a send me my username function linked to an email address.

share|improve this answer
    
If I know somebody's email address, I can make a good guess at their username, so point 4 isn't a significant issue, nor points 1, 2 and 3 which are really parts of point 4. –  Gilles Aug 6 at 11:28
5  
My bank sets my user ID. Those points very much depend in the user ID strategy. –  Andy Boura Aug 6 at 11:31
2  
Even in scenarios where I can pick my own user ID, it never has anything in common with my e-mail address. –  GalacticCowboy Aug 6 at 12:58
3  
@Gilles: although you may choose an username close to your email, this will not be the case for every user. Also, giving the possibility for additional security can be good. If the user does not use it, the fault is (at least partly) on the user and the financial institution can just say that it was an user fault. Also it can allow the bank to prevent using the email as user id or perform additional checks or even generate the user id for the user as someone mentioned. –  BlueTrin Aug 6 at 14:28

I can speak from the bank accounts I know in europe: You don't even need an email address to have an online banking account, as registration usually happens offline - you get Pin and everything via postal mail.

Since you don't need an email to use the account, it does not make sense to use email as username.

share|improve this answer

My experience from local government, where money was involved, is that user-names provide another level of security beyond an email address.

It was the generally held opinion that someone could relate an email address to an individual but a user-name could be unique to that site.

It's a fairly arbitrary measure, but it's a measure.

share|improve this answer

There are a lot of good things up here, but it misses one key point: you can't use an email address for a password reset, because it's not secure enough, and you don't use an email sign up. Those are the two key reasons why almost every online service has an email address associated. Without them, there's no reason not to use a username instead.

share|improve this answer
    
Sorry I wasn't clear. Assume there is a user address associated with the account. I'm specifically looking for reasons why you would use email or a username to log into an account on a system. –  Chromarush Aug 5 at 23:29
    
A username is preferable to a email address for many reasons; because it represents the person themself, rather than a way to send them a message because there's never a case in which it needs to be changed, which is preferable for technical reasons. There are other advantages too to the username; my point was that there are no advantages for the email left, and so a username makes sense. You asked "Why do most financial institutions use usernames instead of emails for login?", and I think this answers that question. –  ctbeiser Aug 5 at 23:55
1  
I misread your answer. Thank you for the clarification. –  Chromarush Aug 6 at 19:33

Email is less secure than online banking (I hope) so maybe the thinking is that since people tend to use the same passwords for everything, using email instead of username for bank login would create a vulnerability in the case of email passwords leaking, the thief could go around and try that email password combination a bunch of places, and probably successfully get into at least some of them. With a username, the thief will have to do more work to get all the information they need to get into the account. So it is not exactly an airtight security measure, but it is a little safer than letting customers use their email address.

share|improve this answer

As a developer creating an application for capital markets, I do not want to verify email addresses as valid by checking against any third party email providers even if they are good ones. I dont even allow anyone to sign up on their own. An admin signs them up, gives them a username. The login page itself is also an https. This is just because all banks, financial institutions have a very big list of security questionaire which they throw at you and by the time you are done answering Yes to all those, you have admin created usernames, https with SSL provided by a big trusted provider, password reset by admin, auditing every user action, chinese walls and so on and on and on....

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.