We have a situation here. The client which I work for is currently placed as a finance brokerage firm and their current positioning are:
- The firm has different branches in different locations
- The firm has a giant customerbase
- The firm takes security serious
Now, their requirements specifies these:
- Passwords if shared by customers should trigger an OTP to real account
- With generation of OTP, the account owner is informed
The question is what can be done to prevent different people using the same shared password or in simple, what are different ways in which the firm can restrict the use of shared password for intended users apart from using OTP?
Note: Earlier they had trading password which alongside with the main password could be shared to the third-party so that's not a reliable option.