One of the major problems with traditional user ID and password login is the need for maintaining a password database. Whether that password is encrypted or not, if the database is captured, it presents an attacker with a source to verify his guesses at speeds limited only by his hardware resources. When given enough time, a captured password database will fall. Today there are more types of financial fraud to manage other than password hacking. In a multi-faceted fraud, a fraudster obtains a PIN number through phishing or ATM skimming and then uses that stolen data such as social security numbers, and email addresses to implement their schemes. Armed with this information, these fraudsters are able to employ social engineering to target unsuspecting customer service representatives and trick them into changing sensitive account data. Once this process is complete, fraudsters can use any channel to commit fraud against the account. Combating multi-faceted fraud takes multi-factor authentication.
What is multi-factor authentication?
Multi-factor authentication includes layers of security to try to eliminate the number of holes that can be exploited by intruders. Each successive layer must be able to cover up places where other layers are weak.
The most common type of multi-factor authentication involves sending the user a temporary key that the user can input along with its username and password.
Typical multi-factor authentication scenarios include:
- Swiping a card and entering a PIN.
- Requesting the user to enter an additional one-time password (OTP) that the website’s authentication server sends to the requester’s phone or email address.
- Downloading a VPN client along with a valid digital certificate and then logging into the VPN before access is granted to a network.
- Swiping a card, scanning a fingerprint and answering a security question.
- Attaching a USB hardware token to a desktop that will generate a one-time code and using that one-time code user can log into a VPN client.
Multifactor authentication technologies:
- Security tokens
These are small hardware devices that the user carries for authorizing access to a network service. This device may be in the form of a smart card or may be embedded in an easily-carried object such as a key fob or USB drive.
- Soft tokens
These are software-based security token applications that have the ability to generate a single-use login PIN. Soft tokens are often used for multifactor mobile authentication, in which the device such as a smartphone itself can provide the possession factor.
- Mobile authentication
These methods include SMS messages, smartphone OTP apps or phone calls sent to a user as an out-of-band method. It also involves biometric authentication methods such as retina scans, fingerprint scans, iris scans, finger vein scans, facial recognition and voice recognition.
Computer security at this point is complicated, but implementation of multi-factor authentication is providing new and effective opportunities, that can make fraud detection and handling much easier and more convenient.
