Banks turn to smartphone tech to fight online fraud

Banks turn to smartphone tech to fight online fraud

To ward off cyber-crooks trying to break into customers' accounts, banks are expanding their security efforts beyond desktops and onto iPhones and other mobile devices.

Take HSBC Bank USA, for instance, which this week announced it's handing out free two-factor authentication tokens in the next few months for customers to use in their personal Internet banking. These digital and physical security tokens from Vasco Data Security can generate unique one-time passwords each time a customer logs in. And another financial institution, U.S. Bank, this week said it's testing how voice biometrics in a mobile banking app for smartphones can let customers authenticate via their own voice for access to their payment-card accounts rather than having to type passwords.

"We take security very seriously," says LuAnne Kingston, senior vice president at HSBC, which is especially encouraging use of two-factor tokens in sensitive transactions such as bill paying, wire transfer or changing account information. Cybercrime is a fact of life on the Internet, and "we're trying to stay ahead of the game," she adds. "The bad guys are constantly trying to access customer data."

Gartner analyst Avivah Litan notes that other banks, such as Bank of America, have also tried mobile two-factor authentication, and that Schwab and E*Trade offer this on an opt-in basis. She says it's unclear how many customers actually do opt in. But it's particularly interesting that HSBC will utilize the consumer's mobile phone for loading the one-time password software, Litan adds.

+ Also on NetworkWorld: Security analysis of mobile banking apps reveals significant weakness | Payments made via mobile surge to about 20% of all transactions, says processor +

One-time passwords generated by tokens or other devices do not provide any absolute guarantee of security, because "sophisticated thieves using common banking Trojans" have shown one-time passwords can be "circumvented," Litan says. However, one-time passwords  "still add another layer of protection for the consumer" and their use "is likely to send the bad guys to other accounts that are not so well protected," Litan points out.


As for U.S. Bank's voice biometrics approach, customers might one day simply utter a "passphrase" into their smartphones to enable authentication via unique voiceprint into certain accounts, says Dominic Venturo, chief innovation officer, payment services.Venturo says the financial institution is looking for security alternatives to having customers type out long complex passwords on smartphones, and voice biometrics is viewed as a possibility because every one of these mobile devices does have a microphone.  Venturo adds that the bank has had success in using voice biometrics for other purposes internally.

U.S. Bank has developed a mobile app for voice biometrics, with the first round of tests focused on Apple iOS devices. Venturo says one reason for that is because the iOS platform, tightly controlled by Apple, is singular, while there are multiple versions of Google Android. However, if the pilot is successful, U.S. Bank is going to support other platforms, including Android, for voice biometrics. If the voice biometrics for mobile banking tests out well, there would be a need to set up a voiceprint registration process for customers.

Nuance Communications is providing the back-end server authentication piece for the project. Brett Beranek, senior principal of solutions marketing at Nuance, says once  the individual's audio voiceprint is sent digitally via the smartphone app, it's matched against a voiceprint database as part of the "go" or "no-go" decision-making process. If the match is approved, the user gets access via the smartphone to the appropriate account.

Ellen Messmer is senior editor at Network World, an IDG website, where she covers news and technology trends related to information security. Twitter: MessmerE. E-mail:

Read more about wide area network in Network World's Wide Area Network section.

Follow Us

Join the newsletter!


Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags cybercrimeGartnerlegalfinanceVascoindustry verticalsHSBCWide Area NetworkBank of AmericaAviva

Brand Post



Malwarebytes shoots the breeze with channel, prospects

Malwarebytes shoots the breeze with channel, prospects

A Kumeu, Auckland, winery was the venue for a Malwarebytes event for partner and prospect MSPs - with some straight shooting on the side. The half-day getaway, which featured an archery competition, lunch and wine-tasting aimed at bringing Malwarebytes' local New Zealand and top and prospective MSP partners together to celebrate recent local successes, and discuss the current state of malware in New Zealand. This was also a unique opportunity for local MSPs to learn about how they can get the most out of Malwarebytes' MSP program and offering, as more Kiwi businesses are targeted by malware.

Malwarebytes shoots the breeze with channel, prospects
EDGE 2019: Channel forges new partnerships during evening networking

EDGE 2019: Channel forges new partnerships during evening networking

Partners, vendors and distributors reconnected during a number of social gatherings during EDGE 2019. The first evening saw the channel congregate for a welcome party at the Hamilton Island yacht club, while the main poolside proved to be the perfect stop for a barbecue on the final night.

EDGE 2019: Channel forges new partnerships during evening networking
Show Comments