APRP Authentication & Access Controls in Payments — Questions and Answers
Question 1: In payments risk management, 'corporate account takeover' (CATO) is BEST described as:
- A hostile acquisition of a payment processing company by a competitor
- Criminals stealing business online banking credentials to initiate unauthorized ACH debits or wire transfers (Correct answer)
- A regulatory action in which authorities seize control of a non-compliant financial institution
- An internal fraud scheme in which an employee diverts incoming wires to a personal account
Correct answer: Criminals stealing business online banking credentials to initiate unauthorized ACH debits or wire transfers
CATO refers to cybercriminals compromising a business's online banking login credentials — often through malware or phishing — and then using those credentials to initiate unauthorized payments such as ACH batch files or wire transfers. It is a major fraud vector specifically targeting commercial payment accounts.
Question 2: Multi-factor authentication (MFA) in payment systems requires users to present credentials from:
- Two or more passwords created independently by the same user
- Two or more independent factors drawn from different categories: something you know, something you have, and/or something you are (Correct answer)
- Authentication tokens issued sequentially by the same hardware vendor
- Any combination of login attempts across multiple registered devices
Correct answer: Two or more independent factors drawn from different categories: something you know, something you have, and/or something you are
True MFA requires factors from at least two distinct categories: knowledge (password/PIN), possession (hardware token, mobile device), or inherence (biometrics). Using two passwords is not MFA — both belong to the same category. The independence of the factors is what makes MFA effective.
Question 3: The principle of 'least privilege' applied to payment system access controls means users should be granted:
- Administrative access to all payment modules to prevent delays during peak processing hours
- Access rights limited to only what is necessary to perform their specific job duties (Correct answer)
- The minimum number of login attempts before account lockout is triggered
- Access only during the least busy processing hours to reduce system load
Correct answer: Access rights limited to only what is necessary to perform their specific job duties
Least privilege is a foundational access control principle that limits each user's system permissions to exactly what their role requires — no more. This minimizes the damage that can result from compromised credentials, insider threat, or accidental misuse.
Question 4: Which control BEST prevents a single employee from both initiating a payment AND approving that same payment for processing?
- Multi-factor authentication for all payment initiators
- Mandatory password complexity and rotation requirements
- Segregation of duties between payment initiation and payment approval roles (Correct answer)
- Transaction velocity limits on individual user accounts
Correct answer: Segregation of duties between payment initiation and payment approval roles
Segregation of duties (SoD) assigns the initiation and authorization steps of a payment workflow to different individuals, ensuring no single employee can complete a fraudulent transaction without a second party's involvement. MFA and password controls address authentication, not authorization workflow separation.
Question 5: 'Out-of-band' authentication for high-value payment transactions refers to verifying the transaction through:
- Authentication processes that occur outside of normal business hours
- A separate communication channel from the one used to initiate or request the payment (Correct answer)
- A third-party authentication vendor operating outside the institution's network
- Bypassing standard authentication steps for pre-approved expedited transfers
Correct answer: A separate communication channel from the one used to initiate or request the payment
Out-of-band authentication uses a different channel — such as a phone call or SMS to a registered number — to confirm a transaction that was initiated via online banking or another channel. This defeats man-in-the-browser attacks because the attacker controlling the primary channel cannot intercept the secondary channel.
Question 6: Which review process should be performed on a REGULAR, recurring basis to ensure that terminated employees and role-changed staff cannot access payment systems?
- Penetration testing of the payment network perimeter
- Vulnerability scanning of all payment servers
- User access recertification (periodic review of access rights) (Correct answer)
- Encryption key rotation across all payment databases
Correct answer: User access recertification (periodic review of access rights)
User access recertification (also called access rights review or attestation) is a periodic process in which managers certify that each employee's system access remains appropriate for their current role. This catches orphaned accounts, over-permissioned users, and access rights retained after role changes or termination.
APRP Authentication & Access Controls in Payments
In payments risk management, 'corporate account takeover' (CATO) is BEST described as: