What U.S. banks offer two-factor authentication (such as password & token) for online banking?

Question

Do you know of any US banks that allow you to have two-factor authentication (i.e. password and token) for your online account? Paypal does that, but it's not really a bank. For some reason banks seem reluctant to do that - is there any reason why or they are just lazy or am I uninformed?

Answer 1

StasM,

It's taken a while but many banks offer tokens - although they tend to limit the accounts for which they will be issued.

All of the following issue tokens, but there are many more:

CitiBank
JP Morgan
Union Bank
Wells Fargo
Callaway Bank
Wachovia
Bank of North Dakota
The River Bank of Wisconsin
Metcalf Bank, Kansas
Stonebridge Bank

In 2005 federal regulators stipulated that banks needed to get better with security for online banking customers, but they did not endorse a particular technology. Tokens (aka fobs) were endorsed. The news was negatively received by the banks because putting more steps in the way of a customer drives the customer away. See this 2005 report for more info: http://www.usatoday.com/tech/news/computersecurity/2005-11-02-cybercrime-prevention_x.htm

My guess is a tipping point was reached since then, where customers became savvy of the risks, and that the "extra steps" became less an issue than the "extra security".

Answer 2

There are very few banks which offer two-factor authentication. Part of the reason is cost. Providing a token to every account-holder is expensive, not just in the device or system, but in providing support and assistance to the millions of people who won't have the faintest idea how it works and complain that they no longer have access to their accounts.

That said, it is sometimes available on request for personal accounts and many banks require it for their business clients.

My HSBC Business account comes with two-factor as default and it works extremely well.

There is also the pseudo-two-factor security offered by Visa and MasterCard (3-D secure) which performs a similar function.

Answer 3

E*Trade offers banking services, and will provide you with a security token free if you have sufficient assets there ($50,000). Otherwise they'll charge you a $25 fee.

Answer 4

Bank of America supports two-factor authentication using SMS messages, similar to PayPal. You can enable the feature from Online Banking under Customer Service -> SafePass Settings.

Update: Over the weekend of July 28th, 2012, the SafePass control on the authentication page was updated to simple HTML + JavaScript instead of Flash, so that it is now possible to login from Safari on iOS, among others.

Answer 5

Some credit unions also offer them and support Business banking as well.

First Tech Credit Union is a great example. They also have the most security-oriented banking website I've seen to date.

https://www.firsttechfed.com/

As a side note I've found that Credit Unions are a MUCH better deal for personal and business banking.