Banking fraud: knowledge is power

With known global fraud topping billions of dollars, having a real-time view of risk patterns and threats, as well as a collaborative approach to combating these threats, is key to effectively mitigating fraud in the financial sector.

This is according to Edward Medcalf, spokesman for Middle East and Africa at Arcot International, a CA Technologies company.

Medcalf says most estimates put the global fraud total in the range of billions of dollars.

“The great unknown, of course, is how much fraud is perpetrated that goes undetected. Financial loss is one measure, while damage to brand and regulatory repercussions increase the losses.

“By using official UK figures over a period of years as a snapshot, we know that increasing control is being gained over e-commerce fraud through measures such as 3D Secure; here, fraud is decreasing, while the channel continues to grow and provide revenue.”

Medcalf adds that online banking fraud is a fluid and ever-evolving hazard. The huge growth in mobile banking has offered fraudsters new and exciting ways to exploit security controls, he says, and while Africa continues to enjoy the exponential progress and capabilities of what can be achieved on a mobile phone, the inevitable result is that hackers are systematically testing the industry for weaknesses.

As users' expectations of a service (such as mobile banking) grow, says Medcalf, they make greater demands of the technology, which in turn leads to inevitable lapses and exposures.

“It is widely accepted that by the time the security industry has developed and begun to distribute a countermeasure to a known fraud, the key perpetrators have learnt from their previous achievements and started applying this experience relentlessly to new areas - for every successful fraud, 100 have failed.”

“Banks and enterprise can only anticipate where fraud will shift to by observing what has happened in similar markets in different stages of evolution - for example, by looking at what happened to the UK when chip and PIN was implemented.”

In trying to mitigate risk, enterprises face an entirely new threat, says Medcalf. They could be alienating their users.

“The greatest threat we observe is the issue of businesses complicating processes and policies for their users. Asking a user to log in numerous times, or to use an unfamiliar piece of technology, or to request customers to download files onto their devices are all recipes for a poorly-used service,” he says.

Medcalf points out that users expect there to be well-designed, efficient and risk-free methods to log on and transact securely, and so when they are asked to complete onerous processes to complete what they believe is a simple task, they will 'vote with their feet'.

“This, in turn, leads to a loss of confidence in the service, and ultimately, a loss of revenue. As an example, e-commerce in South Africa dwindles at 2% to 3% uptake, whereas elsewhere in the world, banks might expect 20% to 25% of their cardholders to be transacting online, as they have confidence in the seamless and risk-managed channel that has been created,” he says.

Officially, 98% of data breaches leading to fraud occurred via external parties, according to a report by Verizon earlier this year.

Medcalf says: “Projects we are involved with across Africa nowadays inevitably confront the dual dangers of internal and external theft. Banks and enterprise customers have long recognised that compromised employees pose a huge risk to their businesses, so measures are now being put in place (almost without exception) using cutting-edge contemporary anti-fraud techniques to counter both channels of risk simultaneously. Frequently, the effect of challenging internal fraud has a similar consequential outcome on the external threat, and vice versa.”

Medcalf says combating fraud requires multiple measures.

“One of the most forward-thinking aspects I have seen in the South African banking industry is the collaborative approach, in which banks and enterprise put aside some of their competitive instincts and meet to discuss what threats they are seeing and what the common response should be to drive that threat out of the marketplace,” he says.

“From CA's point of view, Arcot services are uniquely placed to offer a further global real-time overview of patterns and threats, which is available to add further data to what is being observed locally. By combining worldwide real-time data and historical information with the knowledge of the local teams and contemporary technology, strong progress will be made to push fraud away from businesses in South Africa.”

Medcalf will speak at the upcoming CA IT Management Symposium Africa on CA's approach to fraud, and how CA's strategies have evolved following its acquisition of Arcot. For more information about this event, click here.