Cookie settings

Cookies are small text files stored on your device to identify you and can be used to remember user preferences and analyse traffic to further improve our website. We may share information about your use of our site with our social media, advertising and analytics partners. By clicking "Accept all cookies", you agree to the use of all cookies as described in our cookie statement or "Accept only essential cookies" to only use cookies that are necessary for the functioning of our site.

Read our cookie statement here.

You can choose to adjust your preferences at any time.
Wholesale Banking

InsideBusiness App security

To overview

InsideBusiness App combines the security of two-factor authentication with the convenience of mobile devices.

Encryption and protocols

Each user creates multiple, personal and strong sets of cryptographic keys during the registration process. Separate keys are used for authenticated encryption and signing. These keys allow the app to create a second secure channel on top of TLS, so that even if the TLS layer is broken, the app remains secure.

Strong and proven protocols are used for connection, encryption and keys:

  • TLS 1.2+ for the outer secure channel, with strong certificate pinning to prevent a Man-in-the-Middle attack
  • AES (256), HMAC (512), and RSA (2048) for the additional secure channel on top of TLS. For this additional channel, the app also pins the RSA public key of the server to further thwart a possible Man-in-the-Middle attack

mPIN

A personal mPIN is used specifically for this app, user and device combination to unlock the app and connect to ING.

  • The mPIN is not known to ING and is not transmitted.
  • To authenticate the user based on their mPIN, the Secure Remote Password (SRP) protocol is used.
  • The mPIN is blocked after 5 incorrect attempts and unblock is only possible by re-activation. The user and Corporate Administrator(s) (if any) are informed when a new registration takes place.

Biometrics authentication

Biometrics such as Fingerprint or (Android & iOS) Face ID (iOS) can be enabled by user in addition to the traditional login via 5-digit mPin. 

ING’s security measures

  • The software is extensively tested in multiple phases on different levels during the development process. Before a major release, the implementation is also tested by an external 3rd party (white box, grey box and black box testing).
  • A user can de-register the app (wipe keys and block the app). User, Corporate Administrator and ING can block the app via InsideBusiness.
  • A profile ID and keys are securely stored on the mobile device (based on iOS and Android keychain). Sensitive data downloaded with the app is stored encrypted and only available in combination with a secure connection with ING and the mPIN/biometrics.
  • The app complies with applicable local regulatory requirements, international security standards and market best practices.
  • Ability to detect common cases of tampering with your device.
  • ING monitors continuously for possible fraudulent activities.