Thanks to home PCs, the Web and broadband, banks have been given the chance to revolutionise their business model. Rather than employ an army of well turned-out staff in branch offices across the land, banks now encourage their customers to visit them online.
Online transactions cost a tiny fraction of those conducted over a counter, or even on the telephone, and have undoubtedly helped raise profits. But the smell of the money has attracted a new generation of criminals in the shape of phishers who try to trick the unwary into handing over their personal details, or fool them with fake sites. This technique, called pharming, is particularly devious because users don’t even need to click on an email link to get to the fraudulent site.
Savvy users already know that clicking on a URL in an email does not necessarily take them where they think they are going. But most people have a comfortable level of trust in the fact that if they type a URL in themselves, they know where they will end up.
The solution is for the banks — and major e-commerce sites too — to stop relying just on passwords. No longer is it enough for banks to verify their users online; they need to start now providing a mechanism by which users can verify the banks online.
In the UK, Citibank is tackling keystroke loggers by making users use an onscreen keyboard, but it still does not prove to a user that what lies behind that onscreen keyboard really is Citibank.
Latest figures show that online fraud cost the UK banking sector £12m last year — which should concentrate a few minds.
http://comment.zdnet.co.uk/0,39020505,39190646,00.htm