Transaction Creation
The TrustFactor transaction creation process is a vital part of ensuring the secure operation of a client's application. This process begins when a user triggers an action in the application that requires strong authentication (such as a bank transfer).
Key Steps
- User triggers an action within the application that requires strong authentication (e.g., bank transfer).
- The application initiates a transaction creation process by calling TrustFactorAPI.
- Details related to the action, including parameters like amount, currency, source account, destination account, and risk analysis information, are included in the transaction creation process.
- A notification is sent to all devices linked with the contract for which the transaction refers to, signaling the need for the user's decision.
- As the transaction is created and is still pending, the application should display an UI guiding the user to decide on the transaction.
Assumptions:
- User is already authenticated in Internet Banking / App Client
NOTES:
- Even though transactions might not have any sensitive information (depending on application shared information during transaction creation), their details are all encrypted at-rest on TrustFactor cloud except for the information required on transaction list (for Backoffice and TF Agents UI).
During this process the client's application creates a new transaction for a specific user.
In order to achieve that, the application must specify the TrustFactor User ID (the one specified during Contract Registration flow) and transaction duration.
The application should also share with TrustFactor some more information that will be displayed to the user (using TF Agent) like action (ie: "National Transfer"), message, parameters, etc. For more details about transaction creation check the appropriate application SDK documentation.
Requiring a precise location
An application can require the user to share a precise location before the transaction can be accepted.
A transaction, unlike a registration code, can be fetched from TrustFactor, so the TF App learns of the requirement simply by retrieving the transaction details. Nothing has to be carried in a push notification or a link.
The requirement is enforced when the user decides, and declining never requires a location. See Transaction Decision.
Confirmation code
A confirmation code adds a value that only the client application and TrustFactor know. The client application displays the correct code to the user on its own screen (the internet banking page, for instance), and the TF App shows a shuffled list of candidate codes without indicating which one is correct. To accept the transaction the user has to pick the code they were shown.
Because the correct code never reaches the device, an attacker who has compromised a TF Agent cannot accept a transaction on their own: they can only guess.