Securing online banking

If your bank wants to know the colour of your first car when you pay a bill online, it's part of a new approach to securing online banking that may also include recognizing your computer and some day, perhaps, even the way you speak or type.

It's called multi-factor authentication and is designed to verify a person's identity by more than one method so as to deliver a higher level of privacy and security assurance. With the growth of online banking — and fraud related to online banking, including phishing and pharming scams — customers and financial institutions have been united in their quest to find a solution.

Whenever a customer performs certain high-risk transactions or logs on to EasyWeb from a computer other than his or her usual one, the system poses one of the questions — such as asking for the name of your spouse's grandmother or perhaps what you studied at university.

TD knows when you log on from your usual computer because it places a web cookie on your machine. That provides an extra level of authentication, but if the system doesn't detect your computer, it asks a question instead.

Combining passwords with questions and/or web cookies is the most popular multi-factor authentication technique online.

Some of the banks also lets customers choose pictures to be displayed when they log on. “It really allows the customer to know that they are on a legitimate site and it is not a phishing site."

But while financial institutions have focused much of their attention online, they're also investing in multi-factor authentication methods that will make bank machine and phone transactions more secure.
So adding security provisions to these services hasn't been a priority.

Biometrics — identification by physical characteristics like fingerprints — are popular for some multi-factor authentication but not online banking. Financial institutions use multi-factor systems including biometrics to control access to physical facilities such as computer rooms.

Makers of automated teller machines are experimenting with fingerprint readers and software that recognizes customers' faces.

Banks might install software that monitors customers' typing as they log into online banking sites, he says. Everyone's typing is distinctive, so this should warn the bank if the person at the keyboard isn't the usual customer.

For telephone banking, some U.S. banks are testing software that identifies voices. While there have been accuracy problems in the past, he says, those have largely been resolved. The question now is whether customers are ready?