Bank messaging services: SMS, OTP and tokens 😉
We have all received a bank message: salary notification, validation code and so on. This post explains what happens behind the scenes.
1. Why do banks use SMS and OTP?
• Security: strong authentication, 2FA.
• Notifications: real-time information.
• Traceability: transaction evidence.
• Accessibility: works on all phones.
2. Types of bank message
• OTP, One-Time Password: validates online payments or payments over a threshold, card activation or profile changes.
• Transactional SMS: generally sent for account debits and credits.
• Security SMS: alerts about suspicious logins or password changes.
• Marketing SMS: less frequent messages about promotions, services or regulation.
3. A message's journey
Modern banks generally use this architecture:
1. Core Banking System, CBS: your transaction starts in an application that needs to send an SMS, OTP or token.
2. Notification engine, SMS/email/push: the CBS sends the request to a specialised messaging module.
3. SMSC/SMS aggregator: the module sends the message body to the aggregator.
4. Telecom operator: the aggregator forwards it to your operator.
5. Customer's phone: your phone finally receives the message from the operator.
4. Why an aggregator?
Why not send messages directly to the telecom operator? Operational efficiency: a dedicated aggregator connects to several telecom providers, including internationally. The bank makes one integration rather than multiple integrations with all its customers' operators.
5. Detailed internal technical architecture
6. Security
• TTL ≤ 180 seconds.
• Limited number of attempts.
• Hashed OTP.
• TLS encryption.
• Partially masked sensitive information, for example PAN 472862******4921.
8. Limitations
• Hacking.
• SMS interception.
• Network disruption.
• Expiry.
• Social phishing.
Alternatives: secure push notifications, biometrics and software tokens.
If you enjoyed this post, a like or share is appreciated. Follow this page for more digital-banking content.
#agrégateur, #telco, #télécoms, #digitalbanking, #sms, #otp