How can we show our end-users that we are trusted by a bank?

Question

We are developing an website which serves end users of many organizations
(banks , municipalities etc).

We have already setup meetings with the banks and they've agreed to work with us.

Ok so let's say that a user user1 of bank bank1 is entering bank1's website - then he sees a legit certificate of bank1 and a link for newService1 - : "For using the new service please click here"

This way - user1 can be sure that the new service is trusted by bank1 since bank1 showed the link to user1.

Question

But what about the scenario where user1 has entered newService1's website directly and NOT via bank1 ? How can I show the user that newService1's website is trusted via bank1 ?

Sure I can create a link (in newService1's website) which says : "This service is trusted by bank1 - click here to see confirmation page in bank1's website".

Are there any other trust mechanism which newService1's website can implement to show user1 that newService1's is trusted by bank1 ?

NB
By trust I mean some kind of proof for user1 that bank1 has agreed to work with newService1's .

OAuth with the bank. I'm not sure that there could be any other way to establish trust with a 3rd party. — schroeder, Aug 23 '17 at 11:02
Then it's a messaging problem. Get the bank to host a page describing the relationship and link to it on your site. — schroeder, Aug 23 '17 at 11:15
Another what-if: a phisher craft an email pretend to be `newService1's` — mootmoot, Aug 23 '17 at 13:08

score 2 · Answer 1 · answered Aug 24 '17 at 08:54

If it is possible in your scenario, you might want to "multi-host" your service, under a subdomain of their domain.
E.g. newService1.bank1.com, and have them provide you with their own HTTPS certificate.

This creates an environment where you not only trusted, but it is THEIR service - at least from the perspective of the user, especially if you provide whitelabel branding, their logo, etc.

Note that in this case, you should isolate the bank from other tenants' service - on the backend as much as is feasible, but especially from the user's PoV. E.g. don't make the user re-select which is his bank, or any other bank-defined configuration, you need to function as if you ARE the bank's system. Or if you send out emails to users, these should be identified as the bank's newservice.

(P.S. this also can give you some great marketing tools, onboarding options, and easier to close the sale with many organizations... )

How can we show our end-users that we are trusted by a bank?

1 Answers1