Lloyds TSB to trial two-factor authentication

Lloyds TSB to trial two-factor authentication

Summary: The bank will offer a keyring-sized Access Code Device to 30,000 customers in an effort to combat phishing

TOPICS: Security

Lloyds TSB has announced that 30,000 of its customers will trial a two-factor authentication device, in an attempt to fight online fraud.

The Access Code Device is keyring-sized and produces a randomly generated, one-time-only number that a customer enters when logging on, in conjunction with his or her password, explained Ken Farrow, group head of fraud at Lloyds TSB.

Users of the device are less likely to become victims of phishing and pharming, as the fraudsters would need both device and password in order to access a customer's account, according to Farrow.

"This protects against phishing and remote monitoring, because the device doesn't transmit any signals that can be intercepted," Farrow said.

Loss of the device would not in itself compromise the account, Farrow said, as the authentication is two-factor. "If the device is lost, it doesn't compromise security as you also need a password — this is the two-factor element. If it is lost, you inform the bank, and they cancel the device and issue another."

Lloyds is working closely with APACS (the Association of Payment and Clearing Systems) and other members of a working group to develop a standard authentication device for online banking and shopping, Lloyds said.

"We are working collectively within APACS to enhance security, and a standard is being developed which should be coming on-stream sometime next year," Farrow said. "We wanted to get ahead of the game and test whether our solution was right for our customers."

The 30,000 customers will be selected at random for the trial. "We will be offering the option of taking the device to a cross-section of the customer database," Farrow said.

The device will be modified following the trial, and the findings will feed into the APACS standards work. "We're looking at the impact on fraud levels, and working closely with APACS. If we decide to roll out a two-factor device, it would be this or something else (as part of a standard)."

Farrow was unwilling to say who developed the device because of security implications. "It's a proprietary device that has been made for us by a third party," he said.

Topic: Security

Tom Espiner

About Tom Espiner

Tom is a technology reporter for ZDNet.com. He covers the security beat, writing about everything from hacking and cybercrime to threats and mitigation. He also focuses on open source and emerging technologies, all the while trying to cut through greenwash.

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.


Log in or register to join the discussion
  • I don't understand how it can tell if you have entered the correct number

    it does seem to work, but if the numbers are randomly generated - HOW?
  • The keyring has a clock, accurate to one second. What it displays is essentially an encryption of the time. So it must tell you when the minute is nearly up, or the key will change in the middle of you typing it in - a bit of an inconvenience.
  • see the blog : internet-crime--fraud.blogspot.com