Making internet banking secure

With the exception of the new market-leading Bank of Scotland Ireland savings account, the best deposit rates are only available…

With the exception of the new market-leading Bank of Scotland Ireland savings account, the best deposit rates are only available if the account is managed online. All five current account providers also offer internet banking services.

But online financial transactions can be vulnerable to a type of advanced fraud known as keystroke logging.

Keystroke loggers don't need to rely on consumers' stupidity to obtain Personal Identification Numbers (Pins), user names and other personal information they can use to access their accounts.

They can simply deploy virus-like invaders known as trojans to infiltrate computers and record every single key that is pressed by consumers as they enter their online bank account or make a credit card payment.

READ MORE

Fraudsters can then drain the account unbeknownst to the user.

The risks posed by this type of fraud has prompted AIB to introduce a new security feature to its newly enhanced online banking service, which it is introducing to customers on a phased basis.

A code card, which can be ordered online, features a unique sequence of 100 individual codes. Customers will be asked to enter a random code from the code card if they want to make an automatic transfer to another bank in the Republic of Ireland, with each code on the card only used once.

The ability to make an automatic transfer to another bank is a new feature in the current account market. Up to now, transfers out of current accounts in the Republic have been limited to utility firms or accounts within the same bank. To do anything more complicated, users had to phone the bank and set up a standing order.

But as third-party transfers increase the risk of money being redirected to an unknown destination by keystroke loggers, extra security is needed.

The code card is a type of security measure known as "two-factor authentication" - a procedure based on something you have and something you know.

The something you know is your username and your Pin. The something you have is the code card, in the case of AIB.

Savings provider Rabodirect, which also allows third-party transfers to be set up online, was the first bank to introduce two-factor authentication in the Republic. Its "something you have" is not a code card, but a small device called a Digipass, which is posted out to customers, who then use it to generate a 6-digit unique code that remains valid for just 36 seconds, in which time the user enters it online.

Even if trojans are logging their keystrokes, the code will have expired by the time fraudsters move to strike. AIB and Rabodirect are the only two mainstream financial institutions using two-factor authentication. Bank of Ireland plans to introduce third-party transfers later in 2006.

Laura Slattery

Laura Slattery

Laura Slattery is an Irish Times journalist writing about media, advertising and other business topics