Hackers bypass online security at 34 banks-can get past two-factor authentication

[Krista H_Authentify]

1. Not All Two-Factor Authentications are the Same

Two-factor authentication is a solid security practice, but the techniques vary quite a bit. The OTP exploited by Emmental is obviously flawed because the hackers have redirected the OTP to themselves. An interactive second factor to authenticate the actual person POST-LOGIN like a voice biometric or fingerprint would have stopped some of the Emmental account hijacks. A phone call over the voice channel of the mobile phone repeating the actual transaction details, like “To send $5,000 to an account ending in Ivan666 do this… to cancel do that” would catch the end users attention if they were sending $50 to the electric company.