PSD2, two factor authorization and device binding for a German Bank

This Bank is one of the largest banks in Germany in terms of total assets and number of employees. The company is headquartered in Frankfurt am Main and operates as a universal bank with major branches in London, New York City, Singapore, Hong Kong and Sydney. 43,000 people worked for the bank in Germany in 2017 and 97,000 worldwide. The Bank places particular emphasis on investment banking with the issue of shares, bonds and certificates. In the retail banking business in Germany, its market share was around 15 percent in 2010. After the savings banks and the group of cooperative Volksbanken and Raiffeisenbanken, it is number three in its home country.

 

The Projects

Our project is called DB Mobile and the scope of the project is to deliver the Banks mobile app, which offers its customers the core banking and also brokerage functionality. Additional services, meant to add value to the customers, such as Branch and ATM finder, eSafe, Mobile Payment are also integrated into the app. The app is built for the mobile device platforms iOS and Android.The DB Mobile team includes around 90 people in 2 locations: Frankfurt and Bucharest.

 

The Challenge:

Since the beginning of the app, two and a half years ago, the teams faced frequent challenges such as the implementation of mobile payment, Gini photo transfer or multi bank aggregator. The teams were always able to overcome the obstacles and exceed the expectations. Currently the teams are working intensively on the Payment Services Directive 2 (PSD2) topic. Starting September 2019 it will be mandatory for the customer to authenticate itself based on two or more elements which are categorized as knowledge, possession and inherence.

The Technology:

The following secure elements are valid:

  • FKN + PIN
  • Fingerprint/Touch ID/ FaceID
  • Photo TAN/push TAN
  • Device Binding
  • One time code/SMS

The banks mobile app has to check which 2nd factor ( TAN challenge (photo TAN), an OTP via SMS or a trusted device) has to be used. As long as the customer does not authenticate with the second factor, he is not logged in and therefore not able to see the financial overview or to start any other activity in the app.