Secure Transaction Device For 20,000 1st Union Clients

In a first for a major U.S. banking company, First Union Corp. is deploying Digipass 300, a pocket-size device that lets corporate customers make secure transactions over the Internet.

A few thousand of First Union's cash management customers already have the devices, and as many as 20,000 are expected to be using them by midyear.

The Digipass 300 authentication system is produced by Vasco Data Security International Inc. of Oakbrook Terrace, Ill. The deployment was announced this week at the annual RSA Data Security Conference, but it actually began in November with customers of Philadelphia-based CoreStates Financial Corp., which First Union bought that month.

Distribution to 20,000 customers is sizable by today's standards and a sign that banks' interest in data security technology is growing.

"Our customers will be able to make secure wire transfers and automated clearing house transactions without leaving their desks," said Randall E. York, assistant vice president of the $234 billion-asset First Union in Charlotte, N.C. "That's a powerful selling point for us."

It is also a breakthrough for Vasco, which had done most of its banking industry business overseas and is overshadowed in the United States by Security Dynamics Technologies Inc., which claims a 70% share of the market for so-called two-factor authentication.

Ironically, Security Dynamics is the parent of RSA Data Security Inc., sponsor of the conference where the announcement was made. Vasco, a licensee of RSA's data encryption technology and one of about 140 companies displaying its wares to more than 5,000 people at the San Jose Convention Center, has a patent-infringement suit pending against Security Dynamics.

In two-factor authentication, a security token-in First Union's case, the handheld Digipass 300-augments the common user password by generating a random code number unique to a particular transaction. After entering a personal identification number, the authorized employee would enter the unique code into a computer to authenticate that transaction.

Vasco has sold more than 2.6 million Digipass tokens. They are in use at 130 banks, mostly in Europe.

Two U.S. community banks-Oak Brook (Ill.) Bank and Britton & Koontz First National Bank of Natchez, Miss.-are Vasco customers. But T. Kendall Hunt, Vasco's chief executive officer, said signing a deal with the sixth- largest U.S. banking company will be crucial to establishing a reputation and gaining market share domestically.

"A very visible, prestigious name like First Union is going to make the road ahead a lot faster," Mr. Hunt said. "This is very big for us."

First Union has signaled its intention to adopt advanced forms of data security. It has made an open-ended commitment to deploy digital certificates from Verisign Inc.-an on-line authentication technique for customers and employees-in multiple lines of business.

Mr. Hunt estimated that a potential 300 million to 500 million business customers of U.S. banks could benefit from Vasco's two-factor authentication technology.

Mr. York said First Union required a 95% success rate when customers logged in using the Digipass 300 password. In trials, the first-try success rate topped 99.5%.

Life expectancy of the device was also a factor. The battery life of Digipass 300 runs seven to 10 years, said to be triple that of comparable devices.

"Having to replace these for thousands of customers every two to three years would be a huge drain on resources," Mr. York said.

First Union is also able to brand the token. Each Digipass is First Union green and carries the bank's logo, which, Mr. York said, strengthens the bond with customers.

For reprint and licensing requests for this article, click here.
MORE FROM AMERICAN BANKER