How Can Banks Stop Fraud in Automated Payments?

TL;DR

Protecting automated payments requires financial institutions to rethink authentication across users, devices, apps, APIs, and third-party services. Consumer demand, fintech innovation, and regulations such as PSD2 make financial access faster and easier, but growing transaction volumes and device-initiated activity also increase fraud risk and the workload placed on fraud operations.

Transcript

Okay, we're good to go. Good morning, everybody. Good morning. Take it away. Sure. Hello, everyone. Um, I'm Greg Degivitski. I'm the Field CTO for RSA's Fraud line, here to talk about, oh, a lot of interesting things. And I love the title. Daniel's creativity- ... I'll hand it to him. It's Forget the Kids, Did Alexa Just Use Your Credit Card? And D... Read More

Key Insights

• Consumer demand is a primary force behind digital financial transformation because customers expect fast, efficient, and frictionless access to money. Experiences such as one-click shopping, native mobile apps, and wearable devices have shaped the service standards that customers now expect from banks.
• Fintech companies are expanding financial access by offering new ways to use money, including peer-to-peer lending and payment services such as Zelle and Venmo. These services gain access to financial data and allow customers to complete financial activities quickly through new digital channels.
• Financial regulation is encouraging banks to support greater transparency and more usable digital services. PSD2 promotes API communication and easier third-party access to bank accounts, enabling a bank-as-a-service ecosystem in which banks hold funds while external services help customers use them.
• Growing transaction volumes are increasing fraud risk and operational pressure. As financial access becomes faster and more efficient, more transactions occur, creating additional fraud exposure and increasing the workload that fraud operations must review and manage.
• Authentication is evolving from verifying a person to evaluating a network of devices acting for that person. Banking authentication has moved through physical branches, telephone banking, websites, mobile applications, and connected devices, making the identity behind an interaction harder to define.
• Connected devices can access financial information without performing destructive transactions. Alexa skills described in the presentation can provide information such as bank balances or whether a salary payment arrived, using third-party or API-style access to a bank account.
• Human-not-present transactions create a significant payment-security challenge. A connected assistant could potentially interpret a conversation, decide that products are needed, and place an order using a stored credit card without the account holder directly participating in the transaction.
• Fraud tools are increasingly packaged like commercial software. Underground forums offer bank account checkers, brute-force API checkers, wallet checkers, botnets, multiprocessing features, advertising space, and reputation scores, showing that fraudsters sell tools and cooperate through organized marketplaces.

Questions & Answers

Q: Why does frictionless digital banking increase fraud risk?

Frictionless banking gives consumers faster and easier access to money through websites, mobile apps, fintech services, wearables, connected devices, and third-party integrations. That convenience increases transaction volumes and creates more channels through which activity can occur. The resulting expansion raises fraud exposure and adds operational overhead for fraud teams responsible for reviewing and managing suspicious transactions.

Q: How is authentication changing in digital banking?

Banking authentication has moved from physical identification at a branch to knowledge-based questions in telephone banking, usernames and passwords on websites, native mobile applications, and interactions through connected devices. This progression complicates a central security question: whether the bank is authenticating the customer, a specific device, or a wider mesh of devices operating on the customer's behalf.

Q: What role does PSD2 play in open banking?

PSD2 encourages API communication and allows third parties easier access to customer bank accounts. The presentation describes this as supporting a service-based ecosystem, or bank-as-a-service model, in which the bank primarily holds the customer's money while other services help the customer access and use it quickly, efficiently, and with less friction.

Q: How can connected assistants create payment fraud risks?

Connected assistants can operate as part of a network of devices acting for an account holder. The presentation imagines Alexa hearing a conversation about buying chips and then ordering them with a stored credit card without direct human participation. Such human-not-present activity makes it harder to determine whether an automated purchase reflects the customer's actual authorization or intent.

Q: What financial information can Alexa access through banking skills?

The Alexa banking skills discussed in the presentation are described as non-destructive at that time, meaning transferring money through them is not easy. They can still provide account information. A customer could ask for a bank balance or whether salary had been deposited, with Alexa receiving third-party, API-style access to the relevant bank account data.

Q: How do fintech services affect financial fraud prevention?

Fintech services respond to consumer demand by creating fast and convenient ways to use money, including peer-to-peer lending and payment services such as Zelle and Venmo. Because these services can access financial data and connect customers to funds through additional channels, fraud prevention must account for more providers, interfaces, transactions, and forms of automated activity.

Q: What tools are fraudsters using against financial services?

The presentation shows underground offerings that include a bank account checker, an advertised botnet request, a brute-force API checker, and a wallet root checker. Described capabilities include multiprocessing through threads and timeouts, bypassing SSL pinning and Cloudflare, and targeting wallet companies whose mobile applications communicate with back-end systems through APIs.

Q: Why are underground fraud forums difficult to combat?

Underground fraud forums provide more than isolated malicious tools. They function as organized marketplaces where participants buy software, request botnets and exploits, advertise to other fraudsters, cooperate, and use reputation scores. The products can resemble ordinary downloadable software with useful features and pricing, except that their purpose is to attack accounts, APIs, wallets, and financial services.

Summary & Key Takeaways

• Financial services are becoming more digital because consumers expect fast, frictionless access to their money. Fintech companies support that demand through services such as peer-to-peer lending and payments, while connected devices create additional ways to interact with accounts. Each improvement in convenience expands the environment that fraud controls must protect.

• Regulations and standards also encourage the transformation of banking. PSD2 promotes API communication and third-party access to bank accounts, supporting an ecosystem in which banks hold funds while outside services help customers use them. Easier account access increases transaction volumes, fraud exposure, and the operational burden placed on fraud teams.

• Authentication has progressed from branch identification to telephone questions, website credentials, mobile apps, and connected devices. This evolution makes it harder to determine whether a person or a device acting on that person's behalf initiated an activity. Meanwhile, fraudsters use commercialized tools, botnets, APIs, automation, and reputation-based underground forums to attack accounts and wallets.