Skip to content
BOL Conferences
Thread Options
#582015 - 07/11/06 01:47 PM Internet loan applications and authentication
Gayle Offline
New Poster
Joined: Jan 2004
Posts: 19
I came across a presentation made by the FDIC on the myths & misconceptions of Authentication in an Internet Banking Environment. The presentation indicated that the guidance does not apply to loan/account applicaitons submitted over the Internet at this time. This was a joint presentation made by a systems vendor and the Senior Policy Analyst at the FDIC in Washington, DC. Why would Internet loan applications be excluded from multi-factor authentication?

Return to Top
eBanking / Technology
#582016 - 07/17/06 03:02 PM Re: Internet loan applications and authentication
Andy_Z Offline
10K Club
Andy_Z
Joined: Oct 2000
Posts: 27,748
On the Net
Authentication as to password and system entry - multi-factor authentication?

The multi-factor authentication wouldn't necessarily be an issue on an application because there is nothing available but a blank form. Something has to come first, the chicken or the egg. You give the app, they become a customer, now they need MFA to get into their account.
_________________________
AndyZ CRCM
My opinions are not necessarily my employers.
R+R-R=R+R
Rules and Regs minus Relationships equals Resentment and Rebellion. John Maxwell

Return to Top
#582017 - 10/23/06 06:16 PM Re: Internet loan applications and authentication
Oviedo Boy Offline
Platinum Poster
Joined: May 2006
Posts: 629
Tennessee
Has there been any official language I can access that states the position of MFA regarding Internet Loan Applications? Thanks!

Return to Top
#582018 - 10/24/06 03:31 PM Re: Internet loan applications and authentication
Andy_Z Offline
10K Club
Andy_Z
Joined: Oct 2000
Posts: 27,748
On the Net
The 08-15-06 FFIEC guidance addresses apps from non-customers. I believe that because the thrust is protection of "customers", there is a gap here. But I don't take this to mean you can ignore the need for data protection.

Q-16- Does the guidance apply to loan or deposit account applications submitted over the Internet by non-customers?

A-16- The guidance does not apply to applications submitted by non-customers. As the appendix to the guidance explains, customer verification during account origination is a related but separate process from that of authentication.
_________________________
AndyZ CRCM
My opinions are not necessarily my employers.
R+R-R=R+R
Rules and Regs minus Relationships equals Resentment and Rebellion. John Maxwell

Return to Top
#582019 - 10/31/06 06:57 PM Re: Internet loan applications and authentication
FraudHorn Offline
Member
FraudHorn
Joined: Dec 2005
Posts: 60
Maine
I'm not sure what their requirements were but our Internet loan application vendor conducted a risk assessment on their service and presented the findings to us. They decided the only risk that might require MFA is when an applicant (potential or current customer) returns to an application they had previously started and saved. It is only then that non-public, personal info is at risk. Their decision was to partially mask all risky info rather than require MFA. I ran this by our FDIC examiner and he seemed satisifed.
_________________________
The cannons don't thunder there's nothin' to plunder.

Return to Top

Moderator:  Andy_Z