Token and password handover

Guidelines when delivering tokens and passwords

When tokens or passwords cannot be delivered directly from person to person please refer to the following guidelines. These guidelines complement existing security guidelines documented in Getting Started for Corporates > Security guidelines.

Situations that require delivering a token are typically:

• When new users or administrators receive a new token from an existing administrator, along with its activation password.
• When a token is locked and the user hands it over to an administrator who will prepare it for a reset. The administrator then provides the token that is prepared for reset back to the user, along with a temporary password.
• When a token is lost, the administrator prepares a new token to recover its identifier, and provides it to the user, along with an activation password.

Token handover

A not activated administrator token that is already affected to a user group must be delivered in person. This also applies to the second administrator token that is setup when the user group for your organisation is created. In the eventuality that an administrator token is required in a remote location, a not activated token with a user role can be sent. After reception it can then be prompted to administrator remotely by an existing administrator.

A valid activated token that is not locked cannot be handed over to another user.

In the eventuality that a token is locked and no administrator is on location, the locked token can be sent to a remote administrator who will prepare it for a reset, then send it back to the user for re-activation, along with a temporary password. When he reactivates the token the user will also need to provide the security code of the token. The security code of the token must always remain in the possession of the user and be kept in a secure location. Never send the security code with the token. Refer to the password handover section below concerning the delivery of the temporary password.

In the eventuality that a new token needs to be prepared by an administrator for a user in another location, the token must be added to the user group but cannot be activated before shipping. Refer to the password handover section below concerning the delivery of the initial password.

Password handover

The initial password required to activate a token and the temporary password required to finalize the reset of a locked token need to be communicated through secure channels, such as encrypted email or secured phone call. SWIFT recommends to split the password in 2 parts and communicate each part through a separate channel.

The passsword provided by the administrator will be modified during the activation or reset of the token on the 3SKey portal. The password of an activated token should never be communicated to a third party. It is only to be used within the SWIFT 3SKey portal, the SWIFT 3SKey software, the bank portal or the treasury application.