In 2017, 22 million people managed their current account on their phone which is predicted to increase to 35 million customers using mobile banking applications by 2023. The mobile phone, rather than internet or retail banking, is also the de facto standard for mobile banking services with more than 250 million Apple Pay users.
UK Open Banking is intended to create a FinTech market
similar to a 1980s consumer credit boom by decoupling the underlying bank from
the service provider. Open Banking promotes an aggregated single view of all of
a customer’s accounts in one place as well as aggregated personal finance and
debt management tools. This creates an opportunity for the Mobile Network
Operator interested in providing financial services without undertaking a full
banking licence.
Open APIs and security are critical to Open Banking. The Open APIs enable third-party developers to extend the services of financial institutions. Open Banking effectively supports and extends the European PSD2 directive, how non-Brexity!. In Open Banking, the UK CMA introduced rules that mean that banks must allow the customer to share their financial information with other AUTHORISED providers. These are known as Account Information Service Providers (AISPs) and are regulated by the FCA. This requirement creates an opportunity for the Mobile Network Operator to either become a Mobile Banking AISP and / or to be a more general provider of Security Services to AISPs and Banks. Both options benefit from specific technologies that the MNO can provide. These include:
- a 5G
Network Slice dedicated to “Mobile Banking”
- the
exposure of Risk Evaluation services based on fraud prevention and location
data
- the
implementation of Passwordless Multi-Factor authentication service
Network services that increase the quality and security of
mobile banking
Users of any service do not like service continuity issues.
This discontent is greater when the interaction is form based and stateful; and
the worry is higher if the session drops during a mobile banking transaction.
For example, it can be peeving when session interruption affects transferring
money whilst in the back of a taxi on the way to an airport. Mobile
applications can handle session management issues more gracefully than mobile
browsers. Nevertheless there will always be customer dissatisfaction
associated with session drops when using mobile banking services.
5G provides improved session and service continuity. One of the key features of a 5G data service is session and service continuity, it ensures uninterrupted service experience to the user regardless whether there is any change of UE (User Equipment) IP address or change in the core network anchor point (4G LTE evolved packet system only provides continuity of IP session). This means that the Mobile Network Operator can provide a chargeable “Mobile Banking” Network Slice; or consume the service itself as a Open Banking service provider.
A 5G Mobile Network Slice dedicated to “Mobile Banking”
can also provide enhanced user security as unique security parameters can be defined for network slices
individually.
Multi Factor Authentication mechanisms provided by the Mobile
Network Operator
The MNO can provide enhanced security based on location based
services (subject to GDPR & customer approval). The MNO can provide a risk
score based on location of the customer.
The Mobile operator knows through the National Device Register if the device has been stolen. The MNO can provide improved 2nd and 3rd Factor authentication protection through the Equipment Identity Register. This is important as finger print spoofing is a known and achievable process; and an amputated digit injected with Botox will continue to provide a useable finger print for two weeks!
Mobile operator understands the roaming likelihood and can
quantify the risk Matching spend and location reduces fraud. Hence the
Apple Pay contactless system does not have a £30 limit. In fact it is even
safer as a physical card can be cloned and a four digit pin can be noticed.
The MNO can also wrap 2nd and 3rd factor
authentication into its mobile app as an identity provider in the Open Banking
universe. And it can provide commercial Risk and Location based APIs consumable
by Open Banking service providers.
How Open Banking Implements
Multi Factor Authentication and Strong Customer Authentication
UK Open Banking can implement Multi-Factor Authentication including Passwordless authentication mechanisms as part of Account Information Service Provider and Payment Initiation Service Provider flows. UK Open Banking uses OAuth 2.0, OpenID Connect and the Financial API specifications from the Open ID Foundation. This extends the PS2 OAuth 2.0 flow where the providing bank must use Strong Customer Authentication to authenticate the user.
This can
be a Username / Password combination or a higher factor of
authentication. More interestingly this can also be Passwordless
(finger-print recognition) authentication by seamlessly pushing
authentication to the bank’s mobile app (if on a mobile device). Alternatively
this push can be to Account Information Service Providers’ authentication
service. The Mobile Network Operator can
be a UK Open Banking Account Information Service Provider using a 3 Factor
authentication in a single passwordless action supplemented by the MNO’s own
location based and fraud detection services
Use of Open Banking in the Internet of Things
The Mobile operator can also support an AISP model when
supporting consumer Internet of Things propositions. As an example, the
consumer with a listed Airbnb property that includes a number of smart devices
may choose to manage the IoT contracts through a separate bank account whilst
managing all their accounts through a single AISP. This creates a nice up-sell
loop for the Mobile Network Operator providing AISP capabilities alongside IoT
propositions.
Conclusion
Trust is critical for the success of mobile banking. Security
breaches can lower the adoption of online banking services. The most effective
mobile banking service is the one that integrates all of the available security
tools together. This is one that the Mobile Network Operator already does well
and can do better with 5G Network Slices and the use of Passwordless 3 Factor
Authentication.
Good Data Governance is required to gather and store customer
consent as part of Auditing phase of implementing Open Banking. The flow to
secure the relationship between the Bank and the Open Banking provider must be
Multi-Factor Authentication mechanism. The only way to make mass market
3-Factor Authentication any stronger is to utilise the MNOs location services.
Finally, Mobile Networks Operators have historically made
poor banks but with Open Banking they do not need to take that long step.
Instead they can aggregate their customer’s existing banking providers through
Open Banking.