Banking and finance.
Knowing the customer, preventing fraud and proving every transaction.
Few sectors sign as much as banking. Account openings, loans, cards, guarantees, direct debit authorizations, corporate transactions that require two signatures, and every day millions of transfers that customers authorize from their phones. In that world, two tools that are often confused coexist: multifactor authentication and the electronic signature. Telling them apart is the first step to using each one well.
Authenticating is not signing
Multifactor authentication, or MFA, is used to confirm that whoever is accessing a service is who they claim to be. It combines at least two factors from different categories:
- Something you know. A password, a PIN.
- Something you have. A registered phone, a card, a physical security key.
- Something you are. A fingerprint, your face.
A signature, by contrast, links a person to specific content: this contract, this transaction, this amount. Authentication answers "who is on the other side?" A signature answers "what exactly did that person accept?" A properly authenticated session does not, on its own, prove what was approved within it.
| Multifactor authentication | Electronic signature | |
|---|---|---|
| Question | Who is accessing? | What was accepted, and when? |
| Object | A session or an access. | A specific document or transaction. |
| Duration | As long as the session lasts. | As long as the proof must be retained. |
| Proof | System logs. | An object that third parties can verify. |
Where they meet: signing the transaction
Between the two lies a middle ground widely used in banking: authentication bound to the transaction. The code or confirmation the customer produces is not good for just anything, but only for that transfer, for that amount and to that payee. If someone changes the payee, the code is no longer valid. European payment services regulation calls this dynamic linking, as part of strong customer authentication, and it is a good example of a general principle: the closer authentication gets to the content, the more it resembles a signature.
Typical signatures in a bank
| Transaction | What is advisable |
|---|---|
| Remote account opening | Identity verified at a level consistent with know your customer (KYC) rules, and signing of the contract with its evidence. |
| Loans and guarantees | A high level signature, a timestamp and long term preservation. |
| Transfers and payments | Authentication bound to the transaction. |
| Corporate transactions | Joint signatures in line with the registered powers of attorney, with signing authority verified in each case. |
| Consents | Separate, recorded acceptances, each with its exact wording. |
Identity, fraud and regulation
Banks operate under obligations to know their customers and prevent money laundering. The Financial Action Task Force (FATF), which sets the global standards in this area, published guidance on digital identity in 2020 that accepts digital means of identifying customers, provided the level of assurance is appropriate to the risk. The idea is the same one that runs through this series: proportionality and evidence.
The most damaging bank fraud of recent years does not break authentication: it deceives the legitimate customer into authorizing a transaction themselves. In those cases, signing the transaction, with clear wording that shows who is being paid and how much, and a pause for anything unusual, helps more than adding factors.
- Which transactions are authenticated and which are signed?
- Is the confirmation of a transaction bound to its amount and payee?
- Are joint signatures checked against up to date powers of attorney?
- Do contracts signed remotely support long term validation?
Multifactor authentication confirms who is accessing; a signature proves what was accepted. Banking uses both, and they converge when the confirmation is bound to the specific transaction. Each transaction deserves the tool proportionate to its risk, and evidence that can be shown to a third party.