Created: 5/16/2026 7:22:19
Updated: 5/19/2026 7:04:24
Exported: 5/19/2026 7:04:35

Prompt:

16/05/2026, 07:22:19

This is from my bank. What is behavioural security?

Behavioural Security
Behavioural Security is an invisible, extra layer of protection that helps ASB keep you and your money safe from fraud and scams.

Stronger protection
We're committed to staying one step ahead of scammers. That's why we've introduced Behavioural Security - an extra, invisible layer of protection designed to help keep you and your money safe from fraud and scams. It’s entirely automatic, so you won’t notice anything different while you use our online services.

How Behavioural Security works
Just as your handwriting is unique to you, so is the way you use your device.

Behavioural Security recognises how you use our online services, like how you type on your keyboard, swipe and scroll through pages, and press buttons on your screen. We call this behavioural information, but it can also be called behavioural biometric information. This helps us spot unusual behaviour, like if someone pretends to be you and logs into your account.

What information is collected by Behavioural Security
Behavioural information
This includes:

How you use your mouse.
How you scroll.
How you type, tap and swipe.
How you navigate between screens.

Device Details
This includes:

Model and type.
IP address.
Permissions and settings.
Network and connectivity information.

Optional information
Information you've given us permission to see in your device like:

Your location.
If you're connected to Wi-Fi or access points.
Paired devices (Android only).
What information is not collected by Behavioural Security?
Behavioural Security does not collect physical information like fingerprints and facial images.

It doesn’t collect information about your activity on other websites or apps.

It can’t see what you type, read your messages, or look at your photos.

We can't see you or hear your calls, and conversations remain private.

What if you would prefer not to share your behavioural information?
If you don’t want your behavioural information collected, you can still bank with us over the phone, through ATMs, or by visiting a branch.

Your privacy is important
We take your privacy and the protection of your behavioural information seriously:

We will only ever use this information to help detect and prevent fraud and scams.
We won’t use this information for any other purposes including marketing or to assess your eligibility for our products or services.
All data is encrypted so that your behavioural information is secure.
We won’t keep your behavioural information longer than necessary (3 years).
If you’d like to find out more about our privacy practices, your privacy rights, or how to raise a concern, please see our Privacy Statement.

Response:

16/05/2026, 07:22:29

Behavioural security is a fraud detection system that learns your unique digital habits to spot when someone else might be using your account.

Think of it like a digital fingerprint made up of how you interact with your device — your typing rhythm, how you scroll, how you swipe, how you move your mouse. Over time, the bank's system learns your patterns, so if a scammer logs in as you, their behaviour will feel "off" to the system even if they have your correct password.

It's passive and invisible — you don't do anything differently. The system just runs quietly in the background.

What it collects:

• Behavioural patterns (typing, swiping, scrolling style)

• Device info (model, IP address, network)

• Optionally, location and paired devices (if you permit)

What it doesn't collect:

• What you actually type (passwords, messages)

• Photos or biometrics like fingerprints/face

• Activity on other apps or websites

Key privacy points from ASB:

• Used only for fraud detection, not marketing

• Data is encrypted and deleted after 3 years

• If you'd rather not participate, you can still bank via phone, ATM, or branch

It's essentially the same technology used by most major banks now — just usually not explained this clearly.

Prompt:

19/05/2026, 06:52:43

Can this be merged with all other behavioural data points used by advertisers?

Response:

19/05/2026, 06:52:54

This is a genuinely important question, and the honest answer is: ASB says no, but the broader picture is more complicated.

What ASB commits to:

• Only used for fraud detection

• Not shared for marketing purposes

• Not used to assess product eligibility

So within ASB's system, it's ring-fenced.

Where it gets murkier:

The types of behavioural signals ASB collects — typing rhythm, scroll patterns, device fingerprint, IP address, location — are very similar to what ad-tech companies already collect independently. Advertisers don't need ASB's data specifically, because they're often building their own behavioural profiles of you through:

• Browser fingerprinting

• App tracking

• Device advertising IDs

• Cookies and pixel trackers

So while ASB's specific dataset shouldn't flow to advertisers, you could theoretically already have a near-identical profile of your digital behaviour assembled by data brokers from other sources.

The real risk isn't ASB sharing it — it's convergence. If a data broker has your device ID, IP address, location patterns, and behavioural fingerprint from other sources, they've essentially reconstructed something very similar independently.

What would actually protect you from that:

• Limiting app permissions (especially location)

• Using a VPN to mask your IP

• Keeping ad tracking opt-outs enabled on your device (iOS Privacy > Tracking, Android equivalents)

So ASB merging it — unlikely and contractually prohibited. The ad industry arriving at similar data through other means — already happening.

Prompt:

19/05/2026, 06:54:44

Essentially the ad, and presumably security, services are constructing a virtual doppelganger.

Response:

19/05/2026, 06:54:54

Yes, that's a really apt way to describe it. And it's more complete than most people realise.

The doppelganger is layered:

• What you look like digitally — device, IP, browser fingerprint

• Where you are and move — location patterns, Wi-Fi networks, routines

• How you physically interact with technology — typing rhythm, scroll behaviour, swipe pressure, mouse movement

• What you're interested in — browsing, purchases, content consumption

• Who you know — contacts, paired devices, social graphs

• When you do things — time patterns, sleep cycles inferred from phone activity

Put together, this isn't just a profile about you — it's a model that can predict you. It knows your habits well enough to notice when something is off (security use) or to anticipate your desires before you've consciously formed them (advertising use).

The uncomfortable flip side:

The same doppelganger that protects you from fraudsters — by flagging behaviour that doesn't match your pattern — could theoretically be used to manipulate you, because it knows exactly how you respond to things.

The deeper philosophical point is that this virtual model of you exists and operates whether you're aware of it or not. Decisions get made based on it — fraud flags, ad targeting, credit risk, insurance pricing — while the real you goes about their day completely unaware.

You're not really interacting with these systems. Your doppelganger is.

Prompt:

19/05/2026, 06:57:07

But I, as a human being, am providing the data points used to construct the (is there a better word than doppelganger?) and the online world then interacts with that. It's still up to me to decide, as a human, whether to react to the online world's prompts, isn't it?

Response:

19/05/2026, 06:57:20

Yes — and that's an important distinction to hold onto. You remain the agent. The doppelganger (and there is a better word, which I'll get to) doesn't make decisions, you do.

A better word: proxy

Or more specifically, a digital proxy. It acts on your behalf and in place of you in systems you never directly touch. "Doppelganger" implies an evil twin with its own agenda — a proxy is more accurate because it's a representation that others interact with instead of the real you. Some academics use "data double" which is also quite precise.

But here's where your point gets challenged:

You're right that the final decision is yours. However, the system isn't just responding to you — it's increasingly shaping the environment in which you make decisions.

• The ads you see are chosen to match your proxy's known vulnerabilities and desires

• The content you're served reinforces existing patterns

• The sequence, timing, and framing of prompts are optimised to reduce friction toward a particular choice

So while you retain agency, the field in which you exercise that agency is being sculpted around your data double. It's less like someone forcing your hand, and more like someone who knows you extraordinarily well arranging the room before you walk in.

The philosophical tension is really between:

• Agency — you decide

• Autonomy — whether that decision is genuinely free, or nudged along a path pre-built for your proxy

You're still the human. But the question worth sitting with is how much of what feels like a free decision has already been quietly shaped upstream.

Prompt:

19/05/2026, 06:59:24

So it is autonomy that is being eroded. Rather like modern democracy in which, once per election cycle, we get to choose between pre-determined candidates, candidates chosen for their allegiance to the party rather than the constituency.

Response:

19/05/2026, 06:59:38

That's a sharp analogy, and it holds up well. In both cases, the field of choice is curated before you ever get to exercise it.

The parallel runs deep:

• The candidates are pre-filtered (party machinery) — the products, content, and ideas you encounter are pre-filtered (algorithmic proxy)

• You choose freely within that set — but the set itself was never your choice

• The illusion of participation is maintained — voting, clicking, buying — while the meaningful decisions happened upstream, invisibly

And the feedback loop is similar too:

Political parties study voter behaviour to select electable candidates — reinforcing what already resonates rather than expanding what's possible. Algorithms study your proxy to serve more of what you already engage with — narrowing rather than broadening your world.

Both systems are optimised for engagement and compliance, not genuine autonomy.

Where the analogy gets even darker:

At least in democracy, the machinery is somewhat visible. We know parties exist, we know candidates are vetted. The digital proxy system is largely invisible — most people don't know their data double exists, let alone that it's shaping their experienced reality.

The deeper question both raise:

Is autonomy meaningful if it only operates within pre-approved boundaries? Philosophers like Isaiah Berlin would call what's being eroded here positive liberty — not just freedom from interference, but genuine freedom to think, choose, and act outside the curated frame.

What's being sold as personalisation and democracy is, in both cases, something closer to managed consent.

Prompt:

19/05/2026, 07:01:43

Digital proxy, data double, managed consent, optimised for compliance and engagement. These are all loaded terms not often seen in mainstream discussions. Is there substantial research on them?

Response:

19/05/2026, 07:01:58

Yes, there's a solid body of academic work underlying all of them — though you're right that it rarely surfaces in mainstream discourse.

The foundational thinkers:

Shoshana Zuboff is probably the most important. Her 2019 book The Age of Surveillance Capitalism is the landmark text. She argues that human experience itself has become a raw material harvested for behavioural prediction products. Her term "behavioural futures markets" — where your predicted behaviour is bought and sold — is as loaded and accurate as any of the terms you've noted.

David Lyon has written extensively on surveillance culture and what he calls the "surveillance society" — the idea that being watched and categorised has become a structural feature of modern life, not an exception.

The "data double" comes largely from academic surveillance studies — Kevin Haggerty and Richard Ericson used it in a 2000 paper describing how institutions reassemble people as informational constructs that then take on a life of their own.

On democracy and managed consent:

Noam Chomsky and Edward Herman's Manufacturing Consent (1988) predates the digital era but established the framework — that mass media systems filter and shape what populations believe they're freely choosing to think.

Cathy O'Neil's Weapons of Math Destruction (2016) bridges both worlds — showing how algorithms encode existing power structures and apply them invisibly at scale.

Why it stays academic:

This is worth reflecting on. These ideas remain largely outside mainstream discourse partly because the mainstream media and platforms that would carry them are themselves products of the same system being critiqued. There's a structural incentive to keep these concepts technical, obscure, or framed as conspiracy thinking.

Which is itself a form of managed consent.

Prompt:

19/05/2026, 07:03:57

Thanks.

Technical question now. Can you draft me an SEO title (<60 characters) and description (120-160 characters) for this whole chat, please?

Response:

19/05/2026, 07:04:00

Title (52 characters)
Your Digital Proxy: Privacy, Ads & Eroded Autonomy

Description (148 characters)
How behavioural security and ad tracking build a data double of you — and what it means for your autonomy, democracy, and managed consent.

Prompt:

19/05/2026, 07:04:20

Great, thank you. Time to publish.

Response:

19/05/2026, 07:04:24

Good luck with it — it's a genuinely interesting conversation that covers ground most people don't connect up: a routine bank notification becoming a thread that pulls through surveillance capitalism, algorithmic autonomy, and the structural limits of democratic choice.

The academics are there for anyone who wants to go deeper, and Zuboff in particular is very readable for a scholarly work.

Hope it lands well with your audience.