Access Security for Online Payments

Why you need access security for web and mobile payments

inWebo access security for web and mobile payments  

Authenticating the payer as the owner of the method used for a payment makes sense from a fraud reduction perspective, but not just that. For online payments made with cards, the liability of the payment is transferred from the merchant to the bank (or the issuer) if the user is authenticated by the bank (or the issuer). Banks and issuers therefore need to enforce secure authentication in order to limit their risks. However, making the payment too complex leads to a higher percentage of purchases being dropped, which is even worse than fraud from the merchants perspective. The convenience of the authentication mechanism is key. Finally, in regulations such as PDS2 in Europe, strong authentication is increasingly required for online payments. Limiting fraud, shifting liability, and ensuring compliance are the main reasons for enforcing secure and convenient user authentication during payments. Also, as specialists have found out, fraud always shifts from the best protected payment methods to the least protected ones.

inWebo access security for web and mobile payments

Our MFA solution for payment applications consists of

  • Client-side OTP-generation libraries, inWebo mAccess and inWebo Helium.
    • These libraries turn the interfaces to your payment applications – your mobile payment App or SDK, your mobile wallet App, as well as web browsers – into trusted devices, i.e. strong authentication methods.
    • Validating a payment on behalf of the user requires a valid One-Time Password (OTP) generated from one of the user’s trusted devices. Therefore, this defeats attackers who don’t have access to one of the user’s trusted device(s), while making the payment extremely easy for the legitimate user, since the OTP is generated locally (it is not sent to the user) and is provided automatically (the user doesn’t have to copy-paste it).
    • inWebo authentication libraries can dynamically be used for 1-factor (trusted device), 2-factor (trusted device + a secret or a biometric factor), or even 3-factor authentication (if combined across channels / devices). You can use them to design and implement efficient protection strategies across all online payment channels.
    • Unlike other MFA vendors, 100% of user devices – laptops, tablets, smartphones – are supported. Integrating the library into your web and/or mobile applications is all what it takes, there’s no physical token to provide or manage, no App or plugin to download. It’s a very efficient approach to MFA.
    • The libraries provide an abstraction layer for user credentials management. Your developers don’t need to worry about platform specific security integration.
  • A back-end authentication service and full API. The API’s obvious purpose is to validate OTPs received by your mobile and web payment applications and to enforce the security policies that you have defined. It also allows you to fully automate credential management, user enrollment (to MFA), and trusted device management. Only with such an automation can you implement security at scale.

What are your options

To get a deeper understanding of our solutions, you may

  • Sign up for free for a basic account and start implement inWebo access security for your web and mobile payment applications. You’ll be able to upgrade this account at any time to get more licences or options. Nothing to lose but an item on your to-do-list.
  • Evaluate inWebo for free and without commitment for 30 days. Note that we have project management, consulting, and integration partners trained in our solutions whom you can ask for an evaluation and a PoC.
  • Request a customized demo. We’ll be happy to show and explain the basics of our solution and answer your questions.