In Indonesia, 97% of businesses have experienced account takeover (ATO) fraud, with 8 out of 10 cases leading to unauthorized transactions. This situation typically occurs due to leaked sensitive data, which is then exploited by cybercriminals.
Account takeover is a type of digital fraud that can result in financial losses. To prevent this, many companies are strengthening security measures with Two-Factor Authentication (2FA).
Two-Factor Authentication (2FA) is a security method that verifies a user’s identity based on a combination of two factors.
For example, when logging into an e-commerce or social media account, after entering your password, you receive an OTP (One-Time Password) that must be entered into the platform.
While OTP authentication is still widely used, some financial institutions in Singapore are starting to phase it out. Let’s explore the advantages of 2FA security and why biometric authentication is a more secure alternative.
Enhanced Security: Two layers of verification significantly reduce the chances of hackers successfully accessing an account.
Protection Against Cyberattacks: 2FA minimizes risks from phishing, credential stuffing, and brute force attacks.
Increased User Trust: Businesses that implement 2FA demonstrate their commitment to user security, fostering greater trust.
Two-Factor Authentication (2FA) requires users to provide two types of credentials before gaining access to an account or system. It strengthens security against phishing, data breaches, and brute force attacks.
2FA typically involves three main categories of authentication factors:
Users enter a password (first factor) and receive an OTP via SMS, email, or an authenticator app (second factor).
Examples:
Risk: This method is easy to implement but highly vulnerable to phishing and SIM swapping.
Instead of OTP via SMS, users generate OTPs through authenticator apps like Google Authenticator or Microsoft Authenticator.
Example:
Benefit: Safer than SMS OTP since phishing attacks can’t intercept codes. Yet it has downside, it requires users to install an additional app.
No password, PIN, or OTP is needed. Users authenticate via biometric verification (facial recognition), which is linked to their device.
Example:
OTP has evolved over decades as a security measure:
RSA SecurID tokens became popular, producing time-based OTPs valid for a few seconds or minutes.
Although OTP was initially designed to enhance security, advancements in cybercrime have made it a frequent target for fraud and hacking attempts. Here’s why OTP is no longer considered secure:
Phishing scams trick users into entering their OTPs on fake login pages that resemble real banking or e-commerce sites. Once the OTP is entered, scammers gain full access to the victim's account.
Scammers impersonate customer service agents from banks or platforms and ask for OTPs under the pretense of account verification or security updates. Many victims unknowingly provide their OTPs, leading to account takeover fraud.
Attackers trick users into activating SMS forwarding, redirecting OTP messages to the fraudster's number. This allows scammers to access accounts without the victim realizing it.
SIM swapping is an increasingly common attack. Fraudsters convince mobile carriers to transfer a victim’s phone number to a new SIM card controlled by the scammer. Once the transfer is complete, the fraudster can intercept OTPs and gain control over all accounts linked to the number.
Modern authentication systems are shifting towards biometric and device-based authentication. VIDA offers secure, fast, and phishing-resistant authentication methods:
Two-Factor Authentication (2FA) is a crucial security step, but traditional OTP-based authentication is no longer safe. Companies should transition to biometric and device-based authentication to protect users from fraud, phishing, and SIM swapping attacks.
Explore VIDA’s latest whitepaper: Where’s The Fraud? The State of Authentication and Account Takeovers in Indonesia.