From identity theft to phishing attempts, the number of digital fraud attempts in the U.S. is up 25.07% in the first four months of 2021, compared to the last four months of 2020.
That’s according to a new report from TransUnion, which found that when looking at specific industries, digital fraud attacks against financial services companies increased 109% in the U.S. during that same period. Globally, fraud attempts in this industry were up 149%.
TransUnion defines digital fraud as any online scams or fraudulent transactions. That includes schemes where fraudsters attempt to steal personal information through social media networks and online sites and phishing attempts, which occur when cyber criminals send fake emails to you that either attempt to retrieve personal information or infect a device with malware.
While it is, to some extent, a business’ responsibility to ensure customers are protected from fraud, customers should also be responsible as well. That includes signing up for and using protections such as two-factor authentication, which generally requires users to not only enter a password, but also confirm their identity by entering a code texted or emailed to them.
Nine types of bank Frauds vs PasswordFree™️
Imposter Websites
Fake bank websites are a growing concern because hackers have become skilled at making a fake website look identical to the legitimate one. As a result, users are easily fooled into providing their login and password and this is providing the hackers a revenue stream estimated in the hundreds of millions of dollars.
For imposter-website attacks, PasswordFree® uses Full Duplex Authentication® to connect the enrolled app with the expected authentication service before approval. Avoiding a typed password removes that credential from the fake-page exchange. This does not secure a compromised browser or device by itself, so the bank must also protect sessions and verify the integration and request context.
Account Takeover Fraud (ATF)
For account takeover, a device-bound credential with local biometric activation can make stolen passwords less useful. Public-key authentication supports proof of control of the enrolled authenticator; it is not interchangeable with EMV transaction processing. Recovery abuse, malicious enrollment and endpoint compromise still require controls, and encrypted transport does not make malware harmless.
Friendly Fraud
This type of fraud occurs when an account holder shares their login credentials with a friend. The friend then logs in to the account holder’s account and executes Real-time Payments (RTP) type transactions that move funds to another financial organization (bank, credit union, fintech) such as a wire transfer or Zelle/CashApp transactions. Once the transactions have been completed the friend notifies the account holder and at that point the account holder logs into their bank account and then calls the bank reporting ATF.
For friendly-fraud disputes, a device credential and approval record can provide evidence that an enrolled authenticator was used. Local biometrics are an activation check, not conclusive proof of legal identity or of every disputed transaction. Banks still need transaction-specific records, authorization controls and a fair dispute process.
Transaction Fraud
For real-time payments or ATM withdrawals, a bank can integrate an approval checkpoint before executing a sensitive action. The request must clearly identify the action being approved and be bound to that transaction by the integration. A biometric step alone does not establish PSD2 compliance or prevent an account holder from approving a fraudulent payment.
ATM Fraud
ATM card skimming fraud can be prevented using PasswordFree™️ by replacing passwords or Pin numbers with a biometric step on the account holder’s smartphone or PC. When an account holder inserts their card into an ATM, KAL software sends a message to PasswordFree™️ to prompt the account holder to perform a biometric step to authenticate their identity.
Call Center Fraud
Account holder impersonation is on the rise for bank call center operations where fraudsters can defeat a bank’s security protocols that validate the account holder’s identity such as security questions and voice analytics. PasswordFree™️ can be integrated with existing call center technology to prompt the account holder to perform a biometric step on their smartphone or PC to authenticate their identity while they are in queue waiting to speak with a bank customer service representative.
Person to Person (P2P) Identity Verification Fraud
During a telephone call or video meeting, a bank may initiate a contextual request through its configured customer application to check control of an enrolled account. The employee and customer should be able to relate that request to the conversation. This is an account-authentication checkpoint, not a replacement for identity proofing or a guarantee that the caller and all statements are trustworthy.
This concept can also be leveraged in a bank’s branch operations to authenticate account holders when they arrive at a branch to authenticate their identity. Today, bank employees ask account holders to show their driver's licenses as proof of their identity. The problem with driver's licenses is they are easily fabricated by fraudsters. PasswordFree™️ biometric step eliminates any doubt about who they are.
Shared Account Access Fraud (SAAF)
SAAF fraud occurs in commercial and retail bank accounts where you have multiple parties accessing the same bank account and executing financial transactions. PasswordFree™️ provides the ability to deploy a concept called “Two Party Integrity” that requires a second party to approve the first party’s transactions. In this concept, PasswordFree™️ would push a transaction authentication message to the second party to approve the first party’s transaction by executing a biometric step on their smartphone or PC.
Shared Branching Fraud
In the credit union industry, there is a business concept called Shared Branching (SB) which allows account holders to perform transactions at a credit union branch that is not part of their credit union. This process requires a lot of real-time human interaction between the two credit unions to authenticate the member and their transactions. SB transactions are considered high risk but are a necessity for account holders that require this level of mobility and customer service flexibility.
A federated version of PasswordFree™️ provides the ability to perform identity verification in real-time leveraging the biometric step and PKI to authenticate the account holder’s identity when the account holder enters another credit union. This concept would require both credit unions to offer PasswordFree™️ to their account holders. An encrypted PasswordFree™️ authentication token message would be sent between the two credit unions in this process that will validate the account holder’s identity.
