Researchers find flaw in two-factor authentication system

Posted on: March 6th, 2013 by art 62 Comments

The idea behind two-factor authentication is to provide a multi-layered security defense that allows good users to safely access their accounts while preventing criminals from illegally accessing other peoples’ accounts. In theory, this is a sound method that many of today’s financial institutions use to authenticate their customers over various banking channels.

Implementing more effective security initiatives is also the byproduct of stronger federal regulations like the FFIEC (Federal Financial Institutions Examination Council), which recommends banks deploy at least two-factors of authentication as defined by its 2011 Supplement to the Authentication.

Sometimes, however, even effective security measures can fall short of their goal.

This was widely illustrated last week when researchers announced they found a loophole in Google’s two-factor authentication system. In the article, “Google Two-Factor Authentication Bug Allowed Account Hijacking,” Duo Security reported that the search engine giant’s two-step verification system for authenticating users had a flaw that could allow accounts to be hijacked — the vary thing the security platform was designed to prevent.

This is yet another case where a company that has done their due diligence to implement a multi-layered security strategy still had vulnerabilities within its system that could allow criminals to sneak past their authentication processes.

This is why financial institutions need to understand the importance of having at least two-factors of authentication, which still may not be enough to secure online account. Shortcomings like those revealed last week could apply to other customer channels, as well.

Take, for example, the telephone. Today, banks still use knowledge-based authentication (KBA) solutions to identify their customers over the phone. For many, KBA (“something you know”) is a critical piece to their verification strategy. It’s also part of the FFIEC’s two-factor authentication criteria, along with “something you are” (fingerprint, DNA, retinal pattern) and “something you have” (ID card, security token, telephone). Unfortunately, KBA has become a solution that thieves have proven to beat time and time again.

Designed to ask callers security questions that only the customer would know, crooks can now slip past KBA methods by combining identity theft with social engineering. By correctly answering challenge questions, criminals can ironically break down a security barrier that’s precisely designed to prevent criminals from getting through in the first place.

I’m not saying that using passwords, personally identifiable information (PII) or PIN numbers are worthless for customer authentication, but exposure to social engineering schemes over the telephone can pose a weakness in two-factor authentication systems. It’s vulnerabilities like these that the FFIEC recommends at least two factors of authentication for defending banking networks and their customers from today’s criminal threats.

Tags: , , , , , , , ,
Posted in Authentication, Banking Fraud | 62 Comments »

Security processes should not compromise customer service

Posted on: February 27th, 2013 by art 71 Comments

For financial organizations that provide a service, what is it that keeps customers coming back? Since a product is not the competitive differentiator, is it speed? Convenience? Exceptional customer service? How about customer trust and confidence? And where does security factor in? For financial institutions, the answer to these questions could very well be all of the above.

With banks working overtime to safeguard their many customer channels, the one thing they want to make sure their security processes don’t do is interrupt their ability to deliver excellent customer service. Any disruption to the customer experience can have an impact on their ability to retain existing customers and win ones.

Today’s smarter, savvier banking customers expect more from financial institutions. They’ve become less tolerant when a bank falls short of meeting their high expectations. In fact, the 2012 U.S. Bank Customer Switching and Acquisition Study by J.D. Power and Associates found that year-over-year more customers are switching banks as a result of fees, poor service and unmet expectations.

While security can plan a key role in building customer confidence and loyalty, on the flip side, it can also have a negative impact if handled the wrong way. Take, for example, knowledge-based authentication (KBA). Once the standard for identifying banking customers over the telephone, KBA alone is no longer predictive for customer authentication. What can be equally as damaging is how a barrage of security questions interrupt the customer experience to the point that banks lose their customers’ trust and goodwill, and ultimately their business altogether.

Unlike KBA and other personally identifiable information (PII) security methods, which interrogate customers over the telephone, the TRUSTID® Physical Caller Authentication solution helps secure the telephone channel without call center agents saying a single word. By non-intrusively validating the Caller ID and ANI before the call is answered, TRUSTID doesn’t intervene in the customer experience at all. By automatically validating good customers before their call is answered, bank representatives can provide immediate customers service at the onset of each call. Immediately addressing customers’ needs leave them feeling respected and creates a senses of loyalty that they got what they needed, when they needed it, all in a timely manner.

In today’s remote banking environment, it’s no longer good enough to simply keep fraud or unwanted activity in check — fraud has to be contained without damaging the larger, broader relationship between banks and their customers. Establishing this not only creates a competitive differentiator, but allows financial institutions to open up new revenue opportunities with both existing customers and future customers.

 

Tags: , , , , , , , , , , ,
Posted in Authentication | 71 Comments »

How pre-answered caller authentication helps prevent telephone bank fraud

Posted on: February 20th, 2013 by art

Prevention vs. clean up. It’s a security question all financial institutions should ask themselves.

When it comes to providing a trusted customer environment, banks are typically better at resolving problems stemming from non-predictive authentication and fraud than preventing them. That’s because they continue to allow criminals to get their foot in the door.

What I mean by this is when banking customers place a call into a contact center, the very act of answering the telephone sets the stage for criminals to start their elaborate social engineering schemes. And once the dialog starts, anything goes.

Javelin’s director of security, Phil Blank, has long said when it comes to safeguarding customer environments, the biggest challenge is prevention. Done right, however, it can also have the biggest payback for both the bank and customer.

The typical scenario for customer calls looks something like this. A call center agent picks up the phone then proceeds to ask the caller their customer ID and social security number. Based on the level of information the customer is requesting, the bank representative may ask a number of challenge questions. At this point, they’ve already taken up a minute or more of the customer’s valuable time using knowledge-based authentication (KBA) methods that, quite frankly, can no longer assure that the person on the other end of the line is who they say they are.

In today’s many banking channels, criminals armed with the right personal and financial details they’ve collected over the Internet can convincingly impersonate an actual banking customer. In the telephone channel, for example, the very moment they’re able to talk with a call center agent, they have the upper hand.

Whether the caller is a valid banking customer or an impersonator, telephone interrogations impact banks and their customers in several ways, including:

 

  • Employee costs: Every second a bank has to validate and serve their customers counts. If a bank’s contact center agents still rely on KBA for customer identification, they’re likely overspending in many areas for identity authentication, including employee training, security systems and other internal processes.
  • Bank-customer relationship: Burdening customers with lengthy interrogations tests the goodwill of customers and impacts the overall customer experience. This can put a heavy toll on the profitable bank-customer relationship that’s important to any bank’s overall success.
  • Non-predictive authentication: Because personally identifiable information (PII) is used to socially engineer banks, it is not predictive for positively identifying customers calling into a contact center. Therefore, financial institutions should not rely solely on PII for identity authentication.

The TRUSTID® Physical Caller Authentication solution helps banking institutions solve these problems by validating all customer calls before they are answered. Using real-time telephone network forensics to proactively validate the physical location of the landline or mobile device calling the contact center, banks can determine the risk of each inbound call before it is picked up. This insight allows banks to eliminate the time spent authenticating bad calls and serve good customers faster and more seamless. As a result, preventing high-risk callers from reaching bank representatives builds a safer banking environment and strengthens the bank-customer relationship without having to worry about the time, resources and costs associated with cleaning up fraud after it has already happened.

Tags: , , , , , , , , , , , , , ,
Posted in Authentication, Banking Fraud, Call Center | Comments Off

Can banks prevent social engineers from lying?

Posted on: February 13th, 2013 by art

In a world where security technologies work around the clock to stop cyber threats, sometimes the most deceptive and under-appreciated bank crimes can stem from the ancient act of lying.

The opening minutes of the new film, “Identity Thief,” shows just how easy it can be to con someone into providing their private personal and financial details over the telephone. While it might seem unlikely that it could happen to you or your company, the scene illustrates how anyone answering the telephone, even a top accountant for a financial services firm, can be at risk.

We’ve spoke volumes about the various types of lies that criminals rely on to defraud banks. With most financial institutions fully invested in sophisticated hardware to detect and stop fraud over the Internet, the challenge of recognizing when someone is lying over the telephone can be a risk hard to deal with.

In the article, “Social engineering: Clear and present danger,” skilled liars are taking advantage of information shared over online social networking websites to socially engineer their way into the corporate world. One of the ways banking institutions have tried to combat social engineering is to strengthen security policies that make their employees and customers more aware of the dangers they potentially face, said Jason Hong, CTO at Wombat Security.

“The underlying strategy and rationale for social engineering attacks is to circumvent all of the security measures in place by tricking people. For this reason, it’s critical for organizations to train people to be aware of the tactics that bad guys use, so that they can identify them and know how to react in given situations.”

The problem with relying on individuals to identify a lier over the phone is through knowledge-based authentication (KBA), which are essentially challenge questions. The shortcomings of using personally identifiable information (PII) to detect criminals is that they can bypass them quit easily.

But what if you didn’t have to rely on intuition or defeatable security questions to detect when somebody is lying? Would if you could spot a social engineer before he starts to lie?

Without relying on KBA or your call center agents from having to determine whether someone is who they say they are, the TRUSTID® Physical Caller Authentication solution uses network-based forensic technology to automatically validate the caller’s phone location before bank employees pick up. By invisibly identifying whether a banking customer is real or not, financial institutions can eliminate the phone conversation a criminal depends on to socially engineering a bank.

Tags: , , , , , , , , ,
Posted in Authentication, Banking Fraud | Comments Off

How to turn telephone identity interrogations into better customer care

Posted on: February 6th, 2013 by art

How confident are you that the next time one of your call center agents answers the phone the call will be handled safely and efficiently? If your contact center still relies solely on a host of challenge questions to identify customers over the telephone channel, my guess is your security confidence level falls a few notches below where it should be.

We all know that the reliability of traditional knowledge-based authentication (KBA) today is not what it was a few short years ago. The Internet and social media websites let too much out of the bag these days. Anyone with criminal intentions can spend a little time collecting personally identifiable information (PII) and other public data they can use to socially engineer others over the phone. With the right answers to security questions, criminals can defeat KBA and other PII-based solutions designed to catch suspicious or criminal behavior over the telephone channel.

But what if you could verify the actual risk of the call before the phone is answered? How valuable of a security tool would this be in protecting your customers and confidential bank information? A lot, I would presume.

To put it another way, would if you could eliminate the thousands of hours spent each year on known high-risk calls and transfer all that time and resources into providing better care to your good customers? How much would that save on your annual operating costs, not to mention positively impacting the profitable bank/customer relationship? This is possible through the TRUSTID® Physical Caller Authentication solution.

By using real-time telephone network forensics to validate the physical location of the landline or mobile phone before the call is answered, TRUSTID helps financial institutions realize several security and cost benefits, including:

 

  • Reduce losses relating to fraudulent calls
  • Drop the average call handle (ACH) time
  • Spend more time servicing good customers
  • Spend less time identifying bad ones
  • Build trust and goodwill with customers
  • Improve the overall customer experience

When it comes to proactively identifying customers over the telephone, TRUSTID allows banks to non-intrusively authenticate good callers and instantly identify high-risk ones without relying on PII or costly identity interrogations. As a result, financial institutions have the ability to invisibly shut the door on criminal tactics such as spoofed calls and social engineering schemes to achieve a safer, more efficient banking experience for their customers.

In my book, continually improving the level of call center protection and spending more time and resources caring for customers is something both banks and customers can feel good about.

Tags: , , , , , , , , , , ,
Posted in Authentication, Call Center, Caller ID Spoofing | Comments Off

Do your customer calls all look the same? They shouldn’t.

Posted on: January 30th, 2013 by art

Without the ability to verify the Caller ID or ANI, all customer calls can look the same to call center agents. This a risky proposition for any financial institution that handles thousands of customer calls each day. In other words, if all calls appear the same there’s no way to answer some of the key questions all banks should know about customer calls, such as:

Crowd of people

  • Which calls are trustworthy?
  • Which calls require further review?
  • Which calls require a contact center agent?
  • How can I better serve my customers?
  • How can I lower my authentication costs?

To improve the overall security and efficiency of the telephone channel, banking institutions need to be able to confidently identify which customer calls are trustworthy and which ones pose a risk. To be frank, any bank operating without a two-factor authentication strategy to verify callers is putting its entire enterprise, private business information and customers at risk.

With criminals potentially at every customer touch, combining multiple authentication methods is not only a federal requirement for fighting fraud, it’s a must in today’s banking environment.

Over the past few years, financial institutions have put a lot of resources into securing the online channel. According to some studies, these efforts have worked as the number of successful fraud attempts against banks have dropped. But this hasn’t stopped criminals from migrating to other, less protected banking channels like the telephone. This is where TRUSTID can help.

Our TRUSTID® Physical Caller Authentication tool is a proven network-based authentication solution that helps financial institutions proactively validate the Caller ID and ANI to secure the telephone channel, as well as reduce costs by spending less time interrogating customers and more time providing quality service over the phone. As a result of including a complementary, real-time authentication tool like TRUSTID to a bank’s anti-fraud arsenal, we help improve the overall customer experience and achieve true multi-factor authentication to protect one of the most highly used and targeted customer channels in the banking industry.

Tags: , , , , , , , , , ,
Posted in Authentication, Call Center | Comments Off

Banks continually challenged with securing growing sales channels

Posted on: January 23rd, 2013 by art

Along with providing faster and more convenient ways to bank, financial institutions are constantly challenged with making sure all of their customer channels are protected. The problem with offering customers more tools for customers to bank remotely is the ability to successfully secure the growing number of sales channels without impacting the user experience.

While the recent Computerworld article, “How Emerging Technology Fights Fraud in the Call Center,” highlights the progress that banks have made detecting and preventing online fraud, there’s more to be done on other channels that criminals are turning to because of their lack of success over the Internet. Ori Bach, director of solution management for call center provider NICE Systems, said the potential for human error makes contact centers the weakest link in today’s enterprises.

“It’s a remote channel with a large human factor. As fraudster’s have gotten less successful online, they’ve either moved solely to contact center attacks or to cross-channel attacks–starting in the call center and migrating to another channel using a credential they’ve attained.”

One of the points called out in the story is the fact that call center agents are not security experts. Their job is, first and foremost, to make the customer happy. The challenge with this is telephone representatives not privy to the latest scams can be susceptible to fraud attempts. And it doesn’t stop there. The entire phone system can be at risk, too.

Today, it’s too easy for criminals to steal anyone’s personally identifiable information (PII) from social media websites. Someone with the right data and the capability to spoof Caller ID or ANI can, as the article suggests, “whiz passed the typical call center authentication process.” That’s a frightening thought for any financial institution that doesn’t have proactive security measures in place to identify spoofed calls before they are answered.

That said, financial institutions should not rely on non-predictive PII to determine whether a caller is a real customer or a fraud. Too many security methods like knowledge-based authentication (KBA) are vulnerable to social engineering schemes because they depend too much on PII to catch crooks posing as customers on the telephone. And this says nothing about the damage that security questions can have on the goodwill of banking customers.

By automatically validating the location of the landline or mobile phone “pre-answered”, the TRUSTID® Physical Caller Authentication tool enables banks to invisibly identify crooks before they can attempt to a fool bank agent. Proactively identifying criminals in real time not only eliminates the need for unpleasant telephone interrogations that impact customer trust, it allows bank representatives to immediately begin servicing customers at the onset of the call, which improves the overall banking experience and plays a critical role in strengthening the profitable bank-customer relationship.

Tags: , , , , , , , ,
Posted in ANI Spoofing, Banking Fraud | Comments Off

Security concerns prompting banks to invest in multi-factor authentication

Posted on: January 16th, 2013 by art

It shouldn’t come to anyone’s surprise that account takeover attacks are up around the globe. With fraud against financial institutions on the rise, what will banks be focusing on in the coming year? That’s the question recently posed to Bill Nelson, president and CEO of the Financial Services Information Sharing and Analysis Center (FS-ISAC).

The recent BankInfoSecurity article, “New Insight on How to Respond to 2013’s Top Fraud Trends,” suggests that fraud attempts against banks and credit unions will continue to increase this year. While the number of attacks is certainly a growing concern with the global banking community, it has also prompted financial institutions to take extra security precautions to help reduce the amount of losses resulting from account takeovers and other fraud attacks, said Nelson.

“[Account takeover] attempts are up, and we’re really seeing that around the world… The good news is that financial institutions are doing a good job to detect and prepare for these attacks.”

Because stronger security measures have contributed to a decline in actual fraud losses, Nelson believes the financial services industry will continue to see more investment in anomaly detection and multi-factor authentication in 2013 to help banks verify the increasing volume of customer transactions. We at TRUSTID strongly agree. Deploying a multi-factor authentication strategy can play a critical role in preventing fraud across all banking channels.

With tens of thousands of calls coming into bank call centers every day, financial institutions need a way to quickly and non-intrusively identify whether every customer call can be trusted or not. The TRUSTID® Physical Caller Authentication tool does this by verifying the physical location of the telephone calling in before the call is answered. By validating whether the call is coming from a legitimate customer or poses a risk, TRUSTID gives financial institutions have an additional layer of authentication that allows them to serve good customers faster or stop known spoofed calls before a criminal has a chance to socially engineer a contact center agent.

In 2013, financial institutions investing in complementary authentication solutions like TRUSTID will achieve true multi-factor authentication that is recommended today for protecting banking channels from account takeovers and other unwanted criminal activity.

Posted in Authentication, Banking Fraud | Comments Off

Restoring the trust and usability of Caller ID

Posted on: January 9th, 2013 by art

Trust, once the very essence of the financial industry, is gone.

That’s according to the recent USA Today article, “Remember when trust actually meant something,” which says most of today’s major brands have implicit trust problems. Many are on a spinning treadmill trying to make up for lost customer and public trust.

Trust fadingThis certainly applies to today’s Caller IDs and ANI. The one-time foundation for customer identification and knowing whether an incoming call could be trusted or not, the Caller ID is no longer the relied upon source for identifying incoming calling party phone numbers it used to be. Thanks, in part, to the rapid rise of Caller ID spoofing tools and social engineering schemes.

These telephone scams take advantage of the risky handling of personally identifiable information (PII) over the Internet to defeat security methods like knowledge-based authentication (KBA) security questions. These methods no way of validating the Caller ID and rely too much on PII for authenticating activities such as bankcard activation, money transfers new account applications and customer service processes.

With more banking transactions still being conducted over the telephone than the Internet, financial services industry needs to re-establish Caller ID and ANI as trusted sources for authenticating customers. Why? When you think about it, the ability to automatically validate the actual telephonic device making the call is a far better, more reliable credential than the last four digits of a customer’s social security number.

Today, relying on PII is no longer predictive for identifying customers over the phone. IN fact, it can put a bank’s information and customer accounts at serious risk. And once the trust between the bank and customer is lost, it can be a long road for financial institutions to win back that important trust with customers and the public in general.

Unlike traditional PII-based authentication tools, the TrustID® network-based Physical Caller Authentication doesn’t depend on challenge questions to identify customers over the phone. Rather, it automatically transmits the caller’s phone number to our API before a call center agent picks up. Using real-time telephone network forensics, the actual location of the telephonic device is validate or identified as a spoofed call.

Finally, because this process takes place without interrupting the customer experience or tipping off criminals who are identified before the call is answered, TRUSTID helps restore the trust and usability of the Caller ID and ANI to help banks can reduce revenue losses from fraud and provide a faster, more trustworthy experience for the millions of banking customers who still bank over the telephone.

Tags: , , , , , , , , ,
Posted in ANI Spoofing, Authentication, Caller ID Spoofing | Comments Off

Combating bank fraud that targets user behavior

Posted on: January 2nd, 2013 by art

Even with fraud defenses in place, individuals are still the ones who have to ultimately make banking decisions that could put them at risk. In other words, while anti-fraud technologies are designed to provide red flags and help detect fraudulent transactions, they can’t always stop people from being duped by clever social engineering schemes. That risk is often left up to the individual’s discretion, whether it’s a customer or employee.

The recent article, “How to Address Security’s Weakest Link,” explores one of the most inherent security vulnerabilities that banks face today — people. Broadly recognized as a bank’s most valuable asset as well as its biggest weakness, Matthew Speare, M&T Bank’s senior VP for information technology, said it doesn’t matter how much awareness effort is made, the ongoing challenge for every banking institution is to continually educate people about fraud trends while influencing user behavior.

“Whether it’s internal employees or customers, unfortunately, people end up being their own worst enemy, as well as ours.”

While today’s security strategies are largely focused on various technologies that protect banking channels and their customers, and rightly so, many see the value in incorporating educational programs to raise awareness around fraud and emerging social engineering schemes.

There’s no denying the role education can play in any bank’s anti-fraud strategy; however, that can be complemented with fraud prevention solutions that both educate and inform bank representatives about the level of risk of each customer call. The TrustID® network-based Physical Caller Authentication incorporates proactive fraud detection to instantly educate bank agents about the legitimacy of incoming calls.

By automatically validating the physical location of the telephone (landline or mobile device) before the call is answered, TRUSTID gives contact center representatives more insight into the call before they pick up. So, even when a criminal tries to manipulate their Caller ID or ANI in an effort to socially engineer a bank’s call center, financial institutions can instantly see if the call is coming from a legitimate customer, or if it poses a higher risk for fraud.

As a result of having a real-time customer authentication solution like TRUSTID that non-intrusively identifies legitimate customers and invisibly sees when criminals have spoofed their Caller ID — all before the call is answered — banks can make faster, better educated business decisions to reduce the risk of social engineering schemes that target unsuspecting customer care agents over the telephone channel.

Posted in Banking Fraud, Caller ID Spoofing | Comments Off
  • REQUEST INDUSTRY BRIEFING PAPERS
  • VIEW DEMO
  • USE CASE
  • ANI SPOOFING TOOL

  • CISO Text

             

    Authentication without caller involvement materially improves the customer experience, especially for ‘premier accounts.’ TrustID will greatly assist with not only customer service, but also with board level compliance issues.

    – CISO, top 10 global bank

  • CISO 2 Text

             

    As less customer PII is made available to our contact  center advocates for identity validation, our enterprise risk of a costly data  breach is dramatically decreased.

              – CSO, global financial company

    Offshore agents are highly vulnerable to fraud schemes  and social engineering. TrustID’s solution enables informed routing decisions,  optimizing agent cost reduction programs.

             - CISO, top 10 global bank           

  • VP Quote text

         

    Since  it is now commonly sold by criminals, personal information for identity  authentication is no longer the single solution to identity resolution. The  value of knowing reliably that a customer is calling from their phone is far better security than knowing the last four digits of someone’s SSN.

    - VP of Card Fraud, large international bank