Skip to main content

The WiKID Blog

Viewing posts tagged Phishing and Fraud

etrade-to-offer-zero-liability-accounts

Kudos to ETrade for offering a "zero liability" account. I suspect this is an attempt to foil my prediction that brokerage accounts will be increasingly targeted by phishers. (Though, to be honest, they were getting off to a good start in Q4.)

Brokerage accounts are tempting. Most people (if they have brokerage accounts) have more in their stock accounts than in their bank account or savings. It's probably harder to determine if a payment leaving the account is fraudulent. With bank accounts, phishers target a larger number of users for smaller dollars amounts. With brokerage accounts, phishers aim for bigger dollars. From the BusinessWeek article:

dhs-predicts-more-brokerage-attacks

The DHS is joining in on one of my earlier predictions: Brokerage accounts will be increasing targeted in the coming year. According to their post they are tempting accounts because they typically have more money in them. Further, typical anti-fraud transaction analysis doesn't really work because of the infrequency of transfers.

I'm convinced that brokerage accounts and other heavy transactions accounts will need cryptographically secure transaction authentication in addition to session and host/mutual authentication.

dns-and-mutual-authentication

Once again, Amit Klein has hacked DNS. Once again, we'll say if you are doing high-value web-based transactions, you should consider using Mutual Authentication for HTTPS.

incent-for-the-averages-insure-against-the

One the comments on Emergent Chaos about my post Incentive plan for an information security team was from Andrew Jaquith of the Yankee Group:

embedding-wikid-two-factor-authentication-in-your

One of our customers, Online Banking Solutions offers banks and financial institution software for commercial account management. They have embedded WiKID for two-factor session authentication and mutual https authentication in both the server side and on their optional client. The combined client facilitates the initial validation process, performs session authentication using the one-time passcode and performs mutual https authentication to prevent MITM attacks.

Recent Posts

Archive

2021
2019
2018
2017
2016
2015
2014
2013
2012
2011
2010
2009
2008

Categories

Tags

Authors

Feeds

RSS / Atom