TAP-OTAC
We provide both the security of hardware OTP and the convenience of mobile OTP
to ensure a robust & efficient financial authentication service.
Risk of smishing incidents in mobile OTP
A phishing scam at one bank in Singapore in 2021 demonstrated how mobile OTP remains vulnerable to smishing. As the OTP was delivered by text message via mobile, it was stolen and a fake text message was sent to bank users by scammers. This resulted in at least 469 victims with a loss of around S$8.5 million, which lead to the banks plans to transition to a digital OTP authentication process being put on hold. In Korea, a case in which a hacker installed a remote-control malicious code on a mobile phone through a link in a text message under the guise of a family member, and then used the stolen personal information to obtain a mobile OTP and transfer a large amount of money, has also been noted.
Relative security vulnerabilities compared to physical OTP
Unlike physical OTP devices (hardware tokens) that generate OTPs while separated from the network, current mobile OTPs (software tokens) are generated online, with user authentication and OTP generation performed within a single mobile environment. This means mOTPs are vulnerable to external cyber-attacks such as hijacking. After all, despite the inconvenience of portability and the need for periodic replacement, physical OTPs still provide unparalleled security in comparison to other two-factor authentication (2FA) methods.
Solutions
swIDch provides TAP-OTAC (card tapping mobile OTP) to protect against external threats that exploit the security vulnerability of mobile OTP by utilizing medium separation which is free from cyber-attacks. It can be easily applied to payment cards such as a debit card and/or credit card, generating non-duplicate and non-reusable OTPs by simply tapping the card on the user's mobile device. It means that users acquire the advantages of hardware OTP (hardware tokens) and mobile OTP (software tokens) at the same time; robust security and convenient user experience.
Why swIDch
that provides all of the following features, tested and substantiated
by the University of Surrey technical report
Sufficient to IDENTIFY user
that does NOT duplicate
in off-the-network environment
OTAC is a dynamic code, which means the code keeps changing. As a result, you don’t need to worry about any leak of your personal information, such as
your card details, because the codes must have already been changed when others try to use them.
The network connection is NOT necessary at all for generating OTAC.
Reducing an authentication stage that requires the network connection directly means there are fewer gateways for
the hackers to access our personal information.
Moreover, this feature enables users
to authenticate even when they are
in networkless environments, such
as on the plane, underground, rural or foreign areas.
swIDch can guarantee that the code never duplicates with anyone
at any given moment.
There is NO chance of someone else having the same code.
The users or their devices can be identified with the code alone.
Once OTAC has been generated, providing OTAC alone is already fully sufficient to identify the user as the code is unique.
It means, you can forget about the bundles of static information including IDs and passwords.