With the business of Internet banking changing and online threats growing, the industry needs to adapt and integrate security technology across more channels and be more collaborative to reduce fraud, according to one electronic payments specialist.
Standard Chartered Bank consumer banking risk advisor David Leach said there is a problem with payment security in general and even the recent trend of two-factor authentication is not a panacea.
During his keynote address on implementing multi-factor authentication for Internet banking at this year's AusCERT security conference, Leach spoke of how his personal experience with electronic payments spurred his professional interest.
"When I moved to Singapore about five years ago had to move $20,000 online with a telegraphic transfer from Australia since I had already left," he said. "The bank said Internet banking was not a problem and even allowed transfers of up to $50,000 which I thought that was pretty amazing just with a username and password for security."
The problem was the transfer was from a mortgage account and not many customers need to do this every day so Leach asks why do banks put their customers at risk?
"The transfer happened over night so international money transfers are moving very rapidly," he said. "It used to take two or three days but now funds are taken out immediately so who is going to be liable for fraud, the bank? It's not just the Internet banking username and password that can be compromised it's the speed at which transfers happen."
Ad far as the fraudsters are concerned, the theft of funds needs to be automated, which means they need to have some form of straight-through processes of their own. As they do this the banks are moving to faster payments due to demand from customers.
"The problem is we have less time to examine the transactions. If it's a batch thing I can delay this and figure out when I want to do this analysis," Leach said. "So how can we pick the fraud straight away? We need to control things at the point of payment."
Leach used the term "Payment Security 1.0" to describe the next evolution in electronic financial transactions which involves more contextual information from the user and the bank.
"Yes, two-factor authentication does improve security, but it could be better. You should know what's going on in the transaction and authorization can be a multi-party dilemma," he said, adding there could be times when the bank is involved.
"We want consistent authorization across multiple channels. Each party need to know so there needs to be more collaboration. There is nothing to stop us from 'risk scoring' across networks without compromising privacy."
Leach wants to see a risk framework for payments that looks at transactions and gives a feeling of "goodness" rather than just a binary yes or no. The banks could use a risk score that is pluggable across multiple channels.