News

10:38 AM
Connect Directly
Facebook
Twitter
Google+
RSS
E-Mail
50%
50%

3 Keys To Making Payments More Secure

With data breaches on the rise and EMV far from a reality in the US, two-factor authentication, improved transaction monitoring, and encryption are steps banks can take now to better secure payments credentials.

The hackers who conducted cyber-attacks against Target, Neiman Marcus, and other retailers this past December pushed payments security to a new level of public awareness. Data breaches aren't new, but the scale of the attacks and the wave of headlines that followed had never been seen before. The Target breach alone could have affected up to 110 million consumers, with an estimated 40 million credit and debit cards stolen. Since then, Congress has held multiple hearings on payments security, and surveys show that companies, including banks, are increasing their cyber-security investments as a direct result of the attacks.

The breaches aren't going to stop any time soon, either. More than 600 data breaches -- a 30% increase from 2012 -- were reported last year to the nonprofit Identity Theft Resource Center. A recent global survey of IT executives by BAE Systems Applied Intelligence, a security solutions provider, found that 82% of the US respondents -- across all industries -- expected that targeted cybercrime would increase in the next two years. The same BAE survey found that 60% of the respondents are increasing their cyber-security investments, with 78% of those respondents directly attributing that increase to last year's data breaches.

Banks are in an unenviable position in regard to securing payments; they have to absorb the cost of fraudulent transactions that result from breaches, yet cannot guarantee the security of payments credentials throughout the payments system. And each new breach leads to the costly reissuing of potentially millions of card credentials. More than 17 million cards have been reissued since the Target breach, at a cost of $172 million, the Consumer Bankers Association estimates.

Customers expect their banks to protect them from financial loss when a breach occurs, but retailers play a large role in protecting credentials when they are received at the point of sale and processed. Banks have invested heavily in online security over the past several years and have to comply with strict regulations in protecting their customers. Retailers aren't held to the same standards, though, making them an easier target for cyber-criminals. Out of the 614 data breaches reported to the Identity Theft Resource Center last year, only 3.7% targeted banks, while 34% were aimed at retailers.

But banks, like other companies, are investing more in cyber-security, according to a recent survey of bankers by ACI Worldwide, which found that 50% of financial services respondents say they are increasing their investments in fraud detection. "You can only throw so much money at something that isn't under your control, and breaches aren't going away," Michael Grillo, a product marketing manager at ACI, says. "Banks need to look at their whole risk management tools and procedures and develop a multilayered approach to security."

Much of the attention after the data breaches last year was focused on the Europay, MasterCard, and Visa (EMV) standard as a possible solution to protecting payments credentials. But EMV is no cure-all for the vulnerabilities in the payments system today; for instance, EMV wouldn't have prevented the malware attack that hit Target. EMV could eventually help improve security as part of the multilayered approach that Grillo mentioned, but it's still years away from reality here in the US. Banks can help protect customers right now, though, by implementing two-factor authentication and better fraud monitoring, and collaborating with merchants on stronger encryption of credentials. That collaboration could be a challenge, but as the payments system works toward implementing EMV, the liability for fraud losses from breaches will be placed on retailers instead of banks, which may give them an incentive to work with banks on improving security.

An Extra Step in Authentication

Gmail, Twitter, and Facebook already use two-factor authentication through mobile devices for better security, and banks could implement similar systems to protect their customers, says Deena Coffman, CEO of IDT911 Consulting and CISO of IDentity Theft 911. Rather than using a static PIN, customers could have a PIN sent to them via text message that would be good for a certain amount of time or a set number of transactions, limiting the potential risk if a thief were to steal the PIN. Banks offer two-factor authentication to secure other functions, such as online banking sessions, but haven't implemented it at the point of sale, Coffman notes.

Deena Coffman, IDT911
Deena Coffman, IDT911
The big challenge in offering two-factor authentication, however, is whether or not customers will adopt it: Two-factor authentication requires customers to take the extra step of entering the second authentication factor. Banks will need to step up their educational efforts to raise awareness around risks to get customers to take that extra step to make purchases, Coffman says.

"I think people will be willing to [use two-factor authentication]. But they need to understand the repercussions to them of someone getting their information. They need to understand the loans, the jobs they won't get with the damage to their credit. People have been arrested because of fraudsters doing illegal activities with their stolen identities and cards," Coffman says.

And those customer education efforts will probably cost banks less than the mass reissuing of cards that normally occurs after a breach, she points out.

Customers wouldn't bring their money to a bank if they didn't want it to be well-protected, so banks should be able to get their customers to take extra steps to protect themselves, says David Pollino, senior VP and fraud prevention officer at Bank of the West (headquartered in San Francisco, with $62 billion in assets). "Customers bring their money to a bank to keep it safe. … If they're doing an unusual transaction, then they like to see extra security measures in place," he observes.

ACI Worldwide's survey found that customers actually responded well when banks took actions such as blocking their cards to protect them from fraud. Among the bankers surveyed, 42% reported that customers viewed their efforts in the wake of last year's data breaches favorably, even though banks were often inconveniencing customers with those interventions.

"I was surprised by the number of people that thought banks were handling the situation well. It's definitely worth noting that for a good number of banks, customers appreciate what they're doing," ACI's Grillo shares.

Two-factor authentication alone won't fully protect bank customers; it has to be implemented along with other systems as part of a wider risk management strategy for banks to offer the best protection possible, Bank of the West's Pollino says.

David Pollino, Bank of the West
David Pollino, Bank of the West
"There's no one technology that's billed as a silver bullet. EMV, two-factor authentication, encryption -- they all play a role, but none of them solve everything," he explains. "You need to have a risk-based approach, not one size fits all, where you handle riskier logins and transactions differently with added controls."

Jonathan Camhi has been an associate editor with Bank Systems & Technology since 2012. He previously worked as a freelance journalist in New York City covering politics, health and immigration, and has a master's degree from the City University of New York's Graduate School ... View Full Bio

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Mike Angel
50%
50%
Mike Angel,
User Rank: Apprentice
8/27/2014 | 5:31:36 PM
re: 3 Keys To Making Payments More Secure
It would be inteeresting to know what you are using for your Second Factor. One Time Passwords or Codes sent via your cell phone or even a key fob under a time constraint, that you must enter, is still Single Factor Authentication because they are something you KNOW if you must enter them. Anything you must enter can be easily stolen by today's Trojan exploits. If your Second Factor is a Cookie or an IP Address are no longer strong enough because any Trojan will eliminate all Cookies and will temporarily move an IP Address to the Hacker's computer.
Jonathan_Camhi
50%
50%
Jonathan_Camhi,
User Rank: Author
5/15/2014 | 4:24:28 PM
re: 3 Keys To Making Payments More Secure
Some of the tech companies are leading the way on this already. Gmail and Facebook already offer two-factor authentication. So banks should be following their lead.
Jonathan_Camhi
50%
50%
Jonathan_Camhi,
User Rank: Author
5/15/2014 | 4:23:39 PM
re: 3 Keys To Making Payments More Secure
I think it's definitely becoming more of a regular thing in everyday lives, so I think the customer experience issue will go away with time. And the better the banks can educate customer about the benefits, the less likely there will be an issue to begin with.
Kelly22
50%
50%
Kelly22,
User Rank: Author
5/14/2014 | 8:30:21 PM
re: 3 Keys To Making Payments More Secure
I would definitely use two-factor authentication for banking - seems much safer than a static PIN and a solid component of a bank's risk-management strategy.
Nathan Golia
50%
50%
Nathan Golia,
User Rank: Author
5/14/2014 | 7:54:39 PM
re: 3 Keys To Making Payments More Secure
I recently implemented two-factor authentication after the Heartbleed work and an embarrassingly successful phishing attempt on my e-mail account. It's really not that inconvenient. The personal connection with a mobile device seems like an ideal outlet for better security.
JaCa
50%
50%
JaCa,
User Rank: Apprentice
5/14/2014 | 4:25:34 PM
re: 3 Keys To Making Payments More Secure
Great advice, businesses should take a disciplined approach to Web application security that focuses first on the most common security concerns. Payment processing companies need to ensure secure payments and make sure PCI guidelines are met EMV's are inherently secure, it will however take time for the system to mature. I work for McGladrey and there is a whitepaper on our website that offers good information on the above discussed topic readers will find it useful. "Two common Web application attacks illustrate security concerns" @
http://bit.ly/1c0f35M
Register for Bank Systems & Technology Newsletters
White Papers
Current Issue
Bank Systems & Technology - August 2014
Modern core systems are emerging as the foundations of effective channel integration and customer engagement initiatives.
Slideshows
Video
Bank Systems & Technology Radio