Security guarantees: digital certificates play the main role
The Internet is an open network. The banking services network is connected to the Internet, making online banking an easy target for unlawful intrusion and vicious attacks. In the process of communicating, sensitive information (such as passwords, transaction instructions and so on) which customers transmit online may also be intercepted, deciphered and altered. Security therefore becomes the basis for the survival and development of online banking. For this reason, banks have generally adopted effective technologies and services meant to ensure the security of online banking services.
Currently, most banks provide web/mass-edition online banking without a client. Relatively speaking, mass editions have a low level of security and few functions. Usually, their functions only include query and mutual transfers between current accounts and fixed-term accounts. When an outbound funds transfer is involved, digital certificate/professional edition authorized by banks, E-banking password cards, or detached USB Keys are needed. Typical examples include China Merchants Bank's professional edition and Industrial and Commercial Bank of China's U shield. Despite complicated handling procedures and methods of use, it has improved payment security to a certain extent, and has won recognition from most users. In the transaction information transmission process, the 128-Bit SSL Data Encryption Protocol is adopted in most online banking. In addition to technological security, at the services security level, banks are also committed to formulating sound internal operation management mechanisms for counter clerks to lower risks caused by internal factors.
Hidden security defects: online fraud is the number 1 concern
Despite various means of guarantees, online banking as the product of the Internet inevitably has some hidden security defects caused by the Internet. Currently, security risks mainly include confidentiality problems, online fraud, computer virus, hacker attacks, information pollution and system fault. In the past few years, banks and enterprises have rarely had security problems. Only some personal users have suffered from property loss due to lack of security protection awareness and measures in the process of using online banking. Online fraud is the security problem with the biggest harm and influence at present.
Presently, there are 4 types of online banking fraud. One is to trick uninformed users into clicking and entering fake websites in the guise of well-known enterprises, particularly banks, to steal their online banking account, login password, payment password and other sensitive information. The second is to use email and online chat to sell products and allure users to enter their website and enter their bank account number, login password and payment password. The third is to plant Trojan viruses into customers' computers; stealing information by asking them to access web pages, download programs or receive email. This is particularly outstanding in public venues such as Internet cafes. The fourth is to guess passwords through trial-and- error.
Security bottleneck: user ability is the key
Compared with advanced countries, online banking services in China are still very new, and need to be improved in the aspects of technology, economy, policies, regulation and user structure. Data show that in South Korea, online banking accounts for almost 40% of the traditional banking business volume. The figure is almost 50% in the United States and 60% in Sweden. By comparison, China is still a ways behind, despite the fast development of online banking services in the past few years. In particular, online banking services for personal users are even further behind (data from Industrial and Commercial Bank of China which takes the lead in the field show that online banking only accounts for 33.5% of its total business volume. But, only 4% of the transaction value comes from personal users). From the perspective of security, what are the bottlenecks that restrict the development of currently immature online banking services?
At the technological level, online banking faces a dilemma between security and ease-of-use. Technology is the foundation of online banking security. But, technological limitations mean that there is conflict between security and ease-of-use. The higher the security, the more tedious the application procedure will often become, and the more complicated the use and operations. Thus this reduces the ease-of-use and raises the threshold for users. On the flip side, as hackers improve their technology, simple-to- operate online banking products and services can hardly guarantee their security. It is precisely this contradiction that has made the promotion of online banking services more difficult. Banks often continue to weigh in between security and ease-of-use. As China gradually approaches the advanced level of international online banking security technologies, this will not be the primary factor that affects the penetration of online banking.
CCID Consulting thinks that user ability is the key factor that affects the development of online banking security and related services. User ability includes 3 aspects. One of them is knowledge and skills. Many users lack computer skills and network security awareness. For example, they do not enable their firewall or adopt other protection measures, leaving themselves open to unlawful elements. The second is consumption values. Many users use pirated systems and anti-virus software, which cannot be upgraded and even sometimes carry Trojan viruses themselves, thus causing great potential risks. The third is economic conditions. Many users still have no personal computer or network of their own. To use online banking services, they can only go to public venues such as Internet cafes, thus increasing online banking security risks. These problems mainly exist with personal users, and are major factors restricting the development of online banking services. This gap between domestic and foreign online banking users has caused many security problems in the process of online banking use, and in turn become a gap in the development and penetration of online banking services. To raise the percentage of online banking services, it is essential to conceive ways to improve user ability. This is also the biggest development bottleneck facing online banking services.
Meanwhile, a sound legal environment is an important guarantee for the development of online banking services. Several cases of online banking security have shown problems of unclear responsibility, absence of corresponding laws, regulations and systems, and lack of post-event remedial measures. These have not only caused losses to users, which are difficult to recover, but also struck a serious blow to customers' confidence in using online banking services. The only to establish users' confidence in using such services and pay the way for the promotion of online banking is to improve corresponding laws and regulations, and specify responsibilities for accidents and provisions for compensations.
While the road ahead is tortuous, the future looks bright. Not long ago, the China Banking Regulatory Commission issued a circular concerning strengthening work on online banking risk management and services, calling upon all commercial banks to adopt unified double identity authentication over operations on high risk online banking accounts before December 31, 2007 at the latest. This will strengthen the management of user account security. Thanks to the tripartite efforts by consumers who improve their own awareness of risk prevention and control, by the baking sector which strengthens security measures and the government department which improves systems and regulations, it is believed that the online banking and trading environment will be effectively improved. Users at large can feel at ease in using online banking, and enjoy all the conveniences which online banking can offer them.
