5 Ways CFOs Can Implement an Effective Cybersecurity Strategy
The recent scandal at Wells Fargo, in which bank employees were found to have fraudulently opened more than 1.5 million deposit and credit accounts without customer authorization, could have been prevented if the right CRM system had been in place.
That’s the claim that was made in my recent interview with Joe Salesky, CEO of CRMNEXT, a customer relationship management software provider headquartered in Uttar Pradesh, India. A Silicon Valley veteran and Oracle alum who was personally recruited by Larry Ellison almost 30 years ago, Salesky went on to do several successful startups before taking the helm at CRMNEXT just eight months ago. It clearly didn’t take long, then, for him to draw the conclusion that the Wells Fargo debacle would never have happened if it had been a CRMNEXT customer. Salesky laid the foundation for his argument in a novel way — by differentiating banks from shoe stores:
At shoe stores, you know whether the shoe fit or didn’t fit before you walk out the door. With financial products, you want to fit the product properly, but that will only be determined based on whether the product is used or not used. That’s what defines customer value and shareholder value. Creating an account that never gets used is fishy, right? It’s bad business.
Real CRM — not just lead management, but something that understands the customer relationship — is trying to match the product to the customer, and to make it easier for the customer to do business with you. The system should actually be making the match. And when bank employees are putting products in outside of what the system is recommending for the customer, those would also be observed. So there are multiple ways in which we would have prevented the Wells Fargo issue.
When I drilled down on that claim, Salesky outlined the prevention mechanisms that would have been in place, the first one of which has to do with the manner in which customers are onboarded:
If they had used an online application, they would have had to do what’s called “KYC”—know your customer. When Wells Fargo was onboarding in the branches, where these bank employees were being incented, they didn’t use the same tool that’s used online. [The general population has] joined the banks’ workforce — not as employees, but as customers, with a lot of self-service. We’ve done a bunch of things to make it easy for people to assist themselves, including creating a process to open an account online. Without CRMNEXT, what they did with online account onboarding wasn’t used at the branch level, so the controls weren’t there. That’s one piece of it.
The other thing that was missing is, once the account is opened, from a quality of business perspective, you need a system that knows that an account was opened, whether it was used, and whether the customer had any other accounts. If it never got used, and they didn’t get other accounts, that’s not good business. So CRM, if it’s really not just about managing leads, but about managing relationships, understands patterns of behavior that are good, and not so good.
Beyond fixing the onboarding process, Salesky said, CRMNEXT would have addressed the incentivization issue:
They were setting goals based on new account openings, rather than on new accounts that go active, and that have a certain amount of activity in them. People do what you pay or incent them to do. The system should have helped the person who was opening those new accounts to fit the customer with other products, in the same process, so that the customer became one with multiple points of value. So by helping incent good business, you’ll obviously help prevent fraud, too. I believe people respond to incentives, but people also want to work in jobs where they believe in the company they’re working for, and believe in the value they deliver to the customer.
There’s another dimension to all of this, Salesky argued, that constitutes an incredibly easy fix — two-factor authentication via text message:
Right now, many banks are spending 50 percent of their R&D budget on implementing regulatory compliance. The question really is, what compliance is essential to improve banking? It’s amazing to me, because there’s an area we all know about, identity theft, which is something we could completely eliminate forever, with one stroke of the pen and a small change. It also would have helped eliminate creating an account for a person who doesn’t exist.
The banks all contribute liability data to credit bureaus, like TransUnion and Experian. But do you know what’s missing? This thing called a mobile phone number. And this is where the law needs a little tweak. The way identity theft causes injury is somebody steals your info, and masquerades as you to get credit. The credit issuer will then ding your credit for non-payment, and you have to go prove yourself innocent. If the creditor was required to reach out to the credit bureau and do an active verification, you would get a text message to the mobile number that is on file with the credit bureau to confirm that the credit request came from you. If you don’t confirm your identity by responding to that text message, guess what? The person never gets credit. That new account never would have gotten opened at Wells Fargo. It’s a simple solution to a hard problem. And there’s not one person who should object to it.
Salesky wrapped up this portion of the interview by explaining why CRM heavyweight Salesforce.com could not have prevented what happened at Wells Fargo:
Wells Fargo is a symptom of a problem that is in many, many banks. Banks know that there’s a challenge. Wells Fargo is an example of how that challenge costs you financially, and in brand equity. Everyone is aware of the challenge of fragmented systems, the challenge of not treating the customer as a customer. And these challenges are being exacerbated.
As much as I like [Salesforce.com founder and CEO] Marc Benioff, Marc is a little bit of the problem. Salesforce comes in one department at a time, and because it was built to be a business-to-business, simple CRM, they’re coming in and layering on top of each one of the product areas — mortgages, auto loans, all these siloes of systems — because its platform is built to do lead management. It runs in the cloud, which means it doesn’t have access to all the back-end systems, all the transaction data. Banking systems weren’t built to talk to something outside of the bank — banks are all about trying to secure their systems. The bottom line is, his system runs external to the banks’ systems, instead of providing automation that orchestrates processes within those bank systems.
It can all be distilled into one simple sentence: Banking systems don’t necessarily make it easy for someone to get something done. CRMNEXT can do bidirectional integrations with 100 backend systems in 60 days. Our DNA enables banks not only to have a view across all systems, but to be able to do across all systems. Automation is not about taking people out of a process. It’s about making it a one-minute task for them to complete, so they can instead focus on the customer. This isn’t about automation to get rid of people. It’s automation so that when people are doing a repetitive task, it’s done quickly so that you’re able to talk to customers about what else you might do for them.
Salesky had a lot more to share, including the story behind how a guy whose legacy was born in Silicon Valley ended up as CEO of a CRM company born in India — and why an Indian company got right what CRM companies in this country got wrong. I’ll go there in a forthcoming post.
A contributing writer on IT management and career topics with IT Business Edge since 2009, Don Tennant began his technology journalism career in 1990 in Hong Kong, where he served as editor of the Hong Kong edition of Computerworld. After returning to the U.S. in 2000, he became Editor in Chief of the U.S. edition of Computerworld, and later assumed the editorial directorship of Computerworld and InfoWorld. Don was presented with the 2007 Timothy White Award for Editorial Integrity by American Business Media, and he is a recipient of the Jesse H. Neal National Business Journalism Award for editorial excellence in news coverage. Follow him on Twitter @dontennant.
