By using the Aculab site, you agree with our use of cookies.

Multi-factor authentication and the PSD2

Over the past ten years we have seen identity theft and fraudulent account access become the primary motivators behind data theft and cyber-crime. If you haven’t been the direct victim of a fraudster yet, the chances are you know someone that has. You will certainly have been affected indirectly. Ever wondered why your insurance premiums keep going up, despite another year without a claim? It’s not because of a nationwide increase in accidents, but the costs associated with fraud prevention and detection. It won’t have escaped anyone’s notice that we’re being asked to prove “we are who we say we are” more frequently than ever. Some form of identification is required every time we go online, log in to an app or call a customer service centre.

The evolution of authentication

There was a time when all you needed was an address, a date of birth and an account number to access services online. However, the vulnerabilities of using information that is easily accessed by “bad actors” required a greater degree of security; hence the introduction of usernames and passwords. For applications with a greater degree of risk (i.e., access to financial records or sensitive personal data) additional security steps were put in place. Most often, this would take the form of several pre-agreed security questions and answers. These are examples of what’s called knowledge factor authentication (i.e., something you know). Other examples include passphrases, passcodes, PINs and patterns. If you own a smartphone, you’ll be familiar with these techniques. Thus, a two-step knowledge factor example would be to state specific letters from your password, followed by the answers to one or more security questions.

Multi-step versus multi-factor

In the constant battle between cyber-criminals and cyber-security professionals the criminals are often a step ahead. Social engineering is frequently used to uncover security credentials, rendering a two-step process insufficient. With the advent of the latest update to the Payment Services Directive (PSD2), at least here in Europe, businesses involved in financial transactions will be obliged, from September 2019, to employ multi-factor authentication. Multi-factor authentication differs significantly from multi-step authentication. There are three universally recognised factors; knowledge (as we’ve seen previously) ownership and inherence. The new PSD2 regulations call for the use of any two of these three for any given transaction.

Examples of multi-factor authentication

So, what do we mean when we talk about knowledge, ownership and inherence? Put simply, it’s something you know, something you own and something you are.Here are some examples:
  • Knowledge - passwords, PINs and security questions
  • Ownership - hardware keys, ID cards and one-time tokens
  • Inherence - biometrics and behaviours
You might argue that tokens should fall into the knowledge category, but they are only known for a brief period of time and can only be used once.

Phone transactions

When it comes to transacting over the phone, choosing the right two factors isn’t straightforward. Voice biometrics, for example, lends itself to being used over the phone, for obvious reasons. However, keys and cards are not practical, and although security questioning has been a staple of call centres for some time, it’s not exactly a customer favourite. The tiresome call and response of security questions adds friction to the customer experience and isn’t a fool-proof process. So, is there a better way? Thankfully, there is. Essentially, it’s a two-factor combination of biometrics and tokens, both of which can be done over the phone. In the world of biometrics, it’s a process known as text-prompted verification. It’s gained popularity amongst contact centre service providers as both factors can be automated, allowing transactions to be incorporated within IVR or self-service applications. Here’s how it works: A caller is prompted to repeat a randomly generated five- or six-digit number sequence, as a means of validating their identity claim. Initially, voice biometrics is used to verify the caller, which counts as one factor, based on their previously having enrolled in the system. Secondly, speech recognition technology is used to verify that the numbers spoken match the requested sequence. The latter is the equivalent of possessing a one-time token, which counts as a bona-fide second factor. For any business that takes identity verification seriously, but particularly for organisations that need to comply with the new PSD2 regulations, multi-factor authentication is essential. However, use of multiple factors can be complicated if multiple technologies are required to implement them. If multi-factor authentication can be implemented using a single system, from a single vendor, the economics of procurement and deployment are obvious. If you would like further information about text-prompted verification, or the role of voice biometrics in fraud prevention, email This email address is being protected from spambots. You need JavaScript enabled to view it. or call us on +44(0)1908 27 38 38.

Archive

The Aculab blog

News, views and industry insights from Aculab

  • Voice Biometrics: Why Businesses and Users are driving its adoption

    In this blog post, we’ll look at the rapidly growing market of Voice Biometrics, and what drives its increasing rate of adoption, as more businesses and services are made aware of the need for multi-factor authentication.

    Read more

  • An underused tool in the fight against the second wave of Coronavirus

    In this article, we'll go into a bit more depth as to why exactly Broadcast Messaging is such a powerful tool. We have compiled a list of six unique characteristics to highlight exactly how it can be used productively, to shore up the lines of communication in the ongoing situation with Coronavirus.

    Read more

  • The seven realms of Broadcast Messaging

    Broadcast messaging that uses a cloud-based service is a natural choice. Using a cloud as-a-service approach gives a variety of message delivery options, and cuts down costs by automatically scaling to meet demand. Find out what makes Aculab Cloud such a natural choice for voice and SMS broadcast messaging, and how other customers are already reaping the benefits from using Aculab's CPaaS platform.

    Read more

  • The technology working behind the scenes to support emergency services networks

    Now more than ever, telecoms infrastructures play a vital role in supporting the health of our communities. Behind the scenes, networking technologies are working to keep the lines of communications open between emergency services and those in need.

    A recent example from the Lombardy region of Italy highlights a typical scenario:

    Read more

  • What’s wrong with Knowledge-Based Authentication (KBA)?

    For many years, online and telephone-based authentication has relied on knowledge-based systems using passwords, PINs, and question-and-answer dialogues to confirm a customer’s identity. With the explosion in the number of contact centres, this approach is close to breaking point. Nobody in the modern world can be expected to remember all of the passwords they need to securely access all their services.

    Read more