Swiss software firm Vasco has bought Cambridge-based banking security specialist Cronto in a deal valued at up to £14.5m.
Vasco will pay $19.3m (€15m, £12.7m), and a further $2.6m (€2m, £1.8m) depending on future earnings, to get its hands on the British upstart's malware-defeating technology. Its software attempts to shield online transactions from any eavesdropping or interfering Trojans lurking on bank customers' PCs. Germany's Commerzbank AG and Switzerland's Raiffeisen bank use the tech - also known as photoTAN - to combat fraud.
Cronto began life in 2005 as a University of Cambridge spin-out, and offers either a mobile application or a dedicated device to scan a "CrontoSign" image shown by a bank's website during a transaction.
Details about the payment are encoded in the picture and, when extracted by the app or device, the information is shown on the phone or handheld for the customer to manually check. If all the details are correct, the image data is used by the app or device to generate an authorisation code, which is typed into the bank website for the financial institution to process and confirm the transaction - having generated the image, the bank will know which authorisation code to expect.
This is supposed to ensure that any miscreant's attempt to alter a payment on the user's PC (such as changing the destination account number) is detected: the correct authentication code required to confirm a money transfer is only known to the bank and the customer, not the PC which may be compromised.
Thus, the technology is said to thwart man-in-the-browser attacks, as used by the infamous ZeuS banking Trojan and other data-intercepting malware, as well as phishing and other methods of social engineering.
The CrontoSign system will eventually be merged into Vasco's MyDigipass corporate security platform. The Swiss biz is best known for its two-factor authentication for secure email login and such stuff, which competes with gear from the likes of RSA Security. The Cronto deal will allow it to branch out to become a business-to-consumer authentication services provider.
In a canned statement, Dr Elena Punskaya, Cronto’s co-founder and CTO, added: “The combination of the experience and R&D capacity will allow Cronto and Vasco to continue to identify new opportunities and implement the market vision, taking advantage of Cronto’s position in Cambridge, UK – an undisputed centre in the global innovation landscape.” ®