Bank Leumi introduces biometric password re-sets for online banking

An interesting story about Bank Leumi on Finextra just before Christmas.

It seems that Bank Leumi will be using voice biometrics for password re-sets for online banking. There are a couple of interesting things about this.

The first is that password re-sets are an absolute pain for helpdesks and similar types of contact centre. Depending on whether this is an internal helpdesk for an organisation or an external facing one, password re-sets can be anything from 50%-70% of the call traffic. The two follow on problems from this call volume are that password re-set is an expensive thing for IT technicians to be spending most of their time on and that they represent a significant potential security risk.

It is this security risk that is the other area of interest. Passwords authenticate you based on what you know, not who you are. Re-setting a password changes that, as it potentially makes the password available to an identity thief. The blog has covered a number of examples of identity theft (this theft from Barclays in 2008 using the identity of Barclays own chairman being a particular case in point) and the vulnerability is obvious.

In theory, biometrics removes some of this risk as it is focused on who you are and not on what you know. In practice things are not so straight forward and this is partly why biometic adoption has been more limited than might be expected. For more detail on the limitations, here's been some good posts on Finextra see "Biometrics - what's that all about then?" by Dave Griffiths and "Who's in your Wallet?" by Jarvis Kandik from 2008.

In Europe I've tended to see biometric deployments mostly for internal password re-sets. A good example that I know of is AIB and VoiceVault who have piloted password resets for staff. The key thing here is that the staff are in a controlled, secure environment and so the biometrics is effectively only one part of a multi-factor and multi-layer authentication.

This is what makes the Bank Leumi example so interesting. I haven't before seen biometrics used directly for consumer authentication for something as sensitive as banking.

I have seen quite widespread use of biometrics outside of Europe and the US and especially for areas like welfare benefits. I got a fair amount of comment to my blog post "BBC Moneybox on Speech Recognition for banking " back in February with examples of biometrics in use from the Philippines (interstingly using PerSay, as does Bank Leumi).



Depending on how the Bank Leumi deployment foes, I may need to revise my last post on the subject "Where are Speech Biometrics in Europe?..... and the Your Call Blog "....!

Man in the middle fraud in call centres

Never one to post only on up to the minute stories, the blog was quite interested in the Finextra report a fortnight ago on "man in the middle" fraud in call centres. I just haven't had a chance to write on it until now.

Traditionally, man in the middle fraud has been more associated more with the web channel than the telephone channel (see for example "Man-in-the-middle phishing kits circulating freely on the Web" or "ABN Amro compensates victims of 'man-in-the-middle' phishing attack" from Finextra), so it's interesting to see the attack take place in the telephone channel. It's also interesting that the attack described in Finextra is very low tech compared with the programing knowledge required for the phisihing attacks. The telephone version of man in the middle is described as,

"....where a fraudster calls the victim claiming to work for their bank, warning that their account may have been breached or compromised. The criminal then puts the customer on hold and calls their bank, connecting the two while remaining on the line.

The bank then requests authentication information, such as social security number, passwords and other personal information. Once the personal information is provided, the fraudster quickly ends the conference line and informs the customer that the issue has been resolved.

Meanwhile, with the personal information gathered during the call, the fraudster can take over the customer's phone banking relationship and transfer money out of their accounts."

The interesting thing for me is that for this type of attack to be successful, it highlights how weak the process side of some banks can be. This attack depends on the banks authentication process revealing (a) all of the customer's authentication data each time and (b) not ensuring that customers have multiple levels of authentication. Most banks I've worked with probably wouldn't be caught by this kind of fraud, so I'm interested to see that there are banks out there that still lag so far behind.

It's far less sophisticated than some of the the attack I've seen recently, where fraudsters have built fake IVRs to pretend to be the bank and used VoIP diversion to fool customers into thinking they are calling a local number (see posts like "Contact Centre impersonation arrives in the UK") and probably far less likely to succeed. Similarly, targeted social engineering attacks are also more likely to succeed as these tend to rely on bypassing security procedures rather than attacking them head on.

I would argue that deception based attacks around identity impersonation (such as the one on Barclays discussed in the post "Security, Call Centres and Fraud") seems to be where the real threat remains, but I'm not so sure that the man in the middle approach is where the real threat lies. My suspicion is that combinations of phishing and contact centre impersonation will remain the fastest growing threat for some years to come.

Scale and its problems in the contact centre

This week and last week I've been on site at the contact centres of some of the UK's biggest banks. These are also some of the UK's biggest contact centres, so it's been very interesting to see the challenge scale presents.

These organisations tend to have at least 10 million customers, which is a decent number if they all decide to phone you! What makes it even more challenging is that these 10 million customers have they data spread across thirty or more years of legacy systems.

It's interesting for me that the challenge of scale that this presents has been well addressed by telephony but the IT industry still lags behind to a certain extent. This might sound controversial, but if I explain that this is viewed from the perspective of customer service, it should become clearer. Contact Centre telephony (whether Cisco, Avaya, or Genesys) pretty much scales to run a very large customer service operation. It's taken twenty years of ACD development to get here (and the evolution of TDM technology to IP), but the telephony side of things works in terms of getting a call to anywhere that the organisation wants it to go.

By comparison, the availability of data and customer information (especially in real time) is still a real challenge. All the organisations I've been working with run 3270 sessions, or other terminal emulation, as so much of their data is still mainframe based. Processes similarly can be embedded in applications and present real challenges scaling to the wider enterprise. There is recognition that the process and application layer is now one of the choke points for customer service and IT System Integrators are starting to address it (see posts like "System Integrators write interesting things about contact centre for the downturn!"). The problem is that while mainframe was previously a very good answer to many of the scaling problems that organisations experienced, integrating yesterdays good solution into today's customer service requirements is still a struggle.

It's an interesting set of challenges and one I'll blog on further.

Contact Centre impersonation arrives in the UK

I wrote yesterday on the problems the Commonwealth Bank of Australia was having with a phishing attack that caused customers to call a fake contact centre that impersonated the bank's centre and captured their credit card details ("Phishing fraud steps up a new level with fake bank IVR & contact centre").

It now seems that this fraud has reached the UK. The BBC is reporting here that the Bank of Scotland has been targeted by fraudsters who have been able to divert customer calls. There's few details in the BBC report other than that the calls were diverted and that there is a theory that a former contact centre employee may be involved. An inside job does seem a strong possibility, and the infiltration of call centres by organised crime is a real risk. Although it wasn't widely covered, the BBC reported back in 2006 that Strathclyde Police believed that perhaps one in ten call centres had been targeted by organised criminals (article here). Normally, though, crime in contact centres has been opportunistic and carried out by individuals. A typical example was when the Barclays Chairman, Marcus Agius, had his details and money stolen by one of his own employees (covered on the blog in the post "Security, Call Centres and Fraud").

It is a worrying development if organised crime has, well, got itself more organised, and moved up from individuals stealing details to systematic attacks from the inside on the banks' contact centre systems.

BBC Moneybox on Speech Recognition for banking

I appreciate the BBC Radio's weekly personal finance program 'Moneybox' may not be something that all of my blog readers are aware of, but this week it's been looking at speech recognition and biometrics as a way of authenticating customers.

The article on their website is here and the podcast/recording is here. The reason for the interest is that two of the big UK banks say they are following developments closely and that a major Australian insurer is running the authentication in production. The story is being pushed strongly the vendor concerned, VeCommerce.

I have to feel a little bit of cynicism here. Speech recognition (and it's close cousin, speech biometrics) have been 'the next big thing' more often than I can count. It's not that this isn't good technology (VeCommerce are impressive, as are VoiceVault and a number of others), but adoption has been slow. Part of this, I feel, is that there is a big gap between what the makers of the technology are interested in and what the users/buyers seem to want. This was highlighted in the last Cisco/Dimension Data Speech survey (see here for my blog post on it). The industry tends to talk very technically, while the buyers are much more interested in customer experience. I suspect until this gap narrows, speech biometrics will remain a nice, niche technology having a vigorous debate about how successful it is as an anti-fraud measure.

Fraud in call centres is a big problem (see past posts like "Security, Call Centres and Fraud " from January last year and "Abbey National - did an IVR survey lead to a customer getting locked out their account? "), but I think speech biometrics needs to be much closer to the customer experience before it becomes more widely used.

More 2009 Contact Centre Predictions - Datamonitor

My last post ("My Contact Centre Top 5 Predictions for 2009") seems to have had a lot of interest, so thank you to all the readers who liked it.

I was sent today Datamonitor's latest contact centre reports ("2009 Trends to Watch: Contact Center Markets and Technologies", published 22nd Dec) and can recommend it. We have a corporate subscription to Datamonitor and and I've tended to like Datamonitor's research as it's focused more on the market trends and the buyers needs than on the vendors and their products. I also must admit to using them extensively in the past when I was working in consulting and needed insight into sectors of the retail financial services markets.

The report has some very good points to make about potential growth in the contact centre mid-market and around SaaS offerings. It also highlights that the super-large contact centre (so common in financial services) will probably not be driving forward technology spend in the current market conditions in the way that this segment has driven functionality in the past. I'm not sure about Datamonitor's view on the 'rehabilitation of outbound', at least for Europe and the UK. It is true that companies do want to use the outbound phone channel more proactively and better, but most to date have managed to damage their reputation with outbound (See my blog posts: "Barclays, silent calling & we've been here before..." and "Banks criticised by BBC for automated calls "). I fully agree with Datamonitor's view on the importance of business process (see my blog: "My Contact Centre Top 5 Predictions for 2009", though Datamonitor have an interesting and slightly different view) and the potential growth in contact centre analytics. I think they've got some very good insight on those subjects and I've got some interesting things to think about.

In short, I've found this Datamonitor report one of the better analyst assessments of the contact centre market in 2009 and it's well worth buying.

Abbey National - did an IVR survey lead to a customer getting locked out their account?

This blog sometimes flirts with the idea of news, rather than just comment, and I couldn't resist this story. I saw it today in the Scotsman (though it's also more detail here in the Daily Mail).

In brief a Mr. George Bates, a 23 year old Abbey National customer, phoned his bank to arrange an overdraft. He claims to have found that the operator was rude, unhelpful and with a heavy Asian accent that was difficult to understand, so at the end of the call he used the automated post-call survey to register his displeasure. A lot of banks use IVRs (Interactive Voice Response Systems) for this as it suits the "push 1 for...., push 2 for...." type of menu that an IVR provides. Anyway, Mr. Bates pushed ones and twos for low scores and finished his call.

When he called back the next day his problems began. He couldn't access the phone bank with his password, the ATM swallowed his card and when he got into his branch he found his identity had been changed from the 23 year old Bristol carpenter he is, to that of a 33 year old Ugandan divorcee. His direct debits had also been cancelled and he was incurring bank charges for missed payments. Abbey have now apologised and offered £200 compensation, but Mr. Bates is still unhappy.

There are some lessons from this story worth pondering.

The first is what price does a bank place on its reputation? I've blogged on this before (see: "Are call centres so bad they hinder business?" or "Barclays, silent calling & we've been here before... "), but contact centres can damage an organisation's reputation very quickly. It seems a mystery that such an important part of a customer's experience of an organisation should be managed as a cost centre and yet other functions that drive reputation and brand (e.g. marketing or PR) should be seen as investments or necessary expense.

The second is that while it's admirable that agents should be given continuous feedback on their performance, they really should not be able to take revenge on customers who score them poorly. There's a whole set of issues here, from the granularity of the feedback given to agents to the level of access to customer data that agents have. Supervision, audit trails and analytics might also be points to think of here in terms of how organisations control agent behaviour.

The third and final point is that the public do not much like offshore contact centres. This is an image that the offshore industry has acquired and has not managed to shake off. I'm sure that had a British call centre worker done this the story would have been much less newsworthy, but as it's an Indian call centre (and Abbey have five UK call centres and only two Indian ones) this fits a lot of popular myths about the offshoring industry.

There may be a view that "all publicity is good publicity" (and you certainly couldn't buy the press coverage this story is getting), but I suspect that Abbey will want to change the way it runs its contact centres as they will not want their reputation damaged in a credit crunch that has hurt the reputation of UK banking so much.

Are call centres so bad they hinder business?

I was struck today by an advertisement for Swiftcover.com that I saw from the train. I know customers often don't like call centres (especially offshore ones), but this advertisement seemed to be targeted at those allergic to the whole idea of talking.

Now Swiftcover.com is part of Axa, so this is not an organization without call centre expertise. Nor is it strictly a web only player, as they have been very innovative about developing a mobile phone channel for insurance sales. Clearly there is a demographic out there who hate the idea of call centres so much that they'd rather use the web.
To a certain extent poor experiences from call centres are to blame, but that may not be the whole story. One big change in the retail insurance market is the rise of web aggregators, such as confused.com. These players don't have contact centres either, but they do pull together large chunks of the insurance market in their comparison tables, and make it very hard for insurers to differentiate themselves by brand. I would suspect that although swiftcover.com may be targeting a demographic less than keen on call centres, they are also trying to drive traffic direct to their website and not have a comparison site in the way.
Of course contact centres still have a major role to play, doing what they are good at. Web sites are ideal for simple or generic quotes. Complex matters, exceptions and assessments of options are still done better as a discussion with a person. For that the contact centre is ideal as it allows an insurance agent to cover business without geographic restriction. Using a human contact centre agent as a data entry mechanism into the quotes system (as some insurance contact centres have done) has never been a good use of resources. Skilled advice at the end of the telephone is extremely valuable and it is there that contact centres can help companies differentiate themselves and their brand in an increasingly competitive market.

Barclays, silent calling & we've been here before...

So Barclays, or at least Barclaycard, have just been fined the maximum Ofcom (the UK communications regulator) can manage for making silent outbound calls. The story is well covered here on Finextra.

What is perhaps more surprising is that the maximum fine is £50,000 and that even in a credit crunch this is not going to inconvenience Barclays hugely. There is the argument of reputational damage being a punishment and the media have done well highlighting the story (see "Regulators stuck in a fine mess" in the Times today, for example for really hostile coverage of Barclays) or BBC Business News leading with the story on the day the fine was announced.

Unfortunately I don't believe that reputational risk alone is enough. Finextra mentions that Abbey National, Complete Credit Management and Carphone Warehouse have all been fined for breaching the silent calls rule and that's just for starters. The frequency of these stories of outbound calling making life painful for consumers and damaging brand suggests that reputational risk isn't working.

In July I wrote about the BBC highlighting the use outbound calling by UK banks for debt recovery ("Banks criticised by BBC for automated calls "). It might be an effective way of collecting debt (I've got no evidence one way or the other) but even if it does little for your reputation, the impact of the fine seems low compared to the potential value of a recovered debt.

I've blogged a lot on outbound as it's the area that makes people most aware of and most dislike call centres. As a result, I suspect that outbound calling in the UK is an industry that will soon be dead. The details are in posts like: "Abbey National fined £30,000 by Ofcom & the future of Outbound in Financial Services" or "Outbound, an explanation of the technology" and "Outbound - industry reputation, branding and regulation", but from the feedback I've had, the irritation outbound causes is still not well understood in the industry and the industry is not adapting.

This may though be irrelevant as the number of consumers registering with the Telephone Preference Service suggests that consumers are making their views clear and are making themselves increasingly difficult to reach.

CRM - a way of banks gaining business in a recession?

I'm always suspicious of vendor surveys but this survey from SAP, reported on Finextra, rather caught my eye. It's entitled "European and Middle Eastern banks look to invest in CRM" and focuses on how banks are focusing on CRM to differentiate themselves from the competition.

To a certain extent this is obvious. It's hard to compete on interest rates alone, and most banks don't want to be in the position where they do. Brand is another differentiator, but a great brand with lousy customer service is hardly a way of retaining customers. Given the cost of customer acquisition and the that banks know a lot about their existing customers, it makes sense to manage the relationship better to get more value from your existing customers.

Simply managing a customers relationship well has long been a selling point of banks like HSBC's First Direct operation (see post: "The contact centre agent experience - First Direct" and "HSBC creates 250 UK call centre jobs & offshore in decline"). What's always surprised me is that while bank's have talked a lot about the importance of the customer relationship, very few have really focused on it. The report does highlight some of the challenges but I suspect that these are going to get increasing focus.

One of the problems with CRM applications in banking historically has been that it has been seen as a call centre application (maybe rolled out to branch sometimes) and as a solution in its own right. Of course the reality is that the application is only one part of the solution and the processes that go round it and the quality of the agents that use it are perhaps more important. Perhaps even more important is what the CRM application is integrated to. For example, linking CRM with a marketing spend tracker can provide all sorts of insight as to how effective marketing is, but is rarely done.

I suspect that as the economic climate gets tougher, the banks that know their customers better will be able to make better lending decisions with what credit they have. They will also be able to target their most profitable customers most effectively. The call centre is key here as it is likely to be a strong determiner of the bank's brand perception, its ability to reach its customer base and its ability to take advantage of sales opportunities when they arrive.

Effectiveness of CRM as a measure of a bank's future success? Well, there are probably dafter metrics floating around at the moment, and I wouldn't be surprised if we see a strong correlation.

Channel in Financial Services

One blog I've been reading lately is Dr. Catriona Wallace's blog (Your Call) that covers the Asia-Pacific contact centre market.

She had a good post on 24th June looking at the consumer use of channels in Australian and New Zealand banking. Her research suggests that at least for Australia and New Zealand:

"... there are distinct differences between the BFI consumers and consumers from other industry verticals. For example, there is almost equal preference for BFI consumers to use the internet as first channel of preference as their level of preference to speak to a live attendant. In all other industry verticals the primary preference is to speak to a live attendant. About 9 in 10 BFI consumers are happy to use self service technology for simple transactions and even 4 in 10 are happy to use self-service technology for complex transactions. We just don't see this level of orientation around consumer self-service in other verticals."

She also highlights how demographics like gender and age also have a big impact on how consumers choose channels when dealing with their financial services provider.

I feel it is also well worth looking at is culture when looking at consumer's choice of channel. In Europe I believe channel preference is driven as much by culture as it is by vertical or by demographics. The last very detailed research I've seen on the subject was Forrester writing in 2004, but the differences are clear.

Asked which channel consumers would use to first contact their bank for a service issue, there were huge contrasts between countries. In the UK 72% of customers would use the telephone channel as their first option compared to only 26% of Italians picking up the phone. Branch showed a similar degree of huge variation, 91% of Spanish would go to a branch as their first action but only 59% of Dutch would go. However, 15% of Dutch would e-mail their bank as their first action (remember this was in 2004, today it's probably higher).

These cultural differences highlight how different the role of the contact centre can be. What in one country is a strategic channel for voice traffic in another is a minor channel for e-mail or remote support.

The acceptance of self-service in Financial Services is also interesting. I've posted previously on the Dimension Data/ Cisco Speech survey but this has focused only on speech acceptance for English speaking countries (including Australia and New Zealand). It might be interesting to extend that and see if consumer acceptance of self-service extends to other cultures. Alternatively, it may be that a lot of people phone up to check their bank balance and their priority is to get the answer quickly rather than from a human.

The one thing that I would stress is that despite cultural differences, is that as a vertical financial services has the most complex set of consumer channel usage however the consumers choose to use those channels.

Merchants Contact Centre Benchmarking study for 2008

One report that it always of interest to managers of customer facing operations is the annual Merchants/ Dimension Data contact centre benchmarking report.

This year's has just been released for download (link here) and the published version will be available at the end of June.

There are two big points of interest to me. The first is that now 31% of all inbound transactions are completed by self-service. This is primarily IVR (15.5% of the transactions), followed by web self service (13.7%) with speech self-service and web co-browsing with an agent making up the balance. Ten years ago, 90% of transactions required an agent to complete, so this represents a significant cost improvement.

The second is that CRM systems have not delivered some basic functions. Ten years ago the benchmarking study found that 39% of organisations had a single view of customer for the agent to work with, today the figure is 34%, despite massive subsequent investment in CRM. This will not come as a surprise to anyone who has dealt with a bank recently, but it is a damning statement on the performance of CRM.

The self-service metrics, though are a great cause of hope. Although IVR and its menus of "press 1 for...., press 2 for...." are widely hated if done badly, there are signs of it being done really well. I was in a presentation from Lloyds TSB a few weeks ago and they reported that their self-service channel regularly achieved very high customer satisfaction scores. The reasons for this is that it is well designed, does what it intends to do well and doesn't try to unduly force customers to use it for complex transactions. It can also be used for a simple post-call survey (the sort that takes 15 seconds so the survey doesn't cause customer dissatisfaction itself), which gives the bank a near real-time view of how customers feel about that interaction.

Interesting to see that despite the hype, it may be IVR and speech self-service that are bringing benefits while CRM is lagging.

Phone Banking vs Facebook banking

I was very interested to see two good stories on Finextra today.

The first was that around half of Facebook users want to be able to bank through Facebook. The second was that 91% of British adults had concerns about fraud on their phone accessible bank accounts.

It seems to me a pretty bizarre set of contradictions. Facebook is a very nice application, but I'm pretty dubious that banking through it is a good idea. There are issues over some of the Financial Services advertising (see the BBC "Facebook users warned about ads") and I'm not convinced that data privacy issues are fully resolved, or in line with the standards set by banks (again the BBC with "Facebook 'violates privacy laws'" and "Facebook faces privacy questions"). It may be that as Facebook matures these issues will be resolved to everyone's satisfaction, but I know many remain dubious about entrusting their details to an organisation that has already had to apologise for how it has used them.

By contrast voice technology is far more mature and security concerns should be on a different level. There are weaknesses but they are more to do with processes than the underlying technology. A good example was the case I covered at Barclays (see "Security, Call Centres and Fraud") where there was nothing wrong with the technology, but the processes were not as robust as needed to be against identity theft. At this point (although the research is funded by Nuance a speech technology vendor) I'm inclined to agree with the article that speech recognition and biometrics could make a difference where pass words have been stolen or an identity otherwise compromised. Certainly it had the potential to make a difference in the Barclays case.

The scary thing about Facebook is that if a Facebook banking application were to be compromised, the chances are that the fraudsters would have access to so much personal information that any future identity recovery could be very difficult. By contrast the telephone channel at least offers the prospect that even if your identity was stolen you would only be authenticated by who you are, not what you know.

Banks criticised by BBC for automated calls

I'm working in San Diego this week, but over the weekend I was sent an interesting story.

The BBC Radio Money Box program has been investigating the use of automated outbound calling by UK banks to chase bad debts.

Some consumers claim that this had led to them receiving up to eight calls a day and Privacy International is arguing that this potentially constitutes harrassment. I can see how this is especially frustrating if the calls are chasing a family member no longer resident at that address.

Lloyds TSB, Natwest/ Royal Bank of Scotland and Halifax Bank of Scotland all use these systems to some degree but say they would not call that often. They say they follow the guidelines laid down by Ofcom, the UK communications regulator and (in the example of Lloyds TSB) they would not expect to call more than perhaps four times and not for more than four days in a row.

To me, this just seems another case of the bank's shooting themselves in the foot. I wrote about the ineffectiveness and decline of outbound calling last week ("Further thoughts on outbound in the UK.....") and while automating the calls might make it cheaper, it hardly makes it more popular. This only adds to thoughts I've had in posts like: "Abbey National fined £30,000 by Ofcom & the future of Outbound in Financial Services" that outbound calling is gets the industry a bad name.

I appreciate fully that banks need to chase bad debts (and some consumers appreciate reminders). However with Ofcom looking to release new, almost certainly tighter, regulations on these outbound systems in June, this may not be the best time for the banks to have poor public relations.


P.S. If any reader requires a guide to call centre outbound technology, this past post provides it: "Outbound, an explanation of the technology"


P.P.S.

From feedback, I realise I probably didn't set out the two big problems with this form of outbound clearly enough.

The first problem was reasonably well stated, that multiple calls to an individual may construe harassment.

The second, slightly more subtle point, is that a phone number doesn't necessarily map to an individual. It's quite easy to think of scenario where two parents have children either living at home or using the home address while they are at university. In these circumstances, potentially informing whoever answers the phone that another family member has a credit problem strikes me as a significant breach of privacy.

Software archaeology, financial services and the contact centre

There's an interesting (and brief) post on Grady Booch's IBM blog that got me thinking. Grady Booch, for those unfamiliar with him, is an IBM's Chief Scientist for Software Research but perhaps more importantly developed UML (Unified Modelling Language) and was very influential in the development of Object Orientated programming. I've seen him through my time at IBM and through the BCS (British Computer Society) and I find he always has something interesting to say on IT.

His particular post this week was on the first signs that 'software archaeology' is emerging as a discipline. I think this is long overdue as alongside Enterprise Architecture, management of legacy software is one of the biggest challenges in modern IT.

I've met this challenge regularly when working with financial services customers and it's been well documented (see Silicon.com on the subject last year). The financial services industry was (and is) a sector that understands how IT can bring efficiency and so adopted automation early on. The problem is that today this can mean an environment of very mixed and some quite elderly systems. What makes this challenging is that as business requirements change, an elderly system than ran quietly on its own in a corner might now need to make it's data available to other systems. Even more challengingly, in an SOA type of architecture it may not be easy to predict which combinations of systems they might be.

It's at this point that the project team usually discover that the documentation for the legacy system is incomplete and that most of those in the organisation who could have helped fill in the gaps have taken early retirement. This means that ripping it out and replacing it is not possible. One option is to bring back these retirees as consultants but this expensive and often not practical. The other emerging option is to do some software archaeology to understand what processes and dependencies are actually in the legacy code.

This has been one of the major challenges I've found in the financial services contact centre. The agents, often young or from a non-IT background, expect either a Microsoft Windows type desktop or a shiny, new Facebook style web 2.0 interface. Instead, they find themselves learning from scratch how to deal with OS2 or 3270 terminals and green screens. This has big impacts on agent productivity and training costs. It's also a long way from the type of technology I was blogging on in: "The future of contact centre - Google, Salesforce, Skype & Microsoft".

Unfortunately, though, if the business logic for something like a life insurance policy is embedded in legacy code, and there is no documentation, then that system has to be kept running. As long as there are customers who could make claims (and that's potentially a 30+ year horizon for life insurance), then the organisation has to be able to manage them under the Ts&Cs of the policy and that means keeping the system as it is as there is no other truly reliable source of the information.

It may not be an expected outcome of software archaeology, but one of the big benefits it could bring is for the call centre agent in financial services. A more easily integrated desktop and presentation layer would help agents find the information they need far more easily. I've seen agents in one bank running three monitors each (and having to type out each piece of information the customer gave them three times to get it into into each system) because they couldn't integrate the various system interfaces.

Software archaeology may initially be focused on the back-end and legacy, but could become very important for the contact centre.

Further thoughts on outbound in the UK.....

I'm back from a week's holiday today and I'm catching up on all the news while I've been away.

On article that caught my attention was from the Times on 17th May. The business columnist Sathnam Sanghera had a rather good full page article on outbound call centres.

What I found interesting about it was that so much on call centres is written as the call centre industry talking to itself. There's nothing wrong with that (this blog does it quite a bit), but an outsiders perspective can be a necessary wake up call.

The article describes how he went to a training course for outbound telephone sales agents. A familiar enough idea for those in the call centre industry, but a strange world to outsiders. As a business person, (and one who has hated receiving cold calls) Sathnam was amazed that the industry was viable, writing:

"According to a survey published by the Direct Marketing Association last year, telemarketing accounted for just 5.5 per cent of all UK direct marketing - a decrease from 7.9 per cent in 2005.

Moreover, the hit rate for this ever-shrinking band of telemarketers is tiny. The survey reported that only 3.5 per cent of people have ever responded positively to a telemarketing call, while one Xerox salesman recently interviewed in a US newspaper said that he made 55 cold calls a day which resulted in one sale a week - a success rate of 0.36 per cent.

In other words, the industry is on the brink of dying, and is being kept alive only by the possibility of a rare positive response.... "

This confirms some of my suspicions, that badly done outbound calls have damaged the industry badly. I've written a little on this before in posts like: "Abbey National fined £30,000 by Ofcom & the future of Outbound in Financial Services" or "Outbound, an explanation of the technology" and "Outbound - industry reputation, branding and regulation". From the feedback I've had, the irritation outbound causes is still not well understood in the industry, though the number of consumers registering with the Telephone Preference Service suggests that consumers are making their views clear.

Of course for some industries, other issues will lead to the death of outbound cold calling. For example, in this age of identity theft it is unlikely that many consumers will want do business with a cold call that claims to be from their bank and wants to the consumer to provide information to verify their identity.

Outbound by consent (e.g. "let me call you back at a convenient time") may have a strong future, especially in Financial Services, but I suspect the Times is right and outbound as cold calling is dying.

Lloyds TSB offshores IT, not call centre

An interesting article on Finextra about Lloyds TSB offshoring 450 IT jobs.

What it makes it interesting is that Lloyds TSB has opted not just to keep its contact centres onshore, but create new contact centre jobs onshore.

I've covered this in past posts like "Onshore still growing - Lloyds TSB" but it makes clear that if customer service is important, then onshore has a lot of attractions. Interestingly, I was in a presentation from a senior Lloyds manager on Wednesday and he was explaining that the contact centre (especially the self-service part) is very well regarded by their customers.

The bigger issue here is whether you view contact centre as a cost or part of your brand. I've talked about this before (e.g. "Is cost a contact centre issue or a symptom?"), but it's an issue that still isn't well understood. My view is that if part of your organisation is going to interact with customers regularly and represent you to them, then managing that part as a cost centre is not sensible. If consumers form their impression of you from direct experience, then vast amounts of marketing spend will struggle to overcome that.

Call centre worker gaoled for data theft

An interesting article on Finextra about the recent theft at a Royal Bank of Scotland call centre.

This isn't the first, and certainly won't be the last, example of security breaches from staff. There's been a lot of recent focus on the risks of external attack and how biometrics can help deal with this but the internal threat has been neglected. I've posted on the external attack on Barclays ("Security, Call Centres and Fraud"), when fraudsters stole the identity of their chairman for a credit card application, and there's been some good posts on Finextra (see "Biometrics - what's that all about then?" by Dave Griffiths and "Who's in your Wallet?" by Jarvis Kandik both last month).

In fact, inside threats are perhaps as serious as the risk of external attack. In 2006 HSBC lost £233,000 after it's Indian call centre suffered inside attack (here for the BBC report). Last year the BBC also reported how HSBC and HBoS had been targeted by an organised gang which both penetrated the banks and laundered the proceeds of their crimes.

An internal threat is nothing new - fraud from dishonest employees is something that banks have had to deal with almost from the start of banking. What is new is the level of the threat and its organisation. As an example, Strathclyde Police (who cover the west of Scotland where many call centres are located) believe that organised gangs have infiltrated perhaps one in ten of the call centres there (full report here).

In the end, as I've argued with biometrics, the criminals will be beaten by process, not technology point solutions. If the defences against external attack are strong, then criminals will seek to get on the inside. The correct response is not to strengthen the exterior with biometrics (though I'm not sure biometrics do strengthen it), but instead to make sure that staff are vetted, exceptions or unusual activity is identified and monitored and good management is in place.

Process is not terribly exciting, but it will be the element that determines whether technology defeats criminals or not.

Capital One cuts 750 UK jobs at Nottingham Call Centre

Not the best news from the Daily Telegraph and Finextra, but perhaps one of the first signs of the credit crunch hitting the call centres of UK financial services firms.

I'd wondered in January this year if trends the call centre job market were a warning sign that things were getting much tougher ("Are Onshore call centre jobs always good news?"). The post was triggered by news of increased hiring for onshore jobs in debt management call centres. Come the credit crunch, these firms look like some of the few potential winners.

I was also interested, though, by the Telegraph's comment that Capital One was suffering from increased competition and had reported a 72pc fall in net profit in the three months to December, down from $390.7m a year earlier to $226.6m. In addition, the bank took a $1.9bn charge for loan losses.

Low margins and lots of competition is not a good place to be in and is one of the few areas where offshoring might make sense (other than getting out of the market altogether). I've talked about this before ("Is cost a contact centre issue or a symptom?"), but offshoring doesn't fix a broken business model.

My suspicion is that the credit crunch will mark a big decision for the remaining monoline credit card companies. They need to work out whether they fight for value (like Amex) and can afford a call centre or, if they targeted lower margin business, if they have to think about cost and start looking at self service to control costs.

The impact of mobile devices on call centres

Chris Skinner over at Finextra has a great article "Numbers, Part Eleven: Mobile and Cellphones". Chris writes mainly from a financial services perspective but has some really good statistics on how traffic from mobile devices has grown. Examples include:

• there are three billion mobile telephone subscribers worldwide, 1.1 billion PC users and 1.8 billion credit card holders;
• 1,000 new mobile telephone connections are added every minute;
• 60% of subscribers are in developing countries, and 80% of new mobile telephone subscribers are from developing countries;
• there has been a 10% increase in mobile usage in the last year, resulting in a 1.2% rise in GDP;
• a 2.5% reduction in the cost of remittances results in a 60% rise in volume; and
  mobile payments users average 26% more transactions than card users (according to NTT DoCoMo's Edy studies in Japan).

The rise in mobile devices has had a huge impact on call centres because customers can call an organisation from anywhere. In the past you could assume that the phone channel meant a customer at home, while if the customer was out and about that meant they had to go to branch.

Now customers can call their bank from outside the branch to see if they can get a better deal in the call centre channel. Similarly, mobiles now allow voice and data to presented, rather blurring the distinction between internet and voice channels. I suspect video might well be the next thing for mobiles, from evidence for insurance claims to helping with complex transactions. I've written a bit on this last week (though not specific to financial services) at: Video and contact centre - some thoughts.

I suspect in the future we may not look at the distinction between channels, but the instead think of the distinctions between end-user devices and their capabilities.