Home » Identity & Access » Access Control

In Brief

The Little Balkan Bank that could do Two Factor Authentication

By the end of this year, U.S. banks will be required to have two-factor authentication on their websites to provide a more effective means of confirming their online customers' identities

By Margaret Locher

February 01, 2006 — CSO — By the end of this year, U.S. banks will be required to have two-factor authentication on their websites to provide a more effective means of confirming their online customers' identities.

If the experience of a small Central European bank is any indication, the process to implement such authentication systems could be challenging and costly. Gojmir Nabergoj is senior adviser for Banka Koper, a Slovenian bank based at the Adriatic Sea port of Koper. Banka Koper earned about $26 million in net profits in 2004. Nabergoj says his bank finished its successful implementation of two-factor authentication for online customers last summer after three months of work.

The bank started online banking with a user ID and static PIN, then introduced a PKI-based system with a smart card reader; however, not many customers used it because of its complexity. So the bank equipped its customers with card readers at no charge. The readers allow a chip card holder to access the bank's services using onetime password authentication.

Nabergoj says the bank also introduced customers to the onetime password device and authentication service in person, not by e-mail. Now, three months after deploying onetime password devices, Banka Koper has almost 16,000 users, or 82 percent of its online banking customers.

The system means that cards with a magnetic strip are no longer at risk for fraud or theft. Nabergoj says that replacing the magnetic strip cards with the chip cards "was very expensive," costing between 150,000 and 200,000 euros (about $181,000 to $242,000).

Ron Carter, director of payment solutions at identity management vendor nCipher, helped Banka Koper with its implementation. Carter says that the cost of two-factor authentication systems, including chip-cards and back-end systems, has been the main barrier to their adoption in the United States. The prevalence of chip-based smart cards in Europe makes the adoption of the systems easier there.

One aspect of Banka Koper's experience will resonate with American security executives: The most difficult part was convincing the bank's management that it was the right thing to do. It took a successful test of the technology for them to buy into the benefits of flexibility and security, Nabergoj says.