Service NSW readies multifactor authentication trial

Service NSW is taking its first steps towards implementing multifactor authentication for its MyServiceNSW service.

Minister for customer service and digital government Victor Dominello announced the move yesterday on LinkedIn.

It comes in the wake of the Optus data breach, which drew attention to the safety of state-issued IDs such as driver’s licences. 

NSW led the way in agreeing to simplify the process for citizens whose driver’s licences were compromised in the breach.

At first, 2FA will be offered only via authentication codes sent as texts, an approach widely regarded as insecure.

Dominello said SMS-based 2FA is a “first phase to test it out”, with further iterations to provide “more robust and convenient second factor choices” including push notifications and support for authenticator apps.

He said “the initial pilot will not be silky smooth”.

Customers who opt-in for the initial phase, he said, will be required to use 2FA for each account login.

As the MFA pilot is enhanced, Dominello said, customers will have “choice in how MFA can be applied (rather than every time a login occurs).”

“Following the initial pilot, Service NSW will be working on applying MFA to specific scenarios and transactions in the MyServiceNSW account to protect customers,” he wrote.

“As an example, MFA will be required when customers want to change their bank account details.”