George Tubin Senior Analyst Consumer Banking © 2005 The Tower Group, Inc. May not be reproduced by any means without express permission. All rights reserved. Online Authentication and Security …and now, You Have To Do Something!

Section Break First: The Good News

© 2005 The Tower Group, Inc. CAGR = 8.7% Projected Online Banking Growth (Among All US Households) Online Banking Continues to Grow Source: TowerGroup

© 2005 The Tower Group, Inc. e-Commerce Continues to Grow US Dollars (millions) Source: US Department of Commerce

Section Break And Now: The Bad News

© 2005 The Tower Group, Inc – The Year of Phishing

© 2005 The Tower Group, Inc. Malware Growth Over Time (Number of Unique Samples) Malware Attacks Are On The Rise Source: McAfee

© 2005 The Tower Group, Inc. Threats Continue to Emerge Cross-Site Scripting (XSS) Trojan Horses Keyboard Loggers Remote Administration Tools (RATs) Man-in-the-middle (MIM) Drive-by Download Pop-up Download Hacking File Sharing Networks Browser Hijackers DNS Cache Poisoning Attachments Root Kits Phishing

© 2005 The Tower Group, Inc. Consumers Cannot Defend Themselves  Proliferating threats  Low anti-virus, anti- spyware usage  Criminals are always one step ahead  Bank is viewed as protector The Bottom Line Usernames and passwords will be stolen!

© 2005 The Tower Group, Inc. My Favorite Solution (so far…)

© 2005 The Tower Group, Inc. Keys to a Good Internet Solution  Convenience  Minimum user action = Minimum mistakes  No opt-in = No adoption issues, full coverage  No change in customer behavior = No confusion  No downloads or cookies = No compatibility issues  Low False-Positives/False-Negatives  Link analysis of compromised accounts to the same fraudster  Low cost  Capital  Resources

© 2005 The Tower Group, Inc. Risk-Based Authentication  PC Identification  PC stored certificate  Browser plug-in  Software token generator  PC fingerprinting  IP Data Analytics  Geolocation  Range restriction  Anonymous proxy  Travel algorithms PC Data Internet-Network Connectivity (IP) Bank.com Website

© 2005 The Tower Group, Inc. Internet Anonymity?

© 2005 The Tower Group, Inc. Risk-Based Authentication Exhibit #: -E1 Source: TowerGroup WEB SERVER AUTHENTICATION ENGINE CUSTOMER CREDENTIALS DATABASE AUTHORIZATION RULES CUSTOMER PROFILE DATABASE IP GEOLOCATION DATABASE LOGIN REQUEST Authorization Decision  Access Granted  Access Denied  Additional Credentials Required ADMINISTRATIVE, CASE MANAGEMENT & REPORTING TOOLS

© 2005 The Tower Group, Inc. The Bigger Picture

© 2005 The Tower Group, Inc. A Comprehensive Strategy to Prevent Fraud Source: TowerGroup Exhibit #: 41:08CPI-E8  Internet Policies  Education  Strong & Secure Authentication  Behavioral/ Transactional Systems  Detection  Intervention  Prevention  Forensics  Policy Based Framework  Vulnerability Management/ Compliance Monitoring  Vigorous Access Management Consumer ProtectionBrand ProtectionData Protection Corporate Policy

© 2005 The Tower Group, Inc. Ingredients for Effective and Efficient Enterprise Fraud Management Exhibit #: 43:16B-E5 Source: TowerGroup People  Fraud culture  Fraud mgmt. incentives  Whistleblower  New employee screening Business Process  Rapid escalation of suspicious activity  Managing fraud across customer lifecycle  Link analysis across fraud types and lines of business Technology & Facilities  Unified view of fraud data  From systems to platforms  Reduced information exposure Customers  Education on fraud prevention  Security awareness campaigns  Heedful disclosure of personal information

© 2005 The Tower Group, Inc. Characteristics of Siloed vs. Enterprise Approach to Fraud Management Exhibit #: 43:16B-E4 Source: TowerGroup Note:R/A/A = Reporting/Alerts/Audit; CM = Case Management; M/D = Monitoring/Detection. Siloed Approach to Fraud ManagementEnterprise Fraud Management R/A/A CM M/D Point 1 Point 2 Point 3... R/A/A CM M/D Point Solution Module Fraud System  Reactive response to fraud permutations  No cross-channel, cross-line of business fraud picture  FSIs “run in place” in fraud fighting  Enables a proactive response to fraud as it morphs  Enterprise view of fraud risk and fraud as it occurs  Links to enterprise efforts for risk management and compliance

George Tubin Senior Analyst Consumer Banking © 2005 The Tower Group, Inc. May not be reproduced by any means without express permission. All rights reserved. TowerGroup is a wholly owned subsidiary of MasterCard International and operates as a separate business entity with complete editorial independence. Online Authentication and Security …and now, You Have To Do Something!