শনিবার, ২৬ অক্টোবর, ২০১৩

Electronic Banking and Online Banking


 
Electronic Banking and Online Banking

[ From chapter-2 of the book "Information Technology in Banking" written by Abul Kashem Md. Shirin and Nusrat Tamanna Prianka and published by Institute of Bankers, Bangladesh (IBB) ]

1.         Electronic Banking

Electronic Banking is modern banking techniques using which a Bank customer can avail banking services without going physically into a bank branch and without assistance of any bank officials. The electronic banking services are narrated below:

1.1.      ATM

ATM or Automated Teller Machine is used mainly for cash-delivery operations with plastic cards. Besides, the ATM allows the holder of a card to receive the information on the current status of the account (including an extract on a paper), and also to transfer money from one account to another.

ATM is supplied with the device for reading a card, and with the display and the keyboard for interaction with the card-holder. The ATM is equipped with the personal computer which provides management of a cash dispenser and the control of its status.

The cash dispenser is a storehouse of cash. Monetary denominations in an ATM are placed in cassettes which are in the special safe (vault). The number of cassette defines number of the denominations which are given out by an ATM.

At present the majority of models are designed for job in on-line mode with magnetic strip cards as well as smart cards.

For maintenance of communication functions ATMs are equipped with modems or LAN Card.

Banks in Bangladesh have installed ATMs in different parts of the country with a view to pass on the banking services close to the customers. As such the customers do not need to go to bank branches for withdrawal or deposit of money or other services. He can avail these services from an ATM installed close to his residence, office or shopping place. ATMs remain open 24 hours a day and 365 days a year. In this way the customers can withdraw or deposit money through out whole day and night even in the holidays. This has given freedom of banking to the customers. Now customers are not worried to withdraw money before close of cash counter at 3:00 pm or before a long holiday or before a journey to another city.

Bank customers can avail following services from ATM Network:

a)      Cash withdrawal
b)      Payment of utility bills
c)      Fund transfer from customers own account to another account
d)      Checking account balance
e)      Printing mini statement (last 5 transactions)
f)       Cash and cheque deposit

However most of the ATMs installed in Bangladesh do not have facility to deposit cash. In some ATM booths a separate deposit machine has been installed to accept cash in envelop and cheque. In such case customer inputs his account number and amount to be deposited in the deposit machine. The machine then print the account number and the amount on an envelop and present the envelop to the customer. The customer now insert the money into the envelop, close the envelop and drop it into the machine. In this way of depositing money, banks sometime may found that the amount figure inputted into the system and the money actually inserted into the envelop is not matching. This may create a dispute. Bank normally count such enveloped under the surveillance of a CCTV system to record such anomalies if any.

There are ATM machines which can accept bundles of money, count the money supplied in different denominations and check for fake notes. These types of ATM machine are called cash-in cash-out ATM. There is another type of ATM which has above functionalities and additionally it can deliver the same money received from one customer to other customers who come to the same ATM later on for withdrawing money. This type of ATM is called Recycling ATM.

To avail the ATM services by a customer, he needs a plastic card and PIN (Personal Identification Number). This plastic card and PIN is supplied by the bank to the customer after opening an account with the bank. This plastic card is called as ATM card or Debit Card. The customer first insert his card in a slot at ATM and then type his PIN using the keyboard of ATM. Then a menu appears using which the customer can do the required activities. In addition to the ATM card or debit card, a customer can also use his Credit Card and PIN for withdrawing money from ATM.

1.2.      POS terminal

A typical POS (Point of Sale) terminal has built-in devices for reading smarts-cards (micro chip) and magnetic strip, key board with a built-in PIN PAD, a printer, a port for connection with a PC or with a electronic cash register (ECR). Besides usually the POS terminal is equipped with a modem with a capability to dial to the NAC (Network Access Controller) at Data Center of the Bank.

Modern POS terminal have GPRS functionality, thus instead of modem it contains a SIM card for connection with the data center using mobile connectivity. Thus this type of POS terminal is movable. To support the mobility of the POS terminal, it has been provided with a battery for supplying power during transactions. The advantages of the GPRS POS terminals are as follows:

a)      The merchant does not require a PSTN connection for use of the POS terminal.
b)      The customer does not require to handover the card to the bearer which can lead the card to be duplicated.
c)      In case of debit card, the customer does not require to come to the cash counter for insertion of his PIN at the PIN PAD of the POS terminal.
d)      It can be used by a small floating shops who sales the goods in different places such as residences, parks, rail stations etc.

Banks buy the POS terminals and supply to a merchant (shop/restaurant) free of cost but at an agreed merchant commission. The merchant commission refers to the commission in percentage over the sale amount settled using the supplied POS terminal which the merchant pay to the bank. This normally rages from 1.5% to 3%. As per the agreement a merchant should not charge the customer for the commission amount. If a merchant do so, the bank has the right to withdraw the POS terminal from the merchant.

After selection of goods from a shop, a customer comes to the counter and handover the card to the teller for settlement of the bill. If the card is a meg-strip card, the teller swipes the card at a long slot or if the card is a chip based card, the teller deep (insert) it into a slot. The teller types the billed amount. If the card is a debit card, he asks the customer to insert his PIN and the customer types his PIN on the key board. Then the teller presses OK button. The POS terminal automatically dials to a stored number and gets connected to the data center of the bank. It then transfers the card information with amount to the bank server for debiting the customer account and crediting the merchants account. If the server can perform the operation successfully, it informs the same to the POS terminal, and the POS terminal prints an approval slip at its printer. If the card is a credit card, the PIN is not required and the teller asks the customer to put his signature on this slip. The teller must verify that the signature is same as that recorded at the back of the card. Signature is not required if the card is a debit card.

Therefore the customer authorizes a POS transaction by signing the approval slip if the card is a credit card, and by typing PIN if the card is a debit card.

1.3.      Internet Banking

Internet Banking is a way of performing some banking activities through internet by a customer himself sitting at his home or office. In some other country, this is also termed as Online Banking. For accessing the internet banking facility of a bank, the customer must have a computer and an internet connection. Then he needs to get an ID (identification) and corresponding password from his bank for accessing internet banking system.

Having all the above, the customer first visit to the website of the bank (by typing website address of the bank at the address bar of a browser) and click the link written “Internet Banking”. The internet banking page will be displayed where the customer has to type his ID and password. If these are correct, the customer will get a menu using which he can do the following activities:

a)      Check balance of all the accounts
b)      View and print the account statement for a particular period
c)      Payment of utility bills
d)      Payment of loan installments
e)      Payment of fee of the educational institutions
f)       Add / modify / delete Standing Instruction
g)      Open a FDR taking money from his SB / STD / CD account
h)      Redeem FDR at maturity or before maturity (money will be transfer to SB / STD / CD account)
i)        Creating LC and sending to the Bank for authorization
j)        Sending request for Cheque book
k)      Making stop payment on a cheque leaf
l)        Check status of a cheque deposited for clearing
m)   Apply for a personal loan
n)      Checking interest rate
o)      Checking exchange rate
p)      Change password, etc.

It may be mentioned that using internet banking system, a customer can’t receive or deposit cash.
           
1.4.      sms Banking

sms banking is a way of performing some banking activities by a customer himself using sms from his mobile phone. For accessing the sms banking system, the mobile of the customer must be registered with the bank. The bank will provide a PIN to the customer. Then the customer can perform the following activities by sending sms from his registered mobile:

a)      Checking account balance
b)      Obtaining a mini statement of his account
c)      Payment of utility bill
d)      Payment of bill against purchase of goods and services
e)      Mobile top up
f)       Fund transfer
g)      Change PIN etc

To do any of the above activities, the customer has to write a sms as per the syntax defined by the bank. For example, for checking account balance the customer may write: “Bal 1234”, where 1234 is his PIN. Then he sends the sms to the short code of the bank, say 14214. This will first go to the mobile operator’s system which knows that the short code (14214) belongs to a bank. The mobile operator will send his sms along with the mobile number to the bank server. As the key word is “Bal”, the bank server knows that the customer is looking for his account balance. System will find the corresponding account number (against the mobile number), extract the balance of the account (if the PIN is correct) from the database and send a sms including account balance to the mobile of the customer. The return sms may be as under:

            Date: 30/5/2010, Time: 2310, Account No.: 99999999, Balance: BDT 9999.99

The syntax for other activities may be as under:

i)        Mini statement:                      stm <PIN>
ii)      Utility bill payment:                ub <PIN> <biller code> <amount>
iii)    Payment against purchase:    pay <PIN> <merchant code> <amount>
iv)    Mobile top up:                        tu <PIN> <mobile number> <amount>
v)      Fund transfer:                         ft <PIN> <to account number> <amount>
vi)    Change PIN:                            pin <old PIN> <new PIN>

1.5.      Alert Banking

Alert Banking is a system which sends a sms to the customer when a debit or credit transaction of an amount more than a pre-specified amount occurs in the customer’s account. For example if a credit alert is set in a customer’s account for an amount more than Tk.1000/- and his monthly salary of Tk.27,000/- is deposited into his account, system will generate a sms as under and send to the customer’s mobile registered for this service:

“Your account has been credited for an amount of BDT 27000/- on 23/4/2010 at 2310.”

The Alert Banking is useful for the customers who receive salary or foreign remittance regularly. This is also useful for the customers as he can come to know about any fraudulent activity in his account instantly and can undertake immediate measures.

To setup an alert against an account, the bank needs to know the following from a customer:

a)      Mobile number of the customer
b)      Account number of the customer
c)      Debit amount: If the transaction amount is more than this, a debit alert will be generated
d)      Credit amount: If the transaction amount is more than this, a credit alert will be generated

1.6.      IVR

IVR or Interactive Voice Response is an automated system where a customer can call from his land phone or mobile phone and interact with the machine pressing digits to perform some banking services. These services may include obtaining information such as balance inquiry or do transactions such as fund transfer and activate/deactivate credit card.

To do banking through IVR, the customer needs to obtain a T-PIN from the Bank. Then the customer will call to a short code such as 3225. The call will be terminated to a machine in the bank. The machine will welcome the customer and ask “Press 1 for account services, 2 for Card services …...” Now if the customer presses 1 in the keyboard of his phone device, the machine will ask “Press 1 for account balance, 2 for fund transfer, 3 for cheque book request, 4 for exchange rate, …..” If the customer now presses 1, the system reads-out his account balance.

2.         Advantages and disadvantages of Electronic Banking

After introduction of the electronic banking systems, it has been a revolutionary change is the way of doing banking both by the bank officials as well as its customers. The Bank officials do not need to record all the transactions manually. The customers do not need to be in long queue at the branches. The advantages and disadvantages of electronic banking systems are mentioned below:

2.1.      Advantages:

i)          Customers do not need to go to a branch for withdrawal of money. He can go to any ATM in the city he lives or in another city and can easily withdraw money.

ii)         Customers do not need to withdraw money during office time. He can withdraw money from ATM at any time, such as during day or night, even on a holiday.

iii)        If a customer goes for a personal / official / business tour, he does not need to carry huge money with him. Thus the risk of hijacking / theft of money can be avoided.

iv)        Customers do not need to go to branch for payment of utility bills and face a long queue. The customers can pay his utility bills such as electricity bill, telephone bill, gas bill and tuition fees of the educational institutions using ATMs anytime anywhere, using internet banking system from home, office or while travelling abroad, and using sms & IVR 24 hours a day, 365 days a year from home, office or while the customer is in a vehicle.

v)         The customer does not need to go to a branch for transferring money from his account to another account. He can affect such fund transfer anytime from anywhere using ATM, Internet Banking system, sms system or IVR.

vi)        Using internet banking system, the customer can open an FDR debiting his SB/STD/CD account. The FDR will be redeemed or reinvested at maturity as per the instruction. If required, the FDR can also be redeemed before maturity.

vii)       The customer does not need to go to a market with a huge amount of money. He can use his card at the POS terminal to pay his bills. This reduces risk of carrying fund. On the other hand, the shop owners also do not need to keep huge cash at his counter which in turn reduce risk of theft at counter or hijacking during transferring money from the shop to the bank.

viii)      If the customer is a salary holder, he gets an alert message at the time of depositing salary into his account. Thus he always remains updated on the status of his account.

ix)        If a foreign remittance is deposited in the account of a customer, he gets an instant sms at his mobile phone which informs him on the remittance amount. Thus customer does not need to remain worried about the status of the remittance sent by his dear ones from abroad.

x)         If any unusual transaction happens in his account, he can come to know the same instantly and make complaint to the bank in time. He can also inform the bank to take necessary measures to avoid such fraudulent activities in his account / card in future.

xi)        After introduction of electronic banking systems, most of the customers perform banking activities themselves. Thus the bank officials can invest their time for other activities. Bank can serve more customers using lesser employees.

xii)       Customer has more control over his deposited money.

xiii)      For electronic banking services, the per-transaction cost is minimum. As such the bank can charge small amount of fees to the customers for such services.

xiv)      As the customers have better control over his money and the money is available all the time anywhere, the customer keeps all the deposit to the bank which is offering electronic banking services. As such the low cost deposit of the bank increases and consequently the profit of the bank also increases.

2.2.      Disadvantages:

i)          Customers can not withdraw more than an amount and more than a number of times from the ATM. For example, a particular bank may set the amount per withdraw at Tk.20,000/-, total withdraw per day at Tk.50,000/- and number of time the customers can withdraw per day at 5. If the customer requires more than Tk.50,000/- in a day, he must go to a branch.

ii)         Customers may not get money from ATM due to fault at ATM hardware or software or due to exhaust of the money at the ATM vault.

iii)        Cash can’t be withdrawn or deposited through Internet Banking, POS terminal, sms or IVR systems.

iv)        Customer must have a computer with internet connection to access internet banking system.

v)         If a hacker can know the password of the Internet Banking System of a customer, he can transfer money to another account and then withdraw from ATM.

vi)        If a hacker can capture the PIN and card information of a customer during travelling the information from ATM/POS to the bank data center, he can produce a duplicate card and withdraw all the money of the customer from an ATM. Hacker can also install a skimming device with the ATM and collect the card information and PIN.

vii)       sms is not a secured media of communication. As such banking activities using sms is not secured.

viii)      Electronic Banking systems are technology driven. Thus the customers need to know some basic technology-driven operations.

ix)        Bank needs a large set of skilled manpower for installation and maintenance of electronic banking systems.

x)         Setup and ongoing maintenance of electronic banking systems are very costly.


3.         Online Banking

In some of the countries, the online banking refers to the Internet Banking System. However in our country, online banking means installation of a centralized core banking system in which all the branches are connected using a WAN (wide area network) and thus the customers can do banking in any branch of the bank. This is also termed as “Any Branch Banking”. The advantages and disadvantages of online banking or Any Branch Banking are as under:

3.1.      Advantages

i)          If the online banking system is introduced in a bank, the customer of a branch becomes customer of the bank. Thus he can withdraw money from any branch or deposit money to any branch of the bank. He can also perform all the transactions from any branch of his choice such as balance inquiry, collection of account statement, placing request for cheque book, collection and preparation of Payment Order (PO) or Demand Draft (DD), opening of LC, buying/selling of foreign currency, receiving foreign remittance etc.

ii)         If a customer goes to another city for personal / official / business purpose, he does not require carrying money with him. He can withdraw money from a branch in that city.

iii)        If a customer receives money from his business partner while he is travelling another city, he does not need to carry back all the money with him. He can deposit the money to any branch of the bank in that city.

iv)        The customer does not need to send PO or DD to other parties for business purpose. He can directly deposit money to the account of his business partners.

v)         In the online banking system, all the customer information and transactions are stored centrally in a data center. Thus it is not require maintaining huge infrastructure in each of the branches and thus posting IT experts in all the branches for maintaining infrastructure and database of the customers at branch level.

vi)        Due to installation of core banking system in banks, it has become possible to debut various delivery channels such as ATM network, POS network, internet banking system, sms banking system, alert banking system, IVR etc.

3.2.      Disadvantages

i)          For introducing online banking system, all the branches need to be brought under a WAN (wide area network). Required communication infrastructure for WAN is not available in all area of the country.

ii)         After introduction of online banking system, all the banking activities become dependent on computer. Therefore if there is no electric power for a long time, all the banking activities become unavailable for that period. This becomes a challenge for the online banking system in the rural area where availability of electric power is very rare.

iii)        For operation of online banking system, all the employees of a branch must be computer literate.

iv)        Sometime, the communication network fails (break down). In such case the branch become disconnected from the data center and thus unable to do any transaction. This creates suffering to the customers.

v)         Preparation of central data center, installation of core banking software, setup of WAN and supply of computers to all the branches for each of the employees are very costly.

vi)        Setup and maintenance of online banking is a very complex activity. For this a very strong expert team is required. Such a team is not easy available. They are also very costly.

vii)       Cost of centralized software is much higher than that of a de-centralized software.


মঙ্গলবার, ৮ অক্টোবর, ২০১৩

Internet Banking



Internet Banking


[ From chapter-12 of the book "Information Technology in Banking" written by Abul Kashem Md. Shirin and Nusrat Tamanna Prianka and published by Institute of Bankers, Bangladesh (IBB) ]
1.         What is Internet Banking?

Internet banking is also known as i-banking or on-line banking. Internet banking is a system which the customers can access from his home, office or anywhere in the world through internet. To avail this service, the customer needs to get an user ID and password from his bank and he need to have access to a computer with internet connection.

2.         i-Banking Password

When the customer accesses the i-Banking for the first time, the system will ask for changing his password. The customer must change the password as per the password policy of the bank. For example a bank may have adopted the following password policy:

•      Length must be min. 6 - max. 12 characters
•      User ID is not allowed as a part of the password
•    Password should have at least 1 upper case, at least 1 lower case, 1 numeric digit and no symbolic characters
•      Number of identical characters: 2

The following is the valid password: Joyful7, raiN567

The following are not valid passwords: Joy7, rain567, rain666, aaAmin2

3.         i-Banking functions

The customers can perform almost all types of banking activities through i-Banking except cash transactions.

Account Summary    

The customer will be able to view the list of Current, Savings, Term Deposit and retail loan accounts held and the Current Balances in each account in the account currency. An indicative valuation of the account balances can be performed in the customer’s preferred currency

Account Details 

The customer can choose a particular account (Savings, Checking account, Term Deposit or Loan account) and see the account details such as date of opening, date of maturity, outstanding balance, interest accrued, interest paid, limit amount etc.

Account Activity

The customer can see transaction activity in a given account for a range of dates specified by the customer.

Transfer Funds

The customer can transfer funds from his one account to his another account with the Bank.

Open Term Deposit (TD)

The customer can open a Term Deposit by transferring funds from one of his current or savings accounts with the Bank.

Modify Term Deposit

The customer can modify the maturity and interest instruction details of the existing term deposit accounts.

Close Term Deposit

The customer can close a TD account prematurely in part or in full. He will be shown the penalty applicable as per the product definition.

Loans Repayment

The customer can make payment of the Loan installment or any amount by specifying the amount. The amount will be transferred from his deposit account.

Early and Final Settlement

The customer can make an early payment of the entire loan amount due. The amount will be transferred from his deposit account.

Standing Instructions – The customer can setup standing instructions for transferring a fixed amount of funds from his deposit account to another deposit (self or third party) or loan account in the bank in a fixed date of every week / month / quarter / year. He can specify the start date and the final date for execution of the standing instruction.

The users can set-up multiple instructions for each account and define the priority in which they can be executed. The instructions can be setup for one–time transfer or for recurring transfers at a pre-defined frequency.

Payee maintenance – The customer can set up templates for use in ‘Third party Funds Transfer’ mentioning account number and other details of the ‘Third Party’. The ‘Third Party’ means an individual who has account with the same bank. However an educational institute or utility company is not a ‘Third Party’.  To be effective and available in the list during the “Third Party Transfers”, such entries need to be approved (authorized) by a bank officer.

Third Party Transfers - The customer can transfer funds from one of his accounts to another ‘Third Party’ account within the bank. The ‘Third Party’ account must be pre-recorded in the system using ‘Payee Maintenance’ and authorized by a Bank Officer for making this available in the list.

Statement Request

The customer can make a request for account statement for a required period. The bank will manually service this request.

Cheque Book Request

The customer can make a request for a cheque book for an account choosing the number of leaves desired from the set that the Bank offers.

Stop Cheque Request

The customer can choose an Account and enter the cheque number/range of cheque numbers for which the cheque encashment should be stopped. He can also specify the reason for stopping the encashment.

Cheque Status Inquiry

The customer can choose an Account and enter the cheque number for which the status should be viewed. In case the cheque is returned or stopped, the reason for rejection will also be shown.

FX Rates Inquiry

The customer can query on the FX rates that the Bank offers using this function. The rates displayed are the TT, cash and DD rates.

Interest Rates Inquiry

The customer can query on the interest rates offered on Savings & Term Deposit Products offered by the Bank.

Change Password

The customer can voluntarily change the Internet password using this function. In addition the user is forced to change the password by the system at first Logon and defined intervals. In both cases the password needs to conform to the policy defined by the bank.

Letter of Credit

Letter of Credit – Initiate

The customer (company) can choose to initiate LC. One officer of the company will fill-in the LC screens from his office. Another higher level officer will authorize the LC and submits to the Bank. The relevant branch officer will examine the entries and verifies with the documents or scanned copies of the LC documents, and authorize. After authorization by the bank, necessary accounting entries will be passed in to the Core Banking System and SWIFT message will be passed.

The data entry (by an officer of the company) in the LC screen will comprise of multiple screens, which will provide Save and Submit options. The Save option will facilitate saving of partial or incomplete data entered in each Screen. Data will be finally submitted when the Submit option is invoked. Validations of the data entered in all the screens will be done and in case of an error(s) it will be displayed to the user.

A verification and confirmation (by higher level officer of the company) screens will be displayed at the completion of the initiation of a LC and will be a Single Screen. Audit Information at the bottom of each screen will be displayed, the contents of which will be the Initiator Name & Date & Authorizer Name and date corresponding to it.

Letter of Credit – Modify

The customer can modify the LC under certain scenario such as:

The transaction to be modified has to be initiated by the same user.

In addition the transaction to be modified has to be either in an Incomplete State or is Unauthorized or rejected by the authorizer.

Audit Information at the bottom of each screen will be displayed the contents of which will be the Initiator Name & Date & Authorizer Name and date corresponding to it.

Letter of Credit – Authorize

The Authorizer can only authorize those LC Transactions for which he has rights. Rights will be based on the Initiator and the Transaction Authorization Limit. Once the transaction is authorized it will be directly sent to core banking system.

Authorizer can also reject a LC. A facility to specify the Reason for rejection is provided. Audit Information at the bottom of each screen will be displayed, the contents of which will be the Initiator Name & Date & Authorizer Name and date corresponding to it.

4.         Fraud in Internet Banking:

If we look at the functionalities covered under the Internet banking system as mentioned above, we can see that if a fraudster can know the ID and password of a customer, he can easily get access to the system and do the following:

1.         Can get the number, outstanding balance and transaction history of all the accounts maintained by the customer in the bank (stealing confidential information)
2.         Can transfer the money from customer’s one account to the customer’s another account or to an utility company’s account (harassment)
3.         Can transfer the money from customer’s account to the fraudster’s account and withdraw money from ATM (real fraud)

To protect the customers from above frauds, Banks need to protect stealing his password while travelling from customer’s computer to the Bank’s server or from phishing attract. Banks may also introduce a mandatory 2-factor authentication for a 3rd party transfer and LC transmission.

These protection measures are described below in brief.

a)         Capture of Password during transmission to the bank server

While the Password is travelling through internet from customer’s computer to the Bank’s server, a Fraudster can easily capture it and use the information to enter into the internet banking system. To protect the PIN from capturing during travel, the bank’ system must be capable to encrypt the PIN and bring into the server and decrypt them before further processing. If a Fraudster capture encrypted information on the way, it is not possible for him to decrypt and find the real information. As such the PIN on the way is safe.

b)         Phishing

Phishing is collection of user PIN by presenting a fake web-site address to the user. For example, let us consider that the website address of a Bank is www.abc-bank.com. Hacker will develop a fake website exactly similar to the website of the Bank, but with a different address such as www.abe-bank.com and place in the internet. Now if a user searches for the “ABC” bank in the Google, address of this fake website will be shown in the search result. Now if the user clicks on this link, he will go to the fake website. If he does not look at the website address carefully or the address is not known to him, he will insert his ID and Password into the fake web-page. The hacker will record all such attempts made by different users and collect ID and Passwords.

The false website address may also be send to various users through email where in the name of a bank, the customer will be requested to enter into his i-Banking system and check something. The users, who are not aware of phishing attracts, may try to login into the false website using his ID and Password. All such information will be captures into the hacker’s database.

The hacker can now use the collected ID and Password to enter into the i-Banking System and do fraudulent activities.

It may not be possible for customers to know the exact website address of the Bank.

It is therefore devised that the website of a bank which offers i-Banking may be certified by a certifying authority such as VeriSign. The page of the bank which collects customer’s ID and Password will display seal of the certifying authority. If a customer clicks on the seal, the website of the certifying authority will appears. All the customers must know the web address of the established certifying authority and thus should be able to verify its correctness. If the website address of the certifying authority is correct, the website page of the bank is also correct. As such the customer can insert the ID and Password safely into this webpage.

c)         Repudiation and Digital Signature

Sometimes some customers do some activity in the internet through internet banking system and refuse that he has not done this, rather blame the bank officers saying that they could know his Password from the system and do the transactions to transfer money from his account. This is for sure that the bank officer has no access to the customer’s Password as all the Password are logically recorded into a system where no bank officer even the administrator has access. Moreover there are electronic records in the system which can easily generate a history of the transactions including name and address of the final beneficiary which will clearly indicates that the bank officer is not a beneficiary. However it becomes very difficult to make this understand to the customers. Digital Signature is a solution to this.

Digital Signature is signing (or encrypting) a message or transaction by sender electronically using his private key which can only be read (or decrypt) by the receiver using the sender’s public key. The pair of public and private key is issued by an Issuing Authority (normally a Government Authority, in Bangladesh it is Bangladesh Computer Council) to a user. The user then sends his public key to other users or institutions with whom he wants to exchange electronic information (like email or banking transaction) and keep his private key with him (at his computer or pen drive). Now he will encrypt or sign all the sensitive information using his private key and send to other party. Other party will only be able to open the email or decrypt the information using his public key. This ensures that the transaction is made by the user himself. If the user refuse such transaction, the court can verdict on the issue based on the ICT Act 2006.

Bank can develop a system which will only receive transaction request from the customer which will be encrypted using a private key. All customer desires to do fund transfer transactions using e-commerce may be asked to buy public and private key from the Issuing Authority and submit his public key to the bank.

d)         Two-factor authentication

Password can be hacked by a hacker and used for making unauthorized transactions in the internet banking systems. To secure such transactions, banks can introduce 2-factor authentication which means that a customer must authenticate a transaction using two factors – one is Password and another may be a Token which is called Cryptographic or USB or Hardware TOKEN.

A token is a small hardware issued by bank to a customer. The algorithm of the token device and that in the authentication server which records all the token information are same, as such both the server and the token generate same number after every specified time period (say one minute). After submitting the ID and Password, the user gets access to the internet banking system and does many activities except fund transfer and LC transmission. While making a 3rd party fund transfer or transmitting LC, the customer is asked to enter his token number displayed on his token at that particular time. He collects the number from his token and inputs into the system. The internet banking system passes this token number and the token ID into the authentication server which checks for the correctness of the number. If the number is correct the transaction is passed, otherwise rejected.

As the token is a physical device belongs to the user and generates random number, the hacker can capture it but will become invalid in the following minute. Thus the two-factor authentication provides more security for the customers and also protect bank from refusing a transaction by a customer as the token belongs to the customer himself.