Internet Banking Security, the BCA story

By Kostaman Thayib

JAKARTA (JP): The Internet is inevitably becoming more popular and exerting a greater influence in our daily life.

The Internet makes life easier.

With the Internet, we can now quickly and easily search for information all over the world. It also makes communication around the world faster, easier and cheaper.

Internet has developed into a powerful medium of information, communication and human interaction in a relatively short period of time.

Banks have also embraced Internet technology to make banking easier, more convenient and available anywhere and anytime.

With the Internet, banking transactions are only a click away.

Several banks in Indonesia have introduced Internet Banking (IB).

Among these banks, BCA -- although not the first bank to launch Internet banking -- has recorded some remarkable results. Since its introduction on Aug. 17, 2000, after its grand launch on March 30, 2001, more than 200,000 customers have registered for Internet banking services (KLIK BCA), and 70 percent of them have logged in and performed banking transactions at its website (www.klikbca.com).

In Internet banking, the main concern is security. Customers are not asking about the conveniences of IB, they are asking about the security of IB transactions. Security remains one of the biggest barriers to consumer acceptance of IB.

Customers have heard of the attacks on several websites, including bank websites by hackers. Sometimes the hackers breach the security of Internet systems and deface the front page of the websites. Actually in cases like this, customers' accounts are safe and not affected.

In Indonesia, over 70 percent of credit card transactions done through the Internet are fraudulent. Credit card transactions via the Internet require customers to divulge their credit card number and its expiry date.

These information is not secure because it is even printed on the credit card and transaction receipt. In most cases, carders who steal the credit card information do not hack the website. The carders steal the data from conventional transactions such as payments at hotels, restaurants, etc, by working with the service providers.

BCA realizes that the security of Internet banking transactions is an issue of utmost importance for customers. Therefore the bank has protected its Internet banking system to ensure a high level of security.

From the very first step in Internet banking, i.e. the registration, BCA has taken security into consideration.

Customers should register through ATM BCA to ensure the person registering is the account holder.

After inserting the ATM Card (Paspor BCA), enter the correct ATM PIN and select the Internet registration menu. The customer is asked to enter his IB PIN, and his user ID will be given right away.

This user ID and IB PIN can be used immediately to log into the website. IB registration through ATM is secure and yet very fast, easy and convenient.

To access an account through IB, the customer is verified through his user ID and IB PIN. This identification and authentication process makes on-line transactions very secure.

Unlike credit card numbers and expiry dates, user IDs and IB PINs are not printed on the card nor on transaction receipts.

No one should have knowledge of this information. For this reason, customers should be careful when making IB transactions in public areas. Make sure there is no one behind you peeking at your user ID and PIN. If you are doubtful of the confidentiality of your PIN, you can change it at KLIKBCA's website.

To protect the security of data during its transmission from the user's computer to the IB server, Klik BCA is secured with 128 bits SSL (Secure Socket Layer) 3.0, verified by Verisign.

If someone taps the transmitted data, the data would look meaningless, and if he tries to decrypt the encrypted data, according to Onno Purbo, he would need 12,710,204,652,610 trillion years to do so. The URL address of the website secured by SSL will begin with https instead of http.

Klik BCA servers are also protected by Firewall to prevent illegal access by unauthorized users.

Customers should make sure they log out of the IB website after they have completed their transactions. They should not leave their computers in a login state as others can then access their bank accounts.

To prevent financial loss when customers are careless in this respect, Klik BCA automatically logs out if no transaction is made in 10 minutes.

For every financial transaction, Klik BCA will ask the user to enter his IB PIN. Although this procedure seems repetitive, it will prevent others from making transactions from your account if you forget to log out.

To monitor the usage of your IB account, Klik BCA provides the last login information on the main menu every time customers login to the website. Every transaction done through Klik BCA will also be reported, through an automatic e-mail notification, to the customer's e-mail address.

Actually IB has provided enough security for online transactions. To breach the IB security is very expensive and very difficult, if not impossible.

Sometimes people who do not understand IB are fooled into revealing their user ID and IB PIN.

With the your user ID and PIN, others can make a transaction from your account. Off course, this is faster, cheaper and easier than breaching the IB security system!

Customers should be aware that the user ID and PIN are keys to their banking account. Therefore they should keep them confidential.

To protect customers who do not understand IB or who are careless, especially during the early stages of IB in Indonesia, Klik BCA has set the limit for transfers at Rp 3 million.

If IB users need to transfer more than Rp 3 million, Klik BCA will provide a security token called Key BCA. Key BCA is a security device, which looks like a calculator, for authorization.

If the transaction amount exceeds Rp 3 million, IB will display a challenge code.

IB users could activate Key BCA by entering the Key BCA PIN and then entering the challenge code seen on the screen on Key BCA.

Key BCA will then generate the response code. Users should enter this response code on the IB screen. If it is matches the number in the IB Server, the transaction will be authorized.

The response code generated by Key BCA will be different every time. In other words, Key BCA is a device to generate dynamic PINs or a One Time Password (OTP). Key BCA helps make customers feel secure in using Klik BCA.

IB offers a lot of conveniences for customers.

Like other conveniences, it is also vulnerable to misuse and crime. Klik BCA offers an up-to-date system and the tools to ensure the security of its IB.

Customers, on their part, should keep their user ID and IB PIN confidential, and conduct their transactions discreetly.

The writer is deputy chief of BCA's Consumers Banking Division.