What is known is that within the banking environment, the authentication methods used by corporate banking customers have been stronger and more sophisticated than the methods used by retail customers. The reasons, of course, are the higher account balances—the higher dollar volume of risk—and the more frequent transfer of funds to accounts belonging to third parties. As a result of the authentication methods used, fewer instances of corporate online fraud than of retail online fraud have been reported. A brief look at the authentication methods used by corporate customers may be useful for banks that are considering applying stronger authentication for retail customers.

A small sample of large banks shows that these institutions are using a variety of authentication techniques for corporate banking.²⁴ Five out of seven global banks and four out of seven North American banks use a single sign-on, with North American respondents generally limiting single sign-on to cash management services. The small sample of large banks uses some combination of user identification, user password, company identification, and company password. Access to trade services, foreign exchange, and investments generally require a separate login and security method for each product.²⁵ Digital certificates are more often used by large global banks compared to their North American counterparts, primarily to support the nonrepudiation of transactions.

Most of these large banks use tokens. Six out of seven North American and global banks included in this sample use tokens to access corporate electronic banking applications, to approve payment transactions, or both. Digital certificates are used by about half the sampled institutions. These large banks have shown little reported interest in using biometrics to authenticate corporate customers.

Online merchants are using, and plan to increase their use of, nonintrusive Internet protocol address filtering methods. Current online merchants are already using a variety of tools, with 33 percent using Internet protocol address filtering and another 22 percent planning to implement that method in 2005.²⁶

When banks consider authentication methods for retail customers, they should be aware that these customers value security and the protection of confidential information and may be prepared to use enhanced authentication methods to access their accounts. But there are privacy implications associated with authentication. Consumers report the greatest concerns with biometrics. Consumers will require a clear explanation of any security mechanism and the use of any personal information required to implement that security mechanism. Consumers will need to understand how the additional information will be used and stored. Overly burdensome authentication systems may lower consumer participation, thereby lowering the effectiveness of the entire system. Consumers are also concerned about the risk associated with large databases of personal information and the potential for the information that is used by authentication methods to be compromised, copied, or imitated.²⁷

Some conceptual acceptance by consumers of additional authentication methods has been reported concerning biometrics and the willingness of consumers to provide additional information for authentication. Limitations on the use of personal information and the existence of privacy safeguards are important elements of consumer acceptance.²⁸ Convenience is another element, for convenience plus security may be more important to customers than security alone. In a more recent study, among approximately two-thirds of respondents who found biometrics generally acceptable, voice recognition and finger prints were the most widely accepted biometric types, and convenience was the overwhelming benefit along with security and speeding up the transaction. The one-third who were unsure or opposed to biometrics indicated concerns about how biometrics works and its accuracy.²⁹

To an extent, consumers appear to be willing to provide additional pieces of information for authentication (with 29 percent agreeing to provide one additional data item and 41 percent suggesting two).³⁰ One-fifth of online U.S. households claim that because of their concerns about privacy or security, they would be willing to have an in-home credit card reader.³¹ At least one vendor reports interest in two-factor authentication for the accessing of on-line bank accounts.³²

The challenge facing banks that offer online banking services is significant. New authentication methods must be reliable, cost-effective, and convenient while meeting the security and privacy needs of customers. Cost, reliability, performance, and ease of enrollment are expected to improve in the near term but will still vary by technology and by product within the technology.

Examples of Two-Factor Authentication
At the time the FDIC Study was published, the FDIC knew of several financial institutions that were using two-factor authentication, and contacted them. Each institution asked that its name not be used in the Study. Since then, the FDIC has become aware of additional institutions that have begun using such technologies, and the names of the participating financial institutions have been made public. There may be more institutions becoming interested at least in piloting two-factor authentication programs. A number of institutions have put such programs into production. For two groups, domestic and international financial institutions, tables 2 and 3 list the technology, its application, and the deployment stage as of the date this Supplement was published. Although these tables are not intended to be an exhaustive list of institutions using two-factor authentication, they do suggest that the use of such technology is becoming more common.