Posts Tagged ‘KBA’

Authenticating caller party numbers shouldn’t be a masquerade ball

Posted on: May 15th, 2013 by art 2 Comments

The challenge of spotting criminals over the telephone channel often plays out like a game of cat and mouse. Crooks use false information to mask their true identities. After spoofing their caller ID to make it look like someone else is calling, they try to convince call center agents they are genuine banking customers.

Armed with enough personally identifiable information (PII) to apply for credit, activate bank cards, transfer funds and defeat PII-based authentication solutions, many criminals continue to successfully socially engineer bank representatives by correctly answering the security questions required by more traditional knowledge-based authentication (KBA) tools.

From an authentication standpoint, the call center environment has somewhat turned into a masquerade ball of disguises, where it’s anybody’s guess as to who is who. The financial services industry can no longer operate within a guessing game environment anymore. Fielding more than 50 billion calls a year, call centers need to have the appropriate tools in place to quickly and accurately authenticate all inbound calls.

As criminals do everything they can to slip past PII-based authentication solutions, it’s more important than ever for financial institutions to deployed effective security measures to identify customers in real time.

Using a patent-pending telephone firewall that includes telephony databases, real-time network forensics and specialized analytics, the TRUSTID® Physical Caller Authentication tool authenticates the calling party number before the call center agent picks up. This allows banking institutions to prevent spoofed calls from being routed to bank representatives, and in doing so, call center agents don’t waste their time interrogating known high-risk calls. Instead, they spend more time servicing good customers and improving the overall customer experience.

With the volume of customer calls increasing every year, operational efficiency is becoming a key component in the authentication process. By invisibly identifying risky calls and not interrupting the customer service process with unnecessary telephone interrogations, TRUSTID helps banks unmask criminals before they’re allowed into the party.

 

The cost of bank fraud and operational inefficiency

Posted on: May 8th, 2013 by art No Comments

When we talk about call center authentication, we’re essentially talking about two things — accuracy and efficiency.

Sure, there are many tools that are designed to identify customers in their own way. But what differentiates one solution from another is the speed and accuracy that it takes to validate calls. In the end, authenticating customers over the telephone channel comes down to how quickly we can analyze risk, which is the indicator that helps banks agents determine whether or not the caller is who they say they are.

While caller ID spoofing can impact banks in many different ways, including bank fraud, the bank-customer relationship and damage to a corporate brand, the time takes to validate customers over the telephone channel can be just as important, and costly. Relying on traditional knowledge-based authentication (KBA) to verify customers over the telephone can also have a negative impact on banks due to the amount of time it takes to verify customers.

For financial institutions that depend on KBA to identify customers over the phone, here are a few things to consider:

  • First, there’s the cost of customer trust and goodwill. By this I mean disrupting the customer experience. For example, an authentication solution that require customers to first answer a bunch of challenge questions can be very disruptive to the process. Of course customers want to know they are being protected, but by taking too much of their valuable time to verify who they are before their needs are addressed can test the customer’s patience. Having a solution that automatically validates callers before the phone is picked up can eliminate unnecessary security questions that can impact the profitable bank-customer relationship.
  • The average call handling (ACH) time is important to every contact center. You can bet every call center manager knows their ACH time because it plays a critical role in their operating costs. The more bank call centers can lower their ACH time, the more money they can save on operations. This underscores the need to deploy fast, accurate solutions for validating callers.
  • Finally, without the ability to accurately identify callers, banking institutions are pretty much operating in the dark. What’s so problematic about this scenario is that authentication solutions that rely on personally identifiable information (PII) are essentially operating on blind faith, which puts both their customers and systems at risk. With personal information so accessible over the Internet today, PII-based authentication solutions should no longer be the basis for customer identification.

The bottom line is there are various costs that come with authenticating customers. Cost in the form of trust, cost in the form of labor and operational expenses, and cost in the form of fraud. All of this can weigh in the balance of how fast call centers can authenticate callers without disrupting the overall customer experience.

There will always be a cost for authenticating customers over any bank sales channel, including the call center. However, banks should not have to accept telephone fraud, lost customers and operational inefficiencies as the cost of doing business.

Are you relying on outdated authentication tools?

Posted on: April 3rd, 2013 by art No Comments

Those of us in the telephone authentication industry can see the shortcomings of the different types of customer identification methods. While this has been evident for some time now, what continues to be an uphill battle is educating financial institutions about the risks of using outdated and ineffective authentication tools to identify customers over the telephone channel.

At last month’s BAI Payments Connect Conference, business leaders from around the globe met to discuss how various forms of fraud impact banks – from account-opening fraud to social engineering and call center fraud. No matter what channel criminals choose, the conclusion among fraud experts is bank fraud is on the rise.

Ori Bach, a call center monitoring expert with NICE Systems, echoed what we’ve been saying all along — knowledge-based authentication (KBA) and Caller ID are broken, call center fraud is up, and untrained personnel are falling for preventable tricks. Collectively, all of these pieces are contributing to increasing fraud losses.

I don’t mean to beat a dead horse, but I can’t stressed enough how important it is to continue informing financial institutions about the risks they face using beatable authentication methods, particularly those that depend on personally identifiable information (PII).

At TRUSTID, we agree with all of Bach’s conclusions, including:

 

  • KBA is not predictive: With personal information available via social websites such as Facebook, PII-based methods for authentication is diminishing. As a result, KBA can no longer be the single solution for identifying customers over the phone.
  • Caller ID is broken: With a wide availability of spoofing tools, calling party number spoofing has become a low cost and power penetration tool used to impersonate identity and actual location over the telephone channel.
  • Untrained call center agents are easily fooled: If bank representatives aren’t up to speed with the latest fraud techniques, they will continue to fall for Caller ID spoofing and social engineering scams.

As stewards of customer authentication for the banking industry, part of our job is to continue educating financial institutions about the many risks of fraud, and the real dangers if using outdated authentication tools. Each week, I have eye-opening conversations with fraud managers that still rely on old-school methods to identify customers. Over time, this essentially puts both their bank and customers at greater and greater risk.

The unfortunate part is many of these fraud risks are preventable. By implementing a multi-factor authentication strategy that doesn’t rely on PII to identify customers, banks can reduce their risk against many of today’s fraud techniques that result in millions of dollars in fraud losses each year.

Phone-based authentication should enhance the customer experience, not erode it

Posted on: March 27th, 2013 by art 70 Comments

Should banks add phone-based authentication? Any financial institution that provides services over the telephone channel needs to have some way to authenticate every call coming into their call center. While the answer to that question is pretty evident, the bigger question banks should be asking themselves is what type of solution best fits their business model.

With fraud protection the top priority for authenticating customers over the telephone, another criteria for phone-based authentication is that it shouldn’t interrupt the customer experience. According to the recent article, “Two Factor Or Not To Factor? An Online Security Conundrum,” the main argument against phone-based authentication is it adds friction to the sign-in process. Does it? Well, it depends on the type of service being used.

Of course consumers want both a secure and seamless way to gain access to their banking accounts. After all, who wants to answer a bunch of challenge questions every time they go to access their account? While there are various authentication methods financial institutions can choose from, many can still delay the process by a few minutes. This lengthy phone interrogation can test the goodwill of customers, giving them the impression that their needs aren’t not the top concerns of banks.

One of the main objectives of an effective telephone authentication solution should be to quickly and non-intrusively verify customers without them knowing it. We at TRUSTID believe customer authentication should not impede the user experience at all. In fact, we think it should enhance it.

By combining innovative technology with the keen understanding of what customers expect from remote banking services, the TRUSTID® Physical Caller Authentication tool uses real-time telephone network forensics to invisibly validate the Caller ID and ANI before the call is answered. Achieving customer verification without requiring customers to answer security questions allows call center agents to immediately begin addressing the customer’s needs the moment the phone is picked up.

Imagine the impact on your business operations and customer relationships if you could validate them before the call is answered. Not only would you maintain and strengthen the confidence and goodwill of your customers, you could also save operating expenses through lower average call handling (ACH) times that other knowledge-based authentication (KBA) methods simply can’t do.

In other words, when it comes to customer authentication, the value of putting your customers’ needs first and delivering safe, exceptional service that exceeds their expectations can create a more satisfied banking experience without eroding it with costly and cumbersome challenge questions.

All banking channels need to be prepared for customer impersonators

Posted on: March 19th, 2013 by art 1 Comment

I’ve often spoke about the many dangers of depending on personally identifiable information (PII) for customer authentication. As we recently learned from the high-profiled credit report celebrity hacking, relying on accessible personal information such as date of birth, mother’s maiden name and Social Security number can put a company’s customers and corporate data at serious risk.

In the article, “FBI Investigating Hackers Who Posted ‘Secret Files’ Of Celebrities, Politicians,” the consumer credit reporting agency, Equifax, released a statement last week confirming that the sensitive financial data that hackers posted on celebrities and political figures was the result of a security breach to the credit reporting agency’s annualcreditreport.com channel, not a break-in to their computer system.

Using PII that could have been accessed through any number of online social networks or public information websites, the perpetrators had enough personal identifying details to correctly answer the challenge questions required to access their intended victims’ private financial files, said Equifax spokesperson, Timothy Klein.

“Our initial investigation shows the perpetrators had the PII of the individuals whose files were accessed and were therefore able to pass the required authentication measures in place. We have launched a full investigation into this matter and we are also working closely with law enforcement authorities on this matter.”

In recent years, cybercriminals impersonating genuine customers or conducting similar social engineering schemes across other sales channels have been responsible for the illegal exposure of tens of thousands of credit reports. These compromises can all lead to identity fraud, account hijacking and other identity-related crimes.

Because customer-impersonating scams are conducted remotely, they can easily be performed over the telephone channel, as well. Social engineering against call center agents is a threat that all financial institutions should not only be concerned with, but adequately prepared for. If we are to learn from incidents like what occurred last week, it’s that relying on knowledge-based authentication (KBA) is not an effective defense against such criminal tactics.

Bank contact centers, which handle billions of calls each year, need an authentication method that goes beyond telephone interrogations such as defeatable security questions. What they need is a security tool that allows them to proactively identify callers before the phone is picked up.

A security tool like the TRUSTID® Physical Caller Authentication solution identifies high-risk calls before the phone conversation begins. Through TRUSTID’s real-time telephone network forensics, banks are able to invisibly identify the physical location of the landline or mobile phone while it is still ringing.

This automated process uses the Caller ID and ANI as trusted sources for validating customers over the telephone. By restoring the usability of calling party numbers to authenticate customers over the phone channel, financial institutions can identify high-risk calls faster, as well as instantly confirm legitimate calls so bank representatives can begin serving customers at the start of each call, without relying on non-predictive and risky PII methods.

Using automated caller authentication to transform the customer experience

Posted on: March 13th, 2013 by art 60 Comments

There’s always been this notion that once a process or system is automated, the people who once performed that task will soon be out of a job. While some tools have certainly earned that reputation, when it comes to automating customer authentication over the telephone, it’s not about replacing people. Rather, it’s about proactively detecting spoofing risks, reducing call center expenses, and transforming authentication into a positive customer experience.

When caller authentication is not automated, this means contact center agents must perform a number of steps to verify that the caller is who they say they are. As we know, security questions are a drawn out identity-interrogation process that requires banking customers to answer a bunch of personal questions that can be beaten by clever social engineers.

Ultimately, this process drives up average call handling (ACH) times, increases operating costs, and can damage the important bank-customer relationship. And because personally identifiable information (PII) is not predictive of identity, knowledge-based authentication (KBA) methods, when used alone, can actually create a false sense of trust that puts company data and customers at risk.

A security tool like the TRUSTID® Physical Caller Authentication solution, however, automatically authenticates the caller using a combination of three core components, including:

 

  • Telephony databases (e.g., local number portability, numbering plans, carrier / line attributes, billing data, routing tables, HLR data, LERG tables, geospatial data, carrier and switch data)
  • Real-time telephone network forensics (e.g., call progress, call messages, network tones, SS7 and SIP signaling, DSP audio energy and voice analysis tools)
  • Specialized analytics (real-time delivery of proprietary credential scores that enable enterprise risk decisioning, customer-specific reason codes, caller data and reports for custom risk model and scoring)

Automatically validating the caller before the phone is answered doesn’t eliminate jobs, it provides stronger customer authentication while streamlining customer service.

What I mean by this is instead of using up valuable time and resources questioning customers over the telephone, call center agents are now free to immediately begin servicing and selling good customers at the initial “golden minute” of the telephone call.

By undetectably authenticating customers through their calling party numbers, TRUSTID helps financial institutions lower customer authentication expenses, reduce the cost of fraud as a result of telephone-based social engineering, and gets call center agents selling and serving customers, not identity-interrogating, which in the end can transform the overall customer experience.

Researchers find flaw in two-factor authentication system

Posted on: March 6th, 2013 by art 61 Comments

The idea behind two-factor authentication is to provide a multi-layered security defense that allows good users to safely access their accounts while preventing criminals from illegally accessing other peoples’ accounts. In theory, this is a sound method that many of today’s financial institutions use to authenticate their customers over various banking channels.

Implementing more effective security initiatives is also the byproduct of stronger federal regulations like the FFIEC (Federal Financial Institutions Examination Council), which recommends banks deploy at least two-factors of authentication as defined by its 2011 Supplement to the Authentication.

Sometimes, however, even effective security measures can fall short of their goal.

This was widely illustrated last week when researchers announced they found a loophole in Google’s two-factor authentication system. In the article, “Google Two-Factor Authentication Bug Allowed Account Hijacking,” Duo Security reported that the search engine giant’s two-step verification system for authenticating users had a flaw that could allow accounts to be hijacked — the vary thing the security platform was designed to prevent.

This is yet another case where a company that has done their due diligence to implement a multi-layered security strategy still had vulnerabilities within its system that could allow criminals to sneak past their authentication processes.

This is why financial institutions need to understand the importance of having at least two-factors of authentication, which still may not be enough to secure online account. Shortcomings like those revealed last week could apply to other customer channels, as well.

Take, for example, the telephone. Today, banks still use knowledge-based authentication (KBA) solutions to identify their customers over the phone. For many, KBA (“something you know”) is a critical piece to their verification strategy. It’s also part of the FFIEC’s two-factor authentication criteria, along with “something you are” (fingerprint, DNA, retinal pattern) and “something you have” (ID card, security token, telephone). Unfortunately, KBA has become a solution that thieves have proven to beat time and time again.

Designed to ask callers security questions that only the customer would know, crooks can now slip past KBA methods by combining identity theft with social engineering. By correctly answering challenge questions, criminals can ironically break down a security barrier that’s precisely designed to prevent criminals from getting through in the first place.

I’m not saying that using passwords, personally identifiable information (PII) or PIN numbers are worthless for customer authentication, but exposure to social engineering schemes over the telephone can pose a weakness in two-factor authentication systems. It’s vulnerabilities like these that the FFIEC recommends at least two factors of authentication for defending banking networks and their customers from today’s criminal threats.

Security processes should not compromise customer service

Posted on: February 27th, 2013 by art 70 Comments

For financial organizations that provide a service, what is it that keeps customers coming back? Since a product is not the competitive differentiator, is it speed? Convenience? Exceptional customer service? How about customer trust and confidence? And where does security factor in? For financial institutions, the answer to these questions could very well be all of the above.

With banks working overtime to safeguard their many customer channels, the one thing they want to make sure their security processes don’t do is interrupt their ability to deliver excellent customer service. Any disruption to the customer experience can have an impact on their ability to retain existing customers and win ones.

Today’s smarter, savvier banking customers expect more from financial institutions. They’ve become less tolerant when a bank falls short of meeting their high expectations. In fact, the 2012 U.S. Bank Customer Switching and Acquisition Study by J.D. Power and Associates found that year-over-year more customers are switching banks as a result of fees, poor service and unmet expectations.

While security can plan a key role in building customer confidence and loyalty, on the flip side, it can also have a negative impact if handled the wrong way. Take, for example, knowledge-based authentication (KBA). Once the standard for identifying banking customers over the telephone, KBA alone is no longer predictive for customer authentication. What can be equally as damaging is how a barrage of security questions interrupt the customer experience to the point that banks lose their customers’ trust and goodwill, and ultimately their business altogether.

Unlike KBA and other personally identifiable information (PII) security methods, which interrogate customers over the telephone, the TRUSTID® Physical Caller Authentication solution helps secure the telephone channel without call center agents saying a single word. By non-intrusively validating the Caller ID and ANI before the call is answered, TRUSTID doesn’t intervene in the customer experience at all. By automatically validating good customers before their call is answered, bank representatives can provide immediate customers service at the onset of each call. Immediately addressing customers’ needs leave them feeling respected and creates a senses of loyalty that they got what they needed, when they needed it, all in a timely manner.

In today’s remote banking environment, it’s no longer good enough to simply keep fraud or unwanted activity in check — fraud has to be contained without damaging the larger, broader relationship between banks and their customers. Establishing this not only creates a competitive differentiator, but allows financial institutions to open up new revenue opportunities with both existing customers and future customers.

 

How pre-answered caller authentication helps prevent telephone bank fraud

Posted on: February 20th, 2013 by art

Prevention vs. clean up. It’s a security question all financial institutions should ask themselves.

When it comes to providing a trusted customer environment, banks are typically better at resolving problems stemming from non-predictive authentication and fraud than preventing them. That’s because they continue to allow criminals to get their foot in the door.

What I mean by this is when banking customers place a call into a contact center, the very act of answering the telephone sets the stage for criminals to start their elaborate social engineering schemes. And once the dialog starts, anything goes.

Javelin’s director of security, Phil Blank, has long said when it comes to safeguarding customer environments, the biggest challenge is prevention. Done right, however, it can also have the biggest payback for both the bank and customer.

The typical scenario for customer calls looks something like this. A call center agent picks up the phone then proceeds to ask the caller their customer ID and social security number. Based on the level of information the customer is requesting, the bank representative may ask a number of challenge questions. At this point, they’ve already taken up a minute or more of the customer’s valuable time using knowledge-based authentication (KBA) methods that, quite frankly, can no longer assure that the person on the other end of the line is who they say they are.

In today’s many banking channels, criminals armed with the right personal and financial details they’ve collected over the Internet can convincingly impersonate an actual banking customer. In the telephone channel, for example, the very moment they’re able to talk with a call center agent, they have the upper hand.

Whether the caller is a valid banking customer or an impersonator, telephone interrogations impact banks and their customers in several ways, including:

 

  • Employee costs: Every second a bank has to validate and serve their customers counts. If a bank’s contact center agents still rely on KBA for customer identification, they’re likely overspending in many areas for identity authentication, including employee training, security systems and other internal processes.
  • Bank-customer relationship: Burdening customers with lengthy interrogations tests the goodwill of customers and impacts the overall customer experience. This can put a heavy toll on the profitable bank-customer relationship that’s important to any bank’s overall success.
  • Non-predictive authentication: Because personally identifiable information (PII) is used to socially engineer banks, it is not predictive for positively identifying customers calling into a contact center. Therefore, financial institutions should not rely solely on PII for identity authentication.

The TRUSTID® Physical Caller Authentication solution helps banking institutions solve these problems by validating all customer calls before they are answered. Using real-time telephone network forensics to proactively validate the physical location of the landline or mobile device calling the contact center, banks can determine the risk of each inbound call before it is picked up. This insight allows banks to eliminate the time spent authenticating bad calls and serve good customers faster and more seamless. As a result, preventing high-risk callers from reaching bank representatives builds a safer banking environment and strengthens the bank-customer relationship without having to worry about the time, resources and costs associated with cleaning up fraud after it has already happened.

How to turn telephone identity interrogations into better customer care

Posted on: February 6th, 2013 by art

How confident are you that the next time one of your call center agents answers the phone the call will be handled safely and efficiently? If your contact center still relies solely on a host of challenge questions to identify customers over the telephone channel, my guess is your security confidence level falls a few notches below where it should be.

We all know that the reliability of traditional knowledge-based authentication (KBA) today is not what it was a few short years ago. The Internet and social media websites let too much out of the bag these days. Anyone with criminal intentions can spend a little time collecting personally identifiable information (PII) and other public data they can use to socially engineer others over the phone. With the right answers to security questions, criminals can defeat KBA and other PII-based solutions designed to catch suspicious or criminal behavior over the telephone channel.

But what if you could verify the actual risk of the call before the phone is answered? How valuable of a security tool would this be in protecting your customers and confidential bank information? A lot, I would presume.

To put it another way, would if you could eliminate the thousands of hours spent each year on known high-risk calls and transfer all that time and resources into providing better care to your good customers? How much would that save on your annual operating costs, not to mention positively impacting the profitable bank/customer relationship? This is possible through the TRUSTID® Physical Caller Authentication solution.

By using real-time telephone network forensics to validate the physical location of the landline or mobile phone before the call is answered, TRUSTID helps financial institutions realize several security and cost benefits, including:

 

  • Reduce losses relating to fraudulent calls
  • Drop the average call handle (ACH) time
  • Spend more time servicing good customers
  • Spend less time identifying bad ones
  • Build trust and goodwill with customers
  • Improve the overall customer experience

When it comes to proactively identifying customers over the telephone, TRUSTID allows banks to non-intrusively authenticate good callers and instantly identify high-risk ones without relying on PII or costly identity interrogations. As a result, financial institutions have the ability to invisibly shut the door on criminal tactics such as spoofed calls and social engineering schemes to achieve a safer, more efficient banking experience for their customers.

In my book, continually improving the level of call center protection and spending more time and resources caring for customers is something both banks and customers can feel good about.

  • REQUEST INDUSTRY BRIEFING PAPERS
  • VIEW DEMO
  • USE CASE
  • ANI SPOOFING TOOL

  • CISO Text

             

    Authentication without caller involvement materially improves the customer experience, especially for ‘premier accounts.’ TrustID will greatly assist with not only customer service, but also with board level compliance issues.

    – CISO, top 10 global bank

  • CISO 2 Text

             

    As less customer PII is made available to our contact  center advocates for identity validation, our enterprise risk of a costly data  breach is dramatically decreased.

              – CSO, global financial company

    Offshore agents are highly vulnerable to fraud schemes  and social engineering. TrustID’s solution enables informed routing decisions,  optimizing agent cost reduction programs.

             - CISO, top 10 global bank           

  • VP Quote text

         

    Since  it is now commonly sold by criminals, personal information for identity  authentication is no longer the single solution to identity resolution. The  value of knowing reliably that a customer is calling from their phone is far better security than knowing the last four digits of someone’s SSN.

    - VP of Card Fraud, large international bank