The convenience of digital banking with the assurance of security

UPI is a digital payment platform in India, which offers customers a mobile phone-based application to send and receive money instantly. This digital form of payment was launched in the middle of 2016 and gained popularity after the government of India carried out a demonetisation exercise at the end of the same year, with a view to curbing India’s shadow economy and returning hoarded cash into the banking system. Overnight, 500 rupee and 1,000-rupee currency notes, constituting over 85 percent of the country’s cash in circulation, were rendered worthless, leading to a severe liquidity crunch in India’s cash-first economy.

With the shortage of cash and long lines at banks to exchange the now-redundant currency notes, digital forms of payment started gaining popularity. Very soon, street vendors and large stores across the country started displaying their personalised QR codes to receive payments via UPI.

That was not all. Rising disposable incomes, low-cost smart phones and affordable internet plans have led to a rise in smart phone usage, adds Dave. “People are spending much more time online. Whether for education, banking, travel or shopping, smartphones are people’s first choice.” India has around 800 million active internet users and some estimates claim that people in the country spend an average of three hours every day on the internet. According to Dave, this changing trend is providing a wider playground for cyber criminals to operate in.

People are still falling prey to simple tactics because cyber criminals take advantage of their greed, fear and vulnerability.Pinakin Dave

Who is responsible for cyber security?

Several parties are involved in online financial transactions. Financial services providers, technology providers, regulators and, of course, those who use these financial services. While each of these parties play a crucial role in ensuring safe financial transactions, Dave feels that consumer behaviour is the generally weakest link.

“Many organisations are investing heavily in protecting their customers. Regulators are also providing strong frameworks for safe online banking, but human behaviour is not keeping pace,” he says. “People are still falling prey to simple tactics because cyber criminals take advantage of their greed, fear and vulnerability.” Several studies show that nine out of 10 cyber attacks start with phishing, a term which refers to criminals tricking users into divulging sensitive data or downloading malware, leading to loss of information and money.

India’s central bank and regulatory body, the Reserve Bank of India (RBI) and market regulator the Securities Exchange Board of India (SEBI) have issued guidelines for digital products and services, provided by financial institutions. For example, the RBI’s Digital Payments Security Controls provides financial institutions separate guidelines for internet banking, mobile banking and card payments. The guidelines make it mandatory for financial institutions to educate consumers about staying safe when using digital payment products or related services.

What role does OneSpan play?

Dave says that OneSpan looks at security holistically, from the perspective of the device, the user and the application that is used for the financial transaction. “We want to make sure that our clients have a convenient banking experience, with the assurance of security,” he says. Elaborating further, “Many of our clients, including Deutsche Bank, are using OneSpan’s App Shielding product which stops the banking application if a screen sharing application is active on the mobile device, while also detecting and monitoring various malicious activity on a user’s mobile device. This works in the background and protects consumers even when their own behaviour can cause them a loss.” 

This is an important feature, because there have been several cases of fraudsters tricking consumers into downloading screen sharing applications and then asking them to carry out financial transactions, which exposes banking credentials and one-time passwords. Early detection of anomalously changing patterns of behaviour on users’ devices leads to identification of new types of malware or attacks and allows organisations to react before it snowballs into large waves of fraud. 
 
In India, online financial transactions require more than one type of authentication, which is usually a message with a one-time password, along with the log-in password. However, this may fall short, if the person’s phone is infected with a malicious application such as a message forwarder. This is why OneSpan is going a step further. OneSpan’s proprietary CRONTO technology is helping overcome this, explains Dave. “We provide customers with an encrypted colour quick-response (QR) code to authenticate financial transactions. As opposed to a generic black and white QR code, CRONTO can be read only by a specialised mobile application or an authentication device. This means customers will not use their normal mobile camera app to scan the QR code which is one of the avenues for malicious actors to push fraudulent links into users’ devices.” 
 
OneSpan also provides advanced hardware-based authentication solutions – including CRONTO and FIDO-powered authenticators. “Banks need to ensure that every user both in retail and corporate banking is protected against phishing and man-in-the-middle attacks, thus having a strong option for users that do not want to rely solely on unprotected mobile devices is a great assurance for banks that all their customers will stay safe,” Dave says. 
 
The company works with banks, healthcare and professional services firms, providing them with products and services ranging from identity verification to secure video collaboration for virtual transactions. “Our firm invests heavily in studying the latest trends in cybercrime, understanding the modus operandi of cyber criminals and developing security products to bridge the vulnerability of digital products.” According to the company, 60 percent of the world’s largest banks are their clients.

Our system creates instructions that only the user’s devices can consume and transform into a very intuitive user experience, which raises awareness of potential risks and allows them to react in the most secure manner.Pinakin Dave

As technology is evolving, banks are using modern tools to protect their customers. “We have products such as Intelligent Adaptive Authentication which uses real-time decision engine that operates with big data, creates easy and fast-to-process data blocks and generates security decisions that are personalised to a user’s account history, device preferences and behaviour patterns. The system creates instructions that only the user’s devices can consume and transform into a very intuitive user experience, which raises awareness of potential risks and allows them to react in the most secure manner.” says Dave. “Most of this takes place in real time and in the background, providing our clients with a seamless experience which meets the highest standards of security and strict regulations.”

What can end users do to protect themselves?

Despite advanced security features in mobile banking applications, Dave warns that users of financial services are often the weakest link in the security chain because even a brief lapse in safe practices can cause severe financial damage. Illustrating this, he adds: “Very often people tend to give their children their mobile phones to play games or watch videos, while leaving them unmonitored. They may end up clicking on a link or downloading a game that contains malware, exposing them to cybercrime. Children could unknowingly, and unknown to their parents, download an application that forwards messages. Criminals could then gain access to one-time passwords and use that to siphon money from an account.” Along with children, Dave says that it is also very important to pay special attention to educate the elderly about safe online behaviour as they make easy targets for cyber criminals.

Advancing technology can be used for the convenience of financial transactions, but on the flip side, cyber criminals also have access to these same tools, making crime even more sophisticated. In recent times, cyber criminals are known to use artificial intelligence to impersonate family members or friends to trick people into willingly sending money to unknown accounts. It is important to verify the authenticity of the caller before transferring any money. He suggests making a call to the actual number of the known friend or relative before taking any action. “Very often, presence of mind and simple checks are all it takes to keep your financial transactions safe.”