Inside IT: Push for mobile mail
Inside IT |
As fraudsters get more sophisticated in their methods for fleecing customers, the banks are re-evaluating their security, reports Ken Young
Thursday November 18, 2004
Sophisticated "phishing" attacks that lure PC users to fake websites are prompting security experts to question whether the current password-based security systems are adequate to cope with the growth in fraud. And if the banks fail to act, this could undermine confidence in online banking, and the whole e-commerce industry.
UK banks now have more than 14 million customers who benefit from 24-hour access to their accounts from PCs with a web browser. Although subscriber growth has slowed recently, the total number of subscribers has doubled since June 2002.
However, phishing - the activity of gaining passwords and other personal data to use to remove funds illegally - is a multimillion pound problem. The most common example is the use of fake emails that purport to come from your bank. These invite you to confirm your password on fake bank web pages set up by the fraudsters. Internet security firm Messagelabs says it is intercepting 50,000 such emails and more than 80 new phishing websites every day.
Around £4.5m has already been refunded to about 2,000 customers, according to the Association for Payment Clearing Services (Apacs).
The problem for banks is that fraudsters are getting smarter. They have started using virus technologies, such as sending emails with Trojan keylogging software that tracks your keystrokes or even grabs screenshots while you are connected to your bank. By logging your actions, they are able to get all the password details they need to enter your account. Clearly, under these circumstances, any system that relies on a single unchanging password is inherently insecure.
Nearly all banks use a password system that requires two or three pieces of information to control access to accounts: user name, password and a third item. Many banks - including Barclays, Lloyds and First Direct - ask users for a random selection of characters from the password, and sometimes the third item is the answer to a selection of pre-agreed questions, such as: What is the name of your dog?
But what happens if you are the victim of phishing? At the moment, the banks say they will reimburse anyone "inadvertently" defrauded through phishing. However, last weekend, Apacs revealed that the banks may withdraw this policy if they believe customers have not paid sufficient heed to the safety advice available.
An Apacs spokeswoman, Sandra Quinn, says the banks are also looking closely at stronger forms of security such as dynamic (variable) passwords. "Our e-commerce group is looking at it. The key issue is whether banks should collaborate on one system or develop their own systems," she says.
"We have seen a massive increase in phishing so there is agreement that something must be done. The most likely outcome is a pilot project later this year," says Quinn.
A variable password system requires the bank to issue a token device that can generate a unique numeric password each time the customer wants to connect online. This random number is automatically synchronised with the bank's server. Alternatively, a card reader can be connected to the user's PC.
Identification specialists agree that another level of authentication will make a big difference. "The adoption of an additional authentication step for high-risk transactions, such as making a payment to a new account, could dramatically reduce the financial exposure to the customer," says Paul Butterworth, product marketing director at Aspace Solutions, an identity management firm.
"Unless banks rapidly introduce anti-phishing technologies, fraud will rise to a level where internet banking becomes a commercial liability."
But there are two problems with this approach: cost and user acceptance. Tokens cost about £35 per customer, and cost even more to administer, maintain and replace. There is also evidence that customers prefer simple password systems, though this may change if phishing attacks continue to increase. It is also unknown how well a token system would scale up to serve millions of users if a unified system were adopted by the banks, as is the case with Chip and Pin, the new authorisation system for credit cards.
What seems most likely is that tokens will be used first with business customers. In Australia, Westpac Bank has already told its business customers they will have to use tokens if their transactions involve more than Aus$5,000 (£2,073) in one day. Previously, it had a Aus$25,000 limit. The bank is also thought to be considering tokens for its 1.5m personal online customers.
Jon Fell, a partner at Masons Solicitors, says banks need to take security more seriously. "Banks are waking up to this, but you have to wonder if they could do more. The problem is they are between a rock and a hard place with phishing. What they really want is the government to spend more on educating people of the dangers. The problem is, recent research by Apacs found that 4% of people said they would reply with password details to an email if they thought it was from their bank."
All the evidence suggests the phishers are capable of constantly developing new ways of using social engineering to fool customers. Raising consumer awareness will help, but it would have to be a continuous process, with new lessons being learned to cope with each new form of attack.
Few experts believe this approach will be as effective, in the long run, as a move to variable passwords and the widespread adoption of secure email technology.
· Send comments to firstname.lastname@example.org. Please include address and phone number. If you do not want your email address published, please say so.
More from the Online team
Privacy on the internet
Parliamentary Office of Science of Technology report on electronic privacy (pdf)
Electronic Privacy Information Centre
Foundation for Information Policy Research
Cyber Rights and Cyber Liberties
The privacy site
Printable version | Send it to a friend | Save story