Sunday, January 25, 2009

When is a safety deposit box not a safety deposit box?

For 25 years or so I've had a safety deposit box (SDB), where I keep valuables like birth certificates, savings bonds, passports, stock certificates, etc. It's in a bank about 5 miles from where I live, and I'd like it to be at a more convenient location. It's also at a bank where I no longer have any other business, and I think one of these days they may decide they don't want my safety deposit box business, since they have a limited number of boxes and would like to offer them to other customers.

So my current bank (PNC) just opened a branch that's reasonably convenient, and has "Express Storage Boxes" (XSB), which are similar to but not the same as a safety deposit box:
  • XSBs are inside the bank, but not in a vault with a big door & lock (which is also presumably fire proof).
  • XSBs can be accessed without talking to a bank staffer any time the bank is open.
  • XSBs don't require a signature card to access.
  • The customer has both keys to the XSB, and there's no "bank key" required for access.
So an XSB seems like a fairly poor cousin to a safety box. But as a security specialist, I think about risk management.

What are the threats that a safety deposit box is supposed to protect against, and how well does it actually protect against them?
  • Fire - an XSB is protected by the standard fire protection system in the bank, while a SDB is inside a (somewhat) more fireproof vault. Or at least I assume the vault is more fireproof - it's hard to tell by simply walking in, and asking too many questions might not be a good thing. Banks don't believe in security by openness!
  • Flood - probably no difference here.
  • Theft - divide this into "bank hours" and "after hours". During bank hours, the requirement for matching signatures provides some (minimal) measure of protection for a SDB, as does the requirement for a bank key. However, the bank key is frequently just kept in an unlocked desk drawer right outside the safe, so it's probably not providing much protection. After hours, the vault (presumably) provides some extra measure of protection for the SDB, although the bank itself presumably has cameras, alarms, etc. which would protect the XSB. Both have the same level of protection against insider (bank employee) theft, since they both require the customer's key to open the box, unless the lock is drilled out which would be pretty obvious.
It isn't obvious to me whether a real safety deposit box is worth the additional aggravation, but it just seems wrong to put my stuff in a box in the bank that anyone could walk over and touch. Is the big vault door just feel-good security, or is it truly offering an extra measure of security, given the cameras and sensors that protect the whole of the bank?

Of course there's the issue for both XSB and SDB if the lock gets drilled out, but I'll put that risk aside for another day...