September 20, 2018
The Authentication Challenge
Online consumer behavior is less predictable, less homogenous, and more complex than ever before. The growth and diversification of the global digital economy offers ever-more opportunities for consumers to integrate digital transactions into their everyday lives, from online shopping and mobile banking to instant global remittance and crowd-sourced loans.
In this evolving digital landscape, how can businesses genuinely authenticate their customer base without introducing unnecessary friction? At the same time, varied regulatory requirements are mandating Strong Customer Authentication (SCA) for some transactions, forcing businesses to integrate new authentication processes in order to comply.
Example: Open Banking Scenario
Simplify the authentication flow: rather than re-directing the user
to their bank for a payment authentication, incorporate a push notification that uses the device biometrics for a secure, frictionless online experience.
ThreatMetrix Smart Authentication with End-to-End Decision Management
ThreatMetrix combines market-leading risk-based authentication (RBA), leveraging crowdsourced intelligence from the Digital Identity Network, with integrated SCA for optimized authentication management. This approach offers the flexibility to balance customer experience with optimized fraud control, providing industry best-practice templates and configuration-driven flexibility for step-up authentication, identity verification, geo-fencing, A/B testing and third-party integrations.
A Holistic Authentication Solution
Risk-based Authentication allows most transactions to be passively authenticated in real time by comparing event data to Digital Identity Intelligence held in the Network. This crowdsourced, global repository combines:
- Web and Mobile Device Intelligence: Device identification, detection of device compromises across web and mobile, device health and application integrity.
- True Location and Behavior Analysis: Detection of location cloaking or IP spoofing, proxies, VPNs and the TOR browser. Detection of changes in behavior patterns, such as unusual transaction volumes, changes to velocity or frequency of transactions or new use of remote access software.
- Identity and Link Analysis: Defining patterns of trusted user behavior by combining identity and transactional metadata with device identifiers, connection and location characteristics.
- Bot and Malware Threat Intelligence: Actionable threat detection for Malware, Remote Access Trojans (RATs), automated bot attacks, session hijacking and phished accounts, combined with global threat information such as known fraudsters and botnet participation.
ThreatMetrix behavioral analytics and machine learning capabilities leverage this global intelligence to better model complex user behavior, dramatically reducing false positives and customer friction throughout the customer journey.
Example: Credential Update
For high-risk events such as credential updates, use Carrier ID services to ensure that the request was made by the legitimate user and their registered device, without disrupting the user experience.
Secure Customer Authentication can then be deployed for high-risk transactions or those that require additional authentication as a result of regulatory requirements (such as PSD2). In this case, the customer’s mobile device becomes the authenticator and the ThreatMetrix Mobile SDK becomes the enabler. Key features include:
- Mobile App Security: ThreatMetrix Mobile SDK is a lightweight software development kit (SDK) for Google Android and Apple iOS mobile devices, providing complete fraud protection for the mobile channel. This includes: application integrity evaluation, advanced persistent device identification, malware detection, location services, jailbreak and root detection technologies, anomaly and device spoofing detection and dynamic configuration and updates.
- Device Binding: Leveraging the trust of existing devices using the following key capabilities:
- Strong Device ID: A unique tamper resistant identifier that cryptographically binds a specific device to a user’s identity, leveraging PKI capabilities.
- Carrier ID: Verifies SIM cards with the carrier network to confirm a user’s identity in the form of a one-time cryptographic challenge response that is secure, private and friction-free.
- Multifactor Authentication (MFA) Secure Notification: Push notifications to the user’s mobile device for low-friction authentication without the associated costs of SMS step-ups, available via ThreatMetrix SDK.
- Biometrics: A comprehensive range of FIDO-compliant, low friction, password-free authentication strategies.
Example: Authenticating High-risk Events Using Location Services
Use app location services to verify a point-of-sale transaction that comes from a high-risk location. This reduces unnecessary intervention for high-frequency travelers.
The ThreatMetrix Advantage
- An Unparalleled Network: The ThreatMetrix Digital Identity Network protects 1.4 billion unique online accounts using intelligence harnessed from 2 billion monthly transactions.
- Rising Recognition Rates: Over 90% of returning users are recognized without friction.
- An Integrated Approach to Authentication: Flexibly incorporate real-time event and session data, third-party signals and global intelligence into a single Authentication Decision Platform to deliver a consistent and low-friction experience with reduced challenge rates.
- A Clear-box Approach to Behavioral Analytics and Machine Learning: ThreatMetrix Smart Analytics generates dynamic profiles matched to individual user behavior and use these to build more accurate, yet simpler, risk models. The result is a competitive edge in customer experience with reduced false positives, whilst maintaining the lowest possible fraud levels.
- Integrated Forensics, Case Management and Business Intelligence for improved productivity.