Is strong customer authentication working?

Any­one who has shopped online recent­ly will have already become accus­tomed to the extra step of hav­ing to receive and then use a one-time pass­word (OTP) or log onto their mobile bank­ing app to approve a pur­chase.

This strong cus­tomer authen­ti­ca­tion (SCA) step became manda­to­ry in March, as ecom­merce providers were oblig­ed to ensure cus­tomers prove their iden­ti­ty through some­thing they know (a pass­word) and some­thing they own (their mobile phone).

The mea­sures were brought in because, accord­ing to fig­ures from the bank­ing and finan­cial indus­tries body, UK Finance, remote pur­chas­es account­ed for four in five (79%) card fraud cas­es dur­ing 2021. By send­ing the legit­i­mate cus­tomer a one-time pass­word or ask­ing them to log into a bank app, the hope is that fraud rates will drop. 

It will not be known how well the new mea­sures are work­ing until the end of the year, when UK Finance will pub­lish fraud fig­ures for 2022. How­ev­er, Nation­wide cred­it­ed the tech­nol­o­gy with record­ing 2,000 few­er cas­es of fraud each month. Its research has shown that more than two in three cus­tomers, 68%, are hap­py to enter a texted pass­code or, as the major­i­ty do, approve a pay­ment in their bank­ing app.

But not all com­pa­nies with­in the indus­try are con­vinced. Tonia Luykx, VP at fraud detec­tion busi­ness Sift, claims its fig­ures show that, at the very least, crim­i­nals have sim­ply changed tac­tics. Its net­work mea­sures fraud across thou­sands of mer­chants and has seen a 41% rise in fraud attempts since SCA was intro­duced. This, she says, is main­ly down to crim­i­nals chang­ing tac­tics and using stolen card cre­den­tials on goods under the £30 lim­it at which SCA pro­tec­tion becomes manda­to­ry.

“SCA is def­i­nite­ly a step in the right direc­tion but we’re see­ing fraud­sters adapt,” she says.

“They’re defraud­ing sites by mak­ing lots of fraud­u­lent pay­ment attempts under SCA’s min­i­mal pay­ment lev­el and then, for larg­er pay­ments, they are tak­ing over accounts so they are sent a pass­word to com­plete a trans­ac­tion.”

Fraud­sters take over accounts by trick­ing peo­ple into pass­ing on their email address and pass­word, typ­i­cal­ly through phish­ing, or by dup­ing a net­work into think­ing a per­son is chang­ing SIM cards and so needs mes­sages sent to a new num­ber. This new num­ber is owned by a fraud­ster who will then pick up any one-time pass­words with­out the vic­tim know­ing. 

Neil Down­ing, VP of prod­ucts at TMT Analy­sis, reveals there has been an uplift in fraud­sters using tac­tics such as SIM swap to cir­cum­vent SCA’s pro­tec­tions. With­out detec­tion tech­nol­o­gy, this fraud can be hard to spot because so many peo­ple are legit­i­mate­ly chang­ing num­bers that the decep­tion con­tin­ues until the vic­tim spots unex­pect­ed charges on their accounts. 

“As an indus­try we see exploits against SMS vul­ner­a­bil­i­ties are on the rise, either through SIM-swap­ping or SIM-jack­ing to inter­cept a mes­sage, or tele­pho­ny-based social engi­neer­ing fraud to trick the vic­tim into divulging the SMS one-time pass­code and cir­cum­vent the secu­ri­ty,” he says.

“How­ev­er, although the indus­try is see­ing sig­nif­i­cant growth in attacks against SCA, the risk of fraud from a reliance on pass­word-only secu­ri­ty is sub­stan­tial­ly greater. The hum­ble SMS OTP is bet­ter than no SCA by orders of mag­ni­tude.” 

While secu­ri­ty busi­ness­es com­mon­ly agree SCA is a wel­come step in the right direc­tion, there are plen­ty of experts who will point out the extra ‘fric­tion’ in mak­ing a pay­ment is hav­ing a neg­a­tive impact on ecom­merce. When there is an extra step to go through, con­sumers may think again about an impulse pur­chase, and many may not have a phone at their side to approve a sale.

Research from open bank­ing pay­ments plat­form, Nua­pay, reveals 99% of mer­chants have seen at least a 5% rise in declined pay­ments since SCA was brought in. The aver­age rate of increase in pay­ments not being com­plet­ed is 37%. While this fig­ure will include pay­ments declined because of insuf­fi­cient funds, Nuapay’s CEO Bri­an Han­ra­han believes because this has always been the case, most of the rise is like­ly down to SCA. It is a wel­come addi­tion in the bat­tle against fraud, he main­tains, but it has had a major impact on retail­ers because of how it had to be imple­ment­ed.

“The prob­lem is that cards are decades old and they’re being used online, so pay­ment providers have to put stick­ing plas­ter on them, like texted one-time-pass­words, to try to make them safer,” he says. 

“That’s why we expect mer­chants will start using tech­nol­o­gy to allow direct pay­ments from bank accounts because they have secu­ri­ty built in, just by the per­son log­ging on.” 

The pay­ments indus­try will not be able to say for sure whether SCA has reduced card-not-present fraud until the end of the year. It is fair to say that the tac­tics used to cir­cum­vent its mea­sures were already in use to take over accounts to make fraud­u­lent pay­ments. They grew in pop­u­lar­i­ty dur­ing the pan­dem­ic as more peo­ple start­ed to shop online. Many were new to dig­i­tal chan­nels and the phish­ing meth­ods used by crim­i­nals, mak­ing account takeover far eas­i­er. 

When 2022 fraud fig­ures are released, indus­try experts believe they will like­ly show SCA has caused crim­i­nals to switch to low­er-val­ue fraud, mean­ing the num­ber of cas­es may be up but indi­vid­ual sums involved will be down. For high­er val­ue fraud, fraud­sters will like­ly con­tin­ue to rely on phish­ing and social engi­neer­ing tac­tics to trick peo­ple into pass­ing on log-in details so their online accounts can be tak­en over. As ever, tech­nol­o­gy can only do so much. The biggest risk in the secu­ri­ty chain is often the cus­tomer.