News
News
10/21/2005
06:20 PM
Connect Directly
RSS
E-Mail
50%
50%

Banks Told To Step Up Security Against Identity Theft

Regulators give them until end of 2006 to add two-step protection

Banks in the United States have been slow to offer more than password protection for online banking, fearing customers didn't want the added inconvenience. Regulators say it's time to pick up the pace.

The Federal Financial Institutions Examination Council, an umbrella group of regulators that includes the Federal Reserve and Federal Deposit Insurance Corp., told banks single-factor authentication, such as a user name and password, isn't enough to protect against account fraud and identity theft. They gave banks until the end of 2006 to implement two-factor authentication, which relies on something the consumer has, such as hardware tokens or smart cards, as well as something the consumer knows, such as passwords.

Regulators say single-factor authentication is inadequate for protecting against Internet-level scams such as phishing and pharming. Not only have they been given a deadline to implement two-factor authentication, they've been directed to do a risk assessment of all online transactions and take a "layered approach" to make sure the level of security matches the risk.

Two-Factor Security

Several options meet new rules for online security

Card readers: Devices that generate a password when a card is entered

Tokens: Key-sized devices that plug into a computer's USB port

Password generators: Tokens or devices to create one-time passwords (picture below)

Biometrics: ID based on a physical trait, like fingerprints or retinal scans

Scratch cards: Contain a fixed number of one-time passwords

Mutual authentication: Customer and Web site each provide information a phisher wouldn't know

That process is where bank security specialists will earn their keep. "Two-factor authentication is a buzzword," says Ilieva Ageenko, director of emerging enterprise applications at Wachovia Corp. "The regulators are talking about an entire arsenal of risk-based controls."

The risks haven't let up for online banking. The Anti-Phishing Working Group found that 85% of the 14,000 unique phishing attacks in August were directed against customers of financial institutions. An industry research group, Financial Services Technology Consortium, is developing a blueprint that financial institutions can use for better authentication between banks and customers. The goal is to develop a framework that banks can tailor to their needs.

Several Options

Despite the added security it offers, customers might not like two-factor authentication, since it generally requires them to take an extra step and have something in their possession, not just a password in their heads. Options for authentication include one-time password systems, which can use an electronic device banks give to every customer to generate a code to enter. Lower-tech versions include bingolike cards or scratch-off cards containing a fixed number of passwords.

Financial institutions have been working on stronger authentication. In the United Kingdom, Lloyds TSB Bank plc is testing with 30,000 customers a device that generates a one-time, six-digit number every time a customer logs on to its banking site. Bank of America earlier this year unveiled SiteKey, in which an image picked by the customer appears when a person signs on, indicating that the bank recognizes the computer from which the customer is signing on and telling the customer the site is legit.

MasterCard International has developed the Chip Authentication Program, in which credit or debit cards are implanted with a chip that generates a one-time password when the card is entered into a handheld card reader supplied by the customer's bank. Banka Koper d.d. in Slovenia has issued the cards and readers to all of its retail and commercial customers. Banks in other parts of the world also have adopted the program, says Pascal DuFour, VP and head of chip product management at MasterCard.

But count on scammers and crooks not to be cowed by two-factor systems. Security vendor F-Secure Corp. this year reported that customers of a Scandinavian bank were tricked into divulging their one-time passwords from a scratch-off sheet. Customers received phishing E-mails that took them to fake Web sites hosted in South Korea, where they were told to scratch off and enter their passwords.

Comment  | 
Print  | 
More Insights
The Business of Going Digital
The Business of Going Digital
Digital business isn't about changing code; it's about changing what legacy sales, distribution, customer service, and product groups do in the new digital age. It's about bringing big data analytics, mobile, social, marketing automation, cloud computing, and the app economy together to launch new products and services. We're seeing new titles in this digital revolution, new responsibilities, new business models, and major shifts in technology spending.
Register for InformationWeek Newsletters
White Papers
Current Issue
InformationWeek Tech Digest - August 27, 2014
Who wins in cloud price wars? Short answer: not IT. Enterprises don't want bare-bones IaaS. Providers must focus on support, not undercutting rivals.
Flash Poll
Video
Slideshows
Twitter Feed
InformationWeek Radio
Archived InformationWeek Radio
Howard Marks talks about steps to take in choosing the right cloud storage solutions for your IT problems
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.