Online transactions, including financial transactions and other confidential transactions, have long been employed to allow two parties to conduct business. In a typical online transaction, the user (such as, for example, a bank customer) uses a client browser on a computer to established a session with an application server (such as, for example, the banking server that is operated by the bank) and accomplishes the desired transaction (such as, for example, transferring money from one account to another account). Since online transactions are often conducted via the Internet, which is a global public network of routers, servers, trunks, etc., security is always a paramount concern.
Risks to online transaction security include risks that an unauthorized third party may be able to obtain the authentication information (such as userid and password) and may be able to subsequently conduct fraudulent transactions to the detriment of the user. For example, if only a userid and password are required to log into a bank from any computer, a third party with access the user's userid and password would be able to log in from anywhere and perform any transaction that the user is able to perform, including for example transferring money to an account under control by the unauthorized third party.
The stealing of userid and password may be accomplished by techniques such as Trojans (generically referring to client-resident applications that snoop the userid and password as they are typed in by the user and relay the userid and password to the fraudster). Another technique involves phishing. In an example phishing scenario, the user may receive an email with a message requesting the user to log into a website purported to belong to a merchant with whom the user has previously done business (e.g., XYZ Bank). The email contains a link to be activated by the user. If the user activates the link that is provided with the phishing email, the user is presented with a website that has a substantially identical look-and-feel to that of the real website (e.g., XYZ Bank). However, this website actually belongs to the fraudster. Information entered by the user into the fraudster's website, which mimics the look-and-feel of the real website, would be recorded and used to subsequently perpetrate fraud on the user. By way of example, the fraudster may employ the entered userid and password to log into the account of the user and perform an unauthorized transfer of money.
One method of combating frauds such as Trojans or phishing involves using second factor authentication, wherein additional information is required for authentication. With the userid/password acting as the First authenticating factor, the application server (e.g., the bank application), also requires additional authentication based on hardware that is possessed by the device being used for access or by the user. For example, a hardware token or ATM card may be required for the second factor authentication. Software may also be used as the second factor authentication.
The aforementioned touches only on some broad categories of online transaction risks. There are other risks currently existing and they are well known and will not be belabored here. Further, techniques are continually developed to combat online fraud. In response, the fraudsters continually develop techniques to defeat the newly implemented security measures, including authentication schemes.
In view of the transaction risks that are currently existing and/or that are being developed in response to security measures, improved authentication techniques are desired.