VeriSign service aims to curb ID theft

VeriSign Inc. is rolling out a new beta service for financial institutions to help protect online bankers against the growing threat of identity theft, officials said Thursday.

Free IT resource Virtualization Insights from Top Experts - Learn how virtualization gets real! Sponsored by Dell Free IT resource TechNet: More ways to know it, share it, and keep it running. Sponsored by Microsoft

The VeriSign Fraud Detection Service will incorporate technology VeriSign is gaining through its US$12 million acquisition of Snapcentric Inc., announced Friday and expected to close later this quarter. Key to the new service is Snapcentric's anomaly detection software, which tracks how a user normally accesses an online banking site and then flags unusual patterns in behavior, said Nico Popp, vice president of authentication services for VeriSign, in Mountain View, California.

"For each user, it sees if you behave the way you're expected to behave," said Popp. "For example, I travel all the time, and I bank online from different locations, so for me it's quite normal to have a changing IP address; but my wife banks from the same home machine at the same time every Saturday morning so for her that wouldn't be normal."

The technology is transparent to end users so they do not have to alter the way they interact with a Web site or install new software, Popp said. If the software detects abnormal online behavior, however, a user may be required to answer a question or respond to an e-mail or phone message with a one-time code.

In addition, the new service also includes a policy engine that uses rules to detect non-user specific patterns of behavior that indicate fraud, such as if a user is coming from a blacklisted IP (Internet Protocol) address, Popp said.

VeriSign says the new service will help banks comply with guidance issued by the Federal Financial Institutions Examination Council (FFIEC) last year. The FFIEC guidelines call for financial institutions to implement stronger authentication methods than user name and password requirements for high-risk online transactions that involve transfer of funds or customer information.

Financial institutions interested in beta testing the service can contact VeriSign now. General availability for the service is expected by mid-April.