The Appearance of Security

Sitekey was touted as the great solution to avoid phishing scams.  When you first log into a Bank of America account, you are asked to choose an image like a basket of fruit.  That becomes your site key or indicator that the Bank of America website you logged into is a real Bank of America site and not a fraudulent one designed to capture your account numbers.

Problem is less than 10% of online customers with site keys will stop and go no further on a so-called Bank of America website that does NOT have the image.

Study finds security flaws on web sites of major banks.

Internet security experts have long known that simple passwords do not fully defend online bank accounts from determined fraud artists. Now a study suggests that a popular secondary security measure provides little additional protection.
--

The Harvard and M.I.T. researchers, however, found that most online banking customers did not notice when the SiteKey images were absent. When respondents logged in during the study, they saw a site maintenance message on the screen where their image and phrases should have been pictured. The error message also had a conspicuous spelling mistake, further suggesting something fishy,.