FFIEC urges stronger security for Internet banking

New guidance issued by the Federal Financial Institutions Examination Council (FFIEC) in the form of a report urges financial-services institutions to move beyond use of user name and password to authenticate the identity of online banking customers.

FFIEC said it issued its guidance, Authentication

The continued growth of Internet banking and other forms of electronic financial activities, including the advent of eMortgage processing, and the increased sophistication of security threats have resulted in higher risks for financial institutions and customers alike.

An effective authentication system, as well as a risk assessment, is necessary in order to ensure financial institutions' ability to secure sensitive information, noted FFIEC.

"Where risk assessments indicate that the use of singlefactor authentication is inadequate, financial institutions should implement multifactor authentication, layered security or other controls reasonably calculated to mitigate those risks," the report said. "The agencies consider singlefactor authentication as the only control mechanism to be inadequate in the case of high-risk transactions involving access to customer information or movement of funds to other parties."

The guidance, which replaces FFIEC's Authentication in an Electronic Banking Environment, issued in 2001, does not endorse any particular technology.