I have just received an official email communication from MBNA which contains the following text:
For your additional peace of mind, every customer e-mail sent by MBNA Europe Bank Limited, including those on behalf of its Credit Card Partners, will include your postcode:
AB123CD
(Obviously I have removed my real postcode there)
In what universe is a postcode considered a secure piece of information? This does nothing for my peace of mind since my postcode is not hard to obtain by anyone who feels like doing so. You do not need to be MBNA to have my postcode. There will be some people out there though who don’t think it through and now when they receive an email saying it is from MBNA (or a Credit Card Partner! And let me tell you I am on the edge of my seat over the kinds of Partners I could soon be receiving email from!) quoting their postcode they will feel just that little bit more convinced that it’s real.
If a service provider wants to alert me to something or pass on some information that they consider it worth proving their identity over, then either they need to use proper digitally-signed email (yeah right) or at least just tell me to log in to my account in the usual way (no need for a link!) and view the message there. Which is what my bank, smile does, and what Egg Money does, and what Paypal does. But not MBNA; they must be new to the credit industry!
And while I am all worked up over this, what is with the email coming from mbnaapply.co.uk!? Were the domains mbna.co.uk and mbna.com not enough? Oh and a third one to do the actual online banking through? Get a clue. You need precisely one domain name; you can use http and https versions of this, and by this means build up a consistent brand and identity which really does go some way to promoting peace of mind. All these stupid extra domains represent the people with good sense at your company being forced to bend over and take it from the muppets known as “The Marketing Dept.”
This kind of stupidity is a great way to encourage me to use your plastic as a balance transfer tool and nothing more.
I can understand (slightly) them thinking that a postcode might help peace of mind. But using a separate domain like that!? That is precisely the trick scammers use. Usually it’s easy to tell when an email is spam, if it’s from “paypal-security.com” or similar. I really am amazed they get away with that…
Heh, I thought the same! I just found this post because I was looking for references to mbnaapply.co.uk. I did check their WHOIS though, and after this post am a bit more reassured 🙂