The pandemic forever altered the payments landscape — moving all sorts of transactions and interactions online. In the process, the anonymity of digital commerce has given fraudsters deep cover — making authentication more essential.
What’s Changing
The rise of all manner of tech-enabled schemes, with the dark web offering up sensitive data for the bad actors to purchase and artificial intelligence in the mix, means that authentication is more important than ever.
Across a series of interviews as part of the “What’s Next in Payments” series, PYMNTS asked what’s new and next in authentication. Passwords may take a while to recede, but the space is rapidly evolving. In the recently-concluded series of the same name, we gleaned insights and a roadmap from nine executives on the frontlines of waging the war against fraudsters.
Jim Colassano, senior vice president and business product manager for the RTP® Network at The Clearing House said, “Compromises and data breaches are occurring more frequently than we would ever want them to. And once someone gets access to your password, it opens and unlocks a whole different set of opportunities for them, especially if you use that same password on different sites.”
We are well past the age when passwords have been enough alone to ascertain that someone is who they say they are, or a few security questions give an additional line of defense.
The Ultimate Goal of Authentication
Siddharth Vijayakrishnan, senior vice president of product and financial intelligence at FIS Platform and Enterprise Products, said that ideally, authentication should be a “lightweight” endeavor, tied to the act of proving that someone is who they say they are again and again as they move through various digital channels.
“They want to get into, and out of, an application as quickly as possible,” Vijayakrishnan said.
“What you want is a system that is designed to let in good actors as easily as possible, and that presents enough of a barrier to deter bad actors,” he added.
Mike Storiale, vice president of innovation development at Synchrony, told PYMNTS that a few key overarching themes that govern authentication revolve around three tenets: something the user knows (passwords); something the user has (cards or phones); and something the user is (biometrics like fingerprints or facial recognition).
The Authentication Challenge
The executives we queried noted an ever-present challenge: The balancing act between security and speed, between caution and convenience.
“Authentication is a constantly moving bullet,” said Shaunt Sarkissian, founder and CEO of AI-ID.
“Fear of friction always exists,” Sarkissian observed, adding that stakeholders have “had to adapt and make sure that we don’t create an arduous authentication process. Many times, it looks like companies are just relying on only a password, but many times they’re not.”
The ubiquity of the handheld device, our executives said, has made it easier to bring biometrics into the fraud-fighting authentication toolkit — and to, in Sarkissian’s telling of it, provide a line of defense at the front end of the interplay between individuals and enterprises.
Data-Rich Defenses
Lisa McFarland, executive vice president and chief product officer at Ingo Payments, told PYMNTS a multi-dimensional approach “can offer sufficient credentials to get to a level of certainty for a given transaction.” That multifactor approach can include device-level analytics, including geolocation.
The use of tech and analytics extends well beyond consumer-facing commerce.
Jim McCarthy, CEO of Thredd, said commercial commerce must also meet the challenges of authentication. The pain points and vulnerabilities are especially acute with onboarded businesses.
“The answer lies with data,” he said.
Once a firm onboards a merchant onto a platform, it is critical to look at data and share that data across the ecosystem — the velocity, types of transactions, where the money is coming from and where it is flowing, he said.
Kyle King, director of product management at NCR Voyix, said financial institutions now include three or even four factors in decisioning and added that continuous verification and even a bit of friction — which can cement trust from consumers making high-dollar transactions — are key to enhanced security and user experience.
Consumers “want to see friction, even if it’s just a popup saying, ‘Hey, we have already validated you using behavioral biometrics or location data, and we are good to proceed,’” said King.
“The intersection of technology and unique identification should be constant throughout the experience,” he added.
Olympe Leflambe, general counsel, legal, compliance and risk at Mangopay, added that the various authenticating factors “need to be independent, so that if one of the three is compromised, then the other one that the provider is using for strong customer authentication is not.”
And as Farhad Farzaneh, chief product officer at Trustly, told PYMNTS: “As technology advances, it also makes it easier to commit fraud. So, the methods of authentication have to also move with the technology.”
“The best payment is one where you’re not there at all,” he said. “Because payments is not what the consumer wants to do. The consumer wants the goods, the transaction is between the merchant and the user. And payments is just a facilitation to make sure that contract is fulfilled.”
