We’ve Upgraded Our Site And Your Login

This morning, I received an email from my bank announcing the release of “the new and improved Internet Branch.”  I think my bank did a nice job with the announcement since they kept the communication short and sweet yet included everything that needed to be said.  The email’s largest emphasis was on the newly-implemented, long-awaited enhancements.  They also provided answers to questions which were sure to arise.  For example, they stated that one now needs to enable pop-ups in order to access statements and they gave instructions on how to do so for some browsers.  They also provided appropriate contact information in case users require assistance.  I don’t know about you, but I don’t think release notes should include anything more or anything less no matter how big or small the application upgrade.

Though I was impressed with the communication (and the fact that I didn’t experience any banking downtime while the latest code was being deployed), I have to question one of the changes.  Why in the world did they change my login?   I’ve been logging into the site using my bank account number for the past 5 years — maybe longer.  Today, however, I was only able to log into the site using my account number without the leading zeros. In other words, if I had been using 000121212, I now need to use 121212 instead. You’re right. This isn’t that big of a deal, but it makes me wonder why they implemented this change.  I have a feeling it was for “business reasons.”  Or perhaps account numbers were being stored as alphanumeric (I think this is the only way to maintain the leading zeros in the database) and there was a need to standardize on numeric only.  I know I have personally witnessed large performance gains from changing account numbers from CHAR(8) to int in SQL Server. In any case, I think my login should have stayed the same.  I don’t think login information should be mucked with unless the user has some say in the matter.  Sure.  There are times when usernames or passwords absolutely need to be changed.  Okay.  Then let the user login using their current credentials and then prompt them to make the change themselves, but don’t make the change them.

In this particular case, I think I would have considered letting the user continue to enter complete account numbers with the leading zeros and all.  In the code, I would strip the leading zeros prior to authentication.  My small brain can’t find ay fault in this approach.  As a coder, I’m thinking, “Keep providing the zeros or don’t provide the zeros.  I don’t care.  I can accommodate and not inconvenience you.”  But who knows?  There may be a legitimate reason for the change and, if so, my bank handled it as well as they could…