2 Factor Authentication for a Retail Bank

The challenge

For the last 2 years, Proxama has worked closely with a leading UK bank to help develop NFC products and demos to support the bank’s contactless card base for the future. As part of a strategy to streamline the business and develop innovative technology solutions for banking and commerce, Proxama was approached to devise a mobile authentication technology roadmap.

Like many other organisations, our client is realising how mobile is critical to customer communication, security and convenience and wished to investigate how the mobile can be used as an authentication device for its remote banking and transaction processing services. Remote banking is usually provided over mobile, telephony and internet, and each channel is uniquely implemented in terms of security and customer credential management.

The challenge was to capture and assess the the banks’s requirements then look to the wider industry for existing solutions and emerging technologies which could help to integrate their customer authentication experience across channels and services.  

Our Approach

A series of 12 workshops was held to gather information; 4 internally to the bank, and 8 with external suppliers. Requirements were captured from the various remote banking teams, as well as representatives from the transaction processing side of the business and fraud prevention. The requirements were documented, analysed and presented back to the teams for feedback and refinement.

Following this, workshops were held with individuals from card schemes, network operators and security services specialists, as well as card manufacturers and transaction processing software houses. To effectively manage the large volume of information collected, we modelled the authentication process as consisting of 5 parts: credentials, protocols, devices, channels and services, and looked at what is and what will be available for each component of the chain.

We presented our analysis of the information using storyboards. We covered use cases for several mobile authentication solutions, starting with what is currently possible, through to the long term future, specifying a converged “ultimate” banking handset with 3-factor authentication, NFC and user interface security.

Results

The Bank is currently reviewing the scenarios and recommendations internally and using them to define their product strategy for mobile authentication over the coming years.