Designing effective responses for anomalies
I live in a rural area (silos, barns, cows, horses) and retrieve my mail from an unsecured plastic mailbox that periodically gets bashed by graduating high-school students or hit by a snowplow in the winter. We’re currently on our fifth mailbox in 12 years.
Recently I stopped at the box and got out a few pieces of mail, one of which was from my bank. I opened it right away while I was parked at the bottom of my driveway.
Here’s the entire text (yes, all in capital letters, as if it had been printed by a chain printer much like the printers I used when I first started programming in the mid-1960s):
>OVERDRAFT NOTICE
ON 05-10-11, WE WROTE TO YOU REGARDING THE STATUS OF YOUR ACCOUNT. TO DATE, WE HAVE NOT RECEIVED SUFFICIENT FUNDS TO CLEAR YOUR OUTSTANDING OVERDRAFT.
WE WOULD LIKE TO CALL TO YOUR ATTENTION THIS SITUATION AND REQUEST THAT YOU MAKE AN IMMEDIATE DEPOSIT IN THE AMOUNT OF $.19 TO COVER THE BALANCE DUE ON YOUR ACCOUNT.
IF THIS OVERDRAFT IS NOT RESOLVED YOUR ACCOUNT MAY BE CLOSED AND YOUR NAME(S) MAY BE REPORTED TO CHEXSYSTEMS, A NATIONWIDE CONSUMER REPORTING AGENCY USED BY FINANCIAL INSTITUTIONS TO IDENTIFY ACCOUNTS HANDLED IN AN UNSATISFACTORY MANNER.
IF YOU WERE UNWARE OF THIS SITUATION OR YOU BELIEVE AN ERROR HAS OCCURRED, PLEASE VISIT YOUR LOCAL BRANCH OR CONTACT OUR CALL CENTER AT 1-800-XXX.XXXX.
My first reaction was that this must be a phishing letter. I keep a checking account and a savings account established in the old days when money in the bank actually earned significant interest. I had paid no attention to the savings account, but I did not know why it should have dipped into overdraft. I noticed that the letter was obviously printed on a black-and-white laser printer, because the colored logo of the bank was in black and white too. Suspicious, I called the 800 number and was made even more suspicious when the robot voice asked me for my authentication code for the account. Maybe this really was a phishing message designed to extract authentication information from me.
However, after speaking with a helpful person in the customer service department, I was reassured. Although there was no way I could tell if she was for real – asking me for authentication information in no way proved that she had access to the confirmatory records – I did think that her insistence on my speaking to people at my local branch seemed on the level.
And indeed, when I finally made it up the driveway, I logged into my accounts via the Web and did find a $0.19 overdraft in my savings account. I transferred the $0.19 and drove down to my local branch office and closed the useless account.
What lessons can we learn from this situation? Aside from the need to check bank records more frequently to see what’s up, how about the following?
• When designing the programs that automatically generate warning letters, don’t use all-caps; many people are so used to e-mail that they will interpret that as shouting.no guarantee of delivery). Although for legal reasons, paper mail may sometimes be necessary, that need doesn’t preclude using a range of alternatives for quicker notification of a problem:Hyperic Application Monitoring & Performance Management is an example of a monitoring system that can provide e-mail and to designated response-team members.PagerDuty adds such capabilities to a wide range of system monitoring tools.
• The triggers for warning messages should be graduated. For example, if a security program automatically generates a warning message when a user violates a security regulation, consider defining different levels of warning. For example, the warning message when the network access control software discovers that an officially-supplied laptop computer being connected to the network has unauthorized software – say, a game – installed. The system could issue an explanatory message if it’s the first time that user has erred in this way, a warning message about consequences if it’s the second time, and a message explaining that access to the laptop has been terminated pending administrative procedures if it’s the third time. If the messages are going to customers rather than to employees, careful composition and appropriate style are even more important to avoid offending someone.
• Using paper postal mail (moving compressed, dried vegetable fibers stained with pigments) to warn someone – employee, client – about a serious situation is ridiculous: it takes too long and has even less assurance of being read than e-mail (which, remember, has
• E-mail & SMS via mobile phone:
• Robocalls: This alternative calls a target on an assigned phone line and either generates an understandable, if peculiarly inflected, warning or selects and plays a prerecorded warning from a person.
In summary, any system that generates automated warnings should be prompt, polite, appropriately targeted, and graduated by severity of the problem.
