Bank Leumi introduces biometric password re-sets for online banking

An interesting story about Bank Leumi on Finextra just before Christmas.

It seems that Bank Leumi will be using voice biometrics for password re-sets for online banking. There are a couple of interesting things about this.

The first is that password re-sets are an absolute pain for helpdesks and similar types of contact centre. Depending on whether this is an internal helpdesk for an organisation or an external facing one, password re-sets can be anything from 50%-70% of the call traffic. The two follow on problems from this call volume are that password re-set is an expensive thing for IT technicians to be spending most of their time on and that they represent a significant potential security risk.

It is this security risk that is the other area of interest. Passwords authenticate you based on what you know, not who you are. Re-setting a password changes that, as it potentially makes the password available to an identity thief. The blog has covered a number of examples of identity theft (this theft from Barclays in 2008 using the identity of Barclays own chairman being a particular case in point) and the vulnerability is obvious.

In theory, biometrics removes some of this risk as it is focused on who you are and not on what you know. In practice things are not so straight forward and this is partly why biometic adoption has been more limited than might be expected. For more detail on the limitations, here's been some good posts on Finextra see "Biometrics - what's that all about then?" by Dave Griffiths and "Who's in your Wallet?" by Jarvis Kandik from 2008.

In Europe I've tended to see biometric deployments mostly for internal password re-sets. A good example that I know of is AIB and VoiceVault who have piloted password resets for staff. The key thing here is that the staff are in a controlled, secure environment and so the biometrics is effectively only one part of a multi-factor and multi-layer authentication.

This is what makes the Bank Leumi example so interesting. I haven't before seen biometrics used directly for consumer authentication for something as sensitive as banking.

I have seen quite widespread use of biometrics outside of Europe and the US and especially for areas like welfare benefits. I got a fair amount of comment to my blog post "BBC Moneybox on Speech Recognition for banking " back in February with examples of biometrics in use from the Philippines (interstingly using PerSay, as does Bank Leumi).



Depending on how the Bank Leumi deployment foes, I may need to revise my last post on the subject "Where are Speech Biometrics in Europe?..... and the Your Call Blog "....!

Man in the middle fraud in call centres

Never one to post only on up to the minute stories, the blog was quite interested in the Finextra report a fortnight ago on "man in the middle" fraud in call centres. I just haven't had a chance to write on it until now.

Traditionally, man in the middle fraud has been more associated more with the web channel than the telephone channel (see for example "Man-in-the-middle phishing kits circulating freely on the Web" or "ABN Amro compensates victims of 'man-in-the-middle' phishing attack" from Finextra), so it's interesting to see the attack take place in the telephone channel. It's also interesting that the attack described in Finextra is very low tech compared with the programing knowledge required for the phisihing attacks. The telephone version of man in the middle is described as,

"....where a fraudster calls the victim claiming to work for their bank, warning that their account may have been breached or compromised. The criminal then puts the customer on hold and calls their bank, connecting the two while remaining on the line.

The bank then requests authentication information, such as social security number, passwords and other personal information. Once the personal information is provided, the fraudster quickly ends the conference line and informs the customer that the issue has been resolved.

Meanwhile, with the personal information gathered during the call, the fraudster can take over the customer's phone banking relationship and transfer money out of their accounts."

The interesting thing for me is that for this type of attack to be successful, it highlights how weak the process side of some banks can be. This attack depends on the banks authentication process revealing (a) all of the customer's authentication data each time and (b) not ensuring that customers have multiple levels of authentication. Most banks I've worked with probably wouldn't be caught by this kind of fraud, so I'm interested to see that there are banks out there that still lag so far behind.

It's far less sophisticated than some of the the attack I've seen recently, where fraudsters have built fake IVRs to pretend to be the bank and used VoIP diversion to fool customers into thinking they are calling a local number (see posts like "Contact Centre impersonation arrives in the UK") and probably far less likely to succeed. Similarly, targeted social engineering attacks are also more likely to succeed as these tend to rely on bypassing security procedures rather than attacking them head on.

I would argue that deception based attacks around identity impersonation (such as the one on Barclays discussed in the post "Security, Call Centres and Fraud") seems to be where the real threat remains, but I'm not so sure that the man in the middle approach is where the real threat lies. My suspicion is that combinations of phishing and contact centre impersonation will remain the fastest growing threat for some years to come.

Contact Centre impersonation arrives in the UK

I wrote yesterday on the problems the Commonwealth Bank of Australia was having with a phishing attack that caused customers to call a fake contact centre that impersonated the bank's centre and captured their credit card details ("Phishing fraud steps up a new level with fake bank IVR & contact centre").

It now seems that this fraud has reached the UK. The BBC is reporting here that the Bank of Scotland has been targeted by fraudsters who have been able to divert customer calls. There's few details in the BBC report other than that the calls were diverted and that there is a theory that a former contact centre employee may be involved. An inside job does seem a strong possibility, and the infiltration of call centres by organised crime is a real risk. Although it wasn't widely covered, the BBC reported back in 2006 that Strathclyde Police believed that perhaps one in ten call centres had been targeted by organised criminals (article here). Normally, though, crime in contact centres has been opportunistic and carried out by individuals. A typical example was when the Barclays Chairman, Marcus Agius, had his details and money stolen by one of his own employees (covered on the blog in the post "Security, Call Centres and Fraud").

It is a worrying development if organised crime has, well, got itself more organised, and moved up from individuals stealing details to systematic attacks from the inside on the banks' contact centre systems.

Phishing fraud steps up a new level with fake bank IVR & contact centre

I normally focus the blog on Europe, but this story from Australia shows a very alarming new level of fraud. In this case fraudsters have targeted Commonwealth Bank of Australia customers with a fake IVR and call centre.

The story ( fully available at APCmag.com here ) is very worrying. It shows that fraudsters are graduating from e-mail phishing to a far more advanced form of fraud. While the e-mail is still the basic trigger for the fraud, a sophisticated use of VoIP (Voice over IP) and IVR systems is a new development. While most consumers are now knowledgeable enough of the risks of fraud to avoid clicking on e-mail links, phone numbers are much more trusted. This fraud relies on customers trusting local dial codes and the familiarity with entering information into the touchtone IVR system. APCmag describes the fraud as:

"An email sent out on 26th May included a phone number in Brisbane to call to unsuspend blocked Maestro cards, but as of today, the number is disconnected. However, another email received this morning has an 08 area code number that is still in operation. According to ACMA, the number is a GoTalk VoIP number, which anyone could have registered over the web using stolen credit card details. (We've tried contacting GoTalk to notify them of this problem but were not able to immediately reach our regular media contacts.)

We called it, and were alarmed that the computer on the other end recognised the fact that we were keying in bogus numbers — an indication that at a bare minimum, it is doing algorithmic validation of the numbers being entered, and in a worst case scenario is operating a live payment gateway system to immediately siphon funds from accounts."

At the moment, most consumers would see a local phone number and trust that to mean that their call was really going there. Few would understand the potential of Voice over IP to route the call anywhere in the world. Fewer consumers still would understand that an IVR system that answered a phone call and asked for identity verification and card details might not be what it seems.

Like most frauds, this is a clever exploitation of some basic technology, but an exploitation in a brand new way. It may be a one off, but I suspect it may represent a new development as the fight against e-mail based phishing becomes more successful. To date, security in call centre has been focused on internal threats and social engineering attacks (see my posts like "Security, Call Centres and Fraud" and "Call centre worker gaoled for data theft"), but no-one has yet impersonated a contact centre on this scale before.

In my view, it looks as if the ease with which IP protocol allowed websites to be impersonate will become a danger for voice.

FSA (finally) determines offshore call centres a risk

I seem to hear the sound of a stable door being shut, and long after the horse has bolted.

The FSA seems finally to have realised that offshore call centres can constitute a risk in financial services. This is not to say all centres, but that offshore centres managed and compliant only to local standards may not protect consumer data that well. Indeed they may be in countries where the law does not recognise most cyber crime or where it is unenforceable.

This isn't news to anyone in the industry, but the FSA has been remarkably relaxed about this until now. It has amazed me that if the data was in the UK it had to be managed securely and comply with what the EU demands, but if the same institution took the data offshore, then the FSA took little interest.

It's perhaps best quote the report in the Financial Times, as it sets out all the issues very well:

"The FSA found that all firms it visited had a high staff turnover rate and a need for constant recruitment, which was seen as a key financial crime risk given the continuing infiltration of financial services firms by organised criminals seeking to obtain sensitive customer data.

In a number of firms the FSA also found that staff vetting procedures were "inconsistent" and did not apply to all staff, which increased the risk that firms may inadvertently take on a person with a criminal background.
The FSA also found that some employees had provided the financial services call centres with false CVs.
The regulator said: "We were informed that fake CVs, inconsistent references and previous employers being reluctant to provide references were common in India."

On top of this, the FSA also said staff training was "generally poor" and urged firms to do more to ensure staff are equipped to identify and report potential financial crime risks.

An FSA spokeswoman said the review was aimed at helping firms understand how having an offshore centre affects firms responsibilities. She added: "Whatever security processes or compliance measures you apply to your business in UK, firm must makes sure those standards are also being applied to the business elsewhere.""

The thing that amazes me is it has taken so long to get to this position. This blog has covered some of the failings in onshore contact centres (see "Call centre worker gaoled for data theft" or "Security, Call Centres and Fraud", for example) and the BBC has highlighted a number of examples in the offshore area (see "Indian Call Centre Fraud and the BBC News"). It's been an area of huge consumer concern and one of the focal points of the opposition to offshoring.

I still believe offshoring has a role to play but it has to be done in a way that complies with UK security standards and where the threat is no greater than onshore. It is no use getting customers to check a waiver box agreeing to their data being handled outside of the EU and thinking that is an end to the matter.

This also highlights one of the great fallacies in offshoring, that it is just a cheaper way of delivering a call centre with the value proposition of "your mess for less". I've long argued that offshoring for cost reasons only is a mistake (see "The comming death of Indian Outsourcing" or "Onshore, Offshore & Internet Resilliency" for examples) and that offshoring for cost has significant risks in areas outside of security such as brand perception and customer experience..

Longer term, I think offshoring still has great potential for businesses who want to provide 24hr customer service through a follow the sun model, but this story is another nail in the coffin for those who see outsourcing as a cost saving.

Indian Call Centre Fraud and the BBC News

The BBC was very excited about its story "Overseas credit card scam exposed " that it ran on the Thursday night news bulletin.

While they did make some good points, they played too much for my liking on the fear around offshoring. the BBC were correct to highlight that India has no equivalent of the UK Data Protection Act and that consumers dealing with an overseas call centre need to appreciate UK legislation may not apply to their data.

The problem is that the main thrust of the report was on what appears to be the theft of data (ironically enough) from the call centre of the security firm Symantec. Data theft is an extensive problem, but it's not one that just happens in India. Only last week, CCF (the UK contact centre news site) was reporting that a British Airways call centre employee had been jailed for two and a half years for data theft. Similarly CCF also reported at the start of March that a Barclays call centre worker had been jailed for obtaining money by deception.

This isn't just a recent phenomenon - this blog has written on thefts at RBS and Barclays by call centre staff (see posts "Call centre worker gaoled for data theft" and "Security, Call Centres and Fraud "). In short theft by employees is a problem in call centres, as it is in many other businesses, but it's not just an Indian problem.

BBC Moneybox on Speech Recognition for banking

I appreciate the BBC Radio's weekly personal finance program 'Moneybox' may not be something that all of my blog readers are aware of, but this week it's been looking at speech recognition and biometrics as a way of authenticating customers.

The article on their website is here and the podcast/recording is here. The reason for the interest is that two of the big UK banks say they are following developments closely and that a major Australian insurer is running the authentication in production. The story is being pushed strongly the vendor concerned, VeCommerce.

I have to feel a little bit of cynicism here. Speech recognition (and it's close cousin, speech biometrics) have been 'the next big thing' more often than I can count. It's not that this isn't good technology (VeCommerce are impressive, as are VoiceVault and a number of others), but adoption has been slow. Part of this, I feel, is that there is a big gap between what the makers of the technology are interested in and what the users/buyers seem to want. This was highlighted in the last Cisco/Dimension Data Speech survey (see here for my blog post on it). The industry tends to talk very technically, while the buyers are much more interested in customer experience. I suspect until this gap narrows, speech biometrics will remain a nice, niche technology having a vigorous debate about how successful it is as an anti-fraud measure.

Fraud in call centres is a big problem (see past posts like "Security, Call Centres and Fraud " from January last year and "Abbey National - did an IVR survey lead to a customer getting locked out their account? "), but I think speech biometrics needs to be much closer to the customer experience before it becomes more widely used.

Phone Banking vs Facebook banking

I was very interested to see two good stories on Finextra today.

The first was that around half of Facebook users want to be able to bank through Facebook. The second was that 91% of British adults had concerns about fraud on their phone accessible bank accounts.

It seems to me a pretty bizarre set of contradictions. Facebook is a very nice application, but I'm pretty dubious that banking through it is a good idea. There are issues over some of the Financial Services advertising (see the BBC "Facebook users warned about ads") and I'm not convinced that data privacy issues are fully resolved, or in line with the standards set by banks (again the BBC with "Facebook 'violates privacy laws'" and "Facebook faces privacy questions"). It may be that as Facebook matures these issues will be resolved to everyone's satisfaction, but I know many remain dubious about entrusting their details to an organisation that has already had to apologise for how it has used them.

By contrast voice technology is far more mature and security concerns should be on a different level. There are weaknesses but they are more to do with processes than the underlying technology. A good example was the case I covered at Barclays (see "Security, Call Centres and Fraud") where there was nothing wrong with the technology, but the processes were not as robust as needed to be against identity theft. At this point (although the research is funded by Nuance a speech technology vendor) I'm inclined to agree with the article that speech recognition and biometrics could make a difference where pass words have been stolen or an identity otherwise compromised. Certainly it had the potential to make a difference in the Barclays case.

The scary thing about Facebook is that if a Facebook banking application were to be compromised, the chances are that the fraudsters would have access to so much personal information that any future identity recovery could be very difficult. By contrast the telephone channel at least offers the prospect that even if your identity was stolen you would only be authenticated by who you are, not what you know.

Call centre worker gaoled for data theft

An interesting article on Finextra about the recent theft at a Royal Bank of Scotland call centre.

This isn't the first, and certainly won't be the last, example of security breaches from staff. There's been a lot of recent focus on the risks of external attack and how biometrics can help deal with this but the internal threat has been neglected. I've posted on the external attack on Barclays ("Security, Call Centres and Fraud"), when fraudsters stole the identity of their chairman for a credit card application, and there's been some good posts on Finextra (see "Biometrics - what's that all about then?" by Dave Griffiths and "Who's in your Wallet?" by Jarvis Kandik both last month).

In fact, inside threats are perhaps as serious as the risk of external attack. In 2006 HSBC lost £233,000 after it's Indian call centre suffered inside attack (here for the BBC report). Last year the BBC also reported how HSBC and HBoS had been targeted by an organised gang which both penetrated the banks and laundered the proceeds of their crimes.

An internal threat is nothing new - fraud from dishonest employees is something that banks have had to deal with almost from the start of banking. What is new is the level of the threat and its organisation. As an example, Strathclyde Police (who cover the west of Scotland where many call centres are located) believe that organised gangs have infiltrated perhaps one in ten of the call centres there (full report here).

In the end, as I've argued with biometrics, the criminals will be beaten by process, not technology point solutions. If the defences against external attack are strong, then criminals will seek to get on the inside. The correct response is not to strengthen the exterior with biometrics (though I'm not sure biometrics do strengthen it), but instead to make sure that staff are vetted, exceptions or unusual activity is identified and monitored and good management is in place.

Process is not terribly exciting, but it will be the element that determines whether technology defeats criminals or not.

Security, Call Centres and Fraud

Fraud, especially around identity theft, is one of the hot topics in the UK at the moment.

Obviously, the UK government department HM Revenue & Customs losing the data of 25 million people has made it a more commonly discussed topic than it was before. Then this week, anyone in the UK who still didn't think loss of personal data was serious now has the example of Jeremy Clarkson to consider. Clarkson (a television show host & newspaper columnist) was so sure that the impact of lost data was over-exaggerated that he published his bank account number and bank sort code in his weekly national newspaper column, claiming that there was nothing to fear. As is now reported, he did have something to worry about. One of the readers of his column used his details to set up a monthly £500 direct debit from his account, as the charity the British Diabetic association is one of the many organisations that does not require a signature when setting up a direct debit.

All of which is jolly good knockabout fun, but risks obscuring a more interesting and more serious story (and one more relevant to the European Contact Centre blog).

Also this week, in a less reported story, an identity fraudster managed to persuade Barclays call centre to issue a credit card to an existing customer called Marcus Agius. This identity fraudster then used the credit card to withdraw £10,000 pounds from a Barclays branch. The more startling point of this is that Marcus Agius is not any customer of Barclays but is the chairman of the bank and has been on the board since September 2006.

I'm not surprised that a call centre agent didn't recognise the chairman by name (though alarm bells should perhaps have rung when he found at the employer during the application process!), as new or junior staff may not be very interested in executives at that level. The two things that do stand out for me in the Barclays case are that firstly the card could be applied for and sent out to an address that was (at best) open to interception and (at worst) totally different from that used normally by an existing customer of the bank. The second is that security measures like passwords failed completely to verify the applicant.

Now you may assume that in a call centre environment verification will always be a problem when a physical signature can't be presented and you can't see the face of the applicant. This is not the case.

I've written previously about Natural Language and Automated Speech Recognition (for example "Speech market share - the role of non-European languages"), and identity verification by voice is a natural extension of this technology. The problem with passwords is that they verify what you know, not who you are. Should what you know not be only known to you, then that knowledge ceases to become verification as to who you are.

Voice prints, or similar techniques of deriving a unique identifier from a voice, offer a much better way of verifying identity. I've mostly had experience with IBM and Nuance in this field but lately I've been very taken with the approach of VoiceVault. VoiceVault do seem to have taken a purer security approach to the problem of voice verification and I rather like that. There do seem to be significant variations in how each vendor approaches the verification problem and so far (though this is early days), I've been very interested in how the different approaches produce results. All of these potentially work with voice portal technology (though I'm primarily interested in applying them with CVP, the Cisco Voice Portal).

The big advantage of voice portals is that they provide an environment where applications can be combined and hence you can have layers of security. So for example, it's unlikely that speaker verification alone would be adopted, even if it could achieve 99%+ rates of verification. Instead, a combination of password, speaker verification and other measures could be deployed relatively easily in a portal environment to provide layers of security. That way even if one security measure is defeated others are likely still to work.

Would speaker verification alone have been enough to prevent the Barclays situation? I doubt that it would have prevented the situation by itself, but it could have highlighted the anomaly of the situation to the agent, and could have triggered further security checks and processes. In the end good processes will provide the security, what technology can do is enhance them and make it harder for them to be defeated.