Banks lead in digital era fraud detection

Virtual assistants placing orders

In the not-too-distant future, said Cohen, it is possible that such virtual assistants will be placing orders in anticipation of users’ needs based on things such as monitored conversations in the home and online information about sporting events, for example.

“While digital services are bringing a whole new level of convenience for consumers, security is becoming a lot more challenging for providers of those services as consumers’ identities become attached to more and more devices, moving us further into the era of human-not-present transactions,” he said.

Fortunately, said Cohen, the banks are coming to terms with this new world that is emerging and are adapting their fraud defence and prevention strategies accordingly, based on their overview of the different interactions that are taking place.

“Fraudsters are going across channels to carry out their attacks and banks understand that they can no longer defend a single silo channel, but need to look at all channels to identify connected activities.” he said.

The value of this approach was demonstrated by a case study carried out with a large US financial institution in which Cohen’s team combined call centre data with online banking data for analysis to achieve an increase in fraud detection rates of 2.2% by being able to see the types of attack that were trying to target both channels.

In this way, analysts could see what fraudsters were attempting to do through the call centre and how many times they failed the authentication checks. At the same time, they were risk-profiling the same individuals, enabling them to assess the legitimacy of their web transactions.

“While 2.2% may not sound like much, from a fraud perspective, it meant that the financial institution involved was able to save an additional $500,000 a year on average,” said Cohen, demonstrating that knowledge of behaviour on the telephone channel increased fraud detection rates for the online channel.

“That 2.2% is also significant in the context of PSD2, because if you can prove to the regulator that your basis points are low and that you have the right measures in place, you can allow frictionless flows of up to £300 before you need to step in with your authentication challenges.”

In a similar exercise involving a European bank comparing online banking data and pay-by-bank e-commerce transaction data, Cohen’s team was able to achieve a 3% increase in fraud detection rates. “It goes to show that cross-channel knowledge of interactions or behaviours drives total fraud detection rates up,” he said.

Omni-channel view

Banks have recognised the need to have an omni-channel view of the different interactions and do their fraud risk assessments across the various channels, he said, because not only are cyber fraudsters working across multiple channels, but so do ordinary consumers, starting something on a laptop, continuing it on the phone and perhaps completing it through a virtual assistant while travelling in a car.

“This is true for all consumer-facing businesses that have different channels through with they interact with consumers, and they should follow the banks’ lead and adopt an omni-channel approach to doing their risk profiling and gain from the visibility you have in each of the channels,” said Cohen.

“In enterprise security, we were talking about breaking down channels years ago, and now we are starting to talk about it in the context of fraud, so that fraud assessments are carried out in the light of what is going on across all the available channels of interaction, especially as interactions become increasingly through third parties.”

This means banks will no longer have direct access to customers or their devices and will therefore no longer be able to rely on defence strategies based on recognising trusted customer devices.

“Down the line, we are not going to have access to the device because it will be just some API call or a virtual assistant doing something, so behaviour and continuous authentication is becoming a key element of fraud detection, driven by the need to see as much as possible about customer interactions,” said Cohen. “Fraud detection is now all about comprehensive risk profiling.”