2. Temenos Digital Web Banking with PIN (or Password) & SMS Secure Code

2.1 Registration (SMS Authentication)

Customer has received the customer ID and Activation Code using the Temenos components.
Customer is prompted to enter the customer ID and Activation Code.
Customer enters the customer ID and Activation Code.
Activation code is successfully validated on the HID Authentication Service.
Customer is sent the SMS Secure Code to the registered mobile number.
Customer enters the Secure Code in the online banking application.
Secure Code authenticated successfully.
Customer is prompted to add password.
Customer's password is submitted.
Customer has successfully registered for SMS-based authentication.

Customer accesses the web online banking application and chooses the option to log in with SMS Secure Code.
Customer is prompted to enter the customer ID and Password.
Customer enters the customer ID and Password.
Customer ID and Password are sent to HID Authentication Service for validation.
If successful, the customer is sent an SMS Secure Code to their registered mobile number.
Web online banking application prompts the customer to enter SMS Secure Code.
Customer enters the received SMS Secure Code in the online banking application.
SMS Secure Code is sent to the HID Authentication Service for validation.
If authentication is successful, the customer is logged in successfully to the online banking application.

Customer initiates transaction in the online banking application.
Customer is prompted to enter the Password.
Customer ID and Password are sent to HID Authentication Service for validation.
If the Customer ID and Password authentication is successful, the customer is sent an SMS Secure Code along with transaction details to their registered mobile number.
Web online banking application prompts the customer to enter SMS Secure Code.
Customer enters the received SMS Secure Code in the online banking application.
SMS Secure Code is sent to the HID Authentication Service for validation.
If authentication is successful, the customer can complete the transaction successfully in the online banking application.

Note: This workflow can also be used for any non-financial transactions such as updating a mobile number or email address, etc.

Customer initiates SMS PIN or Password change in the online banking application.
If authentication is successful, the customer is prompted to enter new SMS PIN or Password.
New PIN or Password is sent to HID Authentication Service and stored securely.

The customer can't recover their forgotten or lost SMS PIN. Customer must contact the bank and request for their account to be reset. Upon reset customer will be sent a new Activation Code so they can re-register for SMS-based authentication to online banking.

Note: If Spotlight is not capable of handling the SMS-based authentication and PIN / Complex password policies it is recommended that the system integrator updates the component to support the functionality.

Customer accesses the web online banking application and chooses the option to log in with SMS Secure Code.
Customer is prompted to enter the customer ID and Password.
Customer enters the customer ID and Password.
Customer ID and Password are sent to HID Authentication Service for validation.
HID Authentication Service returns a response that the PIN or Password has expired.
Temenos Digital prompts the customer to enter a new PIN or Password
Temenos Digital sends the new password to the HID Authentication Service to store it securely
Customer is prompted to enter the new PIN or Password.
The new PIN or Password is sent to the HID Authentication Service for validation.
If successful, the customer is sent an SMS Secure Code to their registered mobile number.
Web online banking application prompts the customer to enter SMS Secure Code.
Customer enters the received SMS Secure Code in the online banking application.
SMS Secure Code is sent to the HID Authentication Service for validation.
If authentication is successful, the customer is redirected to the login page.
Customer enter their customer ID and Password.
Customer is sent an SMS Secure Code to their registered mobile number.
Web online banking application prompts the customer to enter SMS Secure Code.
Customer enters the received SMS Secure Code in the online banking application.
If authentication is successful, the customer is logged in successfully to the online banking application.

An SMS Secure Code authentication policy on the HID Authentication Service can be blocked due to customers entering incorrect SMS Secure Codes for authentication in the web channel. The customer must contact the bank help desk so the bank can reset the failure counter of the authentication policy from Spotlight. It is recommended that the bank staff perform Identity and Verification before resetting the failure counter. Please note that Spotlight integration is out of scope for HID Global.

Note: If Spotlight is not capable of handling the SMS-based authentication policy it is recommended that the system integrator updates the component to support the functionality.

It is possible to configure the number of times a customer can request for SMS Secure Code on the HID Authentication Service without validating it. This configuration prevents the bank customers from being exposed to DDOS attacks. If this is configured to a limited number of requests and the customer has exceeded the threshold then they will not be able to request for SMS Secure Code anymore. Customers must contact the bank help desk so the bank can unregister and register the SMS authentication policy so customers can continue to login. It is recommended that the bank staff perform Identity and Verification before they re-register the SMS authentication policy for the customer.

Note: If Spotlight is not capable of handling the SMS-based authentication policy it is recommended that the system integrator updates the component to support the functionality