Banks turn to smartphone tech to fight online fraud

Banks turn to smartphone tech to fight online fraud

To ward off cyber-crooks trying to break into customers' accounts, banks are expanding their security efforts beyond desktops and onto iPhones and other mobile devices.

Take HSBC Bank USA, for instance, which this week announced it's handing out free two-factor authentication tokens in the next few months for customers to use in their personal Internet banking. These digital and physical security tokens from Vasco Data Security can generate unique one-time passwords each time a customer logs in. And another financial institution, U.S. Bank, this week said it's testing how voice biometrics in a mobile banking app for smartphones can let customers authenticate via their own voice for access to their payment-card accounts rather than having to type passwords.

"We take security very seriously," says LuAnne Kingston, senior vice president at HSBC, which is especially encouraging use of two-factor tokens in sensitive transactions such as bill paying, wire transfer or changing account information. Cybercrime is a fact of life on the Internet, and "we're trying to stay ahead of the game," she adds. "The bad guys are constantly trying to access customer data."

Gartner analyst Avivah Litan notes that other banks, such as Bank of America, have also tried mobile two-factor authentication, and that Schwab and E*Trade offer this on an opt-in basis. She says it's unclear how many customers actually do opt in. But it's particularly interesting that HSBC will utilize the consumer's mobile phone for loading the one-time password software, Litan adds.

+ Also on NetworkWorld: Security analysis of mobile banking apps reveals significant weakness | Payments made via mobile surge to about 20% of all transactions, says processor +

One-time passwords generated by tokens or other devices do not provide any absolute guarantee of security, because "sophisticated thieves using common banking Trojans" have shown one-time passwords can be "circumvented," Litan says. However, one-time passwords  "still add another layer of protection for the consumer" and their use "is likely to send the bad guys to other accounts that are not so well protected," Litan points out.


As for U.S. Bank's voice biometrics approach, customers might one day simply utter a "passphrase" into their smartphones to enable authentication via unique voiceprint into certain accounts, says Dominic Venturo, chief innovation officer, payment services.Venturo says the financial institution is looking for security alternatives to having customers type out long complex passwords on smartphones, and voice biometrics is viewed as a possibility because every one of these mobile devices does have a microphone.  Venturo adds that the bank has had success in using voice biometrics for other purposes internally.

U.S. Bank has developed a mobile app for voice biometrics, with the first round of tests focused on Apple iOS devices. Venturo says one reason for that is because the iOS platform, tightly controlled by Apple, is singular, while there are multiple versions of Google Android. However, if the pilot is successful, U.S. Bank is going to support other platforms, including Android, for voice biometrics. If the voice biometrics for mobile banking tests out well, there would be a need to set up a voiceprint registration process for customers.

Nuance Communications is providing the back-end server authentication piece for the project. Brett Beranek, senior principal of solutions marketing at Nuance, says once  the individual's audio voiceprint is sent digitally via the smartphone app, it's matched against a voiceprint database as part of the "go" or "no-go" decision-making process. If the match is approved, the user gets access via the smartphone to the appropriate account.

Ellen Messmer is senior editor at Network World, an IDG website, where she covers news and technology trends related to information security. Twitter: MessmerE. E-mail:

Read more about wide area network in Network World's Wide Area Network section.

Follow Us

Join the newsletter!


Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags cybercrimeGartnerlegalfinanceVascoindustry verticalsHSBCWide Area NetworkBank of AmericaAviva



The making of an MSSP: a blueprint for growth in NZ

The making of an MSSP: a blueprint for growth in NZ

Partners are actively building out security practices and services to match, yet remain challenged by a lack of guidance in the market. This exclusive Reseller News Roundtable - in association with Sophos - assessed the making of an MSSP, outlining the blueprint for growth and how partners can differentiate in New Zealand.

The making of an MSSP: a blueprint for growth in NZ
Reseller News Platinum Club celebrates leading partners in 2018

Reseller News Platinum Club celebrates leading partners in 2018

The leading players of the New Zealand channel came together to celebrate a year of achievement at the inaugural Reseller News Platinum Club lunch in Auckland. Following the Reseller News Innovation Awards, Platinum Club provides a platform to showcase the top performing partners and start-ups of the past 12 months, with more than ​​50 organisations in the spotlight.​​​

Reseller News Platinum Club celebrates leading partners in 2018
Meet the top performing HP partners in NZ

Meet the top performing HP partners in NZ

HP has honoured its leading partners in New Zealand during 2018, following 12 months of growth through the local channel. Unveiled during the fourth running of the ceremony in Auckland, the awards recognise and celebrate excellence, growth, consistency and engagement of standout Kiwi partners.

Meet the top performing HP partners in NZ
Show Comments