Hackers are more sophisticated than ever. To keep customer data safe and secure, financial institutions need a customer authentication system that keeps them one step ahead.
Both knowledge-based authentication (KBA) and biometrics can help protect sensitive customer information, but which offers better, more reliable data security? And with growing security risks, is one authentication method enough to keep hackers away?
The answer is complex. While no verification system is completely fool-proof, finding the right solution depends on understanding the pros and cons of both knowledge-based authentication and biometric authentication, as well as how a multi-layered approach works to keep customers’ digital assets secure.
What is Knowledge-based Authentication?
Knowledge-based authentication (KBA) uses personal questions to verify a customer’s identity. Users are prompted to answer a series of security questions before gaining access to their accounts. Questions are often easy for customers to remember and answer, making it a user-friendly way to authenticate identities. Implementing KBA is also cost-effective and widely adopted, used in everything from healthcare to banking to government.
But the simplicity of security questions also means answers are often easy to guess or readily available through social engineering. Hackers can pull secret security answers from a target’s social media profiles or public records.
To ward off hackers’ more sophisticated attacks, KBA has evolved to include both static and dynamic security questions.
Static Knowledge-based Authentication
Most people are familiar with static knowledge-based authentication. Static KBA includes common “secret questions” such as your mother’s maiden name, a sibling’s middle name or the make and model of your first car. Customers are prompted to select and answer security questions when setting up a new account.
Users are asked to provide the same answer to each security question before being granted access to their account. Questions are designed to only have one answer, making it easy for customers to remember the answers originally provided. However, these one-solution security questions also make it easy for hackers to solve.
Dynamic Knowledge-based Authentication
Dynamic knowledge-based authentication verifies a user’s identity by generating specific questions in real-time using data sources. Questions might include asking what address the user lived at during a specific year, or what type of car has never been registered under their name.
Dynamic knowledge-based authentication responses typically cannot be obtained through social engineering or guessing, making it much more secure than static KBA. However, questions still rely on public records or credit history to generate questions and often offer multiple-choice answer options.
Neither dynamic KBA nor static KBA offers strong enough protection from hackers to keep customer data totally secure. Replacing KBA with stronger authentication methods is an option, but an even better solution is to create a multi-layered identity verification process with biometric software.
Biometric Authentication
Biometric authentication verifies a user’s identity through unique physical and behavioral characteristics, such as fingerprints, palm prints, face scans, and iris or retinal pattern recognition.
Biometric authentication factors are personal to each user, making them difficult to replicate or fake. They also don’t require users to remember complex passwords or security questions, adding a much higher level of security and convenience.
But biometric authentication is not without risks. False positives are possible and biometric data contains sensitive information, making it a target for theft during a data breach. Institutions that implement biometric verification measures need to ensure customer data collected during the authentication process is secured. This starts with using a highly secure authentication solution provider like Jumio.
Infographic
The Harsh Reality of Account Takeover Fraud and the Future of Prevention
Read More
The Winner: Multi-factor Authentication
In the competition between KBA and biometric authentication, both identity verification processes work to authenticate users, and both can leave gaps for hackers to take advantage of. Although biometric authentication is much more secure than KBA, the best way to fill any potential gaps is with multi-factor authentication (MFA).
Multi-factor authentication improves security by combining multiple authentication processes. Rather than only relying on KBA or biometrics to verify a customer, a multi-factor approach would use a combination of strategies to ensure users are who they say they are, such as checking risk signals in addition to performing the biometric scan.
Each layer of authentication acts as a safety net for the others. On the chance a hacker guesses the correct answer to a security question or a biometric scan delivers a false positive, the second or even third layer of security blocks unauthorized individuals from accessing the account.
However, it’s important to prioritize customer experience and usability. Adding too many security checkpoints can be time-consuming and frustrating for users, deterring them from utilizing the full value of the account. That’s why risk signals like device checks that run silently in the background can greatly improve security without increasing friction.
A well-designed MFA system is intuitive and seamless while still incorporating different forms of authentication, reducing excessive user inputs while strengthening account security. Additional security factors, such as location-based processes, can also be added to further mitigate security risks.
Take Your Authentication to the Next Level with Jumio
Jumio makes it simple to implement robust authentication measures. Jumio’s biometric technology can enhance or replace your existing KBA processes to deliver better account security and reduce the risk of fraud, hacks and account takeovers.
Here’s how Jumio biometric authentication works:
- When creating an account, new users submit a valid government-issued ID, such as a passport or driver’s license, and take a selfie.
- Jumio technology compares the photo on the ID to the selfie image and creates a biometric template using key features and identifiers.
- When the user returns to access their account, Jumio captures a fresh selfie and compares it to the biometric information captured and stored during the onboarding process.
The entire authentication process takes just a few seconds for a user to complete, making it a stronger and faster option than answering KBA questions or waiting for an SMS authentication code. Jumio also offers a variety of frictionless risk signals that can help provide additional assurance that the person signing in to your platform is the same person who opened the account.
Jumio’s liveness detection algorithms also ward off advanced fraudsters who use spoofing or deepfakes to try to get past facial recognition technology — without adding additional friction to the customer experience. Unlike other platforms that depend on gestures and gimmicks to determine if the user is human or a bot, Jumio’s selfie technology just requires the user to hold their device at a natural angle.
Jumio’s advanced biometric-based verification is faster and easier for users while providing a more secure experience. And with a proactive approach to mitigating fraud risks, Jumio can ensure important customer data and accounts stay secure even as hackers and fraudsters develop more sophisticated attacks.
FAQs
What are some examples of static and dynamic knowledge-based authentication security questions?
Static knowledge-based authentication:
- What is the name of your pet?
- What are your parents’ names?
- What is the name of your first school?
- What is your previous address?
Dynamic knowledge-based authentication:
- What color was the car that was registered to your name when you lived in New York in 2015?
- Which of these addresses did you never live at?
- Which of the following options corresponds with the last purchase you made on your credit card?
What are some benefits of multi-factor authentication?
MFA increases security and improves information sharing. It better controls who has access to a person’s identity information as well as their personal files and records. The risk of a security breach is reduced, and sensitive data will remain protected when MFA is used.
Conclusion
Businesses require strong authentication to combat fraud and protect customers’ sensitive information in today’s digital world. A multi-factor authentication approach, including using KBA and biometric processes, is the best approach to keep hackers at bay.
Jumio’s advanced biometric authentication uses the latest technology to verify user identities and improve the overall user experience, helping businesses stay one step ahead of cybercriminals.
