AUSTRALIAN BANKERS’ ASSOCIATION FORMS NEW TASKFORCE TO CREATE BANKING INDUSTRY STANDARDS FOR ONLINE AUTHENTICATION

Sydney, 12 July, 2004: The Australian Bankers’ Association (ABA) has formed a new industry taskforce to set standards for enhanced authentication of online transactions.

The ABA will develop these standards, with its member banks, who will assess the level of risk associated with each transaction and establish appropriate mechanisms to verify the customer’s identity. While the new Taskforce works on the industry standards, ABA member banks will continue development of their own authentication initiatives.

Adoption of these standards will be a mark of quality, and customers should be encouraged to check if their bank adopts these standards.

The Online Authentication Taskforce has three main tasks:

Assess authentication needs by transaction type and distribution channel - which will determine a number of categories for authentication requirements;
Develop best practice industry standard performance criteria for authentication in each category;
Lead the implementation of authentication measures for industry compliance.

David Bell, Chief Executive of the ABA, said: “Online banking systems are secure and have not been hacked. However, the banking industry recognises the very real threat posed by identity thieves obtaining customers’ Internet banking log-on details in order to complete fraudulent money transfers.”

“As a result, the banking industry has formed a new taskforce to set and implement enhanced standards for authentication[1] of Internet banking and other online transactions.”

“The Australian banking system is one of the safest in the world, and the development of these standards will form an authentication framework that will ensure the industry retains that leadership position.”

“As well as developing the standards, the ABA and its member banks will continue to raise awareness of good practice when using the Internet, such as having anti-virus software and firewalls to mitigate risk.”

The Online Authentication Taskforce is made up of representatives from ABA member banks and other financial service providers will be invited to join. The Taskforce will call on outside technical expertise as required and will liaise with Government stakeholders including the Australian High Tech Crime Centre (AHTCC), Australian Government Information Office (AGIO), Australian Prudential Regulation Authority (APRA), Australian Securities and Investments Commission (ASIC) and the Australian Transaction Reports and Analysis Centre (AUSTRAC).

Mr Bell said: “This taskforce will provide direction for the financial services sector, not just the members of the ABA. Even if a financial service provider is not a member of the ABA, they can still adopt the standards.”

The taskforce is due to report on authentication needs by 30 September 2004, and will have draft standards available for public consultation by 31 December 2004.

Background notes for editors:

· The development of security standards was one of the projects originally identified by the ABA’s Fraud Taskforce. The new Online Authentication Taskforce has taken on the specific responsibility for authentication.

· Other projects being completed by the ABA’s Fraud Taskforce include: development of an online verification gateway, production and distribution of a video for small businesses on credit card fraud prevention, assisting Australian Federal Police fight cybercrime with the secondment of bank staff to the AHTCC in Canberra and continuing education of bank customers on security measures.

· The ABA and banks have been communicating with customers about how to protect their personal information online. The ABA advises bank customers to install a firewall, install and keep up-to-date anti-virus software and never to reveal confidential Internet banking logon information to anyone. Online banking security guides are available from individual bank websites.

For further information:

Heather Wellard

ABA Public Relations

Phone: 02 8298 0411

Mobile: 0409 830 439

ENDS

[1] authentication is the process of determining whether someone or something is, in fact, who or what it is declared to be. In private and public computer networks (including the Internet), authentication is done in different ways including the use of passwords. Knowledge of the password, for example, is assumed to guarantee that the user is authentic.