Contents:

1 Background 1.1 Report Overview 1.2 Internet Banking and the Need for Additional Security 2 Security Concept Overview 3 Security Concept Comparisons 4 Security Concept Profiles 4.1 Shared Secrets – Concepts Based on What a Person Knows 4.1.1 Security Questions 4.1.2 Images 4.2 Tokens – Concepts Based on What a Person Has 4.2.1 Smart Cards 4.2.2 USB Token Device 4.2.3 One-Time-Password Token 4.2.4 Transaction Numbers 4.2.5 Grid Cards 4.3 Biometrics – Concepts Based on What a Person Is 4.3.1 Fingerprint Recognition 4.3.2 Keystroke Recognition 4.4 Authentication - Concepts Based on What a Financial Institution Tells a Person 4.4.1 Mutual Authentication 4.4.2 Out-of-Band Authentication 4.5 Location Authentication – Concepts Based on Where a Person Is 4.5.1 Device Authentication 4.5.2 IPA-Location 4.5.3 Geo-Location 4.6 Fraud Detecting Software – Concept Based on Identifying Threat When it Arises Table Index Table 1: Summary of key indicators and rankings among concepts for "Security Questions" concept. Findings based on those who either bank over the Internet at present or who do not bank over the Internet due to security reasons, n=249. Table 2: Summary of key indicators and rankings among concepts for "Images" concept. Findings based on those who either bank over the Internet at present or who do not bank over the Internet due to security reasons, n=244. Table 3: Summary of key indicators and rankings among concepts for "Smart Cards" concept. Findings based on those who either over the Internet at present or who do not bank over the Internet due to security reasons, n=265. Table 4: Summary of key indicators and rankings among concepts for "USB Token Device" concept. Findings based on those who either bank over the Internet at present or who do not bank over the Internet due to security reasons, n=249. Table 5: Summary of key indicators and rankings among concepts for "One-Time-Password Token" concept. Findings based on those who either bank over the Internet at present or who do not bank over the Internet due to security reasons, n=244. Table 6: Summary of key indicators and rankings among concepts for "Transaction Numbers" concept. Findings based on those who either bank over the Internet at present or who do not bank over the Internet due to security reasons, n=265. Table 7: Summary of key indicators and rankings among concepts for "Grid Cards" concept. Findings based on those who either bank over the Internet at present or who do not bank over the Internet due to security reasons, n=249. Table 8: Summary of key indicators and rankings among concepts for "Fingerprint Recognition" concept. Findings based on those who either bank over the Internet at present or who do not bank over the Internet due to security reasons, n=244. Table 9: Summary of key indicators and rankings among concepts for "Keystroke Recognition" concept. Findings based on those who either bank over the Internet at present or who do not bank over the Internet due to security reasons, n=265. Table 10: Summary of key indicators and rankings among concepts for "Mutual Authentication" concept. Findings based on those who either bank over the Internet at present or who do not bank over the Internet due to security reasons, n=249. Table 11: Summary of key indicators and rankings among concepts for "Out-of-Band Authentication" concept. Findings based on those who either bank over the Internet at present or who do not bank over the Internet due to security reasons, n=244. Table 12: Summary of key indicators and rankings among concepts for "Device Authentication" concept. Findings based on those who either bank over the Internet at present or who do not bank over the Internet due to security reasons, n=265. Table 13: Summary of key indicators and rankings among concepts for "IPA-Location" concept. Findings based on those who either bank over the Internet at present or who do not bank over the Internet due to security reasons, n=244. Table 14: Summary of key indicators and rankings among concepts for "Geo-Location" concept. Findings based on those who either bank over the Internet at present or who do not bank over the Internet due to security reasons, n=265. Table 15: Summary of key indicators and rankings among concepts for "Fraud Detecting Software" concept. Findings based on those who either bank over the Internet at present or who do not bank over the Internet due to security reasons, n=249. Figure Index Figure 1: Awareness levels of the 15 tested concepts. Based on those who either bank over the Internet at present or who do not bank over the Internet due to security reasons. Each concept rated by randomly assigned respondents in one of three separate sub-samples: n=249; n=244; n=256. Figure 2: Current availability of the 15 tested concepts at respondent's financial institution. Based on those who either bank over the Internet at present or who do not bank over the Internet due to security reasons. Each concept rated by randomly assigned respondents in one of three separate sub-samples: n=249; n=244; n=256. Figure 3: Current usage of the 15 tested concepts. Findings based on those who either bank over the Internet at present or who do not bank over the Internet due to security reasons. Each concept rated by randomly assigned respondents in one of three separate sub-samples: n=249; n=244; n=256. Figure 4: Security assessments for the 15 tested concepts. Findings based on those who either bank over the Internet at present or who do not bank over the Internet due to security reasons. Each concept rated by randomly assigned respondents in one of three separate sub-samples: n=249; n=244; n=256. Figure 5: Convenience assessments for the 15 tested concepts. Findings based on those who either bank over the Internet at present or who do not bank over the Internet due to security reasons. Each concept rated by randomly assigned respondents in one of three separate sub-samples: n=249; n=244; n=256. Figure 6: Ease of implementation assessments for the 15 concepts. Findings based on those who either bank over the Internet at present or who do not bank over the Internet due to security reasons. Each concept rated by randomly assigned respondents in one of three separate sub-samples: n=249; n=244; n=256. Figure 7: Desired availability of the 15 concepts. Findings based on those who either bank over the Internet at present or who do not bank over the Internet due to security reasons. Each concept rated by randomly assigned respondents in one of three separate sub-samples: n=249; n=244; n=256. Figure 8: Likely usage of the 15 concepts. Findings based on those who either bank over the Internet at present or who do not bank over the Internet due to security reasons. Each concept rated by randomly assigned respondents in one of three separate sub-samples: n=249; n=244; n=256. Figure 9: Coded responses to respondent's implementation advice for "Security Questions" concept. Findings based on those offering a response to this question who either bank over the Internet at present or who do not bank over the Internet due to security reasons, n=188. Figure 10: Coded responses to respondent's implementation advice for "Images" concept. Findings based on those offering a response to this question who either bank over the Internet at present or who do not bank over the Internet due to security reasons, n=179. Figure 11: Coded responses to respondent's implementation advice for "Smart Cards" concept. Findings based on those offering a response to this question who either bank over the Internet at present or who do not bank over the Internet due to security reasons, n=176. Figure 12: Coded responses to respondent's implementation advice for "USB Token Device" concept. Findings based on those offering a response to this question who either bank over the Internet at present or who do not bank over the Internet due to security reasons, n=167. Figure 13: Coded responses to respondents implementation advice for "One-Time-Password Token" concept. Findings based on those offering a response to this question who either bank over the Internet at present or who do not bank over the Internet due to security reasons, n=162. Figure 14: Coded responses to respondent's implementation advice for "Transaction Numbers" concept. Findings based on those offering a response to this question who either bank over the Internet at present or who do not bank over the Internet due to security reasons, n=156. Figure 15: Coded responses to respondent's implementation advice for "Grid Cards" concept. Findings based on those offering a response to this question who either bank over the Internet at present or who do not bank over the Internet due to security reasons, n=153. Figure 16: Coded responses to respondent's implementation advice for "Fingerprint Recognition" concept. Findings based on those offering a response to this question who either bank over the Internet at present or who do not bank over the Internet due to security reasons, n=146. Figure 17: Coded responses to respondent's implementation advice for "Keystroke Recognition" concept. Findings based on those offering a response to this question who either bank over the Internet at present or who do not bank over the Internet due to security reasons, n=157. Figure 18: Coded responses to respondent's implementation advice for "Mutual Authentication" concept. Findings based on those offering a response to this question who either bank over the Internet at present or who do not bank over the Internet due to security reasons, n=141. Figure 19: Coded responses to respondent's implementation advice for "Out-of-Band Authentication" concept. Findings based on those offering a response to this question who either bank over the Internet at present or who do not bank over the Internet due to security reasons, n=141. Figure 20: Coded responses to respondent's implementation advice for "Device Authentication" concept. Findings based on those offering a response to this question who either bank over the Internet at present or who do not bank over the Internet due to security reasons, n=159. Figure 21: Coded responses to respondent's implementation advice for "IPA-Location" concept. Findings based on those offering a response to this question who either bank over the Internet at present or who do not bank over the Internet due to security reasons, n=142. Figure 22: Coded responses to respondent's implementation advice for "Geo-Location" concept. Findings based on those offering a response to this question who either bank over the Internet at present or who do not bank over the Internet due to security reasons, n=155. Figure 23: Coded responses to respondent's implementation advice for "Fraud Detecting Software" concept. Findings based on those offering a response to this question who either bank over the Internet at present or who do not bank over the Internet due to security reasons, n=147.