FFIEC Supplement to Authentication in an Internet Banking Environment

• In 2005, the FFIEC issued guidance entitled Authentication in an Internet Banking Environment.
• This FFIEC guidance supplements the FDIC's supervisory expectations regarding customer authentication, layered security, and other controls in an increasingly hostile online environment.
• The FDIC expects institutions to upgrade their controls for high-risk online transactions through:
  • Yearly risk assessments;
  • For consumer accounts, layered security controls;
  • For business accounts, layered security controls consistent with the increased level of risk posed by business accounts; and
  • More active consumer awareness and education efforts.
• Layered security controls should include processes to detect and respond to suspicious or anomalous activity and, for business accounts, administrative controls.
• Certain types of device identification and challenge questions should no longer be considered effective controls.

Suggested Distribution:
FDIC-Supervised Banks (Commercial and Savings)

Suggested Routing:
Chief Executive Officer
Chief Information Security Officer

• FIL-103-2005 , Authentication in an Internet Banking Environment, October 12, 2005

Note:
FDIC Financial Institution Letters (FILs) may be accessed from the FDIC's Web site at www.fdic.gov/news/financial-institution-letters/2010/index.html .

To receive FILs electronically, please visit http://www.fdic.gov/about/subscriptions/fil.html .

Paper copies of FDIC Financial Institution Letters may be obtained through the FDIC's Public Information Center, 3501 Fairfax Drive, E-1002, Arlington, VA 22226 (1-877-275-3342 or 703-562-2200).