I have a site that needs to collect a user's bank username/password. This is obviously a big hurdle for someone to get over but we have to do that. I'm looking for ways, visually & textually, to increase conversion rates and make users feel more secure in this process. On our backend, we use all the same encryption techniques as major banks do. Any ideas?
4
-
1Sorry, but "we have to do that" is nonsense. You only have to do that if you need to be able to act in the user's name. And to do so with a bank account requires power of attorney. To get power of attorney requires paperwork and that would be the ideal time/place to collect the user's username and password. I cannot envision any scenario in which you would have to collect the information online. If I don't even trust my sister with this information, why would I trust an app not to abuse the knowledge?– Marjan VenemaDec 28, 2013 at 16:58
-
1If it is about an app a user could use to access his bank account, then simply forward to the bank's login pages and find a way to check that the user is logged in. Better yet, talk to the bank how you can automate their website.– Marjan VenemaDec 28, 2013 at 17:00
-
@MarjanVenema Unfortunately, we need to need their user/pass and the have enter it in to be compliant.– bcackermanDec 30, 2013 at 18:39
-
I am sure you are convinced of the validity of your reasons and the necessity of collecting the information. I am still not convinced. Compliant? With what? There is nothing a site could do to entice me into divulging that information. If you want it, and you have legitimate reasons to get it, then get them off-line. Everybody who understands anything about phishing attacks should have the same attitude. It really is unfortunate that many people don't: onthemedia.org/story/234397-why-nigerian-email-scams-work– Marjan VenemaDec 30, 2013 at 21:14
Add a comment
|
4 Answers
Compare yourself to an institute that already encapsulates this security - a bank. You can use a super simple statement with a matching icon: "Bank Level Security".
Other than that, to look super professional make sure your site and page are perfect:
- Visually (see https://medium.com/design-startups/c012e5ad32f7)
- Code wise (no errors, no vulnerability to XSS attacks, SSL certificates, etc.)
Last but not least, try to get social credibility. Nothing will convince me more to trust you if one of my friends or co-workers is already using your site.
Checkout the Web Credibility Project.
That and actual security enhancements like using HSTS...and perhaps a visible notice of that fact on all pages.
While users would not want to feel like they're in an ancient software application, they also don't want to feel like they're giving their information to some extremely modern (inexperienced) app. I think https://www.mint.com/ did a good job of finding a professional balance.
I'm on the fence about this, but, you could think about putting a subtle message on the top of the screen that says something like:
"Your security is important to us. If you do not see a secure icon [insert browser ssl icon here] in your browser, please do not input your personal data. If the icon is showing, our security system is active."
I could see this going either way, because it implies that your security system might not always be in place. On the other hand, it draws attention to the fact that your SSL is in place.
I would take the time to sign up for mint.com and their competitors, paying attention to what made you feel secure about them.
When I joined Vanguard.com recently, I really appreciated their balance of design/usability with the traditional look-and-feel.
On their registration page, they have large, simplified choices with little explanations below with font choices that are easy on the eyes (unlike many legal documents' fonts). At the same time, they have solid, simplistic design that doesn't try to scream "look we're web 2.0!" with skeuomorphic buttons or something. I'd recommend going through the many routes of their sign up workflow for inspiration.
Similarly, TurboTax gives the same general feel, but with more colors and more responsive interactions.
