3

Nowadays, when someone is making an online payment, the associated bank often requires an authentication step.

As far as I know, there are mainly two ways to do this:

  1. SMS Verification. The Bank sends an SMS to the client with a specific code that should be stated on the authentication web page.
  2. Indicate the date of birth. Instead of entering a code, the authentication web page only requires the date of birth of the client.

It seems that the second version is less secure than the first one, as the date of birth is an information that can be found easily from the fact that people provide it on many websites.

So why banks do not only use the SMS verification instead? Does it imply some protocol complications?

  • 1
    first time I heard about using the date of birth. My bank either use an OTP SMS or a predefined password for such payments. Another option some banks use as well is they give you a credit card-sized card with many numbers, and then they ask you for a specific number during the transaction, like Insert the number in C-12 – yzT Jun 7 '16 at 7:14
  • "So why banks do not only use the SMS verification instead? " .... hmm...let's see.... SMS costs the bank money to send, SMS may cost the recipient to receive (especially if they are on holiday / work roaming abroad). That said, I've never heard of date of birth, other forms of 2FA are more common. – Little Code Jun 7 '16 at 21:24
2

I've been doing professional pentesting for quite a while covering many of the banks having a permit here in Switzerland. Traditionally they were using username/password only.

Then they switched to TAN (transaction authentication number) handed out on paper. I just know 2 remaining banks in Switzerland which are still doing this. There are two reasons: (1) It's cheap and (2) some legacy users still fear additional technology.

Most banks enforce two-factor authentication via another devices. The main solutions are smartcards, tokens and SMS. They are cost intensive, all of them: Token/smartcards require an initial investment and SMS have to be paid per message.

Customers which need to login and create transactions dozen times a day are not very welcome when it comes to SMS. Swiss banks tend to pay for the costs of sending these messages. But some of them are thinking about letting their customers pay for it or at least limit the amount of messages sent by day.

SMS might be intercepted either during transmission or while resting on a mobile device (which might also be used for the banking login itself). This is why physically separated solutions like tokens are preferred when it comes to high-security solutions.

4

I've never heard of just using the date of birth for authentication. It's a bad idea as a date of birth is non-revocable. Meaning if it is "compromised" you can't change it.

If it is the only means of authentication for consulting account or transactions it's a REALLY BAD IDEA.

But that brings me to my second point. It is, in general, not considered your risk, but the bank's. If you can proof their authentication mechanism sucks and you get defrauded, there is a reasonable chance the bank will have to pay you back as they weren't very diligent.

That being said you would still have to go through a lot of hassle to get that settled. If a bank is taking such an approach and there are no other controls in place, I wouldn't stay with the bank.

1

Most banks would ideally to use multiple stages of authentication. These are classified as:

  1. Something you know (password)
  2. Something you have (card / token / phone)
  3. Something you are (biometric)

By asking for a DoB, your bank is restricting itself to only one source. Considering that once a password is known it is hard to assume that the attacker cannot find the birth date.

However, setting up infrastructure for the second type of authentication can be expensive. Most businesses would weigh the risk (amount of money lost in paying for losses due to illegal online transactions) against the cost of implementing this system. In economies where there are no legal pressures pushing for stronger authentication of payments, and very low online fraud costs, it makes sense for banks to not invest in complicated systems. The bank could also be doing this only for low-value transactions or because online transactions are few in number.

Also read: Schneier predicting that 2FA wouldn't take off because the gains would be negligible (this was in 2005).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.