When building your title agency’s website, it can be tough to balance security and the overall user experience.

Place too much of an emphasis on keeping things safe, and you may make it difficult for clients to use your service. Go too far in the other direction, and you are putting your client’s data at risk.

One way to get the balance right is by using a corroborative approach; your security will get tighter as the risk to the user increases.

For example:

Just signing up to your service will only require a username and password. However, sensitive tasks like making payments or sending money will need a secure form of two-factor authentication.

This can help prevent malicious attacks such as data breaches and wire fraud. Let’s dive in for a deeper look at how to implement this kind of security.

Encourage Strong Passwords and Include Guidelines

One of the first things clients do when they sign up to a site is choose a password. To keep their account secure, encourage your clients to select a strong one. Google provides these guidelines about how to choose a secure password.

• Longer is better.
• Use a mix of numbers, letters, and symbols.
• Don’t use personal info or common words.
• Use a trusted password manager.

The problem is, many clients don’t know what a strong or a weak password is. Additionally, choosing a unique and difficult to remember password isn’t as convenient for users as choosing the same simple password on each site.

However, you can make it as easy as possible by providing clear guidelines that explain what makes a strong password. Many businesses even require that passwords used on their site hit certain criteria in length and the types of digits used.

Of course, if you do this, you must make the requirements as clear as possible. You can even provide indicators that show when users have hit these standards.

Additionally, you can explain to clients why they have to go through the process. Explain that choosing a difficult password can help protect them from wire fraud and hacking.

Offer Two-Factor Authentication and Make Sure People Use It

Many services now offer two-factor authentication alongside the traditional username and password security combination. This type of verification adds an extra layer of security by requiring the user to input a code that (theoretically) only they have access to, as well as their password.

You’ll likely have seen this on websites such as Facebook, Gmail, and Twitter.

Despite it being an extra step, two-factor authentication doesn’t necessarily mean the user experience will be negatively affected. As a service provider, you can help make things easy by ensuring you support a variety of authentication types; allowing users to choose a method convenient to them.

Some types of verification, such as on-device two-factor authentication, don’t even require the client to do anything else once it is set up. The extra verification takes place automatically on their device.

You should also think about the type of authentication you use in relation to the task the client is performing. This is because some types of two-factor are easier to compromise than others.  

If the service you offer doesn’t have that much risk, then perhaps SMS based authentication is ok. However, if the service involves riskier transactions — such as sending money or bank details — then maybe you will want to use a separate physical authentication key.

Finally, research suggests that even when on offer, a significant number of people don’t bother using two-factor authentication to secure their accounts. As we mentioned above with passwords, explaining to users why it is important can encourage them to take up the feature without negatively affecting their experience.

Get Behind The Scenes Security in Order

Many of the most high profile recent security failures involve cases where customer data has been stolen from the company itself. Companies hit by such breaches include global brands like Adidas, Sears, Best Buy, and Whole Foods. In the attacks, hackers accessed data including credit card information, names, addresses, and passwords.

Luckily, active behind-the-scenes security doesn't have much of an impact on the customer’s experience. Here are some things you can do to avoid being in a similar situation.

Only Store Necessary Client Data

Perhaps the best way to avoid losing your client’s information is by simply not storing it at all. If you don’t store any client data, there is nothing for hackers to steal. If you need some client data, ensure you only ask for the most relevant information and then delete everything once you have finished using it.

Keep Everything Encrypted

Of course, it isn’t always possible to not store any client information. Storing things like credit card data can make it easier for clients to make repeat purchases (think one-click payments on Amazon), or set up a recurring payment subscription.

Encryption can help keep stored data — as well as data being sent and received on your network — safe. This means that even if a hacker does manage to breach your system, they should be unable to read the data that is there.

Use Third-Party Services Where Necessary

In circumstances when it is necessary to have an extra degree of security, it can be best to use a third-party service.

As a title agency, you handle a lot of large transactions, so it makes sense to use a service like CertifID to secure every transfer. CertifID ensures transfers are safe from wire fraud by confirming the identity of each party in the transaction.

If you think this is something you could use, then click here to schedule a demo of our software. As well as wire fraud protection, CertifID guarantees each wire transfer up to a total of $1,000,000.

Conclusion

Balancing security and user experience is a tough thing to do. However, we believe there are two things you can do to get the balance right.

Firstly, make sure that all the steps are clearly explained and easy for clients to understand. Secondly, you can take an approach where the required authentication rises based on the risk of the transaction.