Why do financial institutions use usernames instead of emails for login?

Question

I'm redesigning an application and I'm researching the use of email vs username login options. Our application works with financial institutions and because of this have been told that usernames are required for additional security measures. I cannot find additional information to support this claim and have been reviewing similar questions to see if there is any information proving or disproving this approach.

Upon looking at several banking site I have realized that this seems to be the norm among financial institutions. Paypal seems to be the exception for it is easier to verify identity for money transfers or organizations when using email.

---

Why do most financial institutions use usernames instead of emails for login?

Are there standards that dictate this is more secure or is it a trust factor for usability?

---

---

I've reviewed the following posts that all point toward using emails or email and usernames for login options but do not address if a username provides an additional layer of security.

• When the username is an email address should the field be called 'username' or 'email'?
• Username or email address fields
• email field or username for logging in an application?
• Accessing secure content
• Usernames vs. Real Names
• Why would you, for a local authentication site, have usernames, instead of using e-mail address to login?
• Money transfer username or e-mail

Answer 1

There are a number of reasons:

1. It prevents someone causing someone elses account to be locked maliciously (if I know your email address and you bank with Barclays I can lock you out of your account by repeatedly attempting wrong passwords).
2. As @AlexFritz indicated it makes it harder to try hacked username and password combinations from other sites on the banking site.
3. It makes it harder to iterate through many accounts trying a few common passwords on each
4. It increases the amount of information an attacker needs to know (essentially the user id is a bit of information you are expected to write down or otherwise record but that still extends the effective length of the password).
5. Email addresses can and do get re-used. You don't want someone who happens to get re-allocated a used email address to be able to carry out reset password requests etc.

This all needs balancing against a user being able to remember their username. On many sites there is a send me my username function linked to an email address.

Answer 2

I can speak from the bank accounts I know in europe: You don't even need an email address to have an online banking account, as registration usually happens offline - you get Pin and everything via postal mail.

Since you don't need an email to use the account, it does not make sense to use email as username.

Answer 3

There are a lot of good things up here, but it misses one key point: you can't use an email address for a password reset, because it's not secure enough, and you don't use an email sign up. Those are the two key reasons why almost every online service has an email address associated. Without them, there's no reason not to use a username instead.

Answer 4

My experience from local government, where money was involved, is that user-names provide another level of security beyond an email address.

It was the generally held opinion that someone could relate an email address to an individual but a user-name could be unique to that site.

It's a fairly arbitrary measure, but it's a measure.

Answer 5

Email is less secure than online banking (I hope) so maybe the thinking is that since people tend to use the same passwords for everything, using email instead of username for bank login would create a vulnerability in the case of email passwords leaking, the thief could go around and try that email password combination a bunch of places, and probably successfully get into at least some of them. With a username, the thief will have to do more work to get all the information they need to get into the account. So it is not exactly an airtight security measure, but it is a little safer than letting customers use their email address.

Answer 6

As a developer creating an application for capital markets, I do not want to verify email addresses as valid by checking against any third party email providers even if they are good ones. I dont even allow anyone to sign up on their own. An admin signs them up, gives them a username. The login page itself is also an https. This is just because all banks, financial institutions have a very big list of security questionaire which they throw at you and by the time you are done answering Yes to all those, you have admin created usernames, https with SSL provided by a big trusted provider, password reset by admin, auditing every user action, chinese walls and so on and on and on....

Answer 7

For security reason, the financial institution are rarely accepted new technology or new methods since they won't take any risk by using unproven or uncommon things. Many e-banking site are running before the era login with email so popular today. The username/password methods are common in that era. They simply won't take any unnecessary risk. If username works and common why use email?