We have been using passwords and codes for hundreds of years, but still, it seems like our security thinking hasn’t evolved at all.
People want an ultra-low-friction mobile payment experience that says yes to a lickety-split transaction, with a minimum of taps and without the extra hoo-ha.
Pay on the go, wherever you are, is the catchphrase of today. This is the inevitable reality so let’s take a second to untangle some of the pitfalls and opportunities for banks to get on top of this development.
In-app purchasing, person-to-person payments and e-wallets are all results of consumers’ relentless demand for instant access to their money. Needless to say, this is why the most convenient and readily available device of them all – the smartphone – is becoming the payment channel of choice. Sending money to friends and family, shopping or doing day-to-day things like paying a bill inside various apps are all examples of consumer behaviours that are taking off in a phenomenal way.
It’s no longer just well known online payment services like PayPal, Google Wallet and Apple Pay (that have been around long enough to earn trust) that are competing for a piece of the mobile instant payments pie. Thanks to the revised payment services directive (PSD2), the entire payment services ecosystem have entered the race and offer competitive-edge and value-added “overlay” payments that boost consumer instant access. Whether it’s game-changing players like Square, Klarna, Paym and Dwolla or run-of-the-mill banks, the potential success stands and falls with a combination of convenience and security.
The educated guess would be that as long as people can stay secure, they will take the path of least resistance. But convenience will only go so far when it comes to the adoption of mobile payments. Without the underpinning security, this ever-growing trend could halt in mid-stride if consumers don’t trust that their money is a hundred percent secure.
Trust, trust, trust
Even though banks are late to the mobile payment user-convenience party, research shows that consumers still have a much higher level of confidence dealing with their banks, than online platforms and social-media companies when it comes to payments services. This is a slam-dunk advantage that gives banks the chance to stay competitive by drawing from the hard-earned trust they have built with their customers over the years.
As payment innovation has been about striking the right balance between customer convenience and security banks are successively abandoning yesterday’s security methods and have started to evaluate new and more robust alternatives at hand. But bringing about a genuinely effortless mobile user experience and at the same time reach fool-proof security is no easy feat. To begin with, instant payment features radically shortens the time to identify fraud so no matter which way you look at it, you need to invest in extremely secure real-time fraud detection based on strong user authentication. Exceptional user convenience on the smartphone may be the term of the day as it stands, but without up-to-date security tech behind it, it could be good for nothing.
In the near future, those who offer their customers the security and sought-after split-second payment convenience will survive. This is why we have developed Covr, a user-centric mobile security management platform. It will help banks and other financial players to overcome the biggest hurdles in the transition to large scale open banking as it doesn’t require hardware or huge installations costs.
About Covr Security
Covr Security AB, located in Malmo, Gothenburg, Stockholm, Frankfurt and Palo Alto, is a Swedish cybersecurity company. We have developed a next-generation, user-centric mobile security management app for a wide range of heavily regulated digital industries that depend on strong customer authentication and privacy. The Covr app is available both as an off-the-shelf authentication mobile app ready for a quick launch and as a powerful SDK for hassle-free integration into existing mobile applications.
You’d think that in today’s high-tech society, nobody uses text-messages as part of their 2-factor authentication system. But despite hoping that this was dead and buried practice, every now and then we see examples of when it’s being used and subsequently hacked. Recently, Metro Bank in the UK and its customers suffered the consequences from this, which goes to show it’s time we start using better and safer solutions.
Telecom operators use what’s called an SS7 protocol to reroute both text messages and calls, and also offers the possibility of geo-positioning cellphones. The problem is that the owner of the cellphone doesn’t need to be informed of this, meaning anyone with access can reroute text messages and track the whereabouts of the phone as they choose. This could, for example, be the Telecom operator itself, a government agency, or the not-so-friendly hacker.
All the hackers need to do is figure out the user’s login and password to their bank, things that are relatively easy to get your hands on these days. They then simply use the SS7- protocol to reroute the authentication text message to their own phone and immediately get full access to the bank account. This exact thing happened to customers of the Metro Bank in the UK recently, as reported by “Motherboard”. The SS7-attacks drained the accounts of “an extremely small number” of customers according to representatives of the bank. But regardless of the number of victims, this should really not be a hack that is possible to perform any more. Especially not at a bank that millions of individuals and companies trust with their money.
The victims were of course compensated by Metro Bank, and hopefully, both the bank and customers have learnt their lesson and immediately abandon these inadequate practices.
There are however still thousands of services, banks and others that rely on text- messaging for their 2-factor authentication, apparently living in the belief that their system is secure. But implementing just any 2-factor authentication protocol does not mean your system is secure, much like having a seat-belt made out of paper won’t do you much good in a car crash.
So, take a good look at the service providers you use. if they use text messaging as part of their two-factor authentication inform them of their errors and find yourself another supplier. You simply aren’t safe where these practices are being used.
Both Marriott and Voi have recently had data about millions of their customers leaked, the prior by a hack and the latter by poor security set-up. The conclusion: The current systems for ensuring the safety of our customer’s data are far from sufficient.
In late November last year, the hotel chain Marriott announced that they had been the target of a data hack, exposing the information of 500+ million customers. The hackers had access to the customer data since 2014, but it took Marriott five years to realize they had been hacked. During that time, the hackers had access to names, phone numbers, email addresses, passport numbers, dates of birth and arrival and departure information of 327 million of Marriott’s customers. Besides that, for millions of others, the credit card numbers and card expiration dates were also potentially compromised.
Just a few days ago the electric scooter company Voi, that has placed scooters in major cities all over Europe, had 460.000 of their customer’s names, emails and phone numbers exposed openly on the internet. According to the German media company Bayerischer Rundfunk, the data was accessible by anyone without having to break any rules or even be a very proficient hacker.
Both of these incidents are very severe and point to the fact that the systems that many companies rely on to keep their customer’s data safe are insufficient. Whether it be by poor process design, a lack of understanding, or simply an outdated IT-system, there is a great need for better ways to protect the data customers entrust companies with. Poor PR is also not the only thing that can come from such data leaks. In light of the recent EU-directive GDPR, companies now also run the risk of getting hefty fines. In the Marriott-case, the data-breach has been deemed one of the most severe in history, and it will take several months for regulators to investigate the situation fully.
Had the companies instead ensured that the customer data could only be accessed by authorized personnel and had warning systems in place, the breach would either never have been possible or stopped a lot earlier. As a customer in today’s tech-world, your personal data can wreak havoc in your personal life on a scale previously unimagined. A leak such as the ones at Marriott and Voi, should therefore simply not be possible, especially since there are systems available that would have prevented them.
It’s time that companies accept their responsibility, and take measures to ensure that such leaks are not possible. Finding secure IT-systems is not an impossible feat, rather, there are companies like Covr Security that make sure that your customer’s data will remain safe and secure, while still allowing the information to be accessed by the right person at the right time. Security is not just a fancy word to be thrown around in the corporate visionary document, it’s a necessity to ensure that you have a business in the years to come.
In recent years being able to prove who you are has become more important. Companies and online services need verification and use different methods for you to do so. We started with increasingly complex passwords, but more and more are looking at 2-factor-authentication, or even multi-factor-authentication. But what method is actually preferred, both from a security and user-experience perspective?
Having passwords that are so complex that you can’t even remember them yourself has lately proven to be a rather poor method of securing your online accounts. Bill Burr, the former manager at National Institute of Standards and Technology (NIST), created the password-guide that is used today to find a secure password. The problem is that the guide was produced in 2003, and Burr now says that he didn’t really understand how passwords worked during the time. The guide that is being used today actually doesn’t ensure safe passwords. A better method of creating safe passwords is to put together three or four unrelated words, resulting in a longer password without being unreasonably difficult to remember.
But having just a password to verify your identity has proven to be insufficient, just look at the Heartbleed bug a few years ago where thousands of passwords were leaked. Through the years there have been several reports where passwords have been compromised by hacks or simple errors. So, in order to stay safe, there should be some other method of proving you are really you.
The answer has come in the form of 2-factor authentication, where you use your password to login to an online account, and then get prompted on a different device (often your mobile phone) to authenticate that you are attempting to log in to that account. This ensures that you are really you, or at least in theory. Many started using text messaging to send a passcode that you entered to verify the login. But lately there have been numerous reports of such text-messages being redirected to a different phone, and thus the authentication process is yet again insecure.
Many companies, such as Google, have therefore created their own app that ensures that the verification code is only sent to that specific phone. In countries such as Sweden, the banks have joined forces and created a Bank-ID that is linked to the citizen’s personal identification number. The problem with these is that they do not work globally or universally across platforms. In Google’s case, the service provider must then use Googles authentication, and thus their login-system, something that might be undesirable for many service providers. In the case of the Swedish Bank-ID, you must have a Swedish personal number and also have a Swedish bank account.
In other cases, the verification process often requires several steps, which then becomes a hassle for the user. This reduces the willingness to use the verification system. Since people tend to use the path of least resistance, the user experience must be at the centre of the system. If the process of logging in to your account isn’t easy, then you will probably use a less secure method instead.
Developing a universal and global multi-authentication system that is secure and easy to use is, therefore, something that is desired and urgent. Luckily, we are now seeing several such systems being developed, and the one that is currently leading the charge towards secure and easy online verification is Covr Security. They are a Swedish company that has used the experiences from the Swedish Bank-ID to create a system that is non-affiliated to a vendor with their own agenda and works around the globe. The system is easy to use, easy to implement and ensures the highest level of security. Simply put, it offers all that you could ask for in a multi-factor authentication system.
If you would list the three main start-up scenes in the world that produce more Unicorns (+1 Bn USD companies) than any other, you would probably mention Silicon Valley, Sweden, and Israel. So, for a start-up tech-company in Sweden, it makes perfect sense to visit one of these hubs to learn from their experiences. In the next week Covr is doing just that, and the reason? To make smarter decisions and better business in a global market!
In today’s interconnected world, networking is one of the primary skills you need to master. Both companies and business gurus talk more about collaboration than competition, and as a company, in a small market, you quickly need to expand your network on an international market. Covr is, therefore, taking a trip to Israel to exchange ideas, get inspiration and gain insight into how companies on similar, yet somewhat different, markets do things. The Swedish and Israeli market is similar in the sense that they both are too small for a company to make it on that market alone. As a start-up, you must see yourself as a global company from the start, but that also brings a lot of new obstacles and challenges. To then take the opportunity to learn from others in similar positions is nothing but a smart investment for your future business development.
Covr’s networking trip will hopefully generate ideas that will position the company for a rapid, and profitable expansion, as they are gearing up to bring their security solution to the global market. However, there’s a considerable difference between expanding globally with the experience others have already gained, or going at it alone, much like learning how to drive with or without a tutor. Preferably the earlier before the latter.
We look forward to hearing the tales and lessons learned, and above all to see them implemented, as Covr takes identity validation and digital security to the next level for individuals and companies around the globe.
You don’t want to lose money due to online fraud, do you? Then you better buff up your FDP-solutions, because retailers are expected to lose $ 130 billion in CNP-fraud in just the next 5 years.
As online shopping and digital solutions are becoming more common, we are also seeing a rise in online fraud, and the no-good-doers are getting more creative every day. As an online retailer, you, therefore, need to increase and expand your Fraud Detection and Prevention (FDP) measures in order to keep the bad guys at bay and prevent your business from sustaining heavy losses in the upcoming years.
Catching fraudsters with their hand in the digital cookie-jar simply isn’t as easy as it used to be.
If you are like most eCommerce merchants, you have probably focused mainly on detecting fraud at the point of transaction. This makes sense since this used to be the place where fraud was common, and it’s was also fairly easy to detect certain types of fraud there. But nowadays the fraudsters have become better at hiding their intentions, and you need to look for suspicious behaviour earlier during the session in order to identify them. Catching them with their hand in the digital cookie-jar simply isn’t as easy as it used to be.
The reason why most online retailers don’t invest in a multi-layer FDP is that it seems like a waste of money. There is a perception that an advanced system like that can only detect fraud, and thus it makes little sense investing in a costly system that only does one thing. It can sometimes also be hard to calculate the exact amount of money lost to fraud, so calculating the ROI of such a system becomes trickier. But now that a recent study from Juniper Research indicates a potential loss of $ 130 Bn the coming five years in Card Not Present (CNP) fraud alone, getting a better system might prove to be a good investment after all.
There are also added benefits of having a better FDP-system in place. One of the authors at Juniper Research, Steffen Sorrell, explains,
“A layered FDP solution naturally helps directly preventing fraud, but it also offers major gains in terms of recovering potentially lost revenue through false positives. This is something about which retailers remain undereducated, and has allowed fraudsters to capitalize on relatively low FDP spend,”
Online-shoppers love a retailer they can trust
This means that a well implemented FDP-solution will quickly earn its money back. And not just by preventing fraud, even though the staggering losses Juniper Research calculate might be enough already, but also from increasing consumer-trust.
So, by having a multi-layer FDP you can build a secure and trustworthy shopping experience for your customers. And trust me when I say this: online-shoppers love a retailer they can trust. If you are worried about the ROI, fret no more, buffing up your anti-fraud system will quickly prove to be a good investment for both you and your customers.
Covr Security AB
211 19 Malmö
Grev Turegatan 3,
114 46 Stockholm
Östra Hamngatan 16,
411 09 Göteborg
470 Ramona Street
Palo Alto, CA 94301
Neue Mainzer Str. 66-68,
60311 Frankfurt am Main
NORDIC INNOVATION HOUSE
128 Prinsep Street
Emarat, Atrium Building
Sheikh Zayed RD, Dubai