Explore APIs
Get in Touch

Payment Security

Industry Insights, Product, Reading List

Regulator asking your bank to migrate from SMS-based OTPs to more secure authentication options? Use the opportunity to derive multiple benefits

/

Central Banks are proactively taking steps to reduce the risk of banking/financial fraud The phrase “two sides of the same coin” applies to the world of digital banking and financial services as well. Internet/mobile based banking capabilities have undoubtedly enabled convenience and speed for consumers and reduced costs for service providers. Simultaneously, however, there has also been a steady rise in digital frauds and scams around the world. New ways of scamming consumers are constantly emerging because omni-channel digital first banking has given perpetrators more options based on how banking transactions are authenticated. Central banks around the world have regularly been raising the bar for digital security within their jurisdictions, given their responsibility for orderly conduct of a country’s banking and financial services system and ensuring the highest levels of consumer safety and protection. Individual banks and fintech players are proactively integrating new technologies and protocols to provide customers with the additional security of multi-factor authentication. About a month ago, Bank Negara Malaysia (BNM, the Malaysian central bank) announced that banks operating in that country needed to adopt authentication methods for online activities (opening accounts, making payments and other transactions) that go beyond SMS-based OTPs (One Time Passwords). BNM’s new measures also cover changes to default customer account settings, cooling off periods for new accounts, using just one device for authentication, etc. The rules pertaining to the detection of scams/frauds and the triggering of blocking actions are also being tightened. While many of the steps will kick in after suspicious transactions are detected, what is essential for banks is to strengthen measures that can minimize the occurrence of frauds and scams through superior digital authentication and the detection of risky transactions. OTPs and two-factor authentication are no longer adequate Over the past years, OTPs have become ubiquitous and deeply embedded in our lives as the primary means to authenticate all banking (and many other) transactions. But the two-factor authentication provided by OTPs is no longer enough to provide customers with the desired levels of safety and protection. Authentication is based on entering the 4 or 6 digits sent by the service provider to the customer’s mobile number. It does not verify the identity of the person who has entered the OTP. This means anyone with access to the OTP can easily impersonate a customer and complete transactions without the genuine customer being aware until it is too late. Think about three commonplace scenarios that customers might routinely face: a lost or stolen mobile phone, an unlocked phone on their office desk while they briefly step out, or a phone given for repairs (where unscrupulous staff members have the chance to copy/access personal data). In each of these situations, unauthorized persons can easily access OTPs and other transaction-related messages sent by banks to the phone and essentially “authenticate” transactions that will go through as legitimate transactions initiated/approved by you. If such impersonation risks are not bad enough, think about phishing frauds and scams where users are induced to click on links that they believe have come from their bank or other service providers via SMS. A world of non-banking digital payment apps and platforms gives fraudsters even more opportunities to scam customers by voluntarily giving out information that is needed to complete unauthorized financial transactions. In such a high-risk environment, online authentication must necessarily be made a more rigorous and fool-proof process that is inherently harder to circumvent. Rather than relying on an OTP that can be entered by anyone (and not just the genuine customer), banks must adopt authentication protocols that use multiple data points that can be collectively used to establish customer identity and authenticity of transactions. Multi-factor authentication can make a big difference to the reliability of your authentication and hence customer experience Banks need to balance secure and reliable authentication with the associated costs and impact on customer experience. Working even when there is mobile network latency (or lack of network coverage) is another requirement. Compliance with the bank’s own security norms and complete adherence to prevailing regulatory requirements also needs to be considered. The solution must be such that it can be used seamlessly with mobile banking as well as internet banking. Multi-factor authentication (MFA) solutions tick all these boxes. A robust MFA solution uses a combination of three distinct sets of data points for authentication: · Knowledge- what the customer knows (e.g., password, security question); · Ownership/access- what the user has (e.g., mobile device, USB token); and · Inherence- something that is inherent to the customer (e.g., fingerprint or other biometrics) A world-class MFA solution must provide banks (and other organizations) the option to authenticate customers and transactions based on a variety of authentication touchpoints that cater to customer preferences and risk profiles. It must be used either on a standalone basis or be capable of easily being integrated with a bank’s existing assets. It must support Out of Band (OOB) authentication- which means that the channel used for authentication must be distinct from the one used to sign in or perform a transaction. Ideally, the OOB authentication element must reside in the customer’s registered mobile phone, making it easier to leverage ownership- and inherence-based data points as well for authentication. The MFA solution must be compatible with EMV 3-D Secure and 3-D Secure 1.0 protocols and support CNP transactions as well. Wibmo’s Tridentity is an MFA solution that is designed to address the above needs and deliver the above capabilities. It supports authentication based on Push notifications, Offline OTP, and Biometrics. It is available as a simple SDK or downloadable as an Android/iOS app. Tridentity is compliant with the EU’s PSD2 initiative. Please click on https://www.wibmo.com/tridentity/ for more information on Wibmo’s Tridentity solution and how it can help your bank in Malaysia or elsewhere. If you have specific questions and would like to speak to one of our experts, write to us at [email protected]. Author: Edward Chien, Director- Sales, South-East Asia Wibmo A PayU/Naspers FinTech Company Authentication, Multi-Factor Authentication, Online Payments, Out of

Product

Move to Pre-paid Cards for Simplifying your Corporate Expense Management

/

Tracking Corporate Expenses made easy Corporate expenses range from individual employee benefits to infrastructural allocation to individual units. Everyone has heard the terms reimbursement, employee benefits claims, and other expenses albeit through the prism depicting a myriad of reactions — most of them unsavory to put it mildly. While the corporate executives find the long process of filing expense reports and submitting the invoices tiresome and at times bordering on lack of trust, the accounts find themselves in an unenviable position of questioning, auditing, and reconciling them with the Company Budget. And when auditors do come out with systems to reduce frauds, Department heads are regularly at loggerheads with accounts over the paperwork. The sum total is interdepartmental bad blood and a constant state of tug of war that can adversely affect both the operations and the accounts. Prepaid Cards for Corporate expenses are a boon to both employers and employees. Prepaid cards are one of the best tools to manage corporate expenses. It is no secret that as the company grows so do the expenses, especially the travel and other petty expenses which form a substantial percentage of the overall budget. The bottleneck in tracking is that the disbursement is through individual employees whose numbers might run in hundreds and at times in thousands. This is where maintaining a balance between fraudulent or mistaken charges versus operationally profitable charges becomes a challenge. The prepaid card enables control over the employee spending through a limit set over time and the amount. This also reduces the massive burden of claims or reimbursements. With reduced dependency on actual cash transactions, policy adherence and automated tracking enable the auditors to access a lot of information without depending on the employees for details saving both time and faceoffs. Pointers to get the most of Prepaid Cards to manage corporate expenses. Ideally, the Prepaid cards could be a major relief, but in practice, it is possible only if certain standards are maintained in the implementation and usage of this facility. Selecting a Vendor who would equip and facilitate these services, is crucial to the successful issuance of the Prepaid cards to the employees or other stakeholders of the company. The prepaid card program must be customized as much as their budget would allow. It should strictly adhere to the company policy with separate options for both open and closed-loop programs. The cards should be configured according to the needs, specific to the company for example some might need it to be used in ATMs while others might want it to work within just the cafeteria and sister concerns of the company. Some could select merchants or categories for a certain department or particular grades. E.g., sales teams should have options to use it on online travel sites or enable multiple currencies for certain grades. Wibmo’s Prepaid solution meets all these requirements and more. Covering the whole range of corporate expenses from payroll to daily expenses and travel expenses they are easy to use and have reloading wallets backed with 24-hour customer support. With every advancement comes its own set of risks and unethical practices. The good news is that the market has vendors who can provide services and fortify them against fraud. Two-factor authentication is always recommended for such cards with EMV chips for added security. Market Proven tools like TRIDENT-FRM can be used to disable fraudulent attempts. Additional security and control can be attained through vendors who provide Host Complete back-office card operations. In short, the prepaid cards can empower the companies to control the corporate expenses thereby bring them down without much sweating whilst the employees, now more aware of the limits, need not spend their productive hours filling out expense reports and more importantly feel more trusted with their dignity intact. Author: Krishnan KN, Advisor in Wibmo’s Agile PMO Wibmo A PayU/Naspers FinTech Company Expense management, Payment Security, Prepaid Card, Reimbursement

Scroll to Top