I am not me: Capital One and the failure of Know Your Customer

A frustrating experience trying to login to an account leads to a rumination on how Know Your Customer (KYC) fails us and our humanity.

Hello there! Stop spending so much time searching online for answers to your money questions. Work with me and I’ll get you on the path to financial success. Find out more.

In the financial services industry, you need to be familiar with a procedure called Know Your Customer.

Know Your Customer—often abbreviated to just KYC—refers to the process in which a company verifies the identity of their customers. The idea is to prevent unauthorized access and increase security.

Have you ever called customer service of some banking or credit service and had to be asked a serious of oddly specific multiple choice questions about your past? If so, then you’ve been subject to KYC.

(As an aside, I have been asked questions so obscure about my life that I had trouble answering them, which made me briefly concerned that I wasn’t in fact me.)

All of this seems, if not straightforward, than at least sensible. No one wants a situation where someone else can impersonate you and, say, drain your bank account, or take out a car loan in your name.

But I fear that we have created a system which penalizes humans and doesn’t actually address the larger problems of fraud.

To start this story of woe, let’s talk about Capital One, and how all I wanted to do was log in.

My history with Capital One

I never signed up for an account with Capital One. I was sort of “sold” to them when ING Direct pulled out of the U.S. market and Capital One took over its portfolio of accounts.

I loved ING Direct. It was the first (to me at least) of those no-frills online banks that offered a superior savings rate without giving up anything of importance to me, such as branches.

And when ING Direct became “Capital One 360”, I went along with it, partially due to inertia, and partially because the service was more or less the same.

In the meantime, I had found Ally Bank, which appeared to do the same thing ING Direct did, but a little better, and I signed up for the service. I’ve been very happy with Ally for the past few years, and moved most of my money from Capital One 360 over to Ally, but never felt moved to close my account entirely.

Hmm, there’s something unusual about you

As part of my yearly account verification, I just wanted to log in and make sure that everything was in its right place.

But I found that it was feeling suspicious about me.

I get this a lot these days, as I use a VPN for all my internet traffic for privacy reasons.

But usually it’s not a big deal. They send an email, and I verify that I’m me.

Unfortunately, Capital One doesn’t like email. They only offered one option: phone verification.

Alas, the phone number that they had on file was years old. And when I tried to input a new number, they didn’t accept it. (No love for Google Voice.)

My only recourse was to call. This was annoying, but it was nothing compared to what was to come.

Call #1

The agent was friendly but firm: in order to verify my identity or even change my phone number, I had to send in a picture of a government ID.

“But I’m me,” I sputtered. “I’ve been an account holder for 15 years. Why do you need me to produce copies of my ID now?“

But she said that it was all part of the process of verifying my identity, and that there was nothing she could do about it. Know Your Customer.

She did say that I could go through the process in one of their Capital One Cafes (I had mentioned that there was one in my town) and therefore wouldn’t have to do this on the internet.

I thanked her, and made an appointment to head to the Capital One Cafe.

The Cafe

Dear Starbucks, in your attempt to manufacture culture out of fast food coffee you’ve been surprisingly successful for the most part. The part that isn’t covered by ‘the most part’ sucks.

– Greenberg (2010)

Capital One Cafes are clearly designed by a marketing team to be a “cool, hip space” where you can get a coffee and “hang out”, and hopefully do some banking while you’re at it. It seems a little cynical, like someone said, “our figures show that this is what the kids want“, and feels a little like hanging out in a…bank.

I went in to get business done, and spoke with Edward (name changed). He was young and hip and very well meaning. But when I told him my plight, he frowned. “Oh, we don’t have any ability to do anything about that. You’ll have to call customer service.“

“But they told me to come in here!” I sputtered again.

“Yeah, a lot of the people who work in customer service don’t really understand how the cafes work. Sorry man.“

Know Your Customer? More like Know Your Company.

We tried calling in together, but we got nowhere. “We’ll have to text a link to your smartphone,” the agent said. When I told him I didn’t use one, that stopped him in his tracks. “Oh. Um, I don’t know. We’re a mobile-first bank. We require a smartphone.“

I left.

Call #2

I spent 30 minutes on hold. When I finally got on the line with Connor (name not changed because he was amazing) I told him my plight.

“We’ll have to text a link to your smartphone,” Connor said. When I informed him of the sad truth, he said, “You know, you’re probably going to have trouble banking with us. We’re really a mobile-centric bank now.“

But we pushed forward bravely. He sent me a code, which on my desktop kept me in a loop asking for another code, until I came upon the brilliant idea to switch my desktop into a tablet emulation mode, in effect, faking a tablet.

Bingo, the link worked.

“Okay now take a picture of your photo ID, front and back.” I did this with my webcam. Multiple times. I made it a work of art: no glare, perfectly focused, centered, dead-on, platonic driver license perfection.

But I got an error each time. Connor said, “I see your pictures, and they look good to me, but the system won’t accept them.“

Know Your Customer.

Connor and I got to talking, and I feel like I started to learn things about him. I learned about his career arc, and what he used to do for a living. And he learned about me, what I did for a living, my relationship to technology, thoughts on banking and finance.

I think if we had been on the phone longer, we could have become friends. I think he learned more about this particular customer than anyone else he talked to that day, or even that week.

Alas, we had tried to verify my identity too many times today, and I had to wait until tomorrow. If Connor detected any irony in this, he didn’t say.

What are we even doing?

I didn’t say this, but it struck me as totally broken that after hours on the phone, and after talking to multiple agents, no one was willing or able to go on record and believe that I was me.

I know fraud is a big deal, but at the same time as this was going on, presumably some company was busy saving passwords in plaintext, and some other hacker was logging into a database and harvesting my account information.

As far as I’m concerned, this whole process might have been easier if I had found someone to hack into Capital One.

Why can’t we short circuit the system? Why can’t someone see the insanity of going through this process merely to let me log in to manage money that is mine?

Call #3

Please listen to this before continuing. Listen to it all. Put it on loop. I dare you. Feel my pain.

The next day, I waited on hold for 30 more minutes before I magically got Connor back on the phone again. Either it was amazing luck, or Capital One employs very few customer service agents in its verification department. You make the call.

This time, I was ready, and we knew exactly what to do. Instead of taking a picture of my driver license, we used my passport, on the theory that one picture might be better than two.

I took the most perfect photograph of a passport anyone has ever taken who wasn’t trying to make a fake ID.

And it worked on the first try. I could have hugged Connor.

I was passed over to another agent, who input the phone number I had been trying to use from the very beginning (the Google Voice number). It worked fine.

(Just think about that.)

And with that, I was in.

I then immediately closed my Capital One account and withdrew all my money.

No more inertia

I had no reason to keep my money there aside from inertia, and this experience pushed me over into action. Also, personally, I don’t want to support a bank whose ethos is mobile-first. I don’t use a smartphone, and for lots of reasons, I don’t support businesses who require or assume that one must.

(I hate to sound like a shill, but Ally doesn’t require a smartphone, and we’re doing just fine.)

Preventing fraud is important, and I applaud Capital One for taking steps to ensure proper compliance.

But it seems like we have built a machine that we can’t control. Implementing Know Your Customer shouldn’t prevent you from being able to, well, know your customer.

Good luck Connor. Thanks for everything.

Everyone struggles with money, but most will try to muddle through on their own. Will you be different? I help people from all over the world reach their financial goals. Let’s talk.