Payment collaboration to curb Internet fraud: banker

With the business of Internet banking changing and online threats growing, the industry needs to adapt and integrate security technology across more channels and be more collaborative to reduce fraud, according to one electronic payments specialist.

Standard Chartered Bank consumer banking risk advisor David Leach said there is a problem with payment security in general and even the recent trend of two-factor authentication is not a panacea.

During his keynote address on implementing multi-factor authentication for Internet banking at this year's AusCERT security conference, Leach spoke of how his personal experience with electronic payments spurred his professional interest.

"When I moved to Singapore about five years ago had to move $20,000 online with a telegraphic transfer from Australia since I had already left," he said. "The bank said Internet banking was not a problem and even allowed transfers of up to $50,000 which I thought that was pretty amazing just with a username and password for security."

The problem was the transfer was from a mortgage account and not many customers need to do this every day so Leach asks why do banks put their customers at risk?

"The transfer happened over night so international money transfers are moving very rapidly," he said. "It used to take two or three days but now funds are taken out immediately so who is going to be liable for fraud, the bank? It's not just the Internet banking username and password that can be compromised it's the speed at which transfers happen."

Ad far as the fraudsters are concerned, the theft of funds needs to be automated, which means they need to have some form of straight-through processes of their own. As they do this the banks are moving to faster payments due to demand from customers.

"The problem is we have less time to examine the transactions. If it's a batch thing I can delay this and figure out when I want to do this analysis," Leach said. "So how can we pick the fraud straight away? We need to control things at the point of payment."

Leach used the term "Payment Security 1.0" to describe the next evolution in electronic financial transactions which involves more contextual information from the user and the bank.

"Yes, two-factor authentication does improve security, but it could be better. You should know what's going on in the transaction and authorization can be a multi-party dilemma," he said, adding there could be times when the bank is involved.

"We want consistent authorization across multiple channels. Each party need to know so there needs to be more collaboration. There is nothing to stop us from 'risk scoring' across networks without compromising privacy."

Leach wants to see a risk framework for payments that looks at transactions and gives a feeling of "goodness" rather than just a binary yes or no. The banks could use a risk score that is pluggable across multiple channels.

Page Break

"Internet banking 1.0 involved a username and password, and possibly a secret for high-risk transactions," Leach said. "Internet banking 2.0 introduced tokens and one-time pins, and site authentication. These are all various strategies that make the customer feel more secure, but we still have man in the middle attacks. So I say go to chip implants for Internet banking 3.0! Not really."

In 2003, Singapore was one of the first governments to mandate two-factor authentication for "high risk" transactions, but from the bank's perspective using SMS means sending out a lot of messages for no revenue and people's phone numbers can be altered by social engineering techniques anyway.

Likewise, just because a card has a chip on it doesn't mean it can't be cloned, but it makes it more difficult for the fraudsters.

It's online, or "virtual" transactions where there is a huge amount of potential for fraud.

"If fraudsters can steal your info they can get your money, but with two-factor authentication they have to be more savvy," Leach said.

"On top of that we have fraudsters out there with their own risk management. What's the cost between sending out phishing e-mails compared with breaking a chip card?"

When terminal line encryption was introduced in Malaysia, fraud dramatically decreased but moved over to neighbouring Thailand indicating fraudsters do change and adapt and will find ways around more secure systems.

Standard Chartered has now implemented two-factor authentication in five countries with plans to extend it to 20.

Of the two-factor authentication methods - including tokens, display and "bingo" cards, SMS, and IVR call back - Standard Chartered is deploying them in various ways in different countries.

"We're re-examining the problem. A verifiable identity is a problem and two-factor authentication doesn't solve everything as it's a point solution," Leach said. "And the solution should have the ability to adapt to fraud."