Additional confirmation for online bank payments

Question

Nowadays, when someone is making an online payment, the associated bank often requires an authentication step.

As far as I know, there are mainly two ways to do this:

1. SMS Verification. The Bank sends an SMS to the client with a specific code that should be stated on the authentication web page.
2. Indicate the date of birth. Instead of entering a code, the authentication web page only requires the date of birth of the client.

It seems that the second version is less secure than the first one, as the date of birth is an information that can be found easily from the fact that people provide it on many websites.

So why banks do not only use the SMS verification instead? Does it imply some protocol complications?

Answer 1

I've been doing professional pentesting for quite a while covering many of the banks having a permit here in Switzerland. Traditionally they were using username/password only.

Then they switched to TAN (transaction authentication number) handed out on paper. I just know 2 remaining banks in Switzerland which are still doing this. There are two reasons: (1) It's cheap and (2) some legacy users still fear additional technology.

Most banks enforce two-factor authentication via another devices. The main solutions are smartcards, tokens and SMS. They are cost intensive, all of them: Token/smartcards require an initial investment and SMS have to be paid per message.

Customers which need to login and create transactions dozen times a day are not very welcome when it comes to SMS. Swiss banks tend to pay for the costs of sending these messages. But some of them are thinking about letting their customers pay for it or at least limit the amount of messages sent by day.

SMS might be intercepted either during transmission or while resting on a mobile device (which might also be used for the banking login itself). This is why physically separated solutions like tokens are preferred when it comes to high-security solutions.

Answer 2

I've never heard of just using the date of birth for authentication. It's a bad idea as a date of birth is non-revocable. Meaning if it is "compromised" you can't change it.

If it is the only means of authentication for consulting account or transactions it's a REALLY BAD IDEA.

But that brings me to my second point. It is, in general, not considered your risk, but the bank's. If you can proof their authentication mechanism sucks and you get defrauded, there is a reasonable chance the bank will have to pay you back as they weren't very diligent.

That being said you would still have to go through a lot of hassle to get that settled. If a bank is taking such an approach and there are no other controls in place, I wouldn't stay with the bank.

Answer 3

Most banks would ideally to use multiple stages of authentication. These are classified as:

1. Something you know (password)
2. Something you have (card / token / phone)
3. Something you are (biometric)

By asking for a DoB, your bank is restricting itself to only one source. Considering that once a password is known it is hard to assume that the attacker cannot find the birth date.

However, setting up infrastructure for the second type of authentication can be expensive. Most businesses would weigh the risk (amount of money lost in paying for losses due to illegal online transactions) against the cost of implementing this system. In economies where there are no legal pressures pushing for stronger authentication of payments, and very low online fraud costs, it makes sense for banks to not invest in complicated systems. The bank could also be doing this only for low-value transactions or because online transactions are few in number.

Also read: Schneier predicting that 2FA wouldn't take off because the gains would be negligible (this was in 2005).