Barclays Bank has announced a new device called a PINsentry, a PINsentry looks like a a small calculator. It has slot in one end for a bank card, and an LCD display, and customers use it to log on and to authenticate some online baking transaction like setting up a new customer. You insert your bank card, enter PIN and generate an 8-digit code that you then type into the website. Personal customers can look at their account without authenticating with PINsentry, but business customers are completely locked out. For one thing, device like this may induce a false sense of security which makes customers more likely to fall for scams.
When they try to log in to the fake site it passed on all the details-including the security code generated be a back provided keyfob, which provided a simpler form of two-factor authentication than the PINsentry. the hackers could log in to the real banks site while this number was still valid and move money from accounts. And alot of online fraud these days comes from poor security at the vendor end of the transaction, not the customer end. Aunthenticating access to bank accounts with something other than a password is a very good idea, and those banks who have introduced two-factor system seems to be seeing the benefits, but it has to be part of a broader systemic approach to online security.


http://news.bbc.co.uk/2/hi/technology/7591712.stm