Picking a fight with the banks

Cecilie Wian, who specialises in abusability, examines how systems can be turned against the people who use them. This talk focuses on personal banking in Norway, where online banking is routine and where, she argues, private customers get fewer protections than businesses do.

The core problem is that account access is all or nothing. Power of attorney and shared accounts give one person full visibility into another's money and transaction history, and the bank sends no notice when access is granted. Private customers cannot see access logs, while even very small businesses can. Paper forms remain valid, and the speaker described how a one-page form with two witnesses, never checked against a signature on file, gave a volunteer full access to an account. Businesses can also set up dual signing and transaction limits, which private accounts usually lack.

The speaker described trying to get attention for these findings. Earlier reports were often dismissed as intended features, so she wrote a reader letter to a major financial newspaper and later took part in a televised debate with a bank director. That led to more coverage and invitations from other institutions. For practitioners, the takeaway is to treat shared finances as a threat model, and to ask banks for approval by two people, access logs, and alerts whenever access changes.