Online Banking

The security of online transactions has been closely scrutinized, both by financial regulators tasked to protect the public interest, as well as the target customers. For we have heard reports of hackers using techniques such as phishing to illegally access a bank account online to transfer out the funds, leaving little or no trace.

In recent years, banks have been quick to dish out advisory after advisory warning their customers to ignore phishing emails sent from what appears to be a legitimate bank email. Online transfer limits had also been set, along with additional authentication requirements for third party online transfers of funds. A user wishing to perform an online transfer of funds to a third party would have to enter a separate code received via mobile phone or email. With these records available only with the bank at the time the account is signed up for, it has served a fairly useful purpose.

Enter the realm of two-factor identification. Apparently spurred by the growth of hard tokens issued by corporations to their staff working on virtual private networks, retail banks have started implementing their own versions of the two-factor identification system, with some resorting to using the hard token as a second factor.

This is where it appears that practicality has taken a back seat to an overkill situation. Here's why. For those banks using smart messages to users' mobile phones, the solution is practical and cost-effective, especially in a country where the mobile phone penetration rate is high. Where hard tokens are concerned, a user who has accounts with several different banks will have to either carry all his tokens with him and risk losing one or all, or to only access their online banking from home, where their tokens are. The cumbersome nature of the hard tokens makes it easy for accountholders to lose or misplace them.

The perceived threat of loss is also looking like one of reputational risk to the bank as much as it is the prevention of loss to the customer. For no bank wants to be in the news for being the first or largest online target, seriously damaging customer confidence in the process. As such, it appears that banks issuing the hard tokens have taken the safety first approach, incurring great cost internally, as well as possibly misreading the market’s level of comfort with online banking.

Alas, not all banks have given customers the opportunity to opt out of the hard token method of two-factor identification. Flexibility should be the order of the day, where some banks have given customers several alternatives to ensure that the security of their accounts is preserved in the online environment.