Mellon Fights ID Fraud With New Authentication Technology

CIO — Have you been asked to chime in to your company's version of "Who are you?" If not, you probably will soon, especially if youre in a services industry. More CIOs are facing the need to revamp authentication technologies, used to log employees or customers in to online systems. Authentication must maintain a delicate balance: It needs to be strong enough to keep crooks out but understandable enough for customers to complete successfully. One approach, knowledge-based authentication (KBA), is gaining popularity.

The basic premise of KBA is this: To log in, users answer a series of multiple-choice questions that are based on data from public records about themsay relating to a real estate purchaseand are gathered by a third-party KBA provider.

For Mellon Investor Services (a subsidiary of Mellon Financial, providing shareholder services and related securities products to small- to Fortune 500size firms), the move to KBA started with a longtime problem, says CTO Marc Librizzi. The firm had a large user population of individual shareholders, and no common data to help authenticate them.

A bottom-line business need drove Mellon to find a new authentication method that was workable: Every time someone chooses the call center instead of the website, it costs the company more money.

First, Mellon Investor Services tried a system in 2006 where shareholders logging in for the first time were sent an investor ID via postal mail, then went online to request an access code, which was sent in a second piece of postal mail. Volume to Mellon's related call center went up. "We needed to allow real-time access to our system," Librizzi says.

So Mellon rolled out a KBA solution from Verid in March 2007. Today, Mellon shareholders get the investor ID by postal mail, then visit the website to answer three multiple-choice questions. If successful, they can set up a PIN and use the system immediately if desired.

What are the questions like? According to Verid COO Chris Rickborn, the company uses data derived from public records, much of it from regulated records available to companies doing ID verification. Questions might include the color of your car, previous addresses, age range of a family member or date of purchase of a property, Rickborn says.

Among the aspects of KBA that Mellon likes, it doesn't maintain the repository of personal data as it would have to with hint-style systems, Librizzi says.

Why not choose an option like RSA-style security tokens? Tokens aren't a regulatory requirement, and dual-factor authentication "isn't realistic with a base of 18 million shareholders," Librizzi says, noting the potential for lost or broken tokens.

On the plus side, says Gartner VP and Research Director Avivah Litan, KBA doesn't require special hardware or client software, and it can be invoked at any time in the customer lifecycle. On the minus side, KBA questions and answers are subject to compromise, via guessing or stealing of data such as credit reports. She predicts next-generation KBA will be stronger but may involve consumer privacy concerns.