How the payments industry is coming together to quash financial crime

The world over has seen a marked increase in fraud and money laundering during the Covid-19 pandemic. At a recent roundtable, industry experts discussed how the financial industry is coming together to collaborate and deploy innovative, network-level solutions to trace and prevent financial crime across the digital economy.

Panellists:

• Mark Courtney, chief product officer, Cifas
• Sachin Dean, senior fraud manager, TSB Bank
• Rebecca Ledingham, vice-president, product development, cybersecurity products, cyber and intelligence solutions, Mastercard
• David Rich, executive vice-president, New Payment Platforms services and financial crime solutions, Mastercard

Q: What is the biggest challenge today when it comes to combatting financial crime in its many forms?

Sachin Dean: The biggest challenge now is scams and social engineering attacks, which target bank customers directly. Historically, our systems and strategies have concentrated on detecting fraud on the bank side, but these are not as effective today because the dynamic has changed. These systems were not designed to counter social engineering or scams where customers are making the transactions themselves.

Rebecca Ledingham: Indeed — the biggest challenge for the industry is that there are very few barriers for criminals to scam people and share their methodologies on the web. The consequences of this sort of crime go well beyond the financial loss for people, the invasion of their lives and personal data can be damaging to mental wellbeing and being fearful of participating in the digital economy. The sheer volume of those participating in cybercrime makes it incredibly hard for law enforcement to tackle this type of crime, which means it is a very low risk crime type to the offender.

Mark Courtney: Organised fraud-as-a-service is a big threat today. On the dark web, criminals are recruiting for specific roles, such as data gathering, money mules, scammers, and so on. So the criminal side has professionalised and they are very agile.

David Rich: Criminals are sophisticated and relentless with lots of resources. Looking at criminal behaviour patterns, such as the relationships of accounts used to launder money, shows a high degree of coordination. For example, in an authorised push payment (APP) scam, the money flows quickly through many different bank accounts, the majority of which have been reused more than once for the flow of illicit funds.

Another challenge is the speed of transactions, particularly with the advent of real-time payments. While real-time payments bring many benefits for consumers and businesses alike, the flip side is that criminals can move money incredibly quickly. That means the industry has to operate in as near real time as possible.

Q: Have people/businesses become more susceptible to scams, malware and social engineering under Covid-19?

Mr Courtney: While Cifas members [public, private and voluntary organisations across a number of sectors] are seeing similar scams as they were before, such as phishing, they have switched to Covid themes, such as fake government grants, fake investment opportunities for a vaccine and so on. We are also seeing an increase in voice phishing attacks, where hackers use existing employee names to get others to share login credentials, which is exacerbated by working from home. Facility takeover fraud [ie where a bank account is hijacked by a fraudster] has gone up over 20% in the first nine months of 2020.

The conditions during Covid are a fraudster’s paradise. Cifas has been working with British Business Bank and local authorities, identifying fraudulent activities as the UK government rolled out its relief schemes. We are expecting to see more victims from the loan schemes as payments become due in 12 months — ie in instances where people’s identities have been stolen. The National Audit Office estimates that billions could be lost from fraudulent conduct around the Bounce Back Loan Scheme.

Mr Rich: Likewise, Mastercard’s Vocalink, which works with the UK retail payments authority Pay.UK to power Faster Payments and Bacs services, is working with HM Revenue and Customs, and other government entities, to evaluate whether the disbursements of funds under the relief acts are fraudulent or misdirected payments.

Additionally, the move away from cash during the pandemic, and the need to pay for goods and services online, has led to an increase in digital payments, such as using a card to pay online and internet bank transfers to other people. As the volume of digital payments has risen, so has the incidence of fraud and money laundering. The problem has been compounded by people being isolated at home and prone to romance and other emotional scams.

Mr Dean: Plus, the low interest rate environment opens people up to investment scams because they want to get more of their money, so they are potentially more susceptible to Ponzi schemes or adverts that promise hefty returns.

Ms Ledingham: A common saying among law enforcement is that there are no new crimes, only new criminals. Crime is topical so to understand future trends just look at the news because criminals follow the media. Many people’s livelihoods have been put on hold, particularly in the sectors most impacted by social distancing. A lot of people have been furloughed and are looking for ‘work from home’ opportunities, so the conditions are now ripe for recruiting vulnerable people as money mules if offered financial reward, for example.

Q: What is the value of industry/network-level collaboration and innovation?

Mr Rich: Criminals are sophisticated. The only way to stay one step ahead is through collaboration and innovation. For example, in the UK Vocalink is working with Pay.UK and the major banks, including TSB, on the Mule Insights Tactical Solution (MITS), which traces the money from a confirmed  fraud between financial institutions to identify suspect mule accounts and shuts them down.

Based on insights from two years of active service, we recently enhanced the solution with a proactive alerting capability, which uses artificial intelligence (AI) to monitor transactions for indications of money laundering before the person or business has even reported it. This helps us trace and potentially recover funds much faster than ever before. We have also introduced a range of fraud prevention capabilities to help stop various types of fraudulent transactions from occurring in the first place.

It’s only through a collaborative industry partnership that allows us to make an impact. We need to be organised as well to fight organised crime, which has no boundaries, geographical, moral or legal boundaries.

Mr Courtney: I agree that collaboration is key. In 2019, Cifas launched proactive alerts for bank accounts, so that when one financial institution identifies a bank account from another member being involved in fraudulent conduct, we alert the other bank. In 2020, almost 31,000 accounts were flagged via the system.

Ms Ledingham: It’s always been about information sharing between financial institutions. In my experience in law enforcement, we found the most effective way of targeting money mule networks is with email addresses and telephone numbers. Many criminals tend to use the same information when perpetrating fraud across different banks.

Mr Dean: I also want to touch on Confirmation of Payee, which is an industry initiative to address the scam/social engineering problem. It uses account name matching to help to prevent APP fraud, but fraudsters are inevitably beginning to find ways around it. So we need to use emerging technology, like AI and machine learning, to stay one step ahead of the bad actors.

Q: Continuing on that point, how can emerging technology be used to keep up with the evolving criminal methods?

Mr Rich: Confirmation of Payee is a good example of something we can improve with AI. Currently, we are rolling out a solution to recognise a name in all its different variations, ie David Rich, Dave Rich, D Rich. We’ve applied AI at a network level to ascertain whether they are common combinations, previously used and so on.

Obviously, to do that manually is impossible, as it needs to be done in near real time to reduce the amount of friction for our customers. If they send a legitimate payment, we don’t want to get in the way of that transaction. Thus, not only do we have to stop the criminals, but also provide an acceptable customer experience and low false positive rates for the banks.

Importantly, the AI models improve with feedback and we need to have that capability because the criminals are using AI as well.

Ms Ledingham: I also believe that the advent of biometric account access — which is the way the industry is going — will provide tangible information on bad actors. Whether fingerprints, or the way someone holds or taps their phone, biometric tracking can provide a genetic or behavioural fingerprint of the criminal which can be compared across the industry.

Mr Courtney: But it comes down to the collaboration piece again; once we find a bad actor, we need to be able to share it among the community in a safe way. In 2019, Cifas released a facial matching capability, so our members can match facial images against fraudulent documents filed in the National Fraud Database. Some members saw the same face - but with different names, addresses and fake identity documents — with up to 15 accounts.

Q: Is there a situation where greater friction be useful?

Mr Dean: It’s a very delicate balance. Although it may be necessary for banks to introduce more friction into the journey, many customers wouldn’t like it because we live in an age where we want everything to happen instantly. But I think that’s the need of the hour and we should encourage the customer to take a step back and consider the bigger picture.

Mr Courtney: The UK’s Joint Fraud Taskforce is introducing the concept of a configurable bank account. The purpose is to give the customer more control around what friction level they’re willing to tolerate to increase their protection. It is akin to bringing in a trusted third party, who has that ability to countersign transactions above a certain amount, for example. This is aimed at stopping social engineering fraud targeting the most vulnerable people.

Q: With an estimated $2tn of funds laundered through the global banking system annually, where can new preventative solutions really make a difference?

Mr Courtney: AI and data analytics need to be used to remove the noise and bring key alerts to the surface much quicker. Much of the innovation is around obtaining a real-time risk status of a customer or account, whether business or consumer. When we can identify that someone is at risk and flag their account, then we’ll be in a better place. AI and machine learning platforms will play a huge part in surfacing that data and moving us to that next level: ongoing customer lifecycle screening.

Ms Ledingham: While I agree with greater technical sophistication, this is also about getting back to basics with the consumer. Many people are unwittingly targeted to become money mules. We need to get better at educating vulnerable people and engaging them where they will take notice. We’re very good at telling people not to take drugs, but not so good at telling them not to use their bank accounts for illicit purposes.

Mr Rich: There are geographic pockets of organised crime across the world, so sharing information through a hub and spoke model becomes increasingly critical because money moves quickly between countries, as well as domestically. If we can use what we have learned about criminal behaviour in one jurisdiction, for example the UK, and start applying that to other jurisdictions, and then modifying it based on the uniqueness of another jurisdiction and bringing it back to the UK, then we can also start to tackle the problem on a more global basis.

Q: By shutting down routes to launder funds for organised crime, what are the consequential benefits to the industry and society more generally?

Ms Ledingham: I’ve seen the impact on victims — many are incredibly vulnerable and their lives are decimated by this type of crime. And right now more people are vulnerable in society; they’re lonely, isolated and their mental health may be suffering. This is about more than the dollar or the pound — this is about people’s wellbeing and the loss of their life savings can have a massively detrimental effect on already stressed people.

Mr Rich: It can be devastating for businesses too; corporations, small and medium-sized enterprises (SMEs) are targets of these criminals as well. Many smaller businesses are owner-operated and don’t have sophisticated anti-fraud systems in place. Plus, if an SME is forced out of business due to fraud, then its employees also suffer.

The sophistication of these criminals is increasing and we have to be ever more vigilant, particularly as we move to digital payments and digital currencies. As an industry we need to be very cognisant of all these factors and then collaboratively work together to provide innovative solutions. That is the only way that we’re going to have a chance of not just checking financial crime going forward, but trying to reduce it.