Skip to main content

The Fraud Puzzle: Assembling the Pieces of Payment Security


Following our previous blog '
Rethinking AML: A Call for Innovation and Efficiency' ("https://bankloch.blogspot.com/2024/02/rethinking-aml-call-for-innovation-and.html"), where we navigated the complex world of AML and pinpointed three primary categories of malicious financial activities:

  • Money laundering: Transforming proceeds from illicit activities into seemingly legitimate funds.

  • Sanction bypassing: Circumventing governmental sanctions.

  • Payment Fraud: Exploiting stolen or fake payment details to illicitly acquire goods or funds.

Focusing on Payment Fraud, we discern two principal categories: insider (internal) fraud, conducted from inside an organization by its own staff, and external fraud, perpetrated by outsiders like customers or suppliers. This blog delves into external fraud within the financial sector, particularly the unauthorized extraction of customer funds. This subset of "Payment Fraud" can be further split-up in several types, depending on the tactic used for the fraud:

  • Phishing: A social-engineering strategy that deceives individuals into revealing sensitive information. This category encompasses a broad spectrum, from widespread email phishing to more personalized attacks like Spear Phishing and Whaling, extending to SMS (Smishing), voice (Vishing), and QR codes (Quishing).

  • Skimming: The use of skimmers by fraudsters to capture credit or debit card data at ATMs or sales terminals.

  • Identity theft: Unauthorized use of someone’s personal information for fraudulent transactions or account openings.

  • Chargeback fraud: Customers falsely disputing a legitimate charge, claiming non-receipt of goods or services, or denying the transaction altogether. This type is also known as "friendly fraud".

  • Business email compromise: Unauthorized access to business emails to initiate fraudulent transfers.

  • Card-not-present fraud: Fraudulent transactions conducted online or over the phone using stolen card details.

  • Credential Stuffing: Utilizing stolen credentials, typically collected from data breaches and sold on the Dark Web, to access accounts under the assumption of reused passwords.

  • SIM Card Swapping: Persuading a mobile carrier to reassign a victim’s phone number to a new SIM card, undermining two-factor authentication (2FA) measures.

  • Malware: Installing malicious software to hijack bank accounts.

  • Man-in-the-Middle Attacks: Intercepting communications between a financial institution and its clients.

Many of these fraud types fall under "Account Takeover Fraud" (ATO), where cybercriminals gain control of a victim’s account. However, fraud can also occur without direct account access, as seen in "Spoofing" scams, where fraudsters impersonate legitimate entities to deceive victims into making transfers to their accounts. E.g. a cybercriminal could counterfeit an invoice of a customer’s supplier. If done well, almost no difference can be identified with a legitimate invoice, except of course that the IBAN does not belong to the supplier but to the cybercriminal. This type of fraud is becoming increasingly common, a reason why the new European directives on PSD3 and Instant Payments will force banks to execute IBAN-Name checks.

The extensive list of techniques described above shows that cybercriminals use a variety of techniques to gain access to the money of their victims. As such, addressing Payment Fraud necessitates a multi-faceted approach, combining technological solutions with vigilant practices.

A foundation element to better identify the customer is MFA or Multi-Factor Authentication, which significantly reduces unauthorized access by requiring multiple verification factors (something you know, something you have and/or something you are). For further insights on this, check out my blog "Multi-Factor Authentication and Identity Fraud Detection in the Financial Services Industry" - "https://bankloch.blogspot.com/2020/02/multi-factor-authentication-and.html")

Beyond MFA, Risk-Based Authentication (RBA) offers a dynamic layer of security by adapting authentication requirements based on the user’s behavior and context, enhancing both security and usability. This approach may involve:

  • Behavioral Biometrics & Analytics: Analyzing user behavior patterns, such as typing speed, the way the user moves his mouse over the screen, the way the user holds his mobile phone in his hand, the typical flow the user follows in the banking app…​

  • Device & Network settings: Monitoring IP addresses (e.g. known or new IP address, geo-location of the IP), device types (incl. browser type), and network characteristics (e.g. VPN used or not) for anomalies.

  • User activity: Evaluating the nature and history of user actions to assess risk.

  • Transaction data: Scrutinizing transaction details (e.g. transaction amount, existing or new counterpart, sector of counterparty…​) for irregularities.

  • Timing: Considering the usual timing of user interactions for any anomalies.

By adopting a holistic view of user activity, banks can impose additional controls as needed, striking a balance between security and convenience.

Improving the identification and evaluation of counterparties involves various controls and alerts, including:

  • IBAN - Name Checks: Verifying the match between IBAN and counterparty names.

  • Customer Profile Alignment: Assessing whether transactions align with the user’s typical behavior.

  • Sanction and Blacklist Screening: Comparing counterparties against official and internal lists (i.e. allow customers to report themselves also malicious IBANs and counterparties).

  • Risk and Financial Scoring: Evaluating the counterparty’s credibility and trustworthiness using public (e.g. published annual reports) and private records.

  • Improved KYC and AML screening for customer onboarding, i.e. if malicious customers cannot open a bank account, it adds an additional burden to do payment fraud.

The rise of cybercrime emphasizes the need for robust fraud prevention strategies within the banking sector. The advent of innovative technologies, particularly from RegTech firms, is crucial. Yet, their effectiveness depends on the availability of comprehensive, real-time, and historical data.

As financial institutions grapple with data silos, dismantling these barriers is essential for improving fraud detection and securing the financial ecosystem. By creating an environment where data from various sources can be seamlessly integrated, banks are better positioned to address the growing challenge of cybercrime.

Comments

Popular posts from this blog

Transforming the insurance sector to an Open API Ecosystem

1. Introduction "Open" has recently become a new buzzword in the financial services industry, i.e.   open data, open APIs, Open Banking, Open Insurance …​, but what does this new buzzword really mean? "Open" refers to the capability of companies to expose their services to the outside world, so that   external partners or even competitors   can use these services to bring added value to their customers. This trend is made possible by the technological evolution of   open APIs (Application Programming Interfaces), which are the   digital ports making this communication possible. Together companies, interconnected through open APIs, form a true   API ecosystem , offering best-of-breed customer experience, by combining the digital services offered by multiple companies. In the   technology sector   this evolution has been ongoing for multiple years (think about the travelling sector, allowing you to book any hotel online). An excelle...

Are product silos in a bank inevitable?

Silo thinking   is often frowned upon in the industry. It is often a synonym for bureaucratic processes and politics and in almost every article describing the threats of new innovative Fintech players on the banking industry, the strong bank product silos are put forward as one of the main blockages why incumbent banks are not able to (quickly) react to the changing customer expectations. Customers want solutions to their problems   and do not want to be bothered about the internal organisation of their bank. Most banks are however organized by product domain (daily banking, investments and lending) and by customer segmentation (retail banking, private banking, SMEs and corporates). This division is reflected both at business and IT side and almost automatically leads to the creation of silos. It is however difficult to reorganize a bank without creating new silos or introducing other types of issues and inefficiencies. An organization is never ideal and needs to take a numbe...

RPA - The miracle solution for incumbent banks to bridge the automation gap with neo-banks?

Hypes and marketing buzz words are strongly present in the IT landscape. Often these are existing concepts, which have evolved technologically and are then renamed to a new term, as if it were a brand new technology or concept. If you want to understand and assess these new trends, it is important to   reduce the concepts to their essence and compare them with existing technologies , e.g. Integration (middleware) software   ensures that 2 separate applications or components can be integrated in an easy way. Of course, there is a huge evolution in the protocols, volumes of exchanged data, scalability, performance…​, but in essence the problem remains the same. Nonetheless, there have been multiple terms for integration software such as ETL, ESB, EAI, SOA, Service Mesh…​ Data storage software   ensures that data is stored in such a way that data is not lost and that there is some kind guaranteed consistency, maximum availability and scalability, easy retrieval...

IoT - Revolution or Evolution in the Financial Services Industry

1. The IoT hype We have all heard about the   "Internet of Things" (IoT)   as this revolutionary new technology, which will radically change our lives. But is it really such a revolution and will it really have an impact on the Financial Services Industry? To refresh our memory, the Internet of Things (IoT) refers to any   object , which is able to   collect data and communicate and share this information (like condition, geolocation…​)   over the internet . This communication will often occur between 2 objects (i.e. not involving any human), which is often referred to as Machine-to-Machine (M2M) communication. Well known examples are home thermostats, home security systems, fitness and health monitors, wearables…​ This all seems futuristic, but   smartphones, tablets and smartwatches   can also be considered as IoT devices. More importantly, beside these futuristic visions of IoT, the smartphone will most likely continue to be the cent...

PSD3: The Next Phase in Europe’s Payment Services Regulation

With the successful rollout of PSD2, the European Union (EU) continues to advance innovation in the payments domain through the anticipated introduction of the   Payment Services Directive 3 (PSD3) . On June 28, 2023, the European Commission published a draft proposal for PSD3 and the   Payment Services Regulation (PSR) . The finalized versions of this directive and associated regulation are expected to be available by late 2024, although some predictions suggest a more likely timeline of Q2 or Q3 2025. Given that member states are typically granted an 18-month transition period, PSD3 is expected to come into effect sometime in 2026. Notably, the Commission has introduced a regulation (PSR) alongside the PSD3 directive, ensuring more harmonization across member states as regulations are immediately effective and do not require national implementation, unlike directives. PSD3 shares the same objectives as PSD2, i.e.   increasing competition in the payments landscape and en...

Trade-offs Are Inevitable in Software Delivery - Remember the CAP Theorem

In the world of financial services, the integrity of data systems is fundamentally reliant on   non-functional requirements (NFRs)   such as reliability and security. Despite their importance, NFRs often receive secondary consideration during project scoping, typically being reduced to a generic checklist aimed more at compliance than at genuine functionality. Regrettably, these initial NFRs are seldom met after delivery, which does not usually prevent deployment to production due to the vague and unrealistic nature of the original specifications. This common scenario results in significant end-user frustration as the system does not perform as expected, often being less stable or slower than anticipated. This situation underscores the need for   better education on how to articulate and define NFRs , i.e. demanding only what is truly necessary and feasible within the given budget. Early and transparent discussions can lead to system architecture being tailored more close...

Low- and No-code platforms - Will IT developers soon be out of a job?

“ The future of coding is no coding at all ” - Chris Wanstrath (CEO at GitHub). Mid May I posted a blog on RPA (Robotic Process Automation -   https://bankloch.blogspot.com/2020/05/rpa-miracle-solution-for-incumbent.html ) on how this technology, promises the world to companies. A very similar story is found with low- and no-code platforms, which also promise that business people, with limited to no knowledge of IT, can create complex business applications. These   platforms originate , just as RPA tools,   from the growing demand for IT developments , while IT cannot keep up with the available capacity. As a result, an enormous gap between IT teams and business demands is created, which is often filled by shadow-IT departments, which extend the IT workforce and create business tools in Excel, Access, WordPress…​ Unfortunately these tools built in shadow-IT departments arrive very soon at their limits, as they don’t support the required non-functional requirements (like h...

An overview of 1-year blogging

Last week I published my   60th post   on my blog called   Bankloch   (a reference to "Banking" and my family name). The past year, I have published a blog on a weekly basis, providing my humble personal vision on the topics of Fintech, IT software delivery and mobility. This blogging has mainly been a   personal enrichment , as it forced me to dive deep into a number of different topics, not only in researching for content, but also in trying to identify trends, innovations and patterns into these topics. Furthermore it allowed me to have several very interesting conversations and discussions with passionate colleagues in the financial industry and to get more insights into the wonderful world of blogging and more general of digital marketing, exploring subjects and tools like: Search Engine Optimization (SEO) LinkedIn post optimization Google Search Console Google AdWorks Google Blogger Thinker360 Finextra …​ Clearly it is   not easy to get the necessary ...

The UPI Phenomenon: From Zero to 10 Billion

If there is one Indian innovation that has grabbed   global headlines , it is undoubtedly the instant payment system   UPI (Unified Payments Interface) . In August 2023, monthly UPI transactions exceeded an astounding 10 billion, marking a remarkable milestone for India’s payments ecosystem. No wonder that UPI has not only revolutionized transactions in India but has also gained international recognition for its remarkable growth. Launched in 2016 by the   National Payments Corporation of India (NPCI)   in collaboration with 21 member banks, UPI quickly became popular among consumers and businesses. In just a few years, it achieved   remarkable milestones : By August 2023, UPI recorded an unprecedented   10.58 billion transactions , with an impressive 50% year-on-year growth. This volume represented approximately   190 billion euros . In July 2023, the UPI network connected   473 different banks . UPI is projected to achieve a staggering   1 ...

AI in Financial Services - A buzzword that is here to stay!

In a few of my most recent blogs I tried to   demystify some of the buzzwords   (like blockchain, Low- and No-Code platforms, RPA…​), which are commonly used in the financial services industry. These buzzwords often entail interesting innovations, but contrary to their promise, they are not silver bullets solving any problem. Another such buzzword is   AI   (or also referred to as Machine Learning, Deep Learning, Enforced Learning…​ - the difference between those terms put aside). Again this term is also seriously hyped, creating unrealistic expectations, but contrary to many other buzzwords, this is something I truly believe will have a much larger impact on the financial services industry than many other buzzwords. This opinion is backed by a study of McKinsey and PWC indicating that 72% of company leaders consider that AI will be the most competitive advantage of the future and that this technology will be the most disruptive force in the decades to come. Deep Lea...