Two-factor authentication: Best practices and vulnerabilities for fintech

Content

1. What is two-factor authentication
2. How does two-factor authentication work?
3. The main reason why you need 2FA
4. 2FA Vulnerabilities
5. Why don’t use SMS for 2FA
6. Strong alternatives to SMS as a 2FA
   6.1. Top 8 2FA mobile applications to use in 2023

If you still think that cybersecurity is not your problem, that’s not true. Even the most well-known companies like Google, Facebook, Twitter, Uber, and U.S. Democrats have become the victims of phishing attacks that cost millions of dollars. All these cases could be prevented if reliable security protocols, robust controls, 2FA, and employee training had been implemented. 

What is two-factor authentication?

The backbone of the fintech sector is based on strong account security. Any banking organization should protect every transaction from cyber attacks to ensure the safety of its services. 

Two-factor authentication (2FA) is a security measure that requires two different forms of authentication to verify the user’s identity. This measure is commonly used in the financial technology (fintech) industry, especially when dealing with sensitive customer information. The aim is to make it more difficult for hackers to gain access to financial data and accounts. 

Fintech companies used to implement Multi-Factor Authentification (MFA) and Two-factor authentication (2FA) to protect their processes from being breached. The difference between these methods lies in a number of factors used. While MFA uses a combination of two or more authentication factors, 2FA always uses two of three. 

Two-factor authentication (2FA) is a method that uses two of three authentication factors to verify a user’s identity. A combination of these factors provides an access to a website or an application. Basically, the factors include the following: 1) something the user knows, 2) something the user has, or 3) something the user is.

When passwords don’t work

Two-factor authentication is not a new trend. It has already become a crucial part of user security because passwords can no longer provide it. Due to the rise of highly sophisticated and targeted cybercrimes over the last few years, you can find a lot of usernames and password combinations on the Dark Web for sale. Besides, human factors and trends in password combinations contribute to the vulnerability of authentication too. 

Fintech companies can no longer trust even the strongest passwords to allow their users to access their accounts and make transactions. 

What problems do users often have with their passwords?

They usually use weak passwords or repeat the same across multiple accounts. 

The average user does not perceive data security as something that could really happen to them. The false impression of being not a target for cybercriminals leads to choosing weak passwords such as “0000” or “1234”. Due to the rise of online accounts, nobody wants to remember multiple passwords for each of them. It results in so-called password fatigue when the user repeats the same password across all online accounts.

You might also be interested in:

Our custom software blog

“Omnichannel Solutions For Banks And Their Clients”

“Why Should Fintech Businesses Outsource Their Tech Needs?”

“Payment Orchestration Platform: How It Works and Why So Important”

How does two-factor authentication work

When you log into your account, you enter your username and password. This is your first authentication factor. Two-factor authentication generates time-sensitive tokens or passcodes to protect the user against identity hijacking and further sensitive data loss. 2FA uses the second authentication factor that can be different:

1. You can use One Time Password (OTP) or OTP token
2. You can get a text message on your mobile phone number with a verification code. 
3. You can use a special mobile authentication app, such as Google Authenticator.
4.  You can use hard devices like key fobs or USB.

To implement 2FA the right way, you should go through the following steps:

1. Understand the Requirements 

The first step in setting up two-factor authentication is to understand the specific requirements for your fintech company. Different companies may require different authentication methods, such as SMS two-factor authentication, biometric authentication, and out-of-band authentication. You should also check to see if the authentication system is compliant with the applicable regulations, such as the Payment Card Industry Data Security Standard (PCI DSS). 

2. Choose the Right Authentication Method 

Once you have understood the requirements, the next step is to choose the right authentication method for your fintech company. Each method has its own advantages and disadvantages, so it’s important to consider the benefits and drawbacks of each before making a decision. For example, SMS two-factor authentication has a bunch of drawbacks that we can share in the following section of the article. The security measures should be tailored to the type of transactions that will be taking place. 

3. Implement Authentication

Once the authentication process has been established, it is time to implement it. This may involve setting up a server-side application to handle the authentication process. It may also involve integrating the authentication process with existing systems, such as login portals or customer management systems. 

4. Test the System

Before the two-factor authentication system can go live, it must be tested to ensure that it is secure and accurate. This testing should include stress tests, vulnerability scans, and other tests to ensure that the system is working as intended. 

5. Monitor the System.

Once the two-factor authentication system is tested, it must be tracked, supported, and maintained. You should implement regular updates to the security system, check it for proper usage, and fix issues that can occur on time.

No matter what you choose to use as the second authentication factor, you will get a many times stronger result combined with the first username and password step. The extra step in your security makes it a far more complicated task for cybercriminals to attack you. Thus, 2FA reduces the risk of being a victim of various cyber attacks, such as identity theft, phishing, or scam. 

The main reason why you need 2FA

If you choose only one method of authentication, you will likely become unprotected under cyber attacks. No one authentication method alone is enough to protect you. No matter how strong your password is, it is an insufficient layer of security. 

Today, the principle “the more the better” fits best in data protection. 2FA makes it much harder to cybercriminals to steal sensitive information from your online accounts. 

Data breaches can bring millions of dollars to cyber criminals while you may lose your funds, credit rating, and long-term savings. To reduce the risk of being compromised by sophisticated cyber attacks, select more than one authentication method and use 2FA as a must. 

2FA Vulnerabilities

Two-factor authentication (2FA) is a security measure designed to protect user accounts from unauthorized access. While this technology can be very effective in protecting user accounts, there are still some vulnerabilities that need to be addressed. 

One of the most significant vulnerabilities associated with two-factor authentication in fintech is the potential for phishing attacks. Phishing attacks are attempts to steal personal information via email, text message, social media, or other digital communication. Attackers can use this information to gain access to sensitive accounts or to impersonate victims and commit fraud. Since two-factor authentication requires users to enter a code or use a physical token, attackers can use phishing techniques to gain access to this information and bypass the security measure. 

Another vulnerability associated with two-factor authentication is the risk of credential stuffing. Credential stuffing is a type of attack where attackers use stolen usernames and passwords from previous data breaches to gain access to accounts. Since two-factor authentication requires both a username and password, attackers can use the stolen credentials to gain access to accounts. Besides, installing malicious applications, the user makes it easier for cyber criminals to hijack 2FA. Malware can track and then steal the passcode sent to the user’s device via SMS or voice message. Most of the malware is aimed at targeting fintech applications, where sensitive data can be easily monetized. 

Why don’t use SMS for 2FA

Using phone-based SMS with a verification code as the second authentication factor is the most common practice used by fintech companies. It is still prevalent in most organizations that implement 2FA. However, a lot of pieces of evidence confirm that this method has been compromised so that it is no longer the securest authentication factor to use. 

For instance, Princeton University study defines that the reason why SMS in 2FA is no longer reliable is that the network of the cell phone providers is vulnerable to the most popular cyber crimes, such as social engineering, phishing, and spoofing. Dependency on the mobile phone and the cell phone service provider makes it easier for criminals to target personal accounts. They need only to get a phone number to know OTP that has been sent via SMS. 

Another way to compromise a smartphone is to use malware that intercepts SMS with OTP via the internet connection of the phone. That’s why the use of SMS passcodes as the second authentication factor leads to severe risks for customers.

Moreover, some reliable cyber security leaders insist that it is safer to skip 2FA at all if SMS authentication is the only possible option to protect customers. 

However, financial organizations still use SMS authentication in their 2FA policy. In this case, most cyber security specialists recommend choosing the more secure alternatives that we will describe further.

Strong alternatives to SMS as a 2FA

The second authentication factor excluding SMS may include hardware or physical device, software such as dedicated applications like Google Authenticator, IP-based authentication, GPS, and biometric data. 

1. Hardware authentication provides access to your account by using a physical device as a token. The device builds a unique temporary-based code that is used as the second authentication factor after a strong password. However, this method also has disadvantages. The main is that the users can lose their devices or they could be stolen to compromise their accounts. 
2. Software authentication means that you get a token code to access your account via mobile applications like Google Authenticator (look through the list of the best applications below). This method makes the user not dependent on the cell phone providers and their network. Look through the list of the best applications below. 
3. IP-based authentication provides access to application based on the user’s IP address. This method checks your IP address and offers login from only known IP addresses.
4. GPS authentication as an extra level of data security uses geolocation information to check if a transaction correlates with the location of the user’s mobile device. 
5. Biometric authentication uses such methods as facial recognition or fingerprints. It relates to “something the user has” authentication to validate your identity. Authentication based on unique physical traits is a powerful and accurate method to verify the end users in the financial sector.

Here is the list of top 8 mobile applications to use as the second authentication factor in 2023:

1. YubiKey
2. Lastpass
3. Google Authenticator
4. Microsoft Authenticator
5. Authy by Twilio
6. 2FA Authenticator
7. Duo Mobile
8. Aegis Authenticator

To sum up, two-factor authentication serves to protect fintech users best, although you must select the second authentication factor carefully. Focusing on the malware approach, you should include security awareness training on mobile topics for your employees, track all phishing attacks, and monitor mobile devices to make sure only actual versions are in and no malicious applications are installed.  

As a longer-term strategy, we recommend implementing workflows that do not rely only on the user in the access policy. You should try to implement a workflow strategy that analyzes various indicators, such as context, behavior, and threat signs that help make further authentication decisions. 

Check out our latest posts:

“Payment Orchestration Platform: How It Works and Why So Important”

“Apple Sign In With Keycloak: How To Setup With Ease”