What is multi-factor authentication and how does it work in our Internet banking product?

Multi-factor authentication (MFA) refers to different "layers" of security instead of relying strictly on a passcode or password to log in. Passwords alone are inherently unsafe for a number of reasons.

MFA is typically described in terms of combining two or more of something you know (passwords), something you have (security token), or something you are (fingerprint or other biometric device). Combining two or more of these effectively makes it more difficult for someone to fraudulently log in to your Internet banking account. The problem is, tokens can be lost or stolen and finger tips can be cut or abraded to the point that the authentication process cannot be completed. Each are also additional hardware that has to be purchased by someone and which can malfunction at the most inopportune time.

Danville State Savings Bank, along with our Internet banking partner First Data, has chosen to take the responsibility for MFA instead of depending on possibly unreliable devices. This is done by scoring each log on in real-time using a number of factors. These factors are:

  • Persistant cookie, a small file that is saved on your computer which identifies that you have used this machine to log in to Internet banking previously.
  • IP address from which you log in, the numerical address which your Internet service provider assigns for your use.
  • Last login day and time, the date and time of your last Internet banking session.
  • Country to which IP address is assigned
  • Whether Billpay is enabled for any of the linked accounts, to help prevent Billpay fraud.
  • Browser, the system checks certain browser signatures to help identify whether a different browser than a typical session is used.
  • Frequency, or how often you typically log in to the Internet banking service.
  • Click count, evaluates whether the number of mouse-clicks is significantly different than your typical session.
  • Duration, the amount of time you typically spend logged into Internet banking.

Using a 1 to 10 score of each of the above as inputs, the Internet banking system computes a "score at login" numerical rating. If this score is higher than the threshold we have set, you will be asked to choose between providing the answer to your security question or having a one-time PIN emailed to you at the email address listed in our records. Requiring this helps ensure that the log in attempt is from an authorized individual as well as allow us to comply with various consumer data security requirements.

You can certainly see the importance of maintaining both the answer to your security question and the correct email address we have for you on record. Both can be accessed by clicking on the User Services tab within Internet banking and clicking on the appropriate link.

Danville State Savings Bank encourages you to use an appropriate Internet security product which incorporates an antivirus, anti-spyware, and an Internet firewall, anytime you are physically connected to the Internet to protect both your hardware and any personal information you may have stored on your computer. We also encourage customers to change their Internet banking passcode frequently. This can also be easily done by clicking on the User Services tab within Internet banking and clicking on the Change Passcode link under Security Settings.

For more information, contact us via E-mail at  customer.service@danvillebank.com or call 392-4261 (Tollfree 877-392-4261)

Copyright © 2011 Danville State Savings Bank
All rights reserved