Sounding the death knell for passwords

Remembering complicated passwords, saving PINS on your phone and invoking answers to security questions to access your hard-earned money in banks could soon be a thing of the past.

Thanks to new voice recognition technology being pioneered by a bank in the United Kingdom, customers will no longer be required to remember the name of their Grade 1 teacher or the name of their first pet.

In a promising glimpse of the future, if we want to speak to our bank or make a payment, we will just have to verify our identities simply by speaking, or by presenting our fingerprint to a sensor.

Through this technology, officially launched at the end last month, Barclays Bank customers will be able to verify their identities by speaking or by pressing their fingertips to a fingerprint sensor.

To sign up, users are required to say a number of phrases over the phone which the bank’s systems will analyse and store with the tone, pitch, rhythmic pattern and gaps between words among the vocal attributes analysed.

Once that is done, when the customer calls again, instead of them being forced to go through the usual security questions in order to commence with their banking, they will be asked to say something which will be checked against their digital voiceprint.

In a story which appeared in The Daily Telegraph, the bank said the introduction of this technology was not only to remove the “password plague” but also as a preventative measure against fraud, where criminals gain access to customer’s bank accounts and transfer funds from the individual’s account.

Senior bankers now privately accept that their customers have reached a point of security information saturation.

The sheer volume and variety of passwords, PINS and other information required from customers during the security-checking processes, means it has become difficult to distinguish between genuine bank personnel and increasingly plausible crooks.

While criminals using scams such as phishing, vishin (phishing over the phone) as well as online attacks such as infecting computers with malicious software are on the rise, South Africa also has a huge problem with bank card fraud.

According to the Banking Association of South Africa website bank fraud in South Africa predominantly involves card fraud, where money is stolen through lost and stolen card fraud, false application fraud and card not present fraud.

The website says card fraud is difficult for the banking industry to control as fraudsters prey on the vulnerabilities of bank customers rather than targeting banking systems.

“Counterfeit card fraud involves illegally manufactured cards that use personal information stolen from the magnetic strip of a genuinely issued card. Perpetrators usually use card skimming devices to steal the information needed for counterfeit card fraud,” the website reads.

“Card not present (CNP) fraud refers to a fraudulent transaction, where neither the card nor the card- holder is present at the point of sale.

“CNP transactions can be conducted when orders for goods, travel or accommodation are placed telephonically, by internet, mail order or fax.

Lost card fraud refers to fraudulent transactions conducted on a valid issued debit or credit card after the card holder has lost his or her card.

According to the South African Banking Risk Information Centre (Sabric), a financial crime prevention centre, last year’s fraud statistics show that credit card fraud alone cost banks a total of R252.2-million.

Fraud losses on debit cards stood at R257.1-million within the same year.

CNP credit card gross fraud losses amounted to R189.2-million and contributed 75.0% of the total credit card gross fraud losses. Counterfeit credit card losses amounted to R48.5-million and contributed 19.2% of the overall credit card gross fraud losses.

Counterfeit debit card fraud amounted to R81-million and accounted for 31.5% of the total gross fraud loss on debit cards. The majority of these losses (74.9%) occurred inside South Africa.

Skimming (be it with handheld or ATM mounted devices) is still a common modus operandi used by criminals to obtain cardholder information.

A whopping 892 handheld skimming devices were recovered from 2010 to September last year by either the South African Police or bank investigators, with 31 of these devices seized between January to September last year.

The majority of the money stolen through credit card fraud was used to purchase things such as airline tickets and to pay for holiday accommodation while debit card losses were used mainly for everyday purchases such as groceries.

All information included in the survey was taken from reports from leading banks in the country – but what are South African banks doing to protect their customers?

Standard Bank spokesman Ross Linstroom said the bank had introduced numerous safety methods for their customers, with the most recent being a biometric banking app for Apple product users which allows the customers to long in to the bank’s mobile banking app using fingerprint identity sensors.

The bank has also recently launched new cash-less systems such as the Snapscan app (which allows customers to pay for purchases at the point of sale using their cards of which payments are processed using Quick Read technology), SnapBeacons (which allows customers to pay at merchants who use the SnapBeacon system) and the MasterPass virtual wallet service (which allows customers to store all of their credit, debit or cheque card information for easy online payments).

This means that customers no longer have to draw large amounts of cash at ATMs which is where many criminals wait to prey on their victims to steal both cash and cards.

“Unfortunately there will always be crime, and even though banks are taking significant steps every day to combat and prevent fraud such as phishing and other cyber-related threats, it is wise to always remember to exercise caution when accessing your banking, whether you are doing online shopping, or accessing accounts, or your banks rewards programmes.

Customer should report suspicious websites, and never give away their PIN or logon details.”

First National Bank (FNB) chief information officer Mo Hassem said although FNB was not using voice recognition technology, the bank relied on a strong authentication processes for banking which have been verified and tested by third party vendors to ensure their integrity.

Without divulging what those security systems include, Hassem said: “FNB continuously works to improve the security of its systems. We urge our customers to protect their login details at all times and recommend that customer devices are protected with reputable and up-to-date antivirus and antimalware software.

Both banks warned their customers to remain vigilant when using ATM’s and report all suspicious activity on their online banking profiles to their banks immediately. — zisandan@dispatch.co.za

subscribe

Would you like to comment on this article?
Register (it's quick and free) or sign in now.

Speech Bubbles

Please read our Comment Policy before commenting.