Shareholder Authentication (published 2015)

For various reasons, some authentication measures in common use by fund groups may have become less effective over time. For example, the username/password combination commonly used to authenticate shareholders may not offer the same degree of protection against fraud as it has in the past. Usernames, in and of themselves, are of limited value in authenticating users, and, as algorithms have become more sophisticated and computers have become more powerful, fraudsters continue to make significant advancements in cracking passwords.  Indeed, tools for cracking passwords are readily available to the public, and require relatively modest equipment and little, if any, expertise.¹ A recent report found that passwords as long as 55 characters could be cracked with relative ease.²

 

In any event, the strength of a password is irrelevant if the fraudster simply steals or otherwise obtains a user’s password. Passwords may be obtained in a variety of ways, including through phishing attempts (e.g., e-mails that seek to trick users into entering personal information on fraudulent websites) and through malware that logs keystrokes (including passwords) and relays the information back to the fraudster.⁴

 

Each passing year brings new data breaches involving a range of businesses, often involving the loss of usernames and passwords, as well as of customer personal information and/or financial information.  As a result of a series of data breaches, or even a single data breach, fraudsters may gain sufficient information about a particular user to compromise the user’s accounts at other organizations that were not subject to the breaches. The fraudsters’ task may be simplified by the common predilection of many users to re-use the same or similar passwords at multiple websites.⁵

 

The information underlying knowledge-based authentication questions (e.g., a user’s mother’s maiden name or the name of a childhood pet) may also be lost or misappropriated in large-scale data breaches or may be obtained through hacking.⁶ Moreover, with respect to certain questions, a fraudster may, even in the absence of a data breach or a hacking incident, obtain sufficient information to compromise a user’s account. Indeed, the user himself or herself, perhaps with the assistance of family and friends, may voluntarily divulge much of this information. The ubiquity of social media tends to undermine the value of certain questions, such as the shareholder’s mother’s maiden name or the name of a childhood pet.⁷