2FA is also not reliable to control fraud mitigation

Two-factor authentication (2FA) is a tool that organizations use to secure online accounts; it adds a layer of security on top of a username and password. Many organizations implement 2FA to prevent account takeover and credential stuffing. However, fraudsters are finding ways to bypass 2FA security measures, and many users choose not to enable 2FA because it has a negative impact on user experience (UX).

Traditionally, Two-factor authentication can play an important role in securing your website by blocking a number of application-based attacks. Two-factor authentication adds an additional layer of security to the authentication process by making it harder for attackers to gain access to a person's devices or online accounts because, even if the victim's password is hacked, a password alone is not enough to pass the authentication check.

There are many different devices and services for implementing 2FA - from tokens to radio frequency identification or RFID cards to smartphone apps. Despite the two-factor authentication people are falling prey to cyber fraud attacks. This is because fraudsters are increasingly using social engineering tactics to extract confidential banking information from customers. They are using scripts based on Greed, Threat, and Help ("GTH") and luring customers in sharing passwords, PINs, OTPs, and other confidential information.

In a way, fraudsters are attempting to 'hack consumers' minds' as they are failing to manipulate the system. Fraudsters have derived new ways to steal the second factor authentication details from the customers. They are creating fake websites which are lookalike and asking customers to click and fill in their credentials like customer ID, password, OTP, etc., which are then used by fraudsters to do unauthorized transactions and defraud the customers.

Customers, on the other hand, continue to believe that the secret code/information was not shared by them. Hence, consumers need to be more careful while transacting digitally. Customers need to stay vigilant while clicking any link which is sent by any unknown person/number and should ideally refrain from submitting their secret codes/ information on the sites which are opened through such links.

It is true that, at times, the implementation of two-factor authentication is flawed to the point where it can be bypassed entirely. Verification codes are usually read by the user from a physical device of some kind. Many high-security websites now provide users with a dedicated device for this purpose, such as the RSA token or keypad device that you might use to access your online banking or work laptop.

In addition to being purpose-built for security, these dedicated devices also have the advantage of generating the verification code directly. It shows that there is no end to the technology development, it has to be a continuous process.

Dr. Deepak Kumar Sahu, President & CEO, VARINDIA