Death of the tokens as banks use apps for authentication

Find out how Citi and UOB are simplifying authentication processes.

When Citi launched MobilePASS — an app-based soft token that removes the need for physical tokens when corporate users access Citi e-banking platforms — it showed that the bank was willing to play the technology game to meet customers’ heightened expectations. Experts reckon Asian banks must deploy the next generation of technologies, especially on mobile, to withstand the assault of hungry fintech rivals, and some, like Citi and UOB, are stepping up to the challenge.

“Amongst some banks use of the secure-site channel has begun to shrink, as some customers enthusiastically shift most of their interactions to mobile banking,” says Vinayak HV, partner in McKinsey’s Singapore office.

In the case of Citi, the new MobilePASS feature was designed for corporate clients — from chief financial offers who need to view transaction analytics to corporate treasures who approve transactions on-the-go, says Keng-Mun Lee, Asia Pacific head of channel and enterprise services, treasury, and trade solutions at Citi.

Similarly, UOB has launched UOB Mighty Secure, a digital security token on smartphones, allowing customers to add a new payee to transfer funds or pay credit card bills through the UOB Mighty app without having to toggle between two devices. The feature also requires a PIN or fingerprint login, then a UOB Mighty Secure PIN to generate a one-time password — a two-factor authentication.

For Vinayak, simplifying authentication processes to make them both secure and user-friendly should become a best practice for banks. Currently, about three in five banks surveyed by McKinsey & Company lack the ability to authenticate a user’s mobile device, which can deter higher usage.

“In our experience, banks that store device information and allow users to log on simply by entering a personal identification number or fingerprint see three times more digital interaction than banks that require users to enter data via alphanumeric digits each time they log on,” concludes Vinayak.