Innovative Crime and Cross-channel Fraud
Financial institutions have long struggled with the threat of fraud to their customers and their own bottom line. Historically, that threat was significant but relatively straightforward: credit card fraud criminals attacked customer’s credit cards and online banking fraud criminals tried to move money out of customers accounts via the online banking portal. In the last few years, however, a new threat has emerged as fraud criminals have established innovative new attacks involving many channels and many products.
Cross-channel fraud involves a diversification of the fraudsters’ arsenal. While usually associated with private customers, commercial banking customers have recently become the target of fraud criminals for three reasons. First, online retail banking is increasingly well-defended, using a combination of authentication and transaction monitoring. Second, commercial accounts, with their high balances and wire capabilities, are highly attractive targets. Third, commercial accounts are now more easily accessible via commercial portals and enhanced phone access.
Cross-channel attacks by nature involve multiple channels: the criminal may, for example, gain access to a client’s account with basic customer information via the phone channel, change the customer’s online banking password via the phone and then login to the online banking portal with a new password, completing the attack with a transfer of funds out of the customer’s accounts. Because the password change occurred in the call centre, conventional methods of identifying online banking fraud may not detect this type of attempt. Further, this attack requires only that the criminal gain access to certain personal information, instead of the technically more complicated process of collecting passwords via phishing or through the use of virus software.
More common variants of cross-channel fraud have involved fraudulent Internet transfers to mule accounts, or fake deposits (which themselves depend on collusion with clerks) being followed by a simple ATM withdrawal. Frequently, however, entirely innocent third parties have been used to withdraw funds. Ultimate liability for such frauds lies with an innocent corporate or individual customer.
Other cross-channel attacks involve the repurposing of technically sophisticated online banking attacks in more traditional channels. ‘Man-in-the-phone’ attacks involve the use of a technique developed as part of the most technical sophisticated online banking attacks called ‘man-in-the-middle’ or ‘man-in-the-browser’ attacks. In these sophisticated attacks software is used to give the criminal access to the customer’s PC or browser while the customer himself is logging into the online portal. Man-in-the-phone attacks involve the criminal calling the customer and pretending to be a representative of their financial institution. The criminal tells the customer that there is an issue with their account and that they are going to transfer the customer to a fraud or customer service representative. The criminal then conferences in the actual fraud call centre at the bank and listens while the bank itself authenticates the customer. The criminal disconnects the call and comes away with all of the answers they need to pass authentication themselves, enabling them to call the bank and complete unauthorised transfers of funds and other identity theft attacks. This particular technique is a cause for concern as it borrows from sophisticated technical attacks, but requires a very minimal investment on the criminal’s part, requiring only a phone with conference call capabilities and the customer’s name, phone number and the financial institution’s name.
Another complexity introduced by cross-channel fraud is the involvement of multiple banking products. Traditional payments fraud involved only the customer’s current account. As financial institutions have worked to provide a better customer experience, they have provided means of linking a customer’s brokerage accounts, current accounts, loan accounts and even credit card accounts. The unfortunate by-product of this better customer experience is another form of cross-channel risk: criminals may move money from a loan account to a current account and then ‘cash out’ or complete the theft by removing the proceeds from the loan via the branch, for example. Whereas a criminal closing out a loan might be forced to go through a more lengthy, involved process, withdrawing the loan funds via the current account at a branch might only require a single form of relatively easily obtained false identification such as a driver’s license or passport.
Financial criminals have, in effect, devoted a kind of black market research and development effort to expand their attacks in order to maximise their access to customer funds and minimise the risk of detection. The initial wave of these attacks caught many financial institutions and their security partners by surprise. However, a number of financial institutions are now establishing a broad set of defences to counter the threat of cross-channel fraud.
While an ideal defence would combine transaction monitoring and authentication mechanisms across all customer interactions and accounts, it is often enough for a financial institution to present itself as an unattractive target. Monitoring the phone channel and online channel in tandem, for example, may leave the branch channel exposed, but it makes the financial institution a much less vulnerable and less attractive target for fraud criminals and represents a very good first step in reducing the risk of these attacks.
Authentication has been widely used in the online channel to protect customer accounts but many financial institutions have found that the ability to choreograph more than one authentication mechanism across channels is now required to maintain a secure front door defence. By automatically varying the questions used to authenticate a customer via the call centre or by requiring a more secure method of authentication at the branch for accounts with recent high-risk activity, financial institutions can significantly increase their ability to prevent fraud against their accounts.
This innovative threat that borrows techniques from multiple channels and spreads high-risk activity across many channels and products can be successfully countered. An example of state intervention has been the statutory transfer of ultimate liability for fraud from the client to the bank. Perhaps more successfully, however, banks themselves have increasingly adopted industry norms to protect customer assets and information. The adoption of information security standards, such as ISO 27001 in particular, should provide a timely check to disproportionate regional growth in cross-channel fraud, dealing as it does with security issues and training across channels, from software development to telephone recording and premises security.
It is clear, however, that increasingly sophisticated defences at banks will equate to an increased level of criminal technical capability and resources. For example, the traditional method of defending commercial clients – tokens – is failing at a much higher rate than it was 12 months ago. One European client saw the first successful unauthorised bypass of the token within four hours after going live with a new token defence. Furthermore, and perhaps more commonly, criminals are using increasingly sophisticated software, such as Trojans, to specifically target commercial customers, both as a way to bypass authentication security and to extend the life of the attack through direct access to the user’s computer.
Successful detection and pre-emption require institutions to take a multi-layered view in order to truly secure the financial institution and its customers from fraud. In particular, commercial banking fraud detection requires the use of techniques and analysis that are very different from those used to monitor retail banking accounts.