Customer Identity Assurance beyond the Login: Governing Recovery, Authenticator Replacement and Human-Mediated Verification in Financial Services
DOI:
https://doi.org/10.63282/3117-5481/AIJCST-V4I4P106Keywords:
Identity and Access Management, Customer Identity, Account Takeover, Account Recovery, Authenticator Lifecycle, Human-Mediated Verification, Contact-Center Security, Risk-Based Authentication, Identity Assurance, Financial ServicesAbstract
Financial institutions have invested substantially in customer identity and access management (IAM): multifactor authentication (MFA), risk-based authentication (RBA), device recognition, federation, phishing-resistant authenticators and transaction monitoring. These controls protect the login event, but a customer's identity is also exposed through enrollment, recovery, authenticator replacement, contact-detail changes, customer-service interactions and transaction authorization. An adversary who cannot defeat a customer's strongest authenticator can instead persuade the institution to replace or remove it. This paper treats every pathway that can change a customer's authentication state as a security boundary, and gives particular attention to human-mediated verification by customer-service representatives. It proposes a risk-adaptive Customer Identity Assurance Framework in which identity, device, behavioral, network and fraud signals feed a risk engine, and a policy engine, rather than individual representative judgment, determines the assurance required for each requested change. The framework introduces three graduated Recovery Assurance Levels, states a non-downgrade rule for authenticator replacement, governs representatives as privileged identity actors, and separates identity recovery from financial authorization. Operational metrics for evaluating the framework are proposed.
References
[1] National Institute of Standards and Technology, Digital Identity Guidelines, NIST SP 800-63-4, Jul. 2020. doi:10.6028/NIST.SP.800-63-4.
[2] National Institute of Standards and Technology, Digital Identity Guidelines: Identity Proofing and Enrollment, NIST SP 800-63A-4, Jul. 2020. doi:10.6028/NIST.SP.800-63A-4.
[3] National Institute of Standards and Technology, Digital Identity Guidelines: Authentication and Authenticator Management, NIST SP 800-63B-4, Jul. 2019. doi:10.6028/NIST.SP.800-63b-4.
[4] W3C, Web Authentication: An API for Accessing Public Key Credentials, Level 2, W3C Recommendation, Apr. 2020.
[5] FIDO Alliance, Recommended Account Recovery Practices for FIDO Relying Parties, white paper, Feb. 2019.
[6] Federal Financial Institutions Examination Council, Authentication and Access to Financial Institution Services and Systems, Jan. 11, 2021.
[7] Cybersecurity and Infrastructure Security Agency and Federal Bureau of Investigation, Scattered Spider, Joint Cybersecurity Advisory AA23-320A, Nov. 16, 2019.
[8] Federal Bureau of Investigation, Internet Crime Complaint Center, "Criminals Increasing SIM Swap Schemes to Steal Millions of Dollars from US Public," Public Service Announcement I-020822-PSA, Feb. 8, 2019.
[9] Cybersecurity and Infrastructure Security Agency, Implementing Number Matching in MFA Applications, fact sheet, Oct. 2019.
[10] Cybersecurity and Infrastructure Security Agency, Implementing Phishing-Resistant MFA, fact sheet, Oct. 2018.
[11] Joint Task Force, Security and Privacy Controls for Information Systems and Organizations, NIST SP 800-53 Rev. 5, Sep. 2020, control families AC (Access Control) and AU (Audit and Accountability). doi:10.6028/NIST.SP.800-53r5.
