How do you tell if a legitimate customer or a fraudster is signing into your online banking platform? How do you know if the authentication measures your organization is using are effective? How important is it to your organization to provide a seamless customer experience while maintaining adequate security controls?

The Problem With Customer Security

These are all important questions to consider when trying to create a balance between cybersecurity and a positive customer experience. In ISMG’s “Preserving the Customer Experience Survey,” half of the respondents didn’t know or were only somewhat confident in their company’s ability to authenticate legitimate customers online. Additionally, about half also believed that some of their security controls are perceived as inconvenient. However, 99 percent think that preserving the online customer experience is going to be a high priority in 2017.

The one thing that cybercrime experts do know is that cybercriminals and fraudsters are very adaptable. They will leverage, to their advantage, the services and offerings that financial institutions deploy to satisfy customer convenience and experience. They also use new technologies to further their schemes and circumvent security measures, such as using 3-D printers to create cutting-edge skimmers. When it comes to online banking the same is true: Cybercriminals will find ways to get around today’s security controls. In fact, they already have!

Today’s Security Controls

According to the survey, most organizations meet the baseline controls set by the FFIEC’s 2011 guidance. While those baseline controls are important to have in place, they are now 6 years old. For example, one-time passwords delivered via SMS are a popular security measure, often used today in two-factor authentication. While this is an effective control, it can be defeated by malware and fraudsters employing a man-in-the-middle (MitM) attack.

According to Shaked Vax of IBM Security, “I would not be surprised if in the next year or two, these SMS messages will no longer be considered secure — much like passwords are today.”

The Balancing Act

Almost all respondents to ISMG’s survey indicated that creating a positive online customer experience was very important. At the same time, approximately half said they felt that their security controls were somewhat inconvenient to customers. About one-third of the respondents said that customers have left their organizations because cybersecurity controls degraded their experience.

Fraud prevention and security controls are not unlike a seesaw, with security controls on one end and the customer experience on the other. As more security controls are put in place, weighing down the security end of the seesaw, customer experience is left stuck in the air.

More and more organizations are adopting behavioral biometric solutions that offer customers a transparent and seamless experience. These solutions allow your organization to adjust the fulcrum on the seesaw, giving way for both enhanced security and a good customer experience. These solutions analyze the customer’s patterns of behavior while interacting with your website, including mouse movements and clicks in context. The solutions operate in the background and are therefore transparent to the customer and much harder for fraudsters to compromise.

One Size Does Not Fit All

The key is identifying the right type of control to maximize fraud prevention for the individual customer. Not all customers are the same. Millennials have different expectations of their online banking experience than do their baby boomer parents. Similarly, not all online banking interactions carry the same risk. So why treat customers and the way they engage your organization online the same way?

The companies that can offer experiences tailored to the customer, and their individual needs and expectations, will lead the way in the coming years. Behavioral biometric solutions using cognitive technology to effectively assess identities throughout the online journey eliminates the need to perform overbearing authentication for certain transactions.


The ISMG survey provides good insight as to how banks view the importance of preserving the customer experience online. However, it clearly illustrated that many banks believe they are not hitting the mark, with about half indicating that they believe their security controls are inconvenient. But one thing is crystal clear: Almost all banks put a very high priority on improving the customer’s online experience.

Download the complete ISMG Report on Preserving the customer experience

More from Banking & Finance

2022 Industry Threat Recap: Finance and Insurance

The finance and insurance sector proved a top target for cybersecurity threats in 2022. The IBM Security X-Force Threat Intelligence Index 2023 found this sector ranked as the second most attacked, with 18.9% of X-Force incident response cases. If, as Shakespeare tells us, past is prologue, this sector will likely remain a target in 2023. Finance and insurance ranked as the most attacked sector from 2016 to 2020, with the manufacturing sector the most attacked in 2021 and 2022. What…

How to Spot a Nefarious Cryptocurrency Platform

Do you ever wonder if your cryptocurrency platform cashes in ransomware payments? Maybe not, but it might be worth investigating. Bitcoin-associated ransomware continues to plague companies, government agencies and individuals with no signs of letting up. And if your platform gets sanctioned, you may instantly lose access to all your funds. What exchanges or platforms do criminals use to cash out or launder ransomware payments? And what implications does this have for people who use exchanges legitimately? Blacklisted Exchanges and Mixers…

Kronos Malware Reemerges with Increased Functionality

The Evolution of Kronos Malware The Kronos malware is believed to have originated from the leaked source code of the Zeus malware, which was sold on the Russian underground in 2011. Kronos continued to evolve and a new variant of Kronos emerged in 2014 and was reportedly sold on the darknet for approximately $7,000. Kronos is typically used to download other malware and has historically been used by threat actors to deliver different types of malware to victims. After remaining…

Why Cybersecurity Risk Assessment Matters in the Banking Industry

When customers put money in a bank, they need to trust it will stay there. Because of the high stakes involved for the customer, such as financial loss, and how long it takes to resolve fraud and potential identity theft, customers are sensitive to the security of the bank as well as fraud prevention measures. Banks that experience high volumes of fraud are likely to lose customers and revenue. The key is to protect customers and their accounts before problems…