SMARTCARD READERS
Barclays and RBS offer chip
and PIN card readers in the UK
Three years after it originally tested chip and PIN card readers with MasterCard, Barclays is sending out ‘PINsentry’ hand-held chip and PIN card readers to online banking customers later this year. Barclays customers who use their online bank account to set up payments to new third party accounts will be the first to be offered the service.
Barclays will be joined by Royal Bank of Scotland, Nationwide and
Lloyds TSB in sending out handheld card readers. HSBC and Abbey have
said they regard their existing procedures as sufficiently secure and
will not be sending the devices to their customers, so there will be
no coordinated roll-out by the UK banks.
Customers will use the PINsentry devices, together with their normal debit card and PIN, to authenticate their identity at log-in and for making certain payments, replacing the need for passcodes and memorable words.
Over 0.5 million customers will be automatically sent free PINsentry card readers and instructions by end-2007, with this number increasing as more customers are added to the service. The remaining customers will not need PINsentry at this stage – it will only be needed by those who use online banking to set up payments out of their account to a new third party for the first time.
Customers who simply wish to use online banking to view their accounts and pay bills or established payees will be able to continue to use online banking as normal without the need for PINsentry.
“PINsentry is the next generation of fraud prevention technology and Barclays is proud to be the first organization in the UK to roll it out to its customers,” says Barnaby Davis, director for electronic banking.
“The popularity of Barclays online banking service comes down to convenience and security and the introduction of PINsentry will enhance both of these features.”
Barclays has contracted with Gemalto to supply the devices and a full service encompassing manufacturing of the readers, fulfilment and distribution to customer. In addition, Gemalto industrialized and produced a unique looking device, customized with the bank’s visual corporate identity. As well as delivery of over half a million units by end-2007, the contract includes options for additional deliveries into 2008.
Customers will be able to generate one-time-passwords with the reader, to authenticate themselves at log-in and sign transactions undertaken, inserting their chip-enabled banking cards into the Gemalto device and typing in their PIN. They can carry the devices with them wherever they go and perform transactions from any PC.
The device complies with the standard industry specifications – EMV, MasterCard and Visa Chip Authentication Program (CAP) 2007 – as well as APACS requirements.
Royal Bank of Scotland has signed a contract with Xiring to provide its retail customers with an authentication solution, Xi-Sign 4000 for APACS, for online banking transactions. The first customers received their personal readers in May.
Xi-Sign 4000 for APACS is a two-factor authentication solution using a portable, standalone smart card reader which allows customers to log in to their online bank. Customers insert their EMV card into the device and key in the four-digit PIN to authenticate locally with the card.
They then key in a code provided by the bank (the ‘challenge’);
the reader then displays a dynamic password
(the ‘response’)
generated by the card chip; and this eight-digit
password is valid a single time for accessing
banking services via the web portal. 