Customers at Salem Five Bank (above) could see changes resulting from new federal guidelines for online banking protection as early as this summer.

Banks are in the process of deciding just how they will determine who is sitting behind a computer screen when someone logs onto an account.

Right now there is single-factor authentication, which means a username and password is all that is needed to access an online bank account. But come 2007, online banking is going to require more than just a customer password.

The Federal Financial Institutions Examination Council recently released guidelines to help banks meet new standards, calling for them to strengthen customer authentication for online banking purposes.

According to the Federal Deposit Insurance Corp., customer concerns have been negatively affecting the growth of online banking. David Barr, FDIC spokesman, said banks are in the process of assessing the risks associated with the products and services they offer online. The next step will be to adopt software or hardware that is aimed at strengthening security for online banking.

“They will have to do something. That something is up to them,” said Barr.

Jay Spahr, senior vice president of electronic commerce at Salem Five Bank, said he believes the guidelines are a positive step for the industry. He said the idea is to match the level of security with the level of risk so the customer is better protected. While no one will disagree with the theory, banks have some decisions to make over the next year as to just how they are going to meet the new guidelines.

Options range from IP tracking software to small tokens that electronically transmit a new password every 60 seconds and thumb drives that are forms of identification stored on a device similar to a USB drive, among others. Industry experts say most banks are expected to start out with software, but may evolve their methods in the future and bring hardware into the picture as needed.

“I think most of the banks are pretty similar on how they want to approach this. There is not a lot of diversity,” said Spahr.

‘Non-Stop’ Changes
Salem Five customers could see the changes as early as this summer even though banks have until the end of the year to implement the imposed guidelines, said Spahr.

However, the changes are not expected to stop. Staying ahead of online fraud means staying on top of new technology and security measures, according to Spahr.

“This is non-stop for us,” he said. “Security measures will be much better than they were in the past. Clients should feel more safe.”

“Chances are it’s not going to completely wipe out fraud, but it’s going to go a long way,” noted Barr, who said the main focus is to ease consumer fears and cut down the fraud.

“It just makes it harder and harder for the crooks,” Barr added.

Spahr said he believes more and more banking products will be obtainable online as multi-authentication tools are put into place and security become stronger.

Jim Jones of Wellesley First Consulting agrees with Spahr. He said it is now more important to secure online banking as much as possible.

Jones said the Generation X and Generation Y populations are getting older, and the fact that they grew up in the computer age means they are likely to rely on technology for many facets of their lives, including online banking. It also means more and more business is likely to be conducted over the Internet, he added.

“We can’t view this as a single step. Banks are going to be in a lifelong process securing online banking. I would just view multifactor authentication as a step in a journey that doesn’t have an end to it,” said Jones. “[The existence of] more and more products means more and more security has to be in place.”

“I think it is a positive thing for us to be doing. E-banking is supposed to be easy and convenient and something people want to do,” Spahr said. “But the challenge is to make sure the new security does not make online banking less convenient. There is a balance we are trying to achieve.”

Stephanie Chaufournier, senior vice president of online banking at Connecticut-based Online Resources – which powers Internet financial services for over 800 companies nationwide – said the face of online banking is definitely going to change. But a lot of the initial changes will happen behind the scenes, she said.

Online Resources is teaming up with New York-based Cyota Inc. to offer banks two security solutions to its clients. The software will track the IP addresses where customers log on. If a customer logs on from a different location than what is considered normal for online banking habits, he will be prompted to answer questions to verify his identity.

Two-way authentication is also something banks will use to better protect their customers. When a customer goes to log onto a bank’s Web site, a picture will appear that was previously selected by the customer. Chaufournier said it will be a signal to customers that it is safe to type in a password.

Several banks will test the new software in March, including a Massachusetts bank, said Chaufournier.

Bank of America already has a similar system in place. The software was implemented in the Northeast part of the country this month.

Barr said the idea of using pictures in addition to passwords is beneficial since hackers can’t monitor mouse clicks or easily duplicate the pictures. He said adding a layer of protection that does not rely on the keyboard is a definite benefit.

Though hardware options likely will not be the first step banks take, Chaufournier said they could be implemented in the future or on an as-needed basis for specific customers.

Chaufournier said most financial institutions seem to be opting for the software rather than the hardware for now.

“We feel [the hardware is] not quite ready for prime time,” she said.

Peter Blanchard, vice president of member services at the Massachusetts Bankers Association, said the goal is to implement new security that is easy for the customer to manage and won’t discourage the use of online banking.

“It has to be done in this day and age,” said Blanchard, adding he believes such measures could be carried over to ATMs in the future.