Prevent unauthorized electronic fund transfers

Authentify released the ETF Verifier application which enables financial applications and payment platforms to alert legitimate account owners via phone whenever a new payee or funds transfer destination account is added to the user’s financial account.

This verification process permits the account owners to authorize a transaction or, more importantly, cancel a transaction if they are not behind the activity themselves. Adding new destination accounts has been the point of attack for the organized criminals behind ZeuS and its variants for getting cash from compromised accounts.

Keystroke loggers like ZeuS and Zbot capture everything a user may type on his or her keyboard including bank account numbers, passwords and other logon information. Even when an account is compromised, however, the trick is still getting funds out of the account. Electronic funds transfer via wire transfer or e-payment applications have become the vehicles of choice for criminals moving money out of a compromised account.

The final step is the addition of a new destination account number or new payee for an account controlled by the fraudsters.

ETF Verifier’s process can be invoked whenever a new payee is added to an online payment or wire enaled account. The out-of-band authentication process sends an XML message to Authentify’s telephony service center. The message triggers a phone call to a telephone number on file for the account owner. A portion of the transaction details including payee identification is repeated audibly to the legitimate account owner over the phone. The account owner can then allow or cancel the transaction using their telephone keypad.