Editorial & Advertiser Disclosure Global Banking And Finance Review is an independent publisher which offers News, information, Analysis, Opinion, Press Releases, Reviews, Research reports covering various economies, industries, products, services and companies. The content available on globalbankingandfinance.com is sourced by a mixture of different methods which is not limited to content produced and supplied by various staff writers, journalists, freelancers, individuals, organizations, companies, PR agencies Sponsored Posts etc. The information available on this website is purely for educational and informational purposes only. We cannot guarantee the accuracy or applicability of any of the information provided at globalbankingandfinance.com with respect to your individual or personal circumstances. Please seek professional advice from a qualified professional before making any financial decisions. Globalbankingandfinance.com also links to various third party websites and we cannot guarantee the accuracy or applicability of the information provided by third party websites. Links from various articles on our site to third party websites are a mixture of non-sponsored links and sponsored links. Only a very small fraction of the links which point to external websites are affiliate links. Some of the links which you may click on our website may link to various products and services from our partners who may compensate us if you buy a service or product or fill a form or install an app. This will not incur additional cost to you. A very few articles on our website are sponsored posts or paid advertorials. These are marked as sponsored posts at the bottom of each post. For avoidance of any doubts and to make it easier for you to differentiate sponsored or non-sponsored articles or links, you may consider all articles on our site or all links to external websites as sponsored . Please note that some of the services or products which we talk about carry a high level of risk and may not be suitable for everyone. These may be complex services or products and we request the readers to consider this purely from an educational standpoint. The information provided on this website is general in nature. Global Banking & Finance Review expressly disclaims any liability without any limitation which may arise directly or indirectly from the use of such information.

USERNAME AND PASSWORD AUTHENTICATION BORDERS ON NEGLIGENCE IN MOBILE BANKING

Author: Steven Hope, CEO of Winfrasoft
Earlier this week the Financial Conduct Authority announced that it will be publishing a full report in to mobile banking early next year, by revealing its initial findings and the potential risks to consumers concerning fraud, cybercrime and user error. In an article published by the BBC, the Director of Supervision at the FCA, Clive Adamson, states that: “With the market growing, now is the right time for us to take stock and, as part of the FCA’s forward looking approach, to ensure that consumers are appropriately protected.”

PINgrid iPhone
PINgrid iPhone

The scale of this market growth was highlighted earlier this year when the analyst firm Juniper Research published its Mobile Banking: Handset & Tablet Market Strategies 2013-2017 report revealing that the number of people using mobile phones for banking purposes will grow from 590 million in 2013 to one billion in 2017. If the security history books tell us one thing, it is wherever the masses go, the cybercriminal is sure to quickly follow suit.
Mobile viruses, phishing attacks, Trojans and worms have been with us for the past decade, however, as we shift our online habits from desktops and laptops, to tablets and smartphones, the bad guys have also altered their focus, realising the wherever the masses are, the money is to be found. In fact, McAfee recently reported that it found more than 17,000 new strains of malware targeting Android devices in a three-month period, representing a 35% increase.
So, with industry analysts telling use mobile device usage will grow exponentially and malware experts highlighting similar increases in the targeting of these devices it is clear we have two big challenges to overcome.
The first challenge is for the security industry to go back to square one and better educate the public about the risks of using their smartphones and tablets, in the same way they did to promote safe Internet usage. The second is for those who stand to lose (particularly the banks) to take a long hard look at the measures that they have in place to protect themselves and their customers.
As it stands today, the vast majority of mobile banking apps are using the same archaic and vulnerable username and password approach to authenticate customers, which they use for their Internet banking offering. In my opinion this borders on negligence, given the lack of favour amongst consumers and their ability to offer any serious safeguards against a determined cybercriminal.
Others have built cumbersome key ring or card readers based two-factor systems which are also loathed by customers, are extremely expensive to implement and manage and have been thwarted many times by hackers. Some banks just simply don’t “get” the agile on-the-go mobile banking customer at all and expect them to login to their new banking app, via their all singing all dancing super-slim and light-weight mobile device, using that same old clunky two- factor chunk of plastic!
Of course, for customer convenience and ease of administration it makes perfect sense for the security model used for online and mobile banking to be pretty much the same. The actual device should be largely irrelevant, especially given the vast number that are out there today. What is needed is a secure way for customers to prove who they are regardless of what phone, browser or app they are using. Furthermore, the logon method must be suited to the usage scenario – i.e. no key rings with iPhones, no TEXT messages when you have no signal and certainly no more passwords! The system must be easy to use and not get in the way of the customer doing what they want to do… banking.
In the next few weeks changes come in to force that will make it far easier for people to switch who they bank with, and with that comes added pressure for banks to up their game in order to gain and retain customers. Mobile platforms are today more secure than your average browser but that isn’t really saying very much! There is a responsibility from the customer to do what they can to safeguard the devices that they use and the banks need to do their utmost to create a strong and secure mobile banking environment and that means moving away from weak username and password authentication for good.
Author biography
An IT security expert and respected industry speaker, Steven is the founder of Winfrasoft and is regarded as a leading specialist and pioneer in the development, implementation and adoption of authentication software technology. He has lead the company in its development of a new generation of authentication solutions that deliver ground-breaking 1.5 and 2 factor authentication by transforming mobile devices in to secure tokens, and take advantage of the human mind’s ability to easily recognise patterns. In addition, he has been instrumental in introducing the ground-breaking 1.5 Factor Authentication concept as well as making Transaction Verification technology available to all.

About Winfrasoft PINgrid
Winfrasoft is a simple and secure password replacement system which also offers two factor authentication and award winning transaction signing capabilities. It can run inside a Banking App on any mobile platform (via SDKs), on an Online Banking web site, and can even be used with telephone banking so make that a much less arduous task. A full working demo is available at www.winfrasoftbank.com.