BioCatch Highlights Limitations of Device ID Security

BioCatch has detailed some of the limitations of device ID in a new post on the company blog. In the post, the company acknowledges that device ID is a useful security tool when used in conjunction with other technologies, but nevertheless argues that it creates several blind spots that make it inadequate as an organization’s primary fraud prevention strategy.  

As BioCatch explains it, device ID is a “what you have” form of authentication that links a device to an individual user based on factors like browser data and IP address. The system will then approve future authentication requests as long as those requests come from a trusted source.

While that information is useful, it does not provide any insight (or ongoing security) beyond the login window. As a result, cybercriminals are able to operate unimpeded if they are able to get past the device ID check, and that can now be accomplished in several different ways. For example, a fraudster can use social engineering to trick a customer to log in and transfer funds, and the interaction will appear to be legitimate because the user did in fact use their regular device to access their account.

By the same token, a hacker can use a Remote Access Tool (RAT) to take over someone’s computer and initiate a fraudulent transaction from that device without the owner’s knowledge or consent. Device ID can also be spoofed remotely with methods like proxy IP addresses and Man-in-the-Browser attacks.

Device ID similarly struggles with new account fraud, largely because a new user does not yet have any device history. A fraudster and a new customer will both appear to be using an unfamiliar device, so device ID cannot intervene without creating barriers for genuine users.

With that in mind, BioCatch pushes behavioral biometrics as a solution for both problems. The company’s technology can identify suspicious behavioral patterns during the registration process, and can then continue to monitor the account after the user has logged in. The solution is able to spot and stop multiple forms of fraud that would slip past device ID alone.

BioCatch recently made the CB Insights FinTech 250 list as one of the industry’s fastest-growing financial security providers.  

–

September 30, 2020 – by Eric Weiss