There’s no such thing as a secure bank. the best any bank can do is design its systems in such a way that mitigate any losses should a breach occur. Back in the mid-nineties – yes, it really was that long ago – I was privileged to be asked to be the system design architect for a major UK global bank’s app-based banking customer help desk architecture.

For me, it was a case of right place right time and it gave me a unique insight into how a global bank can transition from being branch-centric, to phone banking and onwards to digital delivery.

That bank was Barclays. And their operation in Coventry was the slickest and most customer focussed environment of its kind.

I can’t talk about specifics as my NDA is perpetual. But I will say that the experience in that bank and others like it qualifies me to talk about the challenges tomorrow’s digital banks face and the potential disasters they could be lining up for themselves. And while I deliberately don’t follow it too closely now, what I see of those “evangelists” driving the New Banking scares me. A lot.

security is a myth – everything is breakable

There’s an old saying in system security design. Everything you build can be unbuilt. Everything you lock can be unlocked.

That’s a basic premise of risk management. You live with it and mitigate against it as best you can. But never – ever – underestimate that eternal truth. Let me give you an example of just one fundamental difference between a conventional branch network and a digital network.

breaking bricks

We’ve all seen the bank heist movies. The strong-arm thugs armed with explosives and guns. That daring escape in a scream of burning tyre rubber, sirens and alarms. But the worst that can happen is as tightly stage-managed as any movie score. It’s all under control – the risk is mitigated.

The amount of cash each branch can keep on the premises – even the notes in the ATM is risk assessed. If the neighbourhood is dodgy, the location exposed, the bank construction weak, the less cash and system access the branch will have. Next time you withdraw cash at an ATM, if you get small denomination notes, then its for that reason. To restrict potential losses.

The worst that can happen is restricting to that one piece of real estate.

cracking code

OK, moving forward to today and tomorrow. A pure-digital bank has no branches. Wow. What a saving. No premises to maintain, no local staff to worry about. But you’ve removed your first line of risk mitigation.

The customers and potential robbers aren’t walking through your branch door where the exposure is small and controlled. Now they’re a silicon wafer’s distance away from everything. Your lock is now digital. Its a binary tissue paper. The team you employ may be well paid, but believe me, the team that can break it down is paid much more. Be afraid, be very afraid.

Regardless of what you design, the tools you have will be less sophisticated than the people wanting to take it all away from you. However many firewalls you construct, each one you create can be taken down. You aren’t inventing anything that doesn’t exist; no bank can afford that. And what’s more, the person capable of doing that for you, you can’t afford.

not if, but when

Every bank has been raided. Every one has lost money sometime. If one bank branch out of 1000 is robbed, the losses will always be far less than 1000th of the free cash. But if a digital bank is compromised it could all be gone in a nano-second and the trail wiped just as fast. Its inevitable that this will happen, if not sooner, it will be later.

But you know the funny thing, the only way to mitigate that loss is to distribute it. You know, like a branch network. Still think losing those branches saves you money?