Banks angry over security of aggregation services

Halifax and Abbey National have slammed Citibank over the data security of its new account aggregation service.

Halifax and Abbey National have slammed Citibank over the data security of its new account aggregation service.

Citibank had cited the two financial institutions as supporters of its new My Account service, which enables consumers to view all their online bank accounts and financial services from a single Web site.

But Halifax and Abbey National have told CW360 that they were not consulted about the endorsement, and have asked Citibank to remove their names from its Web site.

Ambrose McGinn, e-commerce director at Abbey National, said: "We are absolutely against it [aggregation] and we strongly recommend that our customers do not take part in this service. It's dangerous and they [customers] leave themselves wide open to attacks."

A Halifax spokesman said: "We have already said we are not in agreement with aggregation services because customers will be giving away their security details to a third person. We've contacted Citibank to have our details removed. It goes against the terms and conditions of our accounts."

Account aggregation is proving popular in the US, but the UK's Financial Services Authority (FSA) warned earlier this year that it could not regulate aggregation sites.

"Experience in countries where aggregation is already available indicates that many consumers wish to take advantage of this service," said Philip Thorpe, managing director of the FSA. "It can be a helpful tool in managing finances more effectively. But there are also risks involved in disclosing security information such as passwords or PIN numbers."

Citibank launched its aggregation service in September and has signed up 3,000 users. A representative said the bank was removing the Abbey National and Halifax names from the site.

"Citibank takes the matter of security very seriously and the public can be assured of the very highest standards when dealing with Citibank. We obviously don't discuss the details of this security in the public domain," said the spokesperson. "Citibank does, however, have the advantage of over 15 months' actual experience running the service in the US, with many thousands of users, without incident."

Read more on Antivirus, firewall and IDS products