With the recent introduction of their much–maligned two-factor authentication system, HSBC overhauled their internet banking interface. The Secure Key system prompts users to enter a memorable answer followed by a code generated dynamically from a separate hardware device (the “secure key”). Consistent with guidelines on the importance of providing timely and useful feedback (e.g. Nielsen; ISO 9241-17), entering one’s details triggers a visual indicator whose meaning is apparently obvious but which actually differs to one’s expectations and is therefore ultimately misleading. More →