Online Banking Security

1. Overview of Out-of-Band Authentication (OOBA)

Out-of-Band Authentication uses the phone channel to obtain a one-time passcode to confirm authentication. The solution offers both SMS Text and Voice Interaction. To start the process, the user is presented with a list of the phone numbers already on record in online banking. There are up to six telephone numbers supported, which can include domestic, international, direct dial extensions, and non-direct dial extensions.

If Voice Interaction is selected, the customer can choose any number listed. Voice interaction works well on mobile devices as well as land lines. There are no restrictions in the Voice Interaction network that would prevent a call from going to any device.

When the customer selects to receive an SMS Text, they enter the phone number where they would like to receive the message, allowing us permission to send the SMS Text (mobile carrier requirement). We will verify the number matches one already listed for the customer.

Questions from Clients

Q: If a customer is traveling for an extended period of time (i.e., traveling in Europe with their normal laptop computer), will the login from the device trigger OOBA?
A: It is likely the user will go through a step-up in security. However, there are no restrictions in receiving OOBA verification internationally. If the user has already defined their cell phone in Business Online Banking and it is enabled for international service, it will work fine.

Q. If the customer does not pass OOBA authentication steps, what happens? Is the account locked/frozen?
A: The User ID is not locked or frozen if the customer fails Out-of-Band Authentication. The customer can try again.

Q: How does OOBA handle customers with foreign phone numbers?
A: Non-North American numbers can be entered and are supported.

Q: Is Out-of-Band Authentication (OOBA) optional for basic service clients who don't use tokens?
A: OOBA is a login authentication measure to ensure high levels of account security. For all clients not using tokens, OOBA is therefore required.

Q: Can a customer receive a one-time-passcode via email instead?
A: Email is not used in OOBA. Because email can be accessed via internet browser, it can be compromised by malware and is therefore not an option.

Q: What if a customer selects SMS Text yet does not receive the message containing the one-time passcode?
A: If network coverage is poor, there may be gaps in service. There may also be delays in message delivery across any area of the network. Should the SMS Text not be received, a customer should try the Call option or try the text option again.

2. Software Token Services

Soft Token Authentication and Soft Token Approval services are configurable at a company and company user level, allowing the Bank to offer both hardware and software tokens. The Soft Token Authentication and Soft Token Approval services are essentially modifiers of the existing Token Authentication and Token Approval (hardware token) services. In other words, to enable a software token service for a company, the comparable hardware token service must also be enabled.

Token Authentication and Token Approval are company-level services that, when enabled, each user in that company must use a hardware token to sign on and/or approve transactions. Soft Token Authentication and Soft Token Approval are enabled at the user level which means when either or both services are enabled for a company, that company's administrator can choose which users must use a software token to sign on and/or approve transactions. This allows a company to offer both hardware and software tokens to their users.

While a company can have hardware and software token services enabled, a user cannot use both types of tokens concurrently. A user is required to use a software token when the software token user entitlement is enabled. The RSA SecurID Software Token app is available to company users for download in the Apple App Store and Google Play Store. Once downloaded, the RSA SecurID Software Token app requires activation by company users.

MOBILE DEVICE REQUIREMENTS

The RSA SecurID Software Token app is supported on the following mobile platforms (operating systems):

• Android OS version 9 or later
• iOS (Apple) version 14.0 or later

An internet connection is required to download the RSA SecurID Software Token app and a camera is required for the activation process. Once downloaded, ensure that the app is enabled to access the camera under the Settings options for your device.

SOFTWARE TOKEN ACTIVATION

When a user accesses Business Online Banking after having a software token service enabled, they are required to authenticate their identity using their current assigned authentication method (password/hardware token). This step helps to prevent fraud and is only required for activation. Once a user authenticates their identity with their current assigned authentication method, they can begin the software token activation process, which is as follows:

Select a mobile operating system provided by the RSA SecurID Software Token app.
Scan a quick response (QR) code that contains the software token license.
Create a personal identification number (PIN).

Users are required to complete the activation process for each device they want to use for software tokens. Activation is also required when a user replaces their device or resets/restores it to the factory settings.

DEVICE OPERATING SYSTEM

Once company user credentials are validated on the Sign On page, the Set Up Software Token Sign On page appears where the user must select their device’s mobile operating system.
______________________________________________________________________________________________________________________

3. Guidance for Business Accounts

Since the frequency and dollar amounts of Business Online Banking transactions are generally higher than consumer transactions, they pose a comparatively increased level of risk to business accounts. Hence, we suggest business customers perform their own risk assessment and establish their own internal controls. The following online security guidance may be helpful to you:

A Cybersecurity Guide for Businesses