Businesses shift to risk-based authentication on messaging

Device, location, and transaction signals are helping firms adjust verification by risk.

Businesses using WhatsApp and SMS for customer transactions are moving towards risk-based authentication as impersonation, stolen one-time passwords, and automated traffic attacks make blanket verification less effective.

Sylvain Chaperon, General Manager for Communications Platform as a Service at 8x8, said fraudsters increasingly exploit messaging channels that customers already use for personal and work communications.

One threat is impersonation, where customers receive messages that appear to come from banks or other brands. Another is social engineering aimed at obtaining one-time passwords, whilst businesses can also face artificially inflated traffic that generates large volumes of authentication requests and associated costs.

“Security today needs to be taken as an overall concept, not only as a back-office issue,” Chaperon said.

Businesses can reduce unnecessary friction by adjusting authentication requirements to the level of risk behind each interaction. A returning customer using the same device, internet address and location may require fewer verification steps than a new user attempting a large transaction from an unfamiliar location.

Chaperon said companies can use signals such as phone-number quality, transaction type and user behaviour to determine when security checks should be increased or reduced. Keeping customers within the channel they are already using can also simplify verification. Requiring a user to leave WhatsApp and authenticate through SMS, for example, can add friction when mobile connectivity is limited.

For technology investment, Chaperon said companies should prioritise reliable authentication infrastructure, direct connectivity with telecommunications operators and fraud controls.

He added that firms should invest in systems that determine the most appropriate authentication channel instead of repeatedly resending the same verification request. A multichannel strategy is also becoming more important as customers move between messaging, SMS and voice.

Chaperon said the objective is to strengthen fraud controls without adding unnecessary friction for legitimate users.

Follow the link for more news on

cybersecurity

Reaching the people who run Asia's businesses is harder than it used to be.

Inboxes are crowded. Attention is short. The executives you most want to reach — the founders, CFOs, and operators who actually move budgets — are the hardest to find through the usual channels. If you're building a company, a category, or a reputation, you already know this.

We've spent twenty years building the room they read. Singapore Business Review is where senior decision makers in Singapore and across Southeast Asia come for business coverage they can't get elsewhere — in print, online, and in person at the summits and roundtables we host across seven markets.

If you have something these readers should know about — a point of view worth publishing, a product worth their attention, an event worth their time — we'd like to hear what you're trying to do.

Book a meeting

| Or download the media kit (PDF)

240,000 senior readers quarterly in print Top 1,700 Singapore companies reached

7 markets across Southeast Asia