Two-Factor Authentication

Earlier this week the HKMA and the Hong Kong Association of Banks (HKAB) announced the introduction of two-factor authentication for high-risk retail Internet banking transactions.

Readers may have recently received letters from their banks inviting them to apply for two-factor authentication for conducting high-risk retail Internet banking transactions. The introduction of this security measure is an important milestone in Internet banking, and will, we hope, address the growing challenge of Internet banking fraud.

In June 2003 we received the first report of a fake bank website targeting members of the public in Hong Kong. This was followed shortly by reports about phishing emails, which contained embedded hyperlinks to connect bank customers to fake bank websites. These early cases were not difficult to deal with because the fake login webpage did not carry a security padlock or digital certificate. Our efforts therefore, and those of the banks, focused on educating customers to pay attention to these important security features.

Later on, new fraud techniques emerged. For example, it became possible to fake even the security padlock and digital certificate information on websites. There were also reports about Trojan software, which was planted surreptitiously in a victim's personal computer (PC) to capture his or her keystrokes and then transmit them covertly to the fraudster. So our education programme shifted to stressing the importance of installing anti-virus software and personal firewalls to protecting bank customers' PCs against these attacks.

As the frauds became more sophisticated, we recognised that mere reliance on authentication of the login ID and password and consumer education were no longer sufficient. A general consensus was reached by the banking industry in June 2004 that two-factor authentication would be the appropriate solution. It was no easy task to find two-factor authentication methods that would be tamper-proof and fail-safe, given the ability of criminals to find ever new ways of exploiting the authentication system. Nevertheless, the banking industry in Hong Kong has identified three types of two-factor authentication solutions believed to be effective and simple to use. They are

non-duplicable digital certificate – an electronic identification certification that helps establish a customer’s identity online and is stored in a secure device such as a Hong Kong Smart ID card or an electronic security key
token-based one-time password – a one-time password generated by a security device or token. Each password is used once and expires within a short period of time
SMS-based one-time password – a Short Message Service-based one-time password generated by the bank and sent to a customer’s mobile phone for additional identity authentication for example, to confirm a high-risk transaction.

More information on two-factor authentication may be found in a leaflet and on an interactive programme available at the websites of the HKMA (www.hkma.gov.hk) and HKAB (www.hkab.org.hk), and at the HKMA Information Centre, and from individual banks.

We understand that a number of bank regulators throughout the world are currently reviewing the implications of Internet banking frauds and consulting banks about the adoption of two-factor authentication for Internet banking. We are proud that Hong Kong is one of the first places to introduce this security feature. It should help ensure that Internet banking in our city can continue to be carried out in a safe and sound environment.

Joseph Yam

2 June 2005

Related Viewpoint Article:

• Internet Banking: Some Useful Tips for Users, 15 July 2004

Related Press Release:

• Launch of Two-factor Authentication for Internet Banking, 30 May 2005

Related Information:

Internet Banking: Two-factor Authentication

Click here for previous articles in this column.

Document in Word format