Investigating the possibility to use differentiated authentication based on risk profiling to secure online banking

Abstract

Purpose – The purpose of this paper was to determine factors that could be used to create different authentication requirements for diverse online banking customers based on their risk profile. Online security remains a challenge to ensure safe transacting on the Internet. User authentication, a human-centric process, is regarded as the basis of computer security and hence secure access to online banking services. The increased use of technology to enforce additional actions has the ability to improve the quality of authentication and hence online security, but often at the expense of usability. The objective of this study was to determine factors that could be used to create different authentication requirements for diverse online banking customers based on their risk profile. Design/methodology/approach – A web-based survey was designed to determine online consumers’ competence resecure online behaviour, and this was used to quantify the online behaviour as more or less secure. The browsers used by consumers as well as their demographical data were correlated with the security profile of respondents to test for any significant variance in practice that could inform differentiated authentication. Findings – A statistical difference between behaviours based on some of the dependant variables was evident from the analysis. Based on the results, a case could be made to have different authentication methods for online banking customers based on both their browser selected (before individual identification) as well as demographical data (after identification) to ensure a safer online environment. Originality/value – The research can be used by the financial services sector to improve online security, where required, without necessarily reducing usability for more “security inclined” customers.

Visions of the Future: What Could Happen to User Authentication?

“…• Something the user possesses: This category refers to the authentication process using objects, such as a device or token, to prove the user's identity. The token may be a dedicated item that is used for authenticating (e.g., a USB key), or it may be a digital certificate on a mobile device (Al-Ameen et al, 2016;Butler and Butler, 2015). • Something the user is: Biometrics are physical or behavioral characteristics of the user that are used to prove their identity.…”

“…Modern smartphones carry several means of authentication, such as fingerprint scanners, cameras for face recognition, and input for memory-based methods (Cho et al, 2020), as well as mobile connectivity for out-ofband authentication (Butler and Butler, 2015). As MFA requires extra effort from the user and could cause discontent, methods have been developed to reduce the effort in low-risk interactions.…”

“…More robust authentication is then only required in high-risk situations. (Bonneau et al, 2015;Butler and Butler, 2015. ) One way of reducing the constant authentication requests when using multiple services is the single-sign-on (SSO).…”

Online banking and privacy: redesigning sales strategy through social exchange

“…Effective sales tactics are vital in building successful online strategies by encouraging interactions to enhance confidentiality and trust and generate a competitive advantage in the banking industry (Jaramillo and Marshall, 2004). The concept of online privacy and personal attitudes toward risk can be used as segmentation criteria by a bank to profile consumers and develop a sales strategy recognizing the privacy concerns (Butler and Butler, 2015). With the advancement of e-banking (Sekhon et al, 2010), bank managers should convince consumers of the availability of similar services online as offline environment, encouraging the use of online banking with assurance and confidence regarding confidentiality, privacy and security (Chong et al, 2010).…”

Risk-Driven Behavioral Biometric-based One-Shot-cum-Continuous User Authentication Scheme

“…Risk-based authentication approaches based on basic communication information [49], such as the source-destination IP addresses, or frequency of transactions, performed by a user on her devices to determine risk, are easily exploitable. According to Traore [50], such systems could be exploited by polling or cloning users' devices.…”