Account Authentication & Online Banking

Multi-factor authentication and layered security are helping assure safe Internet transactions for banks and their customers.

---

Important Facts

If you use online or mobile banking, it is important to understand how authentication and layered security help protect your accounts. Banks use security measures designed to help make sure that the person signing into your account is actually you.

Understanding the Factors

Online security begins with the authentication process, which is used to confirm that it is you and not someone who has stolen your identity. Authentication generally involves one or more basic factors:

• Something the user knows — such as a password or PIN.
• Something the user has — such as an ATM card or security device.
• Something the user is — such as a biometric characteristic, including a fingerprint.

Single-factor authentication uses one of these methods. Multi-factor authentication uses more than one and is considered a stronger deterrent against fraud. When you use an ATM, for example, you are utilizing multi-factor authentication: your ATM card is something you have, while your PIN is something you know.

To help assure your continued security online, your bank may use both single- and multi-factor authentication, as well as additional layered security measures when appropriate.

Layered Security for Increased Safety

Layered security uses different controls at different points in a transaction process so that a weakness in one control can be compensated for by the strength of another control.

For example, you may follow one process to log in using your username and password and then provide additional information to authorize certain transactions or funds transfers.

Layered security can strengthen the overall security of online transactions by helping protect sensitive customer information, prevent identity theft, and reduce account takeovers and resulting financial losses.

These layers allow a bank to authenticate customers, detect suspicious activity, and respond appropriately when transactions involve the transfer of funds to other parties.

Internal Assessments at Your Bank

Banks can look for unusual activity that could indicate fraud. The goal is to ensure that the level of authentication required for a transaction is appropriate to the transaction's level of risk.

Risk assessments may consider:

• Changes in the internal and external threat environment.
• Changes in the customer base adopting electronic banking.
• Changes in the functionality offered through electronic banking.
• Actual incidents of security breaches, identity theft, or fraud experienced by the institution or the financial industry.

When increased risk might warrant additional protection, a bank may use additional verification procedures or layers of control, such as:

• Callback or voice verification, email approval, or mobile-phone-based identification.
• Customer verification procedures, especially when opening accounts online.
• Transaction analysis to identify suspicious patterns or unusual activity.
• Dollar limits that require manual intervention when a preset limit is exceeded.

Your Protections Under Regulation E

Banks follow federal rules governing electronic transactions. Known as Regulation E, these rules cover many situations involving electronic transfers.

Your protections can depend on how quickly you detect and report unauthorized activity. Federal rules have specific requirements regarding consumer liability, and state law or individual bank policies may provide additional protections.

If you notice unauthorized or suspicious activity, contact your bank as soon as possible and ask how Regulation E and the bank's policies apply to your particular situation.

Customer Vigilance: The First Line of Defense

Understanding the risks and knowing how fraudsters may try to trick you is an important step in protecting yourself online.

Help make your computer safer by installing and regularly updating:

• Anti-virus software.
• Anti-malware programs.
• A firewall on your computer.
• Operating system patches and updates.

You can also learn more about online safety and security at:

• Federal Trade Commission - www.ftc.gov
• USA.gov - www.usa.gov

If You Have Suspicions

If you notice suspicious activity within your account or experience a security-related event, such as a phishing email appearing to come from your bank, contact the bank at (361) 527-3221.