Tag Archive for "Physical Caller Authentication" - TRUSTID

Posts Tagged ‘Physical Caller Authentication’

Authenticating caller party numbers shouldn’t be a masquerade ball

Posted on: May 15th, 2013 by art 2 Comments

The challenge of spotting criminals over the telephone channel often plays out like a game of cat and mouse. Crooks use false information to mask their true identities. After spoofing their caller ID to make it look like someone else is calling, they try to convince call center agents they are genuine banking customers.

Armed with enough personally identifiable information (PII) to apply for credit, activate bank cards, transfer funds and defeat PII-based authentication solutions, many criminals continue to successfully socially engineer bank representatives by correctly answering the security questions required by more traditional knowledge-based authentication (KBA) tools.

From an authentication standpoint, the call center environment has somewhat turned into a masquerade ball of disguises, where it’s anybody’s guess as to who is who. The financial services industry can no longer operate within a guessing game environment anymore. Fielding more than 50 billion calls a year, call centers need to have the appropriate tools in place to quickly and accurately authenticate all inbound calls.

As criminals do everything they can to slip past PII-based authentication solutions, it’s more important than ever for financial institutions to deployed effective security measures to identify customers in real time.

Using a patent-pending telephone firewall that includes telephony databases, real-time network forensics and specialized analytics, the TRUSTID® Physical Caller Authentication tool authenticates the calling party number before the call center agent picks up. This allows banking institutions to prevent spoofed calls from being routed to bank representatives, and in doing so, call center agents don’t waste their time interrogating known high-risk calls. Instead, they spend more time servicing good customers and improving the overall customer experience.

With the volume of customer calls increasing every year, operational efficiency is becoming a key component in the authentication process. By invisibly identifying risky calls and not interrupting the customer service process with unnecessary telephone interrogations, TRUSTID helps banks unmask criminals before they’re allowed into the party.

Contact centers taking a lead role in the overall banking experience

Posted on: May 1st, 2013 by art No Comments

Long are the days of waiting in long lines to cash checks or make routine bank deposits. In today’s multi-channel marketplace, the way customers want to bank is changing, and in turn, so are the ways financial institutions service customers.

For many of us, walking into our bank’s branch office is becoming a rare occurrence, anymore. More and more customers are banking remotely because of the ease, speed and convenience it has made on our busy lifestyles. Along with that, the primary role of bank contact centers is shifting from informational and troubleshooting centers to sales and purchase-related activities.

The recent article, “Talking Up Sales in the Contact Center,” addresses some key changes that are taking place in the banking environment, including:

Customers are making less branch visits, but still want a live conversation with a bank representative when opening accounts
Remote banking is maturing from a transactions service to a full shopping and banking experience in a multi-channel marketplace
Bank contact centers are playing a central role in customer acquisition and cross-selling
Higher averages sales conversion ratios are taking place in contact centers (2%) than walk-in branch traffic (typically around 1.5%)
Despite years of investments in branch selling, the best sales conversion ratios have only a fraction of the potential of the contact center

With callers typically setting aside 15 minutes for help, if the bank agent can address their needs and service them in the first few minutes, a customer will likely have time to listen to additional banking services that go beyond their initial needs. This is one example of how banks can improve customer satisfaction and their bottom line.

With progressive contact centers fast becoming the largest branch for banking, the article suggests banks need to “strengthen their sales strategies and back up their commitment with the appropriate investments in people, processes and technology.”

Another way many leading financial institutions are enhancing the banking experience through the telephone channel is through the TRUSTID® Physical Caller Authentication tool, which verifies the risk of the call pre-answer so when the banks agent picks up they can immediately begin serving the customer.

Unlike traditional knowledge-based authentication (KBA) tools that interrogate customers with a bunch of challenge questions during the first minute of the call, TRUSTID validates the risk of the call before it is answered to help banks take advantage of the “golden minute” of the phone conversation. These precious few seconds present the highest likelihood of positive engagement to immediately address the customer’s needs and use the time saved to sell additional products and services.

Too many financial institutions continue to lose the opportunity by relying on time-consuming security questions to validate callers. This outdated method uses up valuable resources, drives up call center costs, and is destroying the trust and goodwill of their customers, which ultimately impacts the bottom line.

Moving forward, every banks’ success will be determined by its ability to constantly change with the market and meet growing customer demands. The TRUSTID Physical Caller Authentication solution helps them get there by averting fraud without wasting valuable time and resources interrogating customers over the telephone channel. By deploying tools that keep each customer’s needs upfront and center, banks can better serve their customers, sell new services, drive down operating costs, and generate more revenue through customer loyalty.

Study finds banks not meeting customer demands

Posted on: April 24th, 2013 by art 19 Comments

Customer service has always been at the root of customer satisfaction. In the financial services industry, without providing an exceptional customer experience banks simply won’t be able to retain current customers or attract new ones.

While we known the impact dissatisfied customers can have on a bank’s brand and overall success, a recent study by Cisco found that banks are falling short of meeting customer demands for more personalized service.

In the article, “Banks Fall Short On Delivering Personalized Service for Customers, Study Finds,” Cisco’s Customer Experience Report found that 69% of U.S. customers would be willing to give their bank more personal information if it resulted in better overall service. However, 58 percent of bankers said they had enough personal information on their customers. These somewhat conflicting views show that financial institutions are not meeting their customers’ expectations.

Customers in the study cited that the most important areas of personalized service were identity theft protection (77%), personalized advice to increase their savings (73%), more financial education (67%) and an assessment of their personal financial health compared to other customers (47%).

Cisco’s financial services marketing manager, Al Slamecka, said the problem with fulfilling customer needs is not a lack of personal data, but rather gaining a better understanding of customers across the organization.

In recent years, balancing customer service with enterprise demands has been a challenge for many financial institutions. From a customer’s point of view, it can often look as though customer service has taken a back seat to the bottom line. While banks are working hard to meet growing customer demands across all banking channels, providing an efficient, customer-friendly experience that addresses the customer’s needs is critical to a bank’s brand and improving the overall customer-bank relationship.

At TRUSTID, we understand how the success of a bank’s entire enterprise is directly dependent on the customer experience. That’s why our TRUSTID® Physical Caller Authentication tool is designed to invisibly verify customers over the telephone channel to streamline the interaction between customers and banks. By proactively validating the Caller ID and ANI before the inbound call is answered, bank contact center agents can immediately begin servicing the customer’s needs the moment they pick up. As a result of providing highly secure, convenient and efficient service over the telephone is one example of how financial institutions can give customers the trust and respect they want and deserve from their bank.

Call centers warned about Telephony Denial-of-Service (TDoS) attacks

Posted on: April 10th, 2013 by art No Comments

Imagine a call center without the ability to take inbound calls or make outbound calls. That’s the impact that growing Telephony Denial of Service (TDoS) attacks can have on targeted call centers. Sort of the cousin to online DoS attacks, TDoS as designed to incapacitate call centers after initial calls for fraudulent transactions are made.

According to the article, “Telephony Denial-of-Service Attacks Prompt Federal Attention,” the Department of Homeland Security and FBI recently issued a “situational awareness bulletin” after a number of TDoS attacks were targeting public safety and emergency services call centers. The alert warned that criminals were phoning the call centers impersonating agencies to collect outstanding payday load debt of $5,000. If the targeted employees didn’t agree to pay, the caller would launch the attack that flooded the call center with enough traffic to disable any incoming or outgoing calls for a period of time.

While the recent attacks have targeted public safety telephone lines, the complaints don’t stop there. Many believe criminals are expanding the types of industries they are targeting. In the memo, the DHS said attackers are “targeting various businesses and public entities, including the financial sector and other public emergency operations interests, including air ambulance, ambulance and hospital communications.”

Using network-based forensics to verify in real-time the exact location of the telephonic device calling bank call centers, we at TRUSTID has seen similar TDoS attempts. Because spoofing Caller ID and ANI is a key component to TDoS attacks, curbing these attacks requires the ability to understand if inbound calls pose a risk before the phone is picked up.

In doing so, financial institutions need to find a better way to authenticate their customers over the telephone channel and protect their call center agents from answering spoofed calls in the first place. The TRUSTID® Physical Caller Authentication solution validates whether all inbound calls can be trusted, or if they are high risk. By knowing if a call is trustworthy or not before it happens, banks can mitigate their risk of TDoS attacks and other social engineering scams without having to invest precious time and resources on known fraudulent calls.

Phone-based authentication should enhance the customer experience, not erode it

Posted on: March 27th, 2013 by art 58 Comments

Should banks add phone-based authentication? Any financial institution that provides services over the telephone channel needs to have some way to authenticate every call coming into their call center. While the answer to that question is pretty evident, the bigger question banks should be asking themselves is what type of solution best fits their business model.

With fraud protection the top priority for authenticating customers over the telephone, another criteria for phone-based authentication is that it shouldn’t interrupt the customer experience. According to the recent article, “Two Factor Or Not To Factor? An Online Security Conundrum,” the main argument against phone-based authentication is it adds friction to the sign-in process. Does it? Well, it depends on the type of service being used.

Of course consumers want both a secure and seamless way to gain access to their banking accounts. After all, who wants to answer a bunch of challenge questions every time they go to access their account? While there are various authentication methods financial institutions can choose from, many can still delay the process by a few minutes. This lengthy phone interrogation can test the goodwill of customers, giving them the impression that their needs aren’t not the top concerns of banks.

One of the main objectives of an effective telephone authentication solution should be to quickly and non-intrusively verify customers without them knowing it. We at TRUSTID believe customer authentication should not impede the user experience at all. In fact, we think it should enhance it.

By combining innovative technology with the keen understanding of what customers expect from remote banking services, the TRUSTID® Physical Caller Authentication tool uses real-time telephone network forensics to invisibly validate the Caller ID and ANI before the call is answered. Achieving customer verification without requiring customers to answer security questions allows call center agents to immediately begin addressing the customer’s needs the moment the phone is picked up.

Imagine the impact on your business operations and customer relationships if you could validate them before the call is answered. Not only would you maintain and strengthen the confidence and goodwill of your customers, you could also save operating expenses through lower average call handling (ACH) times that other knowledge-based authentication (KBA) methods simply can’t do.

In other words, when it comes to customer authentication, the value of putting your customers’ needs first and delivering safe, exceptional service that exceeds their expectations can create a more satisfied banking experience without eroding it with costly and cumbersome challenge questions.

All banking channels need to be prepared for customer impersonators

Posted on: March 19th, 2013 by art 1 Comment

I’ve often spoke about the many dangers of depending on personally identifiable information (PII) for customer authentication. As we recently learned from the high-profiled credit report celebrity hacking, relying on accessible personal information such as date of birth, mother’s maiden name and Social Security number can put a company’s customers and corporate data at serious risk.

In the article, “FBI Investigating Hackers Who Posted ‘Secret Files’ Of Celebrities, Politicians,” the consumer credit reporting agency, Equifax, released a statement last week confirming that the sensitive financial data that hackers posted on celebrities and political figures was the result of a security breach to the credit reporting agency’s annualcreditreport.com channel, not a break-in to their computer system.

Using PII that could have been accessed through any number of online social networks or public information websites, the perpetrators had enough personal identifying details to correctly answer the challenge questions required to access their intended victims’ private financial files, said Equifax spokesperson, Timothy Klein.

“Our initial investigation shows the perpetrators had the PII of the individuals whose files were accessed and were therefore able to pass the required authentication measures in place. We have launched a full investigation into this matter and we are also working closely with law enforcement authorities on this matter.”

In recent years, cybercriminals impersonating genuine customers or conducting similar social engineering schemes across other sales channels have been responsible for the illegal exposure of tens of thousands of credit reports. These compromises can all lead to identity fraud, account hijacking and other identity-related crimes.

Because customer-impersonating scams are conducted remotely, they can easily be performed over the telephone channel, as well. Social engineering against call center agents is a threat that all financial institutions should not only be concerned with, but adequately prepared for. If we are to learn from incidents like what occurred last week, it’s that relying on knowledge-based authentication (KBA) is not an effective defense against such criminal tactics.

Bank contact centers, which handle billions of calls each year, need an authentication method that goes beyond telephone interrogations such as defeatable security questions. What they need is a security tool that allows them to proactively identify callers before the phone is picked up.

A security tool like the TRUSTID® Physical Caller Authentication solution identifies high-risk calls before the phone conversation begins. Through TRUSTID’s real-time telephone network forensics, banks are able to invisibly identify the physical location of the landline or mobile phone while it is still ringing.

This automated process uses the Caller ID and ANI as trusted sources for validating customers over the telephone. By restoring the usability of calling party numbers to authenticate customers over the phone channel, financial institutions can identify high-risk calls faster, as well as instantly confirm legitimate calls so bank representatives can begin serving customers at the start of each call, without relying on non-predictive and risky PII methods.

Using automated caller authentication to transform the customer experience

Posted on: March 13th, 2013 by art 54 Comments

There’s always been this notion that once a process or system is automated, the people who once performed that task will soon be out of a job. While some tools have certainly earned that reputation, when it comes to automating customer authentication over the telephone, it’s not about replacing people. Rather, it’s about proactively detecting spoofing risks, reducing call center expenses, and transforming authentication into a positive customer experience.

When caller authentication is not automated, this means contact center agents must perform a number of steps to verify that the caller is who they say they are. As we know, security questions are a drawn out identity-interrogation process that requires banking customers to answer a bunch of personal questions that can be beaten by clever social engineers.

Ultimately, this process drives up average call handling (ACH) times, increases operating costs, and can damage the important bank-customer relationship. And because personally identifiable information (PII) is not predictive of identity, knowledge-based authentication (KBA) methods, when used alone, can actually create a false sense of trust that puts company data and customers at risk.

A security tool like the TRUSTID® Physical Caller Authentication solution, however, automatically authenticates the caller using a combination of three core components, including:

Telephony databases (e.g., local number portability, numbering plans, carrier / line attributes, billing data, routing tables, HLR data, LERG tables, geospatial data, carrier and switch data)
Real-time telephone network forensics (e.g., call progress, call messages, network tones, SS7 and SIP signaling, DSP audio energy and voice analysis tools)
Specialized analytics (real-time delivery of proprietary credential scores that enable enterprise risk decisioning, customer-specific reason codes, caller data and reports for custom risk model and scoring)

Automatically validating the caller before the phone is answered doesn’t eliminate jobs, it provides stronger customer authentication while streamlining customer service.

What I mean by this is instead of using up valuable time and resources questioning customers over the telephone, call center agents are now free to immediately begin servicing and selling good customers at the initial “golden minute” of the telephone call.

By undetectably authenticating customers through their calling party numbers, TRUSTID helps financial institutions lower customer authentication expenses, reduce the cost of fraud as a result of telephone-based social engineering, and gets call center agents selling and serving customers, not identity-interrogating, which in the end can transform the overall customer experience.

Researchers find flaw in two-factor authentication system

Posted on: March 6th, 2013 by art 52 Comments

The idea behind two-factor authentication is to provide a multi-layered security defense that allows good users to safely access their accounts while preventing criminals from illegally accessing other peoples’ accounts. In theory, this is a sound method that many of today’s financial institutions use to authenticate their customers over various banking channels.

Implementing more effective security initiatives is also the byproduct of stronger federal regulations like the FFIEC (Federal Financial Institutions Examination Council), which recommends banks deploy at least two-factors of authentication as defined by its 2011 Supplement to the Authentication.

Sometimes, however, even effective security measures can fall short of their goal.

This was widely illustrated last week when researchers announced they found a loophole in Google’s two-factor authentication system. In the article, “Google Two-Factor Authentication Bug Allowed Account Hijacking,” Duo Security reported that the search engine giant’s two-step verification system for authenticating users had a flaw that could allow accounts to be hijacked — the vary thing the security platform was designed to prevent.

This is yet another case where a company that has done their due diligence to implement a multi-layered security strategy still had vulnerabilities within its system that could allow criminals to sneak past their authentication processes.

This is why financial institutions need to understand the importance of having at least two-factors of authentication, which still may not be enough to secure online account. Shortcomings like those revealed last week could apply to other customer channels, as well.

Take, for example, the telephone. Today, banks still use knowledge-based authentication (KBA) solutions to identify their customers over the phone. For many, KBA (“something you know”) is a critical piece to their verification strategy. It’s also part of the FFIEC’s two-factor authentication criteria, along with “something you are” (fingerprint, DNA, retinal pattern) and “something you have” (ID card, security token, telephone). Unfortunately, KBA has become a solution that thieves have proven to beat time and time again.

Designed to ask callers security questions that only the customer would know, crooks can now slip past KBA methods by combining identity theft with social engineering. By correctly answering challenge questions, criminals can ironically break down a security barrier that’s precisely designed to prevent criminals from getting through in the first place.

I’m not saying that using passwords, personally identifiable information (PII) or PIN numbers are worthless for customer authentication, but exposure to social engineering schemes over the telephone can pose a weakness in two-factor authentication systems. It’s vulnerabilities like these that the FFIEC recommends at least two factors of authentication for defending banking networks and their customers from today’s criminal threats.

Security processes should not compromise customer service

Posted on: February 27th, 2013 by art 63 Comments

For financial organizations that provide a service, what is it that keeps customers coming back? Since a product is not the competitive differentiator, is it speed? Convenience? Exceptional customer service? How about customer trust and confidence? And where does security factor in? For financial institutions, the answer to these questions could very well be all of the above.

With banks working overtime to safeguard their many customer channels, the one thing they want to make sure their security processes don’t do is interrupt their ability to deliver excellent customer service. Any disruption to the customer experience can have an impact on their ability to retain existing customers and win ones.

Today’s smarter, savvier banking customers expect more from financial institutions. They’ve become less tolerant when a bank falls short of meeting their high expectations. In fact, the 2012 U.S. Bank Customer Switching and Acquisition Study by J.D. Power and Associates found that year-over-year more customers are switching banks as a result of fees, poor service and unmet expectations.

While security can plan a key role in building customer confidence and loyalty, on the flip side, it can also have a negative impact if handled the wrong way. Take, for example, knowledge-based authentication (KBA). Once the standard for identifying banking customers over the telephone, KBA alone is no longer predictive for customer authentication. What can be equally as damaging is how a barrage of security questions interrupt the customer experience to the point that banks lose their customers’ trust and goodwill, and ultimately their business altogether.

Unlike KBA and other personally identifiable information (PII) security methods, which interrogate customers over the telephone, the TRUSTID® Physical Caller Authentication solution helps secure the telephone channel without call center agents saying a single word. By non-intrusively validating the Caller ID and ANI before the call is answered, TRUSTID doesn’t intervene in the customer experience at all. By automatically validating good customers before their call is answered, bank representatives can provide immediate customers service at the onset of each call. Immediately addressing customers’ needs leave them feeling respected and creates a senses of loyalty that they got what they needed, when they needed it, all in a timely manner.

In today’s remote banking environment, it’s no longer good enough to simply keep fraud or unwanted activity in check — fraud has to be contained without damaging the larger, broader relationship between banks and their customers. Establishing this not only creates a competitive differentiator, but allows financial institutions to open up new revenue opportunities with both existing customers and future customers.

How pre-answered caller authentication helps prevent telephone bank fraud

Posted on: February 20th, 2013 by art No Comments

Prevention vs. clean up. It’s a security question all financial institutions should ask themselves.

When it comes to providing a trusted customer environment, banks are typically better at resolving problems stemming from non-predictive authentication and fraud than preventing them. That’s because they continue to allow criminals to get their foot in the door.

What I mean by this is when banking customers place a call into a contact center, the very act of answering the telephone sets the stage for criminals to start their elaborate social engineering schemes. And once the dialog starts, anything goes.

Javelin’s director of security, Phil Blank, has long said when it comes to safeguarding customer environments, the biggest challenge is prevention. Done right, however, it can also have the biggest payback for both the bank and customer.

The typical scenario for customer calls looks something like this. A call center agent picks up the phone then proceeds to ask the caller their customer ID and social security number. Based on the level of information the customer is requesting, the bank representative may ask a number of challenge questions. At this point, they’ve already taken up a minute or more of the customer’s valuable time using knowledge-based authentication (KBA) methods that, quite frankly, can no longer assure that the person on the other end of the line is who they say they are.

In today’s many banking channels, criminals armed with the right personal and financial details they’ve collected over the Internet can convincingly impersonate an actual banking customer. In the telephone channel, for example, the very moment they’re able to talk with a call center agent, they have the upper hand.

Whether the caller is a valid banking customer or an impersonator, telephone interrogations impact banks and their customers in several ways, including:

Employee costs: Every second a bank has to validate and serve their customers counts. If a bank’s contact center agents still rely on KBA for customer identification, they’re likely overspending in many areas for identity authentication, including employee training, security systems and other internal processes.
Bank-customer relationship: Burdening customers with lengthy interrogations tests the goodwill of customers and impacts the overall customer experience. This can put a heavy toll on the profitable bank-customer relationship that’s important to any bank’s overall success.
Non-predictive authentication: Because personally identifiable information (PII) is used to socially engineer banks, it is not predictive for positively identifying customers calling into a contact center. Therefore, financial institutions should not rely solely on PII for identity authentication.

The TRUSTID® Physical Caller Authentication solution helps banking institutions solve these problems by validating all customer calls before they are answered. Using real-time telephone network forensics to proactively validate the physical location of the landline or mobile device calling the contact center, banks can determine the risk of each inbound call before it is picked up. This insight allows banks to eliminate the time spent authenticating bad calls and serve good customers faster and more seamless. As a result, preventing high-risk callers from reaching bank representatives builds a safer banking environment and strengthens the bank-customer relationship without having to worry about the time, resources and costs associated with cleaning up fraud after it has already happened.

Posts Tagged ‘Physical Caller Authentication’

Contact centers taking a lead role in the overall banking experience

Study finds banks not meeting customer demands

Phone-based authentication should enhance the customer experience, not erode it

Researchers find flaw in two-factor authentication system

Security processes should not compromise customer service

Search the Blog

CISO Text

CISO 2 Text

VP Quote text