Case Study SMS Two Factor Authentication. Contact us Infracast Ltd, Merlin House Brunel Road, Theale, Berkshire, RG7 4AB

Transcription

1 Case Study SMS Two Factor Authentication Contact us Infracast Ltd, Merlin House Brunel Road, Theale, Berkshire, RG7 4AB T M W

2 01 - About Infracast Infracast provides a wide range of enterprise messaging solutions built on our core EMX platform. We work in close partnership with our customers, helping to build and deliver effective, longterm communication strategies that are specifically tailored to each customer s unique business requirements. We currently process over 50 million messages each month, and have a rapidly growing international customer base that includes Telco s, Banks & Financial institutions, Airlines, Logistics and Retail businesses. From our origins in SMS text delivery within the UK Financial Services sector, we now have the capability to reach over 90% of mobile subscribers worldwide. Our entire ethos is based on customer service excellence our continued growth is built on customer recommendation and repeat business About EMX Enterprise Message Exchange (EMX) is our multi-channel messaging platform that combines high performance SMS, MMS, , Voice and Emerging Channel delivery with ease of integration and management. Extensive analytics enable customers to gain valuable insight and to make effective, real-time communications decisions. EMX is available as a fully managed hosted service delivered from redundant data-centres, run onpremise or on a hybrid basis.

3 03 - Introduction One of the UK s leading Retail Bank and Personal Financial services companies who also are one of the largest providers of mortgages and savings products. With some 25 million customers, an extensive branch network, over 24,000 employees and more than 1.6 million UK shareholders, the bank brings together former smaller banking businesses The Problem With today s sophisticated and constantly-evolving threats from cybercrime, it is essential to provide an effective layered defence against service attacks. Security experts agree that leveraging a customer s mobile phone as an authentication device offers a highly reliable and customerfriendly approach for protecting both consumers and businesses. Using an out-of-band communication channel significantly reduces transaction risk because it requires a compromise to both the channel that the transaction is initiated from, and the alternate channel to complete a fraudulent transaction. Delivering one-time passwords to a phone is a familiar process to consumers, and with appropriate communication and context can make them feel more secure. The bank required a Two-Factor Authentication (2FA) mechanism using limited lifetime one-time passcodes sent to consumers mobile phones as SMS text messages.

4 05 - The Solution The bank selected the O2 EMX Managed Text platform, developed and delivered by Infracast, to implement a cost-effective Two-Factor Authentication solution. The solution runs alongside existing the bank s fraud prevention services, and integrates with other EMX Managed Text services already deployed within the bank. To access the bank s e-banking service, consumers enter their assigned username and password into the login web page as normal. When attempting to set up a new payee, a unique passcode is generated and sent to the account s pre-registered mobile phone number as an SMS text message. This passcode must then be correctly entered into the web browser to complete the login process. Passcodes are only valid for a limited period (typically two minutes) before they expire, reducing the risk of fraudulent access through automated passcode compromise attempts Challenges Because 2FA-secured e-banking access is an interactive process, with the customer needing to receive the passcodes to complete the logon process within the time limit, the SMS messages must be delivered to the consumer s mobile phone in near real-time. The EMX Managed Text platform monitors the real-time delivery status of each message submitted to the consumer s mobile phone. If the passcode cannot be delivered, for example because the handset is switched off or out of coverage, an appropriate message can be displayed in the user s web browser. A time-stamped trail of message delivery is maintained for audit and customer care purposes, and is available online via a secure service management portal. The O2 EMX Managed Text platform currently delivers over fifty million fully tracked SMS messages each month for Banking, Financial Services and other enterprise customers. By allocating dedicated network bandwidth to these limitedlifetime passcodes, and ensuring that real-time message delivery is segregated from less timecritical message traffic, Infracast are able to ensure that passcodes are delivered within The bank s SLA, with over 90% of one-time passcode messages being delivered to consumer handsets in under 5 seconds. To ensure continuity, the service is delivered from two geographicallydistinct Tier-3 data centres, and offers full local resilience as well as automated disaster recovery, even in the event of a catastrophic loss of an entire data centre. Round the clock platform and message delivery monitoring provides early warning of any potential service disruption and enables pro-active preventative action to be taken. O2 and Infracast conduct regular service review meetings with the bank, covering all aspects of the service delivery, including; Service Performance, SLA targets, support incidents and to review any potential planned maintenance, upgrades or potential service improvements.

5 07 - Benefits at a glance Deploying SMS Two-Factor authentication helped the bank: > Reduce Chargebacks SMS Two-Factor Authentication allows companies to ensure their customers are who they say they are at the time of the transaction, reducing chargebacks on fraudulent transactions. > Combat Common Fraud Attacks Independent mobile device use as part of a two-factor authentication process has been proven to protect accounts against compromise, phishing and fraudulent transactions, and is a first step in defending against account takeover and Man-In-The-Middle (MITM) attacks > Make Decisions faster Verifies customers legitimacy in real time, reducing the number of transactions that require manual review. Good customers do not have to wait, saving businesses money and time on cumbersome review queues. > Support a global customer base EMX Managed Text supports near real-time delivery of one-time passcodes to more than 200 countries, and can be localized with local languages and character sets. > Meet Compliance Guidelines Two-factor authentication is a common requirement for financial and other sensitive online transactions; 08 - Outcome The bank s SMS Two-Factor Authentication solution was deployed in 2009 following a six-week implementation process. Live service commenced following a three month evaluation process. The service currently authenticates and helps secure over half a million e-banking logons each month, and is seen as a key part of the bank s commitment to fighting fraud.