How Has 2FA Affected Singaporeans

(Digital Money World) I remembered when the Monetary Authority of Singapore has given a time-line to the local banks (and even global banks that operates within the MAS frame like Standard Chartered, Citibank) to implement 2FA security feature, not many people know what 2FA really was, and how useful it is as a second level of deterrent to hacking or even identity thefts such as social engineering.

2FA Devices. Singaporeans should find them really familiar – Taken with my HTC Diamond

What is 2FA? (from MAS website)

The common implementation of 2FA requires you to provide two components to identify yourself to a system or service:

i) something you know eg. PINs or password

ii) something you have eg. a 2FA token

2FA differs from traditional authentication method which only requires a single factor such as a password to gain access to a system. The 2FA token could be a hardware device or software module installed in your mobile phone.

Each time you wish to log into a bank’s website and perform online transactions, your 2FA token will generate a One-Time Password (OTP). The OTP is usually a string of numeric or alphanumeric characters which you will have to key into the system before you can perform your transactions. The OTP can also be delivered to you via SMS.

For security reasons, the OTP is usually valid only for a short period of time, after which you will have to obtain a new OTP.

Given a scenario that someone knows your userid/password combination to your bank account, without a hardware token to generate the numbers or your mobile phone for the OTP, attacks would be deterred. Though you still have a chance of losing your phone to someone or token, this second level would have deterred most attackers from trying to access your account.

Aftermath of Singapore Online Banking with 2FA?

You could see people hanging their 2FA tokens with their bunch of home keys, students or even businessmen accessing their bank accounts in cafes with their personal laptop. Singaporeans are now more security conscious as they used to be. I’m sure pretty much other parts of the world things are improving where online phishing/ social engineering attacks are getting lesser and lesser.

I’ve accounts with most local banks in Singapore to facilitate my business and work, and both the SMS and hardware tokens 2FA works seamlessly with banking transactions. In case the cookies aren’t working properly, 2FA OTP codes are asked before most of the important actions such as wiring money to another account or adding a beneficiary to your account.

How’s the other parts of the world doing with 2FA? I know it’s not a new technology to discuss, but it’s interesting to know how much your bank values your banking security.