According to the responses to our survey results, an estimated 4,990 banks, or about  15 percent) of the banks in the United States, plan to offer some type of on-line banking service to their customers by the end of 1998. Although U.S. banks offer a wide range of services on-line, reviews of account information and funds transfers between a customer’s accounts were the most common services reported to be available to bank customers at the time we conducted our survey in June 1997. Half of the banks reported that their expectations were met, and another 77 banks (42 percent) said that their expectations were exceeded. Some Banks That Reported Offering On-Line Banking Said They Did Not Conduct Risk Assessments

On-line banking presents a wide range of potential risks, according to information security experts and banking regulators. However, 12 banks (13 percent) said they had not performed such assessments. Another 16 banks (17 percent) did not know if they had performed risk assessments of their on-line banking systems. To help prevent unauthorized access to on-line banking systems, information security experts and regulatory officials emphasize the importance of banks’ implementing mitigating controls, such as restrictions on access, secure firewalls that restrict access between computer networks, intrusion detection software, and tests of on-line banking system vulnerability. Some Banks Reported Problems With Their On-Line Banking Systems

For the 93 banks that they directly represented, we asked bank officials for information on the types of problems they had experienced with their systems, whether other banking systems were connected to their systems, and the types of controls they had in place to mitigate risks. Although responses of most of the banks we contacted indicated that their on-line banking systems had met or exceeded their expectations, the introduction of on-line banking technology exposes banks and their customers to risks from electronic interception, data corruption, and fraud. Although many of the banks we surveyed had conducted such assessments, others had not and, thus, lacked assurance that they were taking appropriate mitigating measures to protect their on-line banking systems. Telephone Survey Instrument

Objectives, Scope, and Methodology

Our objectives for this assignment were to determine (1) the number of banks and thrifts (referred to as banks in this report) that reported they offer, or plan to offer, on-line banking and the types of services they reported; and (2) the experiences reported by banks in implementing their on-line banking systems as well as their efforts to mitigate associated risks. We obtained information for 185 banks on (1) the channels used to deliver on-line banking services, (2) the reasons for implementing on-line banking, (3) whether on-line banking met or exceeded expectations, and (4) the electronic links that banks had with other payment systems. 3.
Why GAO Did This Study

Pursuant to a congressional request GAO reviewed: (1) the channels used to deliver online banking services; (2) the reasons for implementing online banking; (3) whether online banking met or exceeded expectations; and (4) the electronic links that banks had with other payment systems.

What GAO Found

GAO noted that: (1) as of June 1997, an estimated 7 percent of U.S. banks offered online banking services, which most typically allow customers to access account information and transfer funds between their accounts; (2) on the basis of plans reported to GAO by surveyed banks, GAO projected rapid growth in online banking over the next year and a half as the number of U.S. banks implementing online systems is expected to increase about fivefold nationwide; (3) bank officials identified three primary reasons for their banks' offering online banking: keeping existing customers, remaining competitive, and attracting new customers; (4) officials of 170 of the 185 surveyed banks offering online services said their online banking systems had met or exceeded their expectations; (5) although an estimated 47 percent of U.S. banks reported that they expect to offer online banking services by the end of 1998, introduction of this technology brings with it some attendant risks; (6) responses from 93 of the banks GAO surveyed indicated that some had not performed risk assessments, which can serve as a tool to protect the integrity, confidentiality, and availability of their online operations; (7) although 65 of the banks responded that their banks had assessed the potential risk exposure of their systems, 12 banks reported that they had not assessed these types of security risks, and another 16 banks said that they did not know if they had assessed such risks; (8) risk assessments are an important step in protecting an online system so that appropriate controls can be implemented to mitigate risks; (9) although many of the 93 banks that responded to this question reported they had implemented controls to prevent unauthorized access to their online systems, 9 banks said they lacked firewalls for restricting access between computer networks; (10) 10 banks reported that they did not have such basic security features as detection software for computer viruses and worms; (11) many of the 93 banks that responded indicated they had experienced lapses in service, security problems, or system operation difficulties; and (12) with the projected rapid growth in online banking, it is important that banks take those steps necessary to ensure they protect their online banking operations.