By Edwardcher Monreal
Johannesburg - The digital age has brought convenience and enjoyment to virtually every aspect of our lives: online shopping for everything from motor-vehicles to insurance, shares, shoes and takeaways.
But as we know, that convenience comes with a downside: the ever-present spectre of fraud.
Fraud doesn’t discern or discriminate. For example, young people are generally regarded as the most tech-savvy of any generation, but in the US, young adults experienced a 2 500% increase in scams between 2017 and 2022, compared to an 805% spike among senior citizens.
It’s a global scourge: one study of nearly 80 000 incidents from 88 countries suggests stolen credentials were used in 61% percent of all attacks in 2021.
Phishing remains a key weapon for fraudsters. Customers at one Singaporean bank alone lost nearly $8.5 million (about R161.5 m) last December after being tricked into surrendering their account details via SMS through a smishing campaign. The Australian Competition and Consumer Commission (ACCC) Scam watch department, meanwhile, reported a 106% increase in SMS scams since the start of this year, this after tallying over 67 000 scams and $10 million (about R190m) lost in 2021.
Scams are on the rise locally as well. Recently the South African Ombudsman for Banking services warned of a surge in digital wallet payment fraud. Commonly, it’s where criminals link information on stolen cards – or the information cards, such as card-number, expiry-date and CVV number – to carry out fraudulent transactions using a digital wallet. The ombudsman’s office said it’s clear that an international crime syndicate is targeting consumers, and that one bank alone received more than 6 000 complaints between January 2022 and June 2023.
From January to June 2022, about 550 customers lost about R427 500. But this year alone, the number of targeted customers jumped to 5 450, who lost around R6.5m.
As crime evolves, so must the weapons and strategy to fight it: strong customer authentication (SCA) based on secure mobile push notifications protected by biometrics could have prevented many of these fraudulent transactions from being completed. But banks that are serious about mitigating risks from phishing and identity theft can go one step further and prevent attacks before they can occur.
Banks must take an in-depth strategy and view authentication as part of a comprehensive risk management ecosystem that takes advantage of artificial intelligence (AI) and behavioural intelligence.
Combined, these can identify threats and minimise exposure to defend their customer assets constantly and proactively, which includes safeguarding their online identity.
How precisely can that be achieved?
The principle applied is simple. Identify threats early, know your users, and stop fraudulent payments before they occur. This should be followed by a user-friendly yet secure authentication: if only legitimate users can access their accounts, imposters can’t cause any damage. This requires SCA regulatory requirements, which demand that customers confirm their identities through multi-factor authentication (MFA) using something only they know or have (like a fingerprint) while continuously managing their risk as they navigate and use digital banking services.
This seems straightforward enough, yet many financial institutions worldwide still rely on less secure authentication methods. The leading authentication method used by the institutions HID Global surveyed in 2021 was an SMS sent to customers’ phones — in spite of the security risks that SMS authentication entails. More traditional authentication methods such as secret questions and answers, and email password resets are also still widely in use.
A more secure and user-friendly way to protect logins and financial transactions is push authentication, one of the delivery channels that enable the use of a mobile phone to perform MFA. “Push” authentication uses cryptographic techniques to link a specific device to its owner’s identity, making it impossible for attackers to impersonate someone without physical access to the device. The push user experience is seamless and straightforward. When notifications appear on the users’ phones, they must simply swipe to validate the request by making a binary choice — “Approve” or “Decline” — rather than referencing and retyping an OTP received via SMS.
In fact, the most flexible push authentication solutions enable banks to go completely passwordless by enabling device biometric capabilities and eliminate the threat of compromised credentials.
Data from customer device, customer behaviour, and customer payment history should also be leveraged and together with known behavioural patterns (good and malicious behaviour) it can help build a bank’s customers behavioural intelligence database to be utilised by machine learning and AI.
Everyone’s behaviour is unique and applies to how we all interact with frequently visited websites or favourite mobile apps. Specific customer behavioural patterns also include how a user types, swipes and interacts with his or her devices.
The benefit of using behavioural intelligence in real time relies on being able to determine the user’s intent to identify fraud. Proper risk management during the user’s digital journey leveraging this insight helps arm banks with the ability to prevent, predict and become more proactive against cyber threats. Solely relying on simple authentication solutions is no longer enough to protect against evolving scams. Early threat detection, knowing your users, and transaction analysis collected over time combined with push-based authentication is the best approach prevent fraud today.
The beloved satirist Terry Pratchett wrote that many crooks would be very wealthy if they only applied their lawbreaking skills to legitimate pursuits. Unfortunately, cybercriminals will always be part of the digital banking landscape, but the damage they cause doesn’t have to be. Effective fraud prevention technologies that optimise user experience enable organisations to be proactive about risk — not just to protect their customers but to preserve the financial and reputational integrity of their business.
Edwardcher Monreal is Principal Solutions Architect at HID Global.