OneSpan Intelligent Adaptive Authentication

Financial institutions face escalating cybercrime and mounting regulatory pressure, with bank executives ranking cybercrime as a top concern and attacks expanding from phishing and malware to insider fraud, transaction skimming, account takeover, and new account fraud. Incidents affecting millions of consumers continue to be reported, and attackers are increasingly sophisticated, sometimes using DDoS as a smokescreen and leveraging spear-phishing and malware (botnets, rootkits, keyloggers) to seize control of accounts. Account takeovers surged sharply in 2017, producing multi-billion-dollar losses, and are frequently enabled by weak authentication practices that still persist in digital banking.

Regulatory regimes are simultaneously reshaping security requirements. Global AML and KYC obligations drive the need for stronger consumer identity controls, while GDPR governs personal data usage in the EU. New York’s 23 NYCRR 500 mandates comprehensive cybersecurity programs and requires MFA and risk-based authentication for external-to-internal access, alongside governance measures such as CISOs, testing, incident response, encryption, and rapid (72-hour) reporting. In Europe, PSD2 and its RTS deadlines require Strong Customer Authentication (two of three factors) while enabling exceptions through transactional risk analysis, and introduce Third-Party Providers (AISPs and PISPs) that compel banks to expose and secure APIs—expanding competition beyond traditional banking.

Given password and KBA weaknesses, the paper argues for modern MFA and risk-adaptive authentication with behavioral analytics, mobile-first authenticators, and phishing-resistant FIDO approaches. It highlights OneSpan Intelligent Adaptive Authentication as a cloud service (with on-prem alternatives) combining diverse MFA methods, device/application protections, and machine-learning-driven risk scoring across many contextual factors, enabling step-up authentication when policy thresholds are exceeded. The recommended path is to begin with an IAM maturity assessment, identify architectural gaps, and modernize authentication and risk analytics to meet NYCRR/PSD2 while reducing fraud and customer friction.

• 84% of bank executives reported cybercrime as their top concern in 2018.
• 134 incidents against financial sector companies were reported in the US in 2017, and 84 were reported in the first half of 2018.
• Europol’s Joint Cybercrime Action Taskforce arrested 20 cybercriminals in 2018 who made €1 million by harvesting credentials through phishing emails.
• Cybercrime cost roughly $3 trillion in 2015 and is expected to reach $6 trillion annually by 2021.
• Global spending to combat cybercrime is projected to be nearly $200 billion per year over the next five years.
• Account takeovers tripled in 2017, with associated losses approaching $5.1 billion.
• The 2018 Verizon DBIR states that 63% of data breaches started with weak, compromised, or stolen passwords.
• NYCRR 500 requires covered entities to notify the state superintendent within 72 hours of cybersecurity events.
• PSD2 took effect in January 2018, with RTS testing components due March 14, 2019 and implementation due September 14, 2019.
• OneSpan’s risk engine evaluates up to 150 different factors per digital channel during transactional risk analysis.

• “Cybercrime is a leading cause of loss in the financial industry and this is the biggest concern for bank executives.”
• “Only requiring a username/password for access to online or mobile banking systems is grossly insufficient for account security.”
• “Passwords and KBA are insecure and are not recommended for financial apps”
• “New financial regulations will drive security enhancements”
• “Risk-based authentication for higher identity assurance is fundamental to reducing risk of fraud and data loss in the financial sector.”
• “Biometrics, in general, improve usability, but also have problems”
• “OneSpan provides high-security mobile authentication mechanisms”
• “Advanced risk engines capable of processing real-time fraud and threat intelligence will be essential for reducing risk”
• “NYCRR sketches out some high-level objectives for cybersecurity programs without ‘being overly prescriptive’.”
• “NYCRR and PSD2 represent a major step forward in payment security and processing.”