Authentication: Visa certifies Entersect
- Visa has certified Entersect’s authentication solution for online card transactions and CNP fraud prevention. According to the South African Banking Risk Information Centre (reported by ITWeb), CNP fraud accounted for 142.8 million Rands losses in 2011 (about 14 million euros) or 77% increase compared to 2010).
- Entersect’s tool relies on the cardholder’s mobile phone number, used as a second authentication factor to protect him against potential Man in the Middle attacks when making online transactions.
- A message containing the transaction details is transmitted to the user via mobile so that he can either accept or reject the given transaction. His response is forwarded to the issuing bank and relayed to the merchant through Visa’s 3DS infrastructure. In addition to this measure, the software also provides SMS OTPs and enables OTP generation by mobile. This solution is currently being commercially deployed and especially applies to customers travelling the most, and using alternate international SIM cards when abroad.
- Described as easy to use, Entersect’s solution is likely to raise users’ interest as they more willingly turn to less intricate authentication solutions (see previous Insights). Nevertheless, fraudsters are often able to access customers’ phone number (via social engendering techniques, for example) which may potentially impact these kinds of measures (see "M-banking: Acknowledged Data Thefts").
- To this respect, SRL’s assessments indicating that 80% of mobile phone users could fall prey to new generation attacks must be reminded –SRL’s leader, Karsten Nohl, is notably known for his research work on A5/1 encryption algorithm, the vulnerability of which he demonstrated end 2009.
- Also, however CNP fraud is decreasing in some countries, its figures still remain high: in the UK, for instance, it decreased by about 20% during the first semester 2010 but still represented 296 million pounds (over 350 million euros).