Some background: unlike PCI, which has very large specs for how to protect cardholder data, banks have very little mandated requirements for protecting online b

Some background: unlike PCI, which has very large specs for how to protect cardholder data, banks have very little mandated requirements for protecting online banking. Really the only guidance they've received is the document "Authentication in an Internet Banking Environment", released by the FFIEC in 2005. [1] The mandate boils down to: "Financial institutions offering Internet-based products and services to their customers should use effective methods to authenticate the identity of customers using those products and services. The authentication techniques employed by the financial institution should be appropriate to the risks associated with those products and services." So, if a FI provides basic personal online banking -- with no money transfer abilities -- perhaps a username/password pair combined with pretend-MFA ("What's your favorite secret color?") is appropriate. If you allow your customers to originate ACH or wire transfers, it's simply negligent to not provide true MFA, and their auditors should have caught this earlier. [1] http://www.ffiec.gov/pdf/authentication_guidance.pdf http://www.ffiec.gov/pdf/authentication_guidance.pdf