U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.


Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

White Paper (Draft)

[Project Description] Multifactor Authentication for e-Commerce: Online Authentication for the Retail Sector

Date Published: May 9, 2016
Comments Due: June 3, 2016 (public comment period is CLOSED)
Email Questions to: consumer-nccoe@nist.gov


William Newhouse (NIST), Sarah Weeks (MITRE),


The National Cybersecurity Center of Excellence (NCCoE) has posted a draft Project Description on the topic of Multifactor Authentication for e-Commerce.

As greater security control mechanisms are implemented at the point of sale, retailers in the United States may see a drastic increase in e-commerce fraud, similar to what has been widely observed in the UK and Europe following the rollout of EMV chip-and-PIN technology approximately ten years ago. Consumers, retailers, payment processors, banks, and card issuers are all impacted by the security risks of e-commerce transactions. Retailers bear the cost for fraudulent, card-not-present (CNP) transactions, motivating them to reduce fraud in order to avoid damage to their reputation and eliminate potential revenue losses, which have been estimated to be over $3 billion. Part of e-commerce fraud reduction includes an increased level of assurance in purchaser or user identity.

This project and its example solution will help reduce the risk of false online identification and authentication fraud for e-commerce transaction with multifactor authentication tied to existing web analytics and contextual risk calculation.



retail; multifactor; authentication; MFA; retail; e-commerce; fraud; card-not-present; CNP; web analytics; retail; risk calculation
Control Families

Access Control; Identification and Authentication


Draft Project Description

Supplemental Material:
Submit Comments (other)
Project Homepage (other)

Document History:
05/09/16: White Paper (Draft)
09/20/16: White Paper (Final)


Security and Privacy