Pain points

Simple authentication methods such as mobile OTP (One-Time Password), mobile authentication apps, mobile phone identity verification, and biometrics are widely used in internet-based financial transactions, which allow for easy authentication with a user's smartphone rather than a separate device. However, it is still difficult to fully block interceptions of personal information in financial services due to the inherent vulnerabilities of connected devices.

- Smishing risks in mobile OTP

A phishing scam at one bank in Singapore in 2021 demonstrated how mobile OTP remains vulnerable to smishing. As the OTP was delivered by text message via mobile, it was stolen and a fake text message was sent to bank users by scammers. This resulted in at least 469 victims with a loss of around S$8.5 million, which lead to the banks plans to transition to a digital OTP authentication process being put on hold. In Korea, a case in which a hacker installed a remote-control malicious code on a mobile phone through a link in a text message under the guise of a family member, and then used the stolen personal information to obtain a mobile OTP and transfer a large amount of money, has also been noted.

- Relative vulnerability of security compared to physical OTP

Unlike physical OTP devices (hardware tokens) that generate OTPs while separated from the network, current mobile OTPs (software tokens) are generated online, with user authentication and OTP generation performed within a single mobile environment.

This means mOTPs are vulnerable to external cyber-attacks such as hijacking. After all, despite the inconvenience of portability and the need for periodic replacement, physical OTPs still provide unparalleled security in comparison to other two-factor authentication (2FA) methods.

- Smart OTP's separate card requirement, limited OS support, and operation delay

Smart OTP is evaluated as an incomplete service because it still requires a separate card to be carried by the user despite offering enhanced security. It also cannot be used on iPhone, despite the advantage of being compatible with other banks, unlike existing mobile OTP. In addition, many problems remain including operational delays in generating OTPs.

Solutions

SSenStone provides TAP-OTAC, a Card Tapping Mobile OTP, to protect against external threats that exploit the security vulnerability of mobile OTP by utilizing medium separation which is free from cyber-attacks. It can be easily applied to payment cards such as a debit card and/or credit card, generating non-duplicate and non-reusable OTPs by simply tapping the card on the user's mobile device. It means that users acquire the advantages of hardware OTP (hardware tokens) and mobile OTP (software tokens) at the same time; robust security and convenient user experience.

As of 2021, there are 2.8 billion credit cards in use worldwide. Americans have an average of four credit cards, and EU residents have 0.8 to 3.9 mobile cards per capita. In Korea, the number of credit cards held per person stood at 1.79. SSenStone’s Card Tapping Mobile OTP increases the frequency of physical card use by adding the OTP function to the payment card. Considering that most consumers normally use one or two cards, it will naturally lead to the effect of increasing customer loyalty.

OTAC embedded cards can also be used as a means of diverse authentication beyond payment. Even when logging in to mission-critical sites such as internet banking, you can generate a one-time QR code just by tapping the back of your smart phone. You can also use the same card to enter the office or a restricted area by tapping it on the digital door lock. Businesses can use this innovative card by integrating corporate payment cards, access control devices, and employee ID into one card. High manufacturing costs related to contactless payment function will alleviated naturally through additional uses other than payment only.

Why OTAC

OTAC, developed by SSenStone, is the original technology that provides all of the following features at the same time.

OTAC is a dynamic code, which means the code keeps changing. As a result, you don’t need to worry about any leak of your personal information, such as your card details, because the codes must have already been changed when others try to use them.
The network connection is NOT necessary at all for generating OTAC.

Reducing an authentication stage that requires the network connection directly means there are fewer gateways for the hackers to access our personal information.

Moreover, this feature enables users to authenticate even when they are in networkless environments, such as on the plane, underground, rural or foreign areas.
swIDch can guarantee that the code never duplicates with anyone at any given moment.

There is NO chance of someone else having the same code.
The users or their devices can be identified with the code alone.

Once OTAC has been generated, providing OTAC alone is already fully sufficient to identify the user as the code is unique.

It means, you can forget about the bundles of static information including IDs and passwords.

The University of Surrey, one of the leading global cyber security companies in the UK, conducted OTAC algorithm analysis and academic verification of SSenStone. For the full text of the thesis, please visit the University of Surrey website and download the report.

University of Surrey Website Download the Report

Contact Us

Improve your authentication environment and
make your service reliable with SSenStone!

Inquire now.

5F, 329, Cheonho-daero Dongdaemun-gu, Seoul, Republic of Korea

Contact below if you have an urgent inquiry.

Korea Office (SSenStone)

5F, 329, Cheonho-daero Dongdaemun-gu, Seoul, Republic of Korea (02622)

Tel : 02-569-9668 | Fax : 02-6455-9668

im@ssenstone.com

UK Office (swIDch)

swIDch Ltd Office 176, 1st Floor, 3 More London Riverside, London SE1 2RE

Tel : 020-3283-4081

info@swidch.com

TAP-OTAC