Technological changes, regulation privacy and fraud in the financial aggregation industry Anastassios GENTZOGLANIS Faculty of Business Administration University of Sherbrooke, Canada

Financial Aggregators Businesses (not banks), which collect data on line, group them together and present them to customers within a single interface. A customers various transactions, banking, investment and credit accounts are thus aggregated together and offered by financial aggregators either for fee or free. The aggregating and storage technologies raise privacy and security concerns.

The Industry Primarily targeting US market, but expanding internationally Half a dozen firms active in Canada Mint Yodlee iBank CheckMe Mvelopes PocketSmith Banks ?

The Regulators Canadian regulators are not yet very active in this field. Warnings have been issued by FCAC (Financial Consumer Agency of Canada) as to the possible threats financial aggregation may present to Canadian consumers and recommends a cautionary use of these sites in order to avoid or reduce the risks of fraud or abuse of the financial information provided to financial aggregators by the Canadian public. OPC – funded this project Several jurisdictions (EU, US, Australia, UK, Canada, Japan, South Korea) have set committees to examine the privacy and fraud issues arising from the expansion of aggregator services and consider possible solutions.

The Technologies Screen Scraping Cheap and Dirty Direct Feed More work but more secure

Screen Scraping Fast and does not need human involvement. It uses a customers user name and password provided by the customer to the aggregator and automatically enters his/her accounts; It collects the information available and displays it on a single page for the individual consumer. There are variations of this technology – the user-driven model and the third party model – but whatever technology is used, the screen scraping technology is currently the fastest and cheapest for aggregators to use.

Direct Feed Business to Business Financial aggregators cannot access financial information unless they prove to the financial institution where individuals host their accounts that they have customers authorization to do so. Financial aggregators have to possess consumers account numbers, passwords and user names, and after verification, access is allowed provided that the aggregator respects a standard communications protocol. Once authorization is granted, all the financial information (banking, investment, Paypal accounts, utility accounts, etc.) is displayed on the aggregators web site. Direct feed is costly for the financial aggregator, and it is slower. Nonetheless, it is more secure and reliable.

The Concern That aggregators would tend to provide the services at the lowest cost possible by using the least expensive technology, i.e., the screen scraping one and more specifically, the third party (cloud) model. This model is the least secure and the least reliable and given that it uses extensively the cloud to store valuable information, the risks for fraud and privacy violation are higher.

The Project Questionnaires and interview guides were developed and used to elicit information concerning the attitudes of Canadians towards aggregation services the attitudes of financial aggregators towards technology and safeguards they use to protect customers privacy and identity Industry has refused to participate From Yodlee: There is no upside for us… Following are the consumer attitudes results

The results

The Survey To verify whether differences in attitudes exist between Anglophones and Francophones, the questionnaire was translated and distributed to two different populations Ontario Quebec On average, the Anglophones in the sample have a higher diploma, are wealthier and a high majority of them (66%) are females Francophones are mainly males (63%) and their income is at the lower end since they are mostly students.

The preliminary results (%) AnglophonesFrancophones Trust in encryption technology Strongly7755 Fairly67 Read privacy policy Yes5418 Never4078 Level of concern Very4661 Fairly4529 Change in attitudes Yes3925 No5772 Platform choice Laptop/smart/tablet3669 Desktop4117 Virtual vs bricks and mortar Virtual with privacy7349 Bricks and mortar without privacy 1636 Willingness to pay$05525 Less than $103965

Participants Annual Income

Participants Education Level

Participants Gender

Trusting technology

Privacy Policy

Participants level of concern

Participants change in attitude

The choice of device-platform

Choosing between virtual – brick and mortar aggregators and privacy

The willingness to pay for privacy

Tentative Conclusions Concerns exist but technology is trusted Consumers are motivated by convenience Anglophone and Francophone attitudes may differ Industry refusal to cooperate very concerning What is the balance between innovation and regulation? Who is the lead regulator?