A Tale of Two Yous: Misuse of Multiple User Access

BioCatch recently worked with a major consulting firm in the U.S. that wanted to find out which clients misused password and log-in accesses, beyond what they were entitled to under their membership subscription.

Generally, companies are unable to track this effectively. If the consulting company gives access to 3 employees of company X, there is no way for the consulting company to determine if 20 employees at company X aren’t sharing the same 3 access log-ins since this kind of tracking is usually limited to detecting the device ID and its geolocation which can remain the same in an office, for example.

If the consulting company has a more sophisticated tracking tool, they can see two different devices operating at the same time but in most cases, it can’t give an accurate indication of who the user actually is. For example - someone could have easily forgotten to sign out of their laptop, leaving them logged in on their laptop while they are simultaneously connecting via their PC, leading to a situation where there’s 1 user logged in on two devices.

Behavioral biometrics offers a very effective solution for monitoring employee accesses.

By collecting behavioral data - things like mouse movement, typing patterns, how one holds a mobile device, etc., behavioral biometrics allows for a nuanced view of user activities so that if someone logs in, regardless of device or location, it can be confirmed that they are the authentic user.

In the image to the left, you can see cursor movement during a 10 second interval on 3 different devices/screens. All movements were performed using the same user and log-in credentials.

It’s a clear indication that the account was misused.

Generally speaking, the misuse occurs in big companies where devices look the same (vis-à-vis hardware). This is a factor that behavioral biometrics can easily address and solve.

The image on the right shows typing statistics. In this case, it displays the average time intervals between one key-press to another of three different users, all with identical devices in the same organization. As you can see, the user of Device 1 is a fast-typer in comparison to the users of Devices 2&3. Clearly, this is one account which is being used by more than one user.

The bottom line is that in cases where traditional methods fail to protect abuse of password and log-in accesses, behavioral biometrics can deliver.

*About the writer: Itai Novick is BioCatch Senior Data Scientist

#photo