Banks making 'token' gesture at security

More and more banks are moving their customers to two-factor authentication and experts claim it is only a matter of time before all banks make the switch.

Recently LloydsTSB announced its move to two-factor token-based authentication and today identity management firm RSA announced its own deals with two large banks - Unicredit Banca of Italy and the National Bank of Abu Dhabi.

Art Coviello, CEO of RSA, told silicon.com he believes deals such as these will make customers of other banks start to look at how their own bank authenticates identities in the wake of increased concerns about identity theft.

He said: "People will vote with their feet. They may not change their bank but they may not bank online anymore.

"Banks who aren't doing this will be forced to change."

Steve Wylie, EMEA managing partner in Accenture's security practice, who works with a number of large banks, said it will be customer power which drives a move to stronger authentication once they start hearing about those banks already making the switch.

"Banks will start to realise that customers value this and are increasingly aware of security," he said. "Public awareness drives a lot."

A mix of needing to keep up with their competition and a need to be seen to do right by their customers means the banking industry is likely to reach a tipping point with the rollout of two-factor authentication sometime in the next 18 months, said Wylie.

Speaking on a panel at RSA Conference Europe, Martha Bennett, research director at Forrester, said: "Our research shows there is a correlation between the adoption of online banking and the deployment of two-factor authentication."

"Consumers strongly believe their banks should put the necessary measures in place and do more to protect accounts," added Bennett.

RSA's Coviello added that the changing onus of liability has forced the banks' hands to a degree.

"Until now the banks have been willing to cover the fraud," he said, adding that now they should be looking at the cost of implementing strong authentication and weighing it up against the cost of reimbursing fraud victims.