Security threats Toolkit

Lloyds TSB to trial two-factor authentication

Tags:
Two-factor Authentication

Tom Espiner ZDNet.co.uk

Published: 14 Oct 2005 13:30 BST

Lloyds TSB has announced that 30,000 of its customers will trial a two-factor authentication device, in an attempt to fight online fraud.

The Access Code Device is keyring-sized and produces a randomly generated, one-time-only number that a customer enters when logging on, in conjunction with his or her password, explained Ken Farrow, group head of fraud at Lloyds TSB.

Users of the device are less likely to become victims of phishing and pharming, as the fraudsters would need both device and password in order to access a customer's account, according to Farrow.

"This protects against phishing and remote monitoring, because the device doesn't transmit any signals that can be intercepted," Farrow said.

Loss of the device would not in itself compromise the account, Farrow said, as the authentication is two-factor. "If the device is lost, it doesn't compromise security as you also need a password — this is the two-factor element. If it is lost, you inform the bank, and they cancel the device and issue another."

Lloyds is working closely with APACS (the Association of Payment and Clearing Systems) and other members of a working group to develop a standard authentication device for online banking and shopping, Lloyds said.

"We are working collectively within APACS to enhance security, and a standard is being developed which should be coming on-stream sometime next year," Farrow said. "We wanted to get ahead of the game and test whether our solution was right for our customers."

The 30,000 customers will be selected at random for the trial. "We will be offering the option of taking the device to a cross-section of the customer database," Farrow said.

The device will be modified following the trial, and the findings will feed into the APACS standards work. "We're looking at the impact on fraud levels, and working closely with APACS. If we decide to roll out a two-factor device, it would be this or something else (as part of a standard)."

Farrow was unwilling to say who developed the device because of security implications. "It's a proprietary device that has been made for us by a third party," he said.