Since 2009, internet banking has been the preferred banking method for U.S. consumers — usage grew from 25% in 2009 to 36% in 2010 alone. That growth is exactly why the Federal Reserve issues guidance to financial institutions on how they authenticate consumers online.
Single-factor authentication isn't enough
The Federal Reserve's position is blunt: single-factor authentication — typically just a password — is inadequate for high-risk transactions. As the guidance puts it, "account fraud and identity theft are frequently the result of single-factor authentication exploitation." A password alone can't adequately protect sensitive account information or fund transfers.
What multi-factor authentication actually means
A properly designed multi-factor system is far more resistant to compromise, because it combines more than one type of factor. The classic example is an ATM: "something the user has (i.e. the card) with information the user knows (i.e. PIN)." The three recognized factors are:
- Something the user knows — passwords, PINs, security questions
- Something the user has — cards, tokens, USB devices
- Something the user is — biometric characteristics
Authentication techniques that satisfy the guidance
- Shared secrets — passwords, PINs, security questions, customer-selected images
- Tokens — USB devices, smart cards, password-generating devices
- Biometrics — fingerprint, face, voice, and iris recognition
- Out-of-band authentication — verifying identity through a separate channel
- Geo-location — IP address analysis and location verification
- Mutual authentication — the institution and the consumer verify each other
Risk-based assessment is a requirement, not a suggestion
The guidance doesn't stop at picking a technique. Institutions are expected to identify their transaction risk levels, assess how well current mitigation techniques actually perform against them, and keep adapting as new threats emerge — including tracking fraud-reporting rates and consumer engagement with security education as real effectiveness metrics, not just checkbox compliance.