Can be combined in any combination to make it a layered security.
Waller claims COBAS is the market's only pure out-of-band authentication system. "It's simplistic sophistication all in one," he says, noting that it offers nine authentication methods, which can also be layered for greater security. Users are all relying on the phone/PIN application for credit card authorization. "We are all conditioned to use the phone. It's the most ubiquitous medium in the world," he says. "And when the phone rings and [the computer] asks, 'Will you authorize a $300 purchase at Barnes and Noble?' and you didn't, you can reject it and it won't go through. That's peace of mind." No banks are yet live with the technology, but he says pilot programs are beginning with First Community Bank, Bank of New York and Bank of Tokyo; Chase and Citigroup are also considering testing the product.
the FFIEC does not get in bed with vendors, so they don't require any specific form of MFA only MFA on "transactions" or "risk activities" that have elevated risk. You can read the guidance.
It can be in the form of "stronger security questions" OOB authentication
Authentication from a 2nd authorized employee (in the case of business transactions innitiated online)
Software that monitors financial activity and presents MFA on unusual activity.
Bank or financial institution issued "secure usb tokens"