Banks turn to smartphone tech to fight online fraud

To ward off cyber-crooks trying to break into customers' accounts, banks are expanding their security efforts beyond desktops and onto iPhones and other mobile devices.

Take HSBC Bank USA, for instance, which this week announced it's handing out free two-factor authentication tokens in the next few months for customers to use in their personal Internet banking. These digital and physical security tokens from Vasco Data Security can generate unique one-time passwords each time a customer logs in. And another financial institution, U.S. Bank, this week said it's testing how voice biometrics in a mobile banking app for smartphones can let customers authenticate via their own voice for access to their payment-card accounts rather than having to type passwords.

"We take security very seriously," says LuAnne Kingston, senior vice president at HSBC, which is especially encouraging use of two-factor tokens in sensitive transactions such as bill paying, wire transfer or changing account information. Cybercrime is a fact of life on the Internet, and "we're trying to stay ahead of the game," she adds. "The bad guys are constantly trying to access customer data."

Gartner analyst Avivah Litan notes that other banks, such as Bank of America, have also tried mobile two-factor authentication, and that Schwab and E*Trade offer this on an opt-in basis. She says it's unclear how many customers actually do opt in. But it's particularly interesting that HSBC will utilize the consumer's mobile phone for loading the one-time password software, Litan adds.

+ Also on NetworkWorld: Security analysis of mobile banking apps reveals significant weakness | Payments made via mobile surge to about 20% of all transactions, says processor +

One-time passwords generated by tokens or other devices do not provide any absolute guarantee of security, because "sophisticated thieves using common banking Trojans" have shown one-time passwords can be "circumvented," Litan says. However, one-time passwords  "still add another layer of protection for the consumer" and their use "is likely to send the bad guys to other accounts that are not so well protected," Litan points out.

VOICE BIOMETRICS

As for U.S. Bank's voice biometrics approach, customers might one day simply utter a "passphrase" into their smartphones to enable authentication via unique voiceprint into certain accounts, says Dominic Venturo, chief innovation officer, payment services.Venturo says the financial institution is looking for security alternatives to having customers type out long complex passwords on smartphones, and voice biometrics is viewed as a possibility because every one of these mobile devices does have a microphone.  Venturo adds that the bank has had success in using voice biometrics for other purposes internally.

U.S. Bank has developed a mobile app for voice biometrics, with the first round of tests focused on Apple iOS devices. Venturo says one reason for that is because the iOS platform, tightly controlled by Apple, is singular, while there are multiple versions of Google Android. However, if the pilot is successful, U.S. Bank is going to support other platforms, including Android, for voice biometrics. If the voice biometrics for mobile banking tests out well, there would be a need to set up a voiceprint registration process for customers.

Nuance Communications is providing the back-end server authentication piece for the project. Brett Beranek, senior principal of solutions marketing at Nuance, says once  the individual's audio voiceprint is sent digitally via the smartphone app, it's matched against a voiceprint database as part of the "go" or "no-go" decision-making process. If the match is approved, the user gets access via the smartphone to the appropriate account.

Ellen Messmer is senior editor at Network World, an IDG website, where she covers news and technology trends related to information security. Twitter: MessmerE. E-mail: emessmer@nww.com

Read more about wide area network in Network World's Wide Area Network section.