0709
HSBC's UK subsidiary is developing an alternative form of online banking security authentication, because of its concerns about two-factor authentication.
UK payments association APACS wants banks to use two-factor authentication involving smart cards and passwords for Internet banking. To make an online payment, a customer would place their chip-and-PIN card in a smart card reader and then enter a password.
But HSBC feels that two-factor authentication is not sufficiently customer-friendly. Its alternative "out of band" system uses the customer's telephone to authenticate transactions. The system can work with either mobile phones or landline-based phones.
When an HSBC customer makes a payment via Internet banking, a pop-up appears asking which phone number they want to be contacted on. The pop-up contains a PIN generated by HSBC’s server. HSBC then calls the customer on their designated phone number and asks them for this PIN.
HSBC is in the preliminary stages of testing the system, but it is not yet being trialed with customers. It hopes to roll the system out within a year.
HSBC currently uses two-factor authentication for its business Internet banking service. "The two-factor system works for our business customers, as more than one employee often needs access to the business accounts,” Nick Staib, HSBC UK’s Personal Internet Banking Manager, says. “They can keep a card reader in a drawer.”
But Staib says retail banking customers don’t want to carry a card reader around with them, and are likely to make transactions in various different places.
The “out of band” system also offers better security, Staib says. "With the card reader system, hackers can still take control of your PC,” he says. "We’re working on the basis that there is no way for them to take control of your phone."
Related Links
HSBC to challenge two-factor system
www.hsbc.co.uk
www.apacs.org.uk
UK Banks Cash in on Passport Validation Service
