OCBC hits a mobile milestone

case study When Singapore-based OCBC Group announced the launch of its mobile banking service, it marked yet another milestone for the company.

But for the team largely involved in that maiden voyage, it also signaled the culmination of many months of strenuous hardware and application testing as well as market research.

"It was an exciting journey," recalls Yvonne Cheong, OCBC's vice president of delivery for consumer financial services, in an interview. "Our first foray into mobile banking back in 2005 created a good opportunity for us to measure the market and understand our customers' immediate needs."

Earlier in 2005, the bank had partnered with local service provider StarHub to extend its consumer banking services on the telco's newly-launched i-mode network. But that corporate honeymoon is now over.

Company The OCBC group is one the oldest banks in Singapore with a global network of branches covering 15 countries and assets totaling S$144 billion (US$93 billion) . The bank and its subsidiaries offer a wide range of financial services from consumer and corporate banking to global treasury and stockbroking services. Project Mobile phone banking Objectives • To grant customers instant access to a variety of banking services using their mobile phone • To change the consumer mindset on mobile banking by creating a secure yet easy-to-use service • To create an extension for its customer relationship management (CRM) system Budget Undisclosed Timeline The project began in late 2005, with a soft launch in Jul. 27, 2006, to beta test the service. The service finally began operating commercially on Dec. 18, 2006. Tech partners Microsoft; Sony Ericsson Key learnings • With customer loyalties divided across the different telcos and handset makers, the project team learned that in order for the service to succeed, they had to target "the lowest common denominator." This meant forging close ties with members of the telco industry to allow the service greater penetration. • OCBC discovered that the system and user interface design were limited by a phone's form factor. • Resist the temptation to lace its mobile banking interface with too many multimedia add-ons, fearing it might lead to unnecessary technological bloat.

With local consumer loyalties still divided across the different telcos and handset makers, OCBC's new business strategy is to reach out to a wider audience, explains Patrick Chew, head of delivery for consumer financial services.

"We want to make this service available to as many customers as possible," says Chew, adding that OCBC is now the first bank to allow subscribers from all the three telcos in Singapore--StarHub, SingTel and Mobile One--to access its consumer banking facility.

"But we do not see mobile banking as a pure standalone channel," Chew reiterates. "This channel plays an interdependent and complementary role with our existing suite of delivery channels."

As Chia Cheng Kiat, assistant vice president of delivery for consumer financial services, puts it, OCBC's mobile banking model presents a win-win situation for both telcos as well as the bank's technology partners.

"The more applications that can be used on the phone, the more different purposes the phone will serve for the user," says Chia. "And for the telcos, it increases output revenue per user."

Labor pains
It was not all smooth sailing, says Cheong. Like any project in its infancy, OCBC's mobile banking team encountered their fair share of complications, especially where technology was concerned.

"We went through some initial labor pains. [We discovered that] system and user interface design were limited by a phone's form factor. But we had strong IT support, and it helped us cope," admits Cheong, adding that the mobile banking system was developed largely by an in-house team of engineers.

Investing in technology that was familiar, Cheong believes, was a smart and cost-effective move on the company's part.

"We actually used Microsoft's .NET framework to build the back-end portion of our system and J2ME for the phone software client," says Cheong, praising the robustness and flexibility of both platforms. The .NET application was also previously used in the creation of the company's Internet banking service.

"Since we have solid and robust multiple channels riding on this technology, it was a natural progression. The technology met our requirements and it helped us move quickly in terms of application and system development. It would have otherwise taken us years--plus and arm and a leg--to do this."

But the company wasn't shy to ask for external assistance when the situation demanded it. For example, to ensure the new system was up to the new security standards set by both the bank and the Monetary Authority of Singapore (MAS), OCBC contracted several security experts to perform audits to identify potential "weak points" and to further toughen the system's overall security.

According to Chia, the project team went through months of hardware testing and security hardening before it even considered the system ready for commercialized deployment.

"We used various testing methodologies for security," says the OCBC executive, explaining that mobile phone security work on a set of rules that differed from Internet banking.

"For the Internet, we have encryption on top of the normal Secure Sockets Layer (SSL). It's the same approach on mobile phones--you encrypt and secure the data and information--but for Internet banking, the encryption lies between the browser and the Web server, and the tail-end is [sometimes] still vulnerable. For mobile banking, even this end-portion has been encrypted to harden security."

After some tweaks, OCBC's mobile banking user interface is now in its second iteration. According to Chia, the bank has thus far resisted the temptation to further lace the interface with multimedia add-ons, fearing it might lead to unnecessary technological bloat.

The project team had to test each and every individual phone model to make sure it could run the mobile banking client properly. "There's no shortcut, unfortunately," says Chia in resignation. "We had to go through the motions again and again."

Compared to OCBC's Internet banking platform, Chia noted, the mobile banking project required fewer human and financial resources.

"[Internet banking] uses a different technology, [thus] the different economies of scales," he added.

Enter the 2-factor
According to MAS guidelines, local banks must adopt two-factor authentication for Internet and mobile banking, and OCBC claims to be the first bank in Singapore to allow a mobile phone to be used as a token for two-factor authentication.

Says Cheong: "We just rolled out two-factor authentication for the mobile. We use the mobile phone as a security token to generate an additional one-time key so that a user can log into either the Internet or mobile banking sites. So that enhances the level of security because on top of the personal identification number (PIN) you know, the phone also has to generate a random PIN."

OCBC currently offers three flavors of two-factor authentication for its customers--hardware, SMS or mobile phone as a token. Chia, however, personally favors the latter for a token.

"[With a phone,] you don't have to carry an extra hardware token," he argues. "Security-wise, if you lose your hardware token, you won't know till later. But if you lose your phone, you'll know almost immediately because you're more attached to your phone."

What's coming next
Although the mobile phone banking service's soft -launch was six months ago, for OCBC, the battle for the hearts and minds of customers has only begun.

As the company plans to promote the service to its 300,000 account holders in Singapore, the challenge, according to Chia, will not be technological but rather the human element, trying to persuade customers to adopt mobile phones for banking. This will require the dispelling of a few industry myths.

"When banks first started using ATM machines, people were afraid whether the machine would eat up their money," said Chia. "And when Internet banking came along, people where questioning the platform's security--was it safe to perform transactions?"

Nicholas Cheong, vice president of delivery--consumer financial services at OCBC, believes the time is right for mobile banking to succeed.

"The stars are aligning for us," said the senior executive, sharing a bit of corporate insight. "New technology used to take decades for adoption. [But] the general trend now is that it takes consumer technology shorter time to reach critical mass."

He also noted that, in Singapore's context, the average consumer is becoming more receptive to the idea of performing high-risk activities like banking using their mobiles.

"We noticed that consumers were becoming fairly comfortable using a mobile phone to do different things, whether it's downloading ring tones or screen savers. [Based on our customers' transaction history], usage ranges from transferring $10 lunch money to a friend, to sending $10,000 for purchasing shares. It shows that people are receptive and comfortable to the notion of banking on mobile phones."

Other issues are more ancillary in nature, like those of hardware compatibility. Although OCBC's Web site lists support for more than 50 locally-approved handsets, one notable absentee is RIM's popular Blackberry messaging device.

As the person responsible for quality of service (QOS), Chia is making it his personal crusade to ensure OCBC's mobile banking service is usable on as many mobile phone models as possible.

"[At this stage,] there's a little bit of teething problems with certain phone models," he admits. "But I can say our systems will work with models that were introduced a year and a half ago. We test with as many phones that make it to local shores, with the exception of some parallel import models."

To highlight OCBC's commitment to its new service, Chia adds that the mobile banking team will continue to work closely with the major handset makers and go one step further by testing with prototype models before there are launched.

"That kind of collaboration can benefit both parties," enthuses the OCBC executive. "Rather than being reactive, we are being pro-active in ironing out compatibility issues during the prototype stage."