{"id":109288,"date":"2022-07-21T16:41:10","date_gmt":"2022-07-21T16:41:10","guid":{"rendered":"https:\/\/feedzai.com\/?p=109288"},"modified":"2024-04-09T09:15:49","modified_gmt":"2024-04-09T09:15:49","slug":"the-rise-of-scams-in-india-and-how-banks-can-stop-them","status":"publish","type":"post","link":"https:\/\/feedzai.com\/blog\/the-rise-of-scams-in-india-and-how-banks-can-stop-them\/","title":{"rendered":"The Rise of Scams in India and How Banks Can Stop Them"},"content":{"rendered":"
[vc_row row_height_percent=”0″ override_padding=”yes” h_padding=”2″ top_padding=”1″ bottom_padding=”2″ overlay_alpha=”50″ gutter_size=”3″ column_width_percent=”100″ shift_y=”0″ z_index=”0″][vc_column width=”1\/1″][vc_row_inner][vc_column_inner width=”1\/12″][\/vc_column_inner][vc_column_inner width=”10\/12″][vc_single_image media=”109304″ dynamic=”yes” media_width_percent=”100″ uncode_shortcode_id=”208926″][\/vc_column_inner][vc_column_inner width=”1\/12″][\/vc_column_inner][\/vc_row_inner][vc_row_inner][vc_column_inner column_width_percent=”100″ gutter_size=”3″ overlay_alpha=”50″ shift_x=”0″ shift_y=”0″ shift_y_down=”0″ z_index=”0″ medium_width=”0″ mobile_visibility=”yes” mobile_width=”0″ width=”2\/12″][\/vc_column_inner][vc_column_inner width=”8\/12″][vc_custom_heading heading_semantic=”h3″ text_size=”h3″ text_weight=”400″ uncode_shortcode_id=”982946″]I recently participated in India Fintech Forum\u2019s digital event, The Rise of Scams<\/a>: Scams<\/a> are changing & How can we prevent them.<\/em><\/p>\n The webinar was so engaging, we didn’t have time to answer all of the participant’s questions. Below you\u2019ll find those questions, along with my answers.<\/em>[\/vc_custom_heading][vc_column_text uncode_shortcode_id=”205084″]<\/p>\n We are responsible for protecting many banks’ online channels. We accomplish this by understanding the many ways that user credentials can be compromised – including <\/span>phishing<\/span><\/a>, data breaches, or malware that harvests user information stored on a device. Fraudsters use these stolen credentials to access the bank\u2019s online platform and from there they look to monetize their efforts.\u00a0<\/span><\/p>\n Feedzai takes a combination of steps to prevent bad actors from profiting from fraud. We go beyond transaction analysis that simply looks at factors like the frequency, the average value of the customer\u2019s of payments, or whether they\u2019ve paid the recipient before. We also establish <\/span>digital trust<\/span><\/a> with the customer by learning their digital footprint. This insight includes the device the user typically uses, the location where they log in, and even their behavioral patterns with their device – such as how they touch their screen, move their mouse, or tap keyboard keys. From there, we use this information to normalize the customer\u2019s behavior over a period of time.<\/span><\/p>\n Combining the digital trust signals that make up the customer\u2019s digital footprint with the transaction analysis makes it easy to identify potential fraud in real time. This approach gives our banking partners a really strong handle on preventing unauthorized fraud attempts.\u00a0<\/span><\/p>\n What we\u2019ve globally is that <\/span>faster payments<\/span><\/a> generally means faster fraud – and more fraud. This means banks don\u2019t have a two-hour (let alone a 24-hour window) to investigate transactions. Banks in India (and around the world for that matter) must ensure their fraud decisions are real-time to keep up with the realities of instant payments technology. This has forced banks to rethink how they provide controls for their consumers and how they adopt the right technology to prevent instant payments from becoming instant fraud losses.<\/span><\/p>\n We\u2019ve already seen this play out in countries where instant payment systems have been introduced. In the UK, for example, consumers were quick to embrace the nation\u2019s Faster Payment Service (FPS) after it was introduced. And why wouldn\u2019t they be? Consumers realized that money could move quicker than ever before and who wouldn\u2019t like that? Unfortunately, fraud rates also shot up after FPS\u2019s launch.\u00a0<\/span><\/p>\n A good <\/span>behavioral biometrics<\/span><\/a> solution allows banks to protect both channels – web and mobile. It\u2019s worth noting that due to the differing nature of device types, the data that is collected from a mobile app is very different from what would be collected from a web browser.\u00a0<\/span><\/p>\n On the web, we typically look at the data in two parts: keystrokes and mouse movements. Keystroke analysis looks at how fast users type, whether they use keyboard shortcuts (which indicates whether they have a higher typing proficiency), and how long a user holds down a key. Meanwhile, mouse movement analysis tracks mouse curvature, inflections of the mouse, and mouse clicks.\u00a0<\/span><\/p>\n On mobile channels, however, there is no mouse data to collect. Instead, we look at data such as the size of the finger that presses on a mobile touchscreen, swipe patterns, and the pressure that the user applies. We also review gyroscopic data on mobile devices. Gyroscopic signals include the angle at which the phone is held, if the phone is held in the right or left hand, or even held up to the user\u2019s ear. Other mobile apps also use these signals – think of how a YouTube screen shifts its orientation when you turn your phone to a landscape position.<\/span><\/p>\n Like transaction data, behavioral biometric data is used to build a baseline understanding of how customers normally engage with the devices. This baseline knowledge can be used to make future risk decisions – such as if a user is suddenly logging in from a mobile device instead of a web browser or holding the device differently (think flat on a table instead of in their hand).<\/span><\/p>\n Using this data in the smartest possible way can be a game-changing strategy for banks when it comes to preventing a whole range of different mobile fraud types.<\/span><\/p>\n There are a few key differences. First, challenger banks – which are usually digital or mobile-first financial institutions – typically have different fraud risks than traditional banks. This is because traditional banks have a broader range of channels through which the consumer can interact. That changes the way fraudsters plan to attack the institution. Traditional financial institutions, as a result, must assess their technology investment differently.<\/span><\/p>\n Data usage is another key difference between challenger banks and traditional banks. Challenger banks tend to be much more effective when it comes to utilization of data, making strong usage of data science and analytics. However, at the same time, challenger banks don\u2019t tend to have the breadth and depth of data that traditional banks have, due to their limited time on the market. Traditional banks, meanwhile, have access to large volumes of data – but often lack the process and infrastructure connectivity to draw maximum value from that data.<\/span><\/p>\n Finally, each type of bank has different risk appetites. For example, traditional banks have already essentially cornered the market by amassing a large share of consumers. As a result, they\u2019re more likely to take a defensive position and are more concerned with guarding their reputations, keeping their customers satisfied, and protecting a strong reputation of reliability and security. Challenger banks, on the other hand, are more focused on making it as easy as possible for consumers to onboard and reduce the friction in their consumers\u2019 journeys. Unfortunately, if it’s easy for consumers to onboard, it will be equally easy for fraudsters as well, so it is important for challenger banks to manage this risk accordingly.<\/span><\/p>\n Both proposals are focused on not allowing the telecoms to continue to facilitate the rise of scams and fraud. Most fraudsters will contact their victims on a spoofed number that presents the same number as the number printed on a customer\u2019s bank card. Therefore, my opinion is that displaying the name of the caller wouldn\u2019t necessarily fundamentally change the risk landscape. However, I think a better strategy would be telcos working together to tackle number spoofing – one of the biggest scams risks that is currently used today.<\/span><\/p>\n As for the <\/span>SMS OTP debate<\/span><\/a>, it\u2019s worth noting that this was never designed as an authentication mechanism. But we\u2019ve become so wedded to this process that it\u2019s now an accepted and popular method for two-factor authentication (2FA). But it has three key limitations. First, it\u2019s not particularly secure since it\u2019s vulnerable to SIM swap, for example, which is an easy way to circumvent an SMS OTP.<\/span><\/p>\n Second, it\u2019s a cumbersome user journey. I may not receive the SMS OTP. Or the bank might not have my most recent phone number on file so the OTP goes to the wrong number. Or it might take 15 seconds to come through and for me to tap it into the screen. Any one or more of these conditions makes for an authentication headache.<\/span><\/p>\n Finally, it can be expensive. It only costs a small sum to send an SMS. That might not sound like a lot, but it adds up to a hefty sum for a bank that has roughly 20 million customers.\u00a0<\/span><\/p>\n What I\u2019d like to see happen is for banks to shift from overt mechanisms like SMS OTP to more covert and secure mechanisms, like positively identifying a user through their digital footprint. This will improve the experience for the user, and if executed correctly, reduce the fraud and scam risk at the same time.<\/span><\/p>\n It wasn\u2019t that long ago that you might get an email claiming that you\u2019ve won a lottery or from someone claiming to be a Nigerian prince with a plea for help. Scams have gotten much more advanced since those days.\u00a0<\/span><\/p>\nCan you describe how Feedzai prevents and detects fraud?<\/span><\/h3>\n
Have new payment systems like United Payments Interface (UPI) resulted in higher or lower fraud rates compared to older ways of transferring funds?<\/span><\/h3>\n
How should banks use behavioral biometrics solutions for their mobile app security?<\/span><\/h3>\n
Is there a significant difference in fraud prevention investments between traditional banks and challenger banks?<\/span><\/h3>\n
Will the Telecom Regulatory Authority of India (TRAI)\u2019s proposal to display the name of the caller and the industry’s proposal to shift away from SMS OTP for 2FA lead to reduction in scams?<\/span><\/h3>\n
In what ways are fraudsters increasing their level of sophistication in trying to carry out digital frauds?<\/span><\/h3>\n