Online security at Fidelity - poor?

londonman42

I recently had my old company pension scheme taken over by Fidelity. My welcome pack duly arrived complete with web pin. My username would follow in a separate envelope.

So far..so good. Best practice.

So I got my username. What was it? ASD44ff%? Nope. GGGahhs2h? Nope.

In fact, they use my own name which I think is staggeringly poor security and complete negates sending the two items in separate envelopes. If the first envelope with web pin was compromised then that's it, game over. It wouldn't take anyone very long to 'guess' my username. In fact, it wouldn't surprise me if the fact that Fidelity use the customers actual name as a username is probably already widely known out amongst the criminal fraternity.

When I raised this with Fidelity, they seemed to think that it was OK. Am I really that much out of step with online security and best practice? Did all those years in IT security count for nowt?

Marco12452

You have done the correct thing in raising it directly with the company.
As they haven't given a satisfactory response and this is significant, have you thought of informing the FSA ombudsman ?

http://www.financial-ombudsman.org.uk/consumer/complaints.htm

londonman42

I've made a Formal Complaint to Fidelity and will see how that pans out first.

Loughton_Monkey

londonman42 wrote: »

..... In fact, it wouldn't surprise me if the fact that Fidelity use the customers actual name as a username is probably already widely known out amongst the criminal fraternity.......

Well it is now.

atush

I hope you have gone online and changed your username.

jem16

atush wrote: »

I hope you have gone online and changed your username.

Username cannot be changed. You can also login with your Customer Number - using Name login was a recent addition.

However PIN and password can be changed.

atush

I would write and request a change of username. That one is outrageous. And i agree, very poor security.

I just booked a ferry today for my son. My husband had done the inital registration years ago. I used all our normal passwords (we have around 6) and none worked. He'd used our last name, the numpty! ;-) At least it isn't as sensitive as banking or investments.

jem16

atush wrote: »

I would write and request a change of username. That one is outrageous. And i agree, very poor security.

It's not a username though - it's a login where you can choose to use your Customer Reference Number (Number Login) or your own Personal Details (Name Login).

See here;

https://www.fidelity.co.uk/investor/default-adv.page

Porcupine

Usernames typically aren't regarded as sensitive data. Many people's usernames (for lots of different services) are their email address. The PIN/password is sensitive, and they were right to send it under separate cover. I would, however, have expected some means of protecting against compromise of the single PIN envelope: a registration code, sending the PIN in two halves, checking already-held information on first login, a call from your registered phone, something like that. Was nothing like that provided?

Arguably a random username is actually less secure, because you've more chance of forgetting it and writing down your username and password together.