Prevention is Better Than Cure: Fraud Prevention Strategies For the 21st Century
A recent high-profile case of online fraud in the UK has yet again highlighted the fact that security must remain high on the agenda for banks. A gang of online bank robbers took over the accounts of at least 10 people and stole hundreds of thousands of pounds from bank users. The criminals obtained enough information about one victim to have £60,000 transferred from his mortgage reserve account to his current account, which they then spent. The gang is thought to have employed a new technique known as ‘social engineering’, whereby private details are solicited from unsuspecting members of the public and which are then used to order new cards and PINs.
Figures for the first half of 2007 show that instances of card fraud such as the above are on the rise. According to research carried out by the UK payments association APACS, card fraud is up by 26% compared to the same time last year. As a result of EMV fraud migration, reported instances of identity theft, fraud abroad, data compromise and account takeover have dramatically increased. Card fraud cost banks and the economy millions and the effect can be devastating for the victims.
Financial institutions are currently facing a number of challenges in the card fraud arena and combating new fraud techniques employed by criminals, such as social engineering, are just one example. At the same time, banks also need to tackle the security challenges set by the growing number of payment channels and new legislation such as the UK’s Faster Payments scheme. Fortunately, fraud prevention strategies and solutions do exist for banks to take control and beat the card fraudsters at their own game.
It is becoming increasingly apparent that better information management is the key to fighting fraud. With the right systems in place to maximise the value of customer and transaction data, banks will not only be able to track fraud that is occurring but they will also be able to go one step further and prevent it from happening in the first place.
As the more innovative banks have found, technology identifying the so-called ‘point of compromise’ (POC) is an important consideration in the fight against card fraud. It is now acknowledged that POC identification needs to be adopted more widely and should be accorded greater importance by applying technology to solve the problem.
POC detection is the single most important preventative fraud action that a financial institution can take when addressing card fraud. The POC is the location at which the card skimming – the illegal copying of ATM card numbers and PINs for the purpose of stealing money from bank accounts – has taken place. The POC always refers to the specific terminal where skimming occurred; if skimming took place on multiple terminals within a merchant location, then it is said that multiple POCs occurred within the same location.
Identification of the POCs is important as it allows the financial institution to recognise trends and write rules based on the type of locations where the compromises are occurring. However, the true significance of the POC approach is only apparent when it is used to identify potential fraud early enough to enable the bank to take preventative action on cards at risk before any money has been lost. If POC detection is used in this way, such counter-measures could cut a financial institution’s loss per incident by over 50% with very little effort.
In order for a bank to identify a POC, it must have sufficient data that shows cards that have experienced confirmed fraudulent transactions. The fewer the cards, the more difficult it is to identify the fraudulent location with certainty, but a POC can generally be found with as little as two to three cards. The cards that have been used fraudulently will provide invaluable information on spending history and a common point of purchase across all cards should start to emerge. It is important to note that the common point of purchase must be earlier than the first fraudulent transaction and all cards should have been used at the same location and terminal within a similar time frame. The further apart the purchase dates, the less likely that this is the true POC.
After a common location and time frame have been identified across a number of the cards, it is essential that other cardholders who may potentially be at risk are determined through the use of the ‘skimming window’. The skimming window is the period of time between the earliest and latest transactions at the POC on the cards. As new cards are found to carry fraudulent transactions, the skimming window may grow larger. Once a skimming window has been identified, the bank’s transaction database is queried to find a list of all cards that were used at the specific merchant terminal between the dates identified.
Once a list of cards at risk has been collected, a course of action must be decided upon. At this stage, banks often struggle with balancing customer impact against fraud prevention. Unfortunately, the more action relating to fraud prevention that a bank takes, the more customers it will affect. However, there are a number of options open to banks with a varying degree of impact. Depending on the location of the POC, the bank may choose to ‘block’ or ‘watch’ cards at risk, choose to do nothing, or a combination of the two. If the location identified as the POC is a high-risk merchant chain where confirmed POCs are a regular occurrence, the bank may decide that blocking and re-issuing the cards warrants the customer impact. On the other hand, if the POC is not known to be high-risk, or there are not enough cards involved to be absolutely certain, a bank may choose to put a watch on the cards at risk. Consequently, any new activity on the card will be flagged as suspicious and alerted to the fraud team.
The techniques mentioned above can have a huge effect on a bank’s fraud losses. On the downside, they can also affect staff workload. Identifying POCs and taking action on large numbers of cards using manual processes is very time-consuming and difficult. The only way to properly identify and deal with POCs is with a risk management tool designed with POCs in mind. A robust risk management suite with sophisticated POC functionality built in as standard is one possible solution.
As payment channels and banking methods become more varied, the challenge to manage customer and transaction data becomes increasingly complex. The growing number of channels also bring further security challenges. Following the introduction of the Faster Payments scheme in November, banks now face the challenge of processing large numbers of payments with very different characteristics within a common infrastructure.
While customers welcome the enhanced speed of transaction processing that near real-time transfers offer, it has been recognised by banks that the enhanced speed brings with it an increased risk of fraud. It is precisely this issue that is currently being addressed by the banks’ fraud teams in order to ensure that the Faster Payments scheme is a success in the long-term.
One step to minimise Faster Payments fraud taken by a number of UK banks is the introduction of two-factor authentication. Both Barclays and the Royal Bank of Scotland are currently distributing EMV card readers to all online banking customers in order to enhance security at the point of entry of the transaction. The Internet is already one of the most high-risk banking channels available. According to the Anti-phishing Working Group, financial services are the most targeted industry sector for phishing attacks, suffering 94.4% of all attacks recorded in the month of July 2007. Faster Payments will only serve to increase this risk, as the banks have less time to verify the transaction.
Initiatives such as Faster Payments and also customers’ increasing demand for greater flexibility in their relationship with banks mean that the payments landscape will only become more complex. This is a compelling reason that will entice banks to stop working with internally siloed systems and implement single customer databases to collate and measure fraud risk across the enterprise.
The increase in reported incidents of complex fraud methods such as account takeover and identity theft means that it is even more imperative that a bank takes a good look at its defence methods to protect their customers’ accounts as a whole. The good news is that the rise in payments channels means that the customer data that is being accrued by a bank is rising rapidly. This data provides a valuable insight into customer spending habits and transaction patterns, helping a bank to develop a picture of typical and also irregular account activity. A bank’s internal management of this rich information is integral to the fight against financial crime.
However, there are still many banks that are not maximising the information that they have about their customers due to the siloed storage of payments data. Traditional monitoring techniques used by banks mean that their data is segregated, resulting in an inability to internally cross-reference information from different payments channels, such as card fraud information with money laundering figures. Banks operating in regions where the market is more established, particularly in the UK and France, now realise the huge advantage that can be gained from sharing fraud data across various internal divisions within the bank, including new channels such as Faster Payments.
By amalgamating fraud information into a single view, the bank can take a more holistic, enterprise approach to the criminal activity that they are trying to combat and therefore create a sophisticated picture of the irregular account activity that is occurring. By maximising the use of its information, a bank will be able to take greater control of financial crime. The bank will also have a far greater understanding of its customer base, resulting in the ability to provide a better overall service.
Financial institutions are currently facing a number of challenges in the financial crime arena and recognise that using technology is a major element in maintaining their long-term competitiveness. They will always have to play a balancing act between customer impact and fraud prevention, but as the old adage goes, ‘prevention is better than cure’. Europe’s banks will need to increasingly adopt this approach when it comes to their security strategy in order to retain and regain customer trust and loyalty.