FTC Compliance with Chris Farrell - Part 2
20 Jul 2023 · 21 min
In this episode of Accountants LawPod, hosts Linda Artesani, Sarah Prevost, and Steven Libhart (via a brief intro from Tiara) continue their discussion with guest Chris Farrell about the practical hurdles accounting firms face in meeting FTC‑mandated multifactor authentication (MFA) and broader cybersecurity requirements. The conversation highlights the frustration of using short‑code texting, 10‑DLC numbers, and shared phone lines for client bank‑account MFA, and how these obstacles lead firms to leave MFA disabled. Chris explains Liscio’s upcoming line‑management feature that centralizes MFA codes on a single shared number, reducing “who has the code?” confusion. They then explore how email, while still a common source of client documents, creates security and record‑keeping risks; Liscio’s solution automatically ingests client emails, associates them with the correct client record, and allows deletion from the inbox to mitigate breach exposure. The hosts discuss the proliferation of passwords, client portals, and “password fatigue,” arguing that a single‑portal approach—where all client interactions, document exchange, payments, and secure messaging happen in one system—will replace fragmented tools, email, and text‑based workflows. They reference the evolution of banking technology (e.g., Bank of America’s mobile app) as a parallel for how accounting can streamline operations, improve client experience, and lower cyber‑insurance claims. The episode concludes with optimism about simplifying security, the upcoming single‑portal vision, and a teaser for future conversations.
Chapters
Hi, LawPod listeners. Tiara here, the girl behind the scenes, and I'm just popping in with a cold open to let you know that today's episode is actually part 2 of last week's conversation. So if you haven't listened to last week's episode yet, I'll invite you to go back, give it a listen, and we'll see you back here soon. Welcome to Accountants LawPod, where accounting professionals and law firms converge, hosted by Linda Artesani, Sarah Prevost, and Steven Libhart.
It's a cycle. You know what's interesting too is when you're— the texting thing for banks and the voice over IP, it's so infuriating that we can't— I understand there's reasons possibly why or why certain things won't work, but it is really frustrating, especially if you're traveling and you're wanting to use this like a secure way. Like we have what, RingCentral? You have all these other types of apps out there that people have been using. But you can't use it with certain banks or you can't use it with this or, and it, and you can't unlock the product or you can't do something because you're prohibited from this. It is the most frustrating space to be in. And I imagine it just feels like, like you just want to go back to the old days, like to Linda, your point, you just want to go back to the old way of doing it, just whatever that is.
You gotta make it easy. I think a lot of that might have to do with With text messaging, there's the short codes.
Yeah.
Short codes for multifactor authentication, right?
Yeah.
Yeah.
Yeah.
To a 10-digit, what they call a 10-DLC.
Okay.
You know, local number. And so that's why we offer 10-DLC numbers. That way, if you want to use us for 2FA or whatever to improve security, that'll happen because firms have a problem today, which is you— we all know we have to have MFA on everything. Goes back to FTC guidelines. You have to have multifactor authentication on everything. Well, how do you run multifactor authentication for a client's bank account that allows you to tether it to one phone number? Phone number needs to be shared across the team.
It's a frustrating mess.
Problem.
People are leaving 10, so they're leaving MFA off. So we're about to release our feature, which is going to have line management. You can give one line for the firm, all your MFA comes in there. Right? And so the team can manage it with— and you could be working in New York, Boston, and Santa Fe. And it doesn't matter. You don't have to call each other saying, ah, this code's coming in. Who has that line?
Or traveling in Europe.
That's right. Traveling in Europe. There you go.
We have this game all the time every morning because I'm on the East Coast. So a lot of times my phone number and they're like, what's the phone number? What's the phone? Did you get the code? Where did the code go? That's my first question. Where am I finding this code? It's so frustrating. So that's number one. I think that's a huge Big, yeah, a big, big, big problem we all face. So that'd be great to have that.
They're all barriers to FTC compliance. They're all barriers to 557 compliance. When people put out these rules, you have to do these things. There are practical issues which have stopped the profession from being able to move forward with grace. You can try to hack things together, which is stick it all on Linda's phone and we'll all call Linda. It ignores the union cost. Anyway, that's— but that's where I think that's, that's the vision for the future is, you know, this stuff is coming together. You know, we are where we are now with the government. The government's right, right? Yeah. I think as a profession we have to work together to say, okay, what problems do we have and what's a smarter way to handle them? And, you know, tech's never done. We could come out there and say there is a better way. Here's a proposal. I think we all have opinions on it, but I think certainly the future is here now, which is, you know, get texting, get email, get secure messaging, get it all, start to get it all together so you can actually start to move a little bit more quickly and secure.
There's so many bad guys out there and you read about it constantly about all these hacks and things that are happening. And it's, you almost become numb to them because there's so many of different, what happened there? What happened at that? You know, I get things from like even the credit card agencies that'll say, well, we, you know, your data breach. and your whatever password, and you just have to stay on top of those things. I mean, it's just part of business and it is a pain in the neck. I think I saw a post the other day on Facebook and somebody said, dear hackers, I know you have all my passwords. Can you help me out? Because it's kind of, that's how it feels sometimes. There's so many different passwords.
So one of our board members is, he runs operations for Bank of America Merrill Lynch. So, Tens of thousands of employees and that kind of thing in his group.
Yeah.
You know, there's some insight here. And this is— there's publicly available data on Statista, for example, about this. But Bank of America announced their mobile app in 2008. Okay. So it's been 15 full years.
Wow.
We've been doing mobile banking, right? 15 years. Okay. So at the time, Bank of America and their team employees were about 280,000. Okay. By 2012, Bank of America's app started to get real traction. And so again, you can go look at statistics on this. This is all public. Started to get real traction. What you see is a drawdown from 280,000 employees to 200,000 employees because the— we all started self-servicing.
Mm-hmm.
Right? And so the person who couldn't find their things in the Google email, how easy was it to find anything in that Google email account that was deleted?
Not easy. Not easy.
And I started out as an auditor. If a client didn't have a bank statement, what would we do? We'd call the bank. Can you resend us the bank statement?
Yep.
Made it have to be a paper copy back then, right? When was the last time we called or a client had to call the bank to resend something? Never happens.
Yeah, it's true. It becomes electronically available.
Right. You wouldn't do that today. I mean, you think about it, banking has changed quite a bit. I mean, just by the fact that it's in your phone and They're all a little bit different, which is kind of weird. But I mean, we're, we're with Bank of America. It's a big— the big banks are all pretty modern. They have all the little perks to it and the better software and everything. But it has changed a lot. I mean, I don't wanna go to the bank if I don't have to, but I have a husband who would go to the bank in a heartbeat. Like, he likes to sit there and tell his life story to the lady. I'm like, well, you've gone a long time. But yeah.
Well, there's candy there. There's candy.
All this candy. You're right, Sarah. It's probably the candy.
I'm like, hold on a minute. I know why. Not just the social hour, but there's candy there.
You don't need to go to the bank. But yeah, he uses the— he just likes to go to the bank. So, and there's less banks. So now Florida had banks all over the place, right? A lot of old people, and they're taking the banks away. So we're very few. Like, even Bank of America used to be at the end of my street, and now there's one at the mall, but there's none around because they've taken the physical branches away.
So, which is, which is good, right? Because the humans were there. As your husband goes, he's going to go talk to a relationship manager. It's not a transaction anymore. It doesn't have to be a transaction. It's a relationship, which is what the accounting profession should be focused on. We should be focused on nurturing relationships, not doing the transactional stuff.
Yeah.
But I think if we go back to the Social Security thing, right, if we say, look, did Bank of America and Chase and all these firms invest that much in their tech because they wanted to make things secure more, or they wanted clients to self-serve more. It was probably born out from the need that they had to get away from email for security reasons.
Yeah.
They had to. And what they— they had this knock-on effect, which is when we fixed the security problem, we actually made customers happier. And when we made customers happier and more successful, We actually had to do a lot less work ourselves.
Yeah.
Went from 280,000 employees trying to service people transactionally to 200,000.
That's huge.
That's huge.
The same thing is going to happen to accounting.
Yeah, I agree. I have a question though, because talking about banks and just in general, I was a little caught off guard with, oh, just send in, just email me your tax returns. For this loan. I'm sorry, you're the bank. You just—
She had to happen.
You just want me to email you? I was floored. I was— first, I was upset because I have a longstanding relationship, right? Second of all, I'm like, you got to be kidding me. Oh, no, it'll be— it's encrypted when it comes through to us. Like, okay, I'm not stupid. But so that goes back to my initial question, which I think you were going to try and answer a little bit, was We can't control what's being sent to us, whether we request it or not. Right? Like, we requested in the right way. They don't want to send it that way. They're just going to send it via email. So now what?
What? That's— Going to come to the FTC?
Yeah. What happens there? Like, that's not in our control.
When it happens. So, so there's a couple of things here. Number one, most people want to retain the email as a source record. Right?
Yeah.
So email comes in, I gotta retain it. The second you say my email accounts and my team's email accounts are going to be source document repositories, because what happens if your employee receives something and then, you know, downloads the attachment but then deletes it? What happens? You lose all the record. Don't wanna do that. So what's happening is everybody's going after our email accounts because they're so Target rich. So what we do at Liscio is the client email exists in Liscio. So we have john doe at acme.com. We know that's a client. If John Doe sends an email in, we recognize it came from John Doe. We automatically pull it from Outlook or Gmail and associate with John Doe in our system.
Okay.
Okay. So now what— so what happens then is when that association is made, You can see it in Licio, and you can delete that email from your email account. So if your email account is compromised, there's nothing there.
Okay.
It's all behind the 2FA Licio account.
Okay.
Because it's going to happen.
And it's going to remain in the Licio, but it's off that server. It's off that—
yeah.
That's right. Because the same thing is going to happen. You're going to have things that are— you're going to be working with an attorney. The attorney might send you something related to a client that has Extraordinarily sensitive information. It comes over email. You can't control that. But again, what will happen is, even though that Listio contact might not exist for that attorney, you say, okay, this is for John and Jane Doe. It's related to Acme. It comes from the attorney, but it's coming from some attorney that has, you know, affects multiple clients. You'll go into Listio, you'll attach that email to Jane and John Doe and Acme, just related to them, then you delete it out of your email.
Okay.
So everybody can see the entire history in one place and your email stays secure.
Nice. So then you're at that point, the responsibility of what you've done on your side of the firm, because you cannot control the actions, it now you've owned that space a little bit better.
Yeah. Okay.
Because if your email, if your email for whatever reason gets breached, you're like, not a problem because what's in the email is unencrypted. What's in email is probably obviously the biggest entry point for bad people. Those bad actors, right? So you're saying good luck, because here's the deal. People who have been breached, had their email breached, and there's been more than a couple of firms that's had this happen to, you know, whether it's a whole firm or some of their employees.
Mm-hmm.
The first thing they do when they come out of the process is they say, no more PII and email. We are going to make sure our emails are fully deleted. They'll wipe their entire email. account, right? Every, every couple of days just to stay compliant, right? Because you can't have this treasure trove of stuff out there. Same thing with the personal phones, with texting, etc., right? You can talk to any firm in America, you know, from the largest to the smallest, and if they have employees who are texting, none of them have a solution when that employee leaves the company.
No.
Yeah, that's the problem.
I mean, it's crazy. And, you know, the same thing with email. You gotta get it, get the PII in. If PII comes in email, It's fine. Match it to the right account in Liscio so everybody can see it. You don't have to worry about CCing and BCCing and forwarding so much anymore. Put it in there. That's your repository. Now it's transparent and clear. Delete it from email.
Okay. Just curious, because I feel like people feel they're fail-safing on this alone. Well, they've made it encrypted or secured with a password. They send this email in this, like, layer of this or they use an app to cover that. Like it's not a portal, right? So you could do that, you open it up, but sometimes that's where the spoofing happens. That's where the issues lie, right? Like it's the same, it's hard to navigate through that space.
You gotta be smart.
You gotta go train your people like crazy. You gotta be smart. I think the biggest issue with that is like usually it's one way. Usually the accountant who's responsible Well, one-way private key encrypt out, not many clients have the wherewithal or the tooling to encrypt private key sending back.
Yes.
And so what value is one-way security?
That's, that's, I think where I'm going with this is like the value of that is a circumstantial one quick moment, but it's not allowing the same to come back in.
That's right.
If you're going to do it out, which is going to require them to enter a key to decrypt it, Why not just say, let's work like Bank of America where you can Face ID in and not have any mumbo jumbo and the Face ID works for everything we do.
Yeah.
Instead of just that particular file.
We've had that happen with tax people that want something from us and it's like, oh my God, this stupid portal, I can't get into it. And then the client doesn't know how to get into it and it's like they gave it to you to do to upload it for them. And I'm like, this is terrible. I mean, so we just use our software and like, here you go, here's your stuff. Because I can't be bothered. I can't remember already portal or get the codes in the lockdown emails. I guess it's Microsoft does this one thing that's like, I can't. It's very annoying. You can log in with Google. I'm like, I did way too many clicks. I don't have time to be doing all that clicking.
Yeah. We're gonna put this many clicks for how many different software?
Yeah.
You send a link through DocuSign, and then we send— should that be MFA? Probably should.
Probably should.
And something for payments. A link goes out from QuickBooks to pay. Highly spoofable. We send something encrypted email through Microsoft.
Oh, true.
So many different ways the clients would be like, look, I can't MFA my way through all this stuff. That's— this is getting pretty crazy.
It is.
If I ever want to find anything later, I have no idea where to start.
Yeah. Yeah. And it's— and there's this big conversation about client portals in general, right? Do you use them? Do you not use them? How do you do it? Do you— where do you communicate? I honestly feel like the way I've felt strongly is we've invested in a product that protects both of us. And that's what we do. That's, that's how we start our process. But I feel the fatigue. I feel the fatigue in just passwords alone and trying to remember somebody who asked me on my staff, hey, was that you that signed up for that, Sarah? How do I log into that? Oh my God. I mean, I've got 800 passwords right now. I gotta sift through all of them, right? And if they're coded right. That's the other thing with the password protection stuff. You got to sift through to figure out what labeling did you do for that client way back when.
And it's part of business now.
It's just part of doing business.
That's why we have Practice Protect. So we have that layer of security. So we have all these things in place to protect. I don't want any passwords getting taken by somebody or a staff member leaving, taking up— just can't. So we have to have the lockdown systems.
Practice Protect is perfectly on the right track because if you think about You have this single, you have this single system regarding all of really everything you're using, right?
Yeah.
I think if you take that same paradigm, whether it's Bank of America, it's a single system, it's a single portal to do check deposit, get your statements, check your balances, anything you need to do, get your tax forms. It's all there in a single place. I think the future of accounting is clearly single portal. We know we can't use email. Email was never a great solution anyway. Can't send huge documents, can't get things signed. The links are vulnerable, all that kind of thing. So I think take a look at that saying email could never be just inherently can never be a single portal. People don't want to use it anyway. So we end up on text. That's even worse. So we have to, I think in 2024, everybody's going to say, look, single portal is going to be the theme. A lot of firms are moving in '23 towards single portal. Or I think there's just, that's it, the tidal wave of I'm done with this many logins. My clients get one place, I get one place to work with clients, and then we have a bunch of back office systems that work with that.
Yeah, that's smart. I've heard it this year alone. I'm hearing it obviously to your point, and I am excited for this change because I feel like we're also on the 50— we're also squirrely. We all squirrel on shiny objects, but yet It's just nice to simplify. And we see it in the complaint section of our own clientele. So yeah, this is a good topic.
I'm glad you came. Cool.
Great being here. Super fun. So I know we'll continue the conversation about single portal probably next time. Yeah, that's, that's the next reality.
Yeah.
But I think, yeah, hopeful people really are saying, hey, look, the security thing shouldn't be scary. Right? Because Bank of America made it better, right? I think there's this gigantic win for clients and for firms alike by saying, look, we're going to— let's turn the security thing into a positive, right? It's nothing scary. We know we have to go there. When we go there, let's do it the right way so everybody wins. FTC feels great. Cyber insurance claims are going to go. We don't want to have those anyway. But cyber— from cyber's perspective, great. Client feels better off. We feel better off. So I think there's a lot of wins to be had there.
Definitely. Well, thank you so much for your time on this. I know we'll definitely— obviously we're personal friends, so we're going to have you back no matter what.
Sure. More updates with your products.
With your products.
With the software. So we were really excited about what's coming down the pipeline and we love any software that keeps growing and we know that's what you all do over there. Plus you get such great people behind your products.
Yes.
Thank you, Linda. Appreciate that. You'll be the first to know. We'll break a story here. Sure. How about that?
That'd be awesome.
Okay, that would be awesome. Special note, Tiara, I know you're in the background making notes. Okay, so if you've enjoyed this today or you have suggestions for us, please like and subscribe to the podcast on our YouTube channel. On the Accountants Law Pod website, there will be show notes as well. You can also email us at info@accountantslawpod.com where our lovely Tiara in the background We'll monitor that for new topics, suggestions, continuations. If we have continuations, I mean, we could do this on social medias, but ways of comments and stuff. But we could also obviously have Chris back and do a deeper dive on different things. If you'd like to join us in the Accountants Law Lab, which we had an amazing conversation this morning, it is www.accountantslawlab.com to sign up. Also, Steve isn't here, who's our counterpart. We forgot to say that. So Steve's not here because he's traveling. He is traveling. He's going to be in Kansas, in the state of Kansas, I think in Kansas City, I think.
Yeah.
Yeah. Or a small little town. And so he's on an adventure. So maybe we'll put like a little, maybe some photo links or something that he's done because he is the one person in our group that's traveling fool for like 5 months. We love him to pieces. Um, so, and there'll be stuff about him on Instagram, probably some photos and such. So, but anyways, thank you so much for today, Chris. It's really nice to finally connect and have at least a Friday, uh, hang out with you.
Yeah, super fun.
To be continued.
Yes, definitely.
Awesome.
For sure.
Bye, everybody.
Thanks, everybody. Bye-bye.
