Authentication in an Internet Banking Environment
October 12, 2005
The Federal Financial Institutions Examination Council (FFIEC) has issued the attached guidance, “Authentication in an Internet Banking Environment.” For banks offering Internet-based financial services, the guidance describes enhanced authentication methods that regulators expect banks to use when authenticating the identity of customers using the on-line products and services. Examiners will review this area to determine a financial institution’s progress in complying with this guidance during upcoming examinations. Financial Institutions will be expected to achieve compliance with the guidance no later than year-end 2006.
Financial institutions offering Internet-based products and services should use effective methods to authenticate the identity of customers using those products and services.
Single-factor authentication methodologies may not provide sufficient protection for Internet-based financial services.
The FFIEC agencies consider single-factor authentication, when used as the only control mechanism, to be inadequate for high-risk transactions involving access to customer information or the movement of funds to other parties.
Risk assessments should provide the basis for determining an effective authentication strategy according to the risks associated with the various products and services available to on-line customers.
Customer awareness and education should continue to be emphasized because they are effective deterrents to the on-line theft of assets and sensitive information.
FDIC-Supervised Banks (Commercial and Savings)
Chief Executive Officer
Chief Information Security Officer
FIL-66-2005, Guidance on Mitigating Risks From Spyware, issued July 22, 2005
FIL-64-2005, Guidance on How Financial Institutions Can Protect Against Pharming Attacks, issued July 18, 2005
FIL-27-2004, Guidance on Safeguarding Customers Against E-Mail and Internet Related Fraud, issued March 12, 2004
FFIEC Information Security Handbook, issued November 2003
Interagency Informational Brochure on Phishing Scams, contained in FIL-113-2004, issued September 13, 2004
Putting an End to Account- Hijacking Identity Theft, FDIC Study, issued December 14, 2004
FDIC Identity Theft Study Supplement on Account-Highjacking Identity Theft, issued June 17, 2005