Slightly on-topic. I have been trying with some banks in the UK trying to find the best online banking system and I am not happy with the results so far.
HSBC works quite well but the login system (with a RSA key) is annoying. I can accept it for actions like transfers but most times I just login to check my balance and transactions, requiring a token seems to much for me. Their design, even if not great, works.
MetroBank seems great from the outside but their system has some issues. First, to login you need your account number, a password and three digits from a 8 digits PIN. After logging in, you can do everything without any other measure. The systems fails to login most times unless you realise you can just click on the link in the error message and logged in you are. A friend told me to use the incognito mode in Chrome and it seems to fix this issue, probably with sessions. Their design is not the best. On the transactionspage you can only see 3 or 4 transactions on the screen at a time (without scrolling, that is).
I am waiting to try Santander (which I will avoid now) and Northern Rock.
I have account with both HSBC and smile (online branch of the Cooperative Bank).
HSBC is as you describe - seems pretty secure, but enormously frustrating that you need the dongle just to check balances etc. They'll only provide a single dongle, which is annoying as I want to access my bank from both work and home. The dongle is small enough that you could fit it in a wallet if you wanted to avoid that, but then you're more at risk of losing it.
For Smile, to login you just need your numbers, including 2 digits from a 4-digit PIN selected via drop-down. I guess this is to avoid keylogging but seems a bit odd as a shoulder-surfer could see quite easily. For any new/ unusual payments, the card-reader is needed. They were happy to provide me with a second reader so I can bank from home and work. The reader is too bulky to carry around though, so this is necessary.
The other thing Smile do is heavily plug "Trusteer" software on every login. Fortunately this is not yet mandatory.
On the whole I prefer Smile's approach, though I'd be happier if they could provide a smaller dongle that would be easier to travel with.
I just keep the HSBC dongle on my keyring. Initially I was doing this so that it would break and I could order another one in disgust at how fragile it proved to be, and repeat until they got the idea.
I have been utterly thwarted in this plan. The damn thing refuses to stop working.
FirstDirect is better than HSBC, while still being part of the HSBC group. Their phone service is a lot better, with lower time-to-human, and Scottish accents instead of Indian ones. Their web usability is still pretty bad, though.
There's no ridiculous calculator-shaped hardware token. To log in, FD requires 3 characters from your password, and a "secret answer" — effectively, another password. Infuriatingly, they disable the Enter key in the log in form, so a mouse click is necessary.
FD's web UI is stuck firmly in the 90s, with nested menus, cramped screens, and plentiful transitions. Even the log out button redirects to another screen, in order to ask for confirmation.
Finally, FD give you £100 as an incentive to switch, and an additional £100 if you switch back out.
I still use my HSBC bank account from time to time, so I stand by what I said. In fact, I just checked this for you.
Logging in to HSBC's web UI requires me to "Generate and enter the six digit security code", using my hardware token, which I never have when I need it.
HSBC have been an absolute NIGHTMARE for my business. I'd urge anyone in the UK to avoid them for anything. Below is the rant I sent to their complaints department after I had decided to ditch them after one foul-up too many.
tl;dr: It took me weeks to register; they refused to expedite new codes to me after a cockup at their end; then when they eventually allowed me to use the service they declined EngineYard and Google apps payments every single month for over a year for "fraud prevention reasons".
In the process of switching… not sure who to yet.
--
Over a year ago I began the process of opening a business bank account with HSBC over the telephone. I'd already completed incorporation of my business and had a provisional acceptance from HSBC via their online application system. Someone was to phone me to ask some cursory questions. Through this conversation it emerged that one of the directors in the business had somehow mistaken his gender when filling out his paperwork, and there was a pause while we waited for Companies House to update their records.
A few days passed, and with the records amended, I ventured into the Fulham Broadway branch of HSBC to complete this process. I explained to the gentleman hovering menacingly near the doors what I needed to do.
"I see. Come with me to The Business Centre," he said solemnly, visibly annoyed that I was wearing yesterday's jeans and no socks.
He deposited me in a chair and assured me that someone would be over to see me shortly. Instantly, another gentleman arrived and inquired as to what I needed. I explained my situation again. Ah, yes, of course. I needed to see a Business Advisor. Did I have an appointment? No, but the office was empty. Ah, yes. Right this way.
The second gentleman led me to a third representative of HSBC's towering capacity for inefficiency. A portly lady squeezed into a too-tight uniform, tucked inside a glass livestock enclosure; she motioned wordlessly to a chair. I ventured that I had a reference number. She pecked away with her exquisite fingernails on the tiny plastic keyboard in front of her and then abruptly stood, and stalked to a printer, rolling and heaving her monstrous body against a uniform visibly weakening at the seams.
"What," she said, looking at her screen and then, for the first time, at me, "did you hope to do today?"
I explained, for the third time, that I needed to conclude the opening of my business account–a process I'd started over the telephone and had been assured I could pick up in a real life, physical, open-now-on-Sundays-thanks-to-Nat-West retail bank. She nodded.
"So all we need really is to physically ID the other directors and we're done."
Nobody had mentioned of this, and one of them was in France.
"Sorry, there's nothing we can do until then."
Could I just drag them into another branch and have them sign something? I could. Splendid.
Thus resolved, Director #1 and I went to the London Bridge branch of HSBC a few days later. He was clutching a disparate range of proofs of his identity, from bank statements to utility bills.
We explained to the 'Customer Host' what we needed to do. He ushered us up some stairs to The Business Centre, a grandiose term for two offices, a deserted reception area and a jolly looking woman stationed in a narrow glass booth.
After being left alone for several minutes, with no more obvious option, I approached her and, for the second time that day and the fifth overall, explained what Josh and I needed to accomplish. She motioned to the first office, which had an open door. "My colleague will be able to help you with that."
We went into the office. The man behind the desk looked up from the screen, creating the illusion of progress.
"Can I help yeh?" He asked, through the indolent, Americanised drawl of an east London schoolboy.
Once more I explained. Keep count.
"Yeahyeah, if you just take a seat, someone else will help you widdat."
Widdat, we sat and chatted about central American politics for a few minutes.
Another man, with a hole where it seemed obvious an earring usually was, walked past us into the office with Widdat in it. He gesticulated in our direction and then cast a wary glance over his shoulder at us.
He approached us and, as you might have expected, asked us what it was we were there to do, in a mumbling approximation of Widdat's voice which might have seemed like a parody if the intellectual bar set by HSBC's staff so far hadn't been so terribly, terribly low.
He explained, in a roundabout way, that he had to do some work and had an appointment coming in ten minutes, but that a lady would be along to see us very soon indeed, and that if she wasn't, he'd take care of us.
We resumed our discussion for what seemed like a very long time–and not because of Josh's constant oversimplification of the complexities of US paternalism. Eventually, Widdat #2 came back out and invited us into his office, muttering about the receptionist not being at her desk.
Instead of asking what we wanted to do, he began to faff about with his computer. I trotted out the most succinct version of my mission to date.
"I started the process of opening a business account with you. I was told I needed to bring in ID for the directors so you could verify them. I have one of them with me, with his ID."
"Right yeh but there's loads of paperwork to do to conclude and everything, it's maybe 25, 30 minutes and I have appointments and that."
We didn't need to do the paperwork. Could he just scan or photocopy the ID and say that he had seen it?
"I can take the ID from you but I can't give it back to you. We have to keep it. Sorry. You can either go into another branch and try to get it done or come back here and see me."
There is a box on the form for HSBC's Business Banking application which asks you how much you intend to deposit into the account. I assume Widdat #2 hadn't seen it, because I wouldn't ordinarily expect to fight someone to give them or their business several tens of thousands of pounds.
I lost interest. I told him it was ludicrous. He didn't disagree. We left. As a last chance I dropped into their deserted Clerkenwell branch and spoke to a business advisor who told me the previous HSBC employees I'd dealt with were all idiots and that it was very simple. We had the account opened in minutes.
Internet banking is very important to me because A) it's 2012, and I don't see a very good reason for highstreet banks to exist and B) I quite like the internet. So we registered for internet banking (which you have to do separately: is there really anyone who doesn't have or use the internet nowadays?). There are three parts of the verification system for this. HSBC posted me a 25-digit activation code, a cryptographic dongle thing, and another shorter code.
Ignoring the fact that a 25-digit activation code = 25! possibilities, which means HSBC have leave to create, I don't know, a BAJILLION online bank accounts, it's a fucking usability nightmare. Typing this stupid code into a computer, it's absolute overkill.
Oh, and they sent me two. Neither of which worked. The second one canceled the first, apparently (although they arrived at the same time), so I had to wait for a third code to be sent out. Nobody can do anything over the phone. You have to wait for the codes to arrive by post. They can only send them to the business address, meaning that you have to be in the office to pick them up. I spoke to a manager on the phone and politely asked what they could do to speed up the process of getting the code to me, since it was their mistake. Nothing at all, as it happened. They couldn't give it out over the phone, they couldn't send it recorded delivery, they couldn't courier it to me. Thanks for making amends for your mistake!
So after entering this 25-digit code, and another code which was a mix of alphanumerics, and picking a unique username, and specifying a password, and using my secure key dongle to generate a unique entry code, I finally get access to online banking about five weeks after the process begins, and I can finally pay our providers who have been patiently waiting (because they understand our pain–they also bank with HSBC).
Now, all this is pretty bad but manageable. Shitty customer service, a shitty system, and no attempt to make amends for failing to provide a decent standard of service. But we're set up, right? Not quite. HSBC is the only bank I know that actively prevents you from using your funds by periodically just declining your card.
We're a web business. Every month we pay a bunch of money to our web hosts (the brilliant EngineYard), Google Apps, AWS, etc. WE DO THIS EVERY MONTH. THE SAME AMOUNT OF MONEY. And every month an Indian dude calls me in the middle of my lunch, asks me to confirm a load of security questions, and then asks me to confirm the same transactions that I confirmed with him the month before that, and the month before that and EVERY MONTH SINCE OUR JOURNEY OF PAIN WITH HSBC STARTED.
Meanwhile EngineYard are sending us polite emails saying "Please pay us, your card was declined." The upshot is that we have a bad relationship with our hosts. I'd imagine that HSBC's website is hosted internally, because I know for sure that if it was hosted externally it would GET TURNED OFF ONCE PER MONTH BECAUSE YOUR FRAUD PREVENTION TEAM STOPPED PAYMENT FOR IT.
Three months ago I called HSBC and pointed out that this happens every month. "Ah yes Mr. Spencer, I can see that in your account. I can confirm that we will not phone you again about these transactions." Bull. Shit. Two months ago when they called back I brought it up again, in a slightly more irate manner. "Ah yes Mr. Spencer you need to speak to my colleague about that, hang on." I spoke to his colleague and explained it all AGAIN.
Then they called back a few weeks ago. I explained it all again. Everything was fine, again; no fraud or unusual activity (SO WHY DID YOU CALL?). The card is fine and working, the EngineYard payment will go through, I'm told. I explain to the guy that if I ever have a phone call like this again where I have to explain, for the millionth time, why my business uses American hosting providers, I will change banks and never look back. "No, no Mr. Spencer, I'm trying to help you. You just need to speak to my colleague..."
No, I don't. I've spoken to everyone. Nobody I have ever dealt with at HSBC has any respect for my time. I've repeated myself dozens of times with HSBC to no avail, at every step of the process, to different staff members who can't pass a message along to save me from having to explain it again.
I tell the Indian guy that I'll leave him to resolve it. If he can't then that's fine, we'll switch banks.
He calls back to say it's all resolved. A week later, an email from EngineYard. Card declined.
My wife has a horrible time with HSBC, and I always get a bit aggitated when I see people recommend them, so I'm glad to see other people sharing their horror stories about them.
Her situation is that she visits family in Canada once a year. They won't make a note of her being out of the country if she calls them beforehand. The fraud people then call her if she needs to use her card at unsociable (for Canada) hours and never leave answerphone messages. When they do get her, they require her to answer security questions without identifying themselves first. If she calls them, the person she speaks to has no way of knowning if anyone has been trying to call her for any reason.
The problem is that they all suck. In the UK, I've tried NatWest (RBS), Lloyds, Barclays and HSBC and so far, and HSBC are the least worst... they are by no means good, but they're better than many of the others. They still have numerous problems though: customer service agents that disagree with each other and provide inconsistent information, that annoying online banking dongle, payments being declined at random (particularly embarrassing in shops).
Still, at least unlike NatWest, it didn't take 3 weeks of dealing with different customer services staff to withdraw some cash, and I never got their online banking to work at all... after repeated attempts. Every customer service staff member would make excuses about not being able to help me due to their security restrictions.
HSBC is one of the only banks to have a section on their Online Banking where you can tell them your travel plans and which cards you will be taking. Has always prevented fraud calls for me.
I don't know what the hell you do in real life, but you need to write books. Seriously your 2 comments were engaging, hilarious, and just fun to read. It's like a mini-story in a comment.
Out of all the incompetent people you mentioned, why did you feel the need to refer to another incompetent, who happened to be Indian, as the Indian dude. :( ... little things like this constantly remind me of our perception in the world.
It's because all those big corporations outsource their customer service to India and surrounding countries, and whenever we get a call from those outsourced agent, they're always unable to do anything because they're not given access to the big corps network. So specifying 'Indian' most likely meant that - the typical outsourced customer service - instead of being a specific rant about the nationality. It could be any other nationality if the Call Centre of this World were held somewhere else.
Now I'm not saying this is appropriate or not, I'm just explaining the reference.
The Indian guys I speak to are never incompetent. They're always super helpful and friendly. I pointed out that he's Indian because it shows, for me, that HSBC cares more about bottom line than they do the user experience. It doesn't mean that the guy can't provide the same level of support than someone in the UK, but it does mean that a whole bunch of users are going to phone up and have problems with the accent or feel that the support team is disenfranchised from the bank, and misattribute a negative outcome of the incident to the fact that the person is Indian. Whilst I'm super cool about Indian CS I really hate phoning Sky's customer team which is based in Scotland. My family is Scottish and even then I find some impossible accents up there.
Thanks for reminding me, I've been meaning to switch from them for a while. Their telephone banking works until you want to ask them anything unusual (like more than ordering a new card, they just can't tell you any information - it's totally shit.
This has been exactly my experience with HSBC. I moved to First Direct half a year ago, and so far, no fraud prevention Indians. Or Scots, for that matter.
i opened an account online (US) in ... 2006? Transferred some money in - maybe $500? I don't know for certain because... read on.
In 2008 I went to check my balance. Whoops... can't remember my password. Whoops - you tried 3 times and we locked you out. Whoops - our 'internet banking people' aren't available 24/7. 3 days later - whoops - we'll have to sent you something via the postal mail to reset your password (after I'd already answered 5 ID questions on the phone). 7 weeks later... nothing in the post. Call up - resend via post. 6 weeks later - nothing. "Sorry, there's nothing else we can do for you." "Can I have my money back?" "Sorry, we can't confirm who you are".
2010 - Letter from HSBC closing my account for inactivity. So... they know how to get a physical letter to my house. They know who I am. They know how much money I have (and have reported $1 interest to the IRS for 1099 tax forms filed every year), but they can not see fit to actually deal with me as a customer, even after holding my money for 6 years.
My experience with going in to big megabanks is that the 'internet' and 'branch' worlds are two completely separate worlds. I would expect HSBC at a branch to sit me down at a phone to talk to someone on their 800 number, like BoA does when I have a problem there.
If it would have helped, why would HSBC people on the phone not have suggested I go to a branch to resolve things?
I'm in New Zealand and haven't been into a bank once in 6 years (well, I did once but then found I could do what I wanted on the phone, so did). My wife and I have bought 2 houses and sold one 1 in this time. Papers signed at home by roving bankers and everything else by phone, email etc. Some things might require contact (business stuff?) but my stuff doesn't.
And here I thought Bank Of America was crappy for sending me a letter about fraud on my Home Equity Line of Credit which I do not have. And I did check, I still don't have one, and have refinanced since then which would definitely have turned one up if someone had committed identity theft.
I like the Barclays mobile app. You authenticate it once using a pin sentry device, and give it a pass code, and from then on you can just use that pass code to get your balance using the app. The app also acts as a pin sentry when you want to access your account using a computer.
That sounds like the same workflow as the HSBC app. I like it a lot and use it all the time to check my balance but it does not show many transactions, maybe ten only?
I've used quite a few over the years, Lloyds TSB was probably the best in terms of usability (but others will likely disagree). If I were choosing a bank though, I would be more interested in their ethics, hidden charges - which usually means avoiding PLCs.
HSBC refuses to allow me to login. I am unable to use their online banking. HSBC have been unable to fix this for me, despite months of trying. I gave up two years ago. I might try again.
HSBC works quite well but the login system (with a RSA key) is annoying. I can accept it for actions like transfers but most times I just login to check my balance and transactions, requiring a token seems to much for me. Their design, even if not great, works.
MetroBank seems great from the outside but their system has some issues. First, to login you need your account number, a password and three digits from a 8 digits PIN. After logging in, you can do everything without any other measure. The systems fails to login most times unless you realise you can just click on the link in the error message and logged in you are. A friend told me to use the incognito mode in Chrome and it seems to fix this issue, probably with sessions. Their design is not the best. On the transactionspage you can only see 3 or 4 transactions on the screen at a time (without scrolling, that is).
I am waiting to try Santander (which I will avoid now) and Northern Rock.
Any good experiences?