Customer acquisition and retention is a key challenge for banks given the state of customer loyalty today with a number of them turning to a trusted customer onboarding strategy as a game changer. We spoke with Deepak Panigrahy, CEO of EZMCOM on the state of authentic security in Customer Onboarding, and how EZMCOM has been disrupting the space of authentication to deliver next generation onboarding experiences. As the first interaction sets the tone for the relationship between the customer and the bank, read on as Deepak takes us through this transition to a customer-centric mindset in Customer Onboarding.
Given the negative impact of around 400$ for an attrited customer according to The Financial Brand, what do you think is lacking in the current customer onboarding ecosystem?
Data breaches have led to rampant compromise of personally identifiable information (PII). As a result, correctly reciting PII is worthless as a stand-alone method of corroborating a person's claimed identity during customer onboarding. On the other hand, onerous "identity proofing" methods for new-account opening increase customer abandonment. This creates a competitive liability when customer attrition and market share loss exceed the potential fraud loss. As nearly every component of modern life embraces digital channels, the need to corroborate the identity of customers, users, citizens, partners and employees through remote interactions continues to grow.
The onboarding ecosystem must invest in new technologies now to bolster or replace legacy identity proofing tools and processes. It must be accepted that any sense of security that comes from using highly compromised static data as a means of corroborating identity is a dangerous illusion.
The ecosystem must work towards addition of new approaches for identity proofing use cases that focuses on fraud reduction and credit write-offs, as well as increased revenue from lower false-positive rates, lower abandonment rates, and improved customer experience and loyalty.
Customer Onboarding must align three aspects of identity — the real-world identity, the digital identity and the person
In the recent Security Breach when two Canadian banks were hacked and 90000 customers’ data was stolen, how would EZMCOM have solved this problem?
There were two vulnerabilities that were exploited by the hackers to access information in the data breach mentioned above:
i) Knowledge Based Authentication: Security Questions and Answers is a dead game. NIST has, also, deprecated the approach but we continue to use them. The reason is simple: the information is personal and a lot of “personal” information of people is already available on the Internet through social media websites such as Facebook, Google etc. The technology which was relevant 10 years before is obsolete today and needs to be re-looked at immediately.
ii) Lack of appropriate checks with “Forgot Password” and the “Password” itself: Passwords are most vulnerable today. A hack on one website with the leak of password is not a hack of one firm but a hack on many firms because we rely on a fixed form of password or pattern due to human fatigues and unlike few websites to login, we are logging into multiple websites and applications across public and corporate levels on a daily basis.
EZMCOM would recommend the banks to leverage its “continuous authentication” mechanism in combination with an/multi authentication factor(s).
What elements would constitute a successful onboarding program in your view? How has security-based authentication evolved over time?
A Successful onboarding program involves two phases:
1. Opening Accounts
2. Activation and Re-activation of Accounts
Opening Accounts falls within the purview of eKYC, which involves verifying the end customer depending on regulations, normally comprising of:
While account opening is just one part of the story, the customer onboarding should also cover account activations and most importantly, re-activations when people change devices such as mobile.
The combination of a strong Face Biometric Authentication with customer onboarding, can ensure that banks can get a “verified trusted biometric digital identity” for the very first time unlike the FaceID of iPhoneX, where the “biometric face” always remains an unknown face though it might be a trusted device. This mechanism can help banks build right security business workflow keeping the user convenience at the heart of the solution.
What are your views in building a robust and secure customer profile in this dynamic age?
We believe in today’s digital age, it is necessary that banks need to take a multi-layered, intelligent and user convenient security by:
What role should security and governance play while onboarding and how can banks support this agenda while meeting customers’ hyper-personalization attributes?
Governance:
As client onboarding is primarily a coordination function, it encounters many governance issues. It is therefore imperative to establish a governance body to provide leadership and oversight for the program while also supervising “business as usual” activities.
The governance team should define the key principles underpinning the client onboarding process.
Security:
Any security software should be able to do the following things correct and onboarding is no different:
i) Identify Threats: Ability to identify fake and fraudulent onboardings might include multiple scenarios such as:
ii) Adapt to changing scenarios: Real-life threat scenarios could vary and these might include scenarios such as:
iii) Audit
How does EZMCOM support the Temenos digital banking ecosystem?
EZMCOM has a software platform that establishes and sustains trust in digital identities.
This platform comprises of multiple-layers of security
i) The 1st layer is our Identity Proofing software. It can verify on-boarding users and establishes trust on “who they claim to be”.
With these two and an optional external 3rd party corroboration, trust can be established on the on-boarding user.
We’ve built our Identity Proofing product using Deep Learning, AI/ ML technology. That is used in detection of the IDs, data extraction and its authenticity verification. And we use PKI & NFC technology for Identity Proofing of Passports.
ii) The next layer is Biometric Authentication that sustains the trust. We do this with using Device biometrics as well as True-Identity verification using Face recognition, independent of device capabilities.
Our Face recognition is also built using Deep Learning based AI/ ML technology with a very flexible, and robust design on calibrating the FA-FR and Liveness detection to balance security and usability depending on the risk appetite of our customers.
iii) We also have 2-Factor authentication (providing clientless, software, hardware form factors) – PSD2 compliant and deliver Strong Customer Authentication.
Our Software Token for mobile and desktop has been integrated as an SDK or as an independent app by our customers. First time registration (or a re-registration) of the Soft Token has been enhanced with our Identity Proofing software in emerging new use cases.
We’ve implemented our authentication layer for Users, API built on top of OATH, OCRA, OAuth2 OIDC and we can provide Federated Authentication.
iv) The last layer of our platform is for continuous authentication. This layer maintains the trust on a digital identity in an on-going session. Our Behavior-based authentication comprising of keystroke dynamics, GAIT analytics, Risk-based authentication for contextual anomalies delivers this continuous authentication that can trigger a step-up when required or otherwise enable a frictionless experience.
EZMCOM has, already won two clients with Temenos where Aspire Systems has been involved as a digital implementation partner. We have gone live with one of them and we are looking forward to replicating the wins across the globe.
We thank Deepak for his insights on the pressing need to transform security in customer onboarding programs for Banks through continuous authentication. As the onboarding ecosystem is evolving, Deepak calls for a multi-layered, intelligent and hassle-free security layer to build that robust customer profile for this dynamic digital age. This needs to be coupled with a strong governance structure in place that can proactively identify threats and adapt to changing scenarios to sustain that trust in digital identities. It’s a big opportunity for the incumbent banks and others to tap into this ecosystem and nurture deeper relationships with their customers.
Aspire Systems, a Temenos’ specialist partner, is a global technology services firm, with technology expertise in Digital Services, Enterprise Solutions, Software Engineering, Testing and support. They work with some of the world’s most innovative enterprises and independent software vendors, helping them leverage technology and outsourcing in their specific areas of expertise. The company currently has over 2400 employees, over 150 customers globally and is CMMI Level 3 certified. They also have a growing presence in the North America, UK, Europe, India, Middle East and Asia Pacific. For the eighth time in a row, Aspire has been selected as ‘Best Companies to Work For’ by the Great Place to Work® Institute.
