Francisco Chronicle had an article last week about a payment processing
company called Dwolla. Based
out of Des Moines, Iowa, Dwolla enables a person to make a payment directly to
a company or to another person all while avoiding processing fees associated
with credit and debit card payments.
We took a look at the platform, and upfront it seems like a
convenient option. However, we question the real security of it. When we signed
up for an account, it was relatively easy. We used Facebook Connect, so if a
person has your identity authentication from using Firesheep
they would be able to create an account for you.
An email was sent to you, which you had to confirm before
you could start accessing the information available through Facebook Connect,
like finding your friends you would like to send a payment to.
And you entered a 4-digit pin, which is required for you to
enter when you make any changes to your account.
We didnt add bank account information because we have a
concern about the lack of dynamic knowledge based
authentication. While we think its a very easy to use and convenient
platform to use, we suggest they should add in different fraud prevention
measures. Or if they are available, to make them more visible on the site.