FRAUD 2

Michael Salmony 0:12

Hello, my name is Michael Salmony and Ralf Javier and I would like to welcome you to another episode of the Payments Trilogue where we're going into a topic which surprisingly we haven't talked about before, which is fraud. If you think about all the various players in the payment industry, I think, and if you ask who is the most innovative, is it the banks, is it the fintechs, is it the technology providers, is it the regulators?

I think there can only be one answer. It's the fraudsters. They understand human psychology. They understand how to get into side technical systems. They understand every dimension of what our subject entails, maybe better than a lot of other people. So really thrilled to have you, Richard, from Feedzai, who knows all about this topic. So please take it away, tell us about yourself, and tell us what's going on in fraud.

Richard Harris 1:06

Okay, hi Michael, hi Ralf, hi Javier, he's lovely to be here. I appreciate the invite. I'm Richard Harris, I'm the head of advisory and strategy at Feedzai. I've been at Feedzai for the last 10 years, I've spent...

I'll just say more than 25 years in the payments industry in one way, shape or form, working at large card schemes, working at wallets, working at money transfer providers and recently 10 years at FeedZai. I didn't start out looking for a career in payments, so I guess like many people. I was an engineer working in the e-commerce space in the late 90s in the dot-com boom. And one day my boss came in the room and said, they're stealing our computers, figure out how they're doing it and try and stop them. So...

I got a big pile of printed paper on my desk with a load of transactions on it and had to figure it out. from there I was kind of hooked and here I am 25 years later still in this space.

Michael Salmony 2:00

So maybe you can tell us a little bit what's going on in fraud. I fraud seems to be moving away from cards to A2A. Correct me if you see that differently. There are also always new models appearing like APP fraud. Just give us an outline of what you're seeing in Europe and around the world, how fraud is evolving,

if you can.

Richard Harris 2:21

Look, I think you've correctly characterized that. think fraud in the payment space has always been characterized up until probably about five or six years ago as really a credit card problem. And if you looked at it globally, there are still some markets where that's still true.

but rapidly we're seeing a movement to A2A. And that's really because of the rise globally of, know, a lot of what you talk about here on the podcast is the rise of faster payments, instant payments globally. And the fact that those new systems have come in, whether it's faster payments in the UK or PIX in Brazil or any of the other number of methods all over the world, that's made it easy for consumers to move money quickly and conveniently. And it's a great consumer benefit. At the same time,

fraudsters have realised that there are many benefits to defrauding consumers on these rails, not least because of the fact that protections that have gone into protecting the credit card rails over last 25 years have become more and more complex, more and more difficult to defeat. And these A2A networks being new, it's the typical approach for fraudsters, there's a new rail, there's a new approach, a new payment type, a new merchant, whatever it is, new means opportunity to a fraudster because something will not have been covered.

And in the case with A2A, one of the big challenges is that once the money's moved, it's gone. And the fraudsters are very much like that. There's no chargeback period. There's no waiting to get cleared funds, any of those things. The money's gone. So the fraudsters have zeroed in on this globally. It's become the sweet spot to attack from a fraud perspective because, you know, ultimately as a fraudster, what you're trying to do, you're trying to get as much cash out of the system as you can as quickly as possible.

And A2A has unfortunately in a lot of markets around the world given this vector to the fraudsters for them to attack and not all the security controls that have gone into place in these different networks around the world necessarily been good enough. And that's led to an awful lot of fraud. And that's what ties into, you know, when we start talking about crypto scams, romance scams, CEO fraud, know, whatever it may be, there are many different flavors of this. But fundamentally, it comes down to money being moved out of an account.

voluntary or otherwise by a user to an account which is under the control of a fraudster in one way or the other. And that might be direct, it might be a mule, it might be somebody who's under their spell effectively. But effectively that's the approach. And we've definitely seen globally, as you said, very big shift from credit card to A2A fraud. And if you look at the UK, I don't know the exact numbers this year, but definitely A2A fraud is now outstripping credit card. In the UK, it's definitely heading that way. If it hasn't already exceeded it in most other...

markets around the world.

Ralf Ohlhausen 4:58

Is is there well A2A is is growing and cards well still growing as well actually. but it is is one more over proportionately risky than the other? Or what what is what would you say is the riskier way to get paid today? Is it cards or is it account to account?

Richard Harris 5:25

I don't think it's as simple as that. It comes down to which market you're in. It can be as simple as which provider you're using, what approaches are you taking as a consumer to protect yourself. I would say overall payments are safe. When we're talking about fraud, fraud affects a very, very small percentage of payments globally.

Now, when we're looking at screening fraud at Feedzai, you're not looking at the 99 % of transactions that occurred. You're looking at 1%, which are potentially suspicious in a lot of cases. And if you look at the rates of actual fraud in most markets around the world on, A2A, you're talking a fraction of 1 % of payments that are going to be fraudulent. The challenge is more the fact that there are just so many of them, and there is so much money moving that when you actually look at it in isolation into how much fraud is happening, the numbers are extremely large. You're talking billions and trillions

of dollars. But you know I think we all have to remember that fundamentally the payments infrastructure is well built and it is relatively safe but there are niche situations that fraudsters can exploit and they do in order to get money out the system fraudulently and it's those that we zero in on because the payments business is so large that even that small fraction is a huge amount of money

Javier 6:36

Mm-hmm. What what scares me most is that more than a crime, fraud is becoming an industry. In the past we tended to see fraudsters as hackers, pirates, individuals who were criminals, but acting alone. But now we see that they are growing, organizations are backing this activity, and combined with cyber threats and with even the the support of states

It's becoming more than a pirate activity, a course or activity. So it's well organised and it's becoming like another means of using warfare against

Richard Harris 7:15

Mm.

Javier 7:16

many others. How do you see this perspective that it is not simply crime that should be chased by by by legislation, but we need some higher coordination of of the the nations against this kind of crime?

Richard Harris 7:36

I think it's a really good point. think if you look back to the beginning of my career and the type of fraud I was stopping then in terms of people stealing computers off websites, was, I'm not going to say it wasn't organized because it was organized crime to a large extent, but it would tend to be done, the sophistication required to do it, the knowledge required to do it was not widespread. And the protection against it was sporadic. So was very opportunist.

I think if you go back there. Now having said that, the internet arriving in the late 90s didn't suddenly invent fraud. Fraud was existing way before that. You when I was at college in the late 90s, I had friends who were scammed in much the way that consumers are scammed now. just, they were scammed through, you know, postal letters instead of emails or instant messages on Instagram. So it's not that this MO is fundamentally different. It's still there. It's just that the speed and the scale of the internet organized crime.

know, instant messaging, social media makes this much easier to mass produce. So that's what's leading to this epidemic, if you like, because it's become ever cheaper and easier to do this return on investment can be very high. So before, if you had to send out 1000 letters to get one mark to steal 1000 euros, that was expensive because those letters cost money, you have to print them or you have to write them by hand, you know, there's a cost to doing that. So the ROI is poor.

Now using an LLM to generate those messages in any language you want, to send it to an email address of 100,000 people that you just have in a spreadsheet, the cost of doing that is basically zero. So now the ability to scale that and machineify that is so much easier in the modern world. So I think that's partly what we're seeing. And as you say, this now becomes not just a case of happening at organized crime level, which is happening at a huge scale across the world.

Yes, we have nation states involved in this. And more than that, it's become an industry. And the industry comes back to the fact that this is an industry that has different suppliers for different parts of the fraud chain. So you have certain actors who are involved in stealing data and credentials. You have others who are involved in testing those credentials to validate which ones are high or low quality. You have others who are involved in creating scripts and tools to allow you to exploit those. You have others who are creating

networks of mule accounts to allow you to cash money that you've stolen out. So you can effectively crowdsource your supply chain if you like from existing experienced actors who know how to complete each part of the chain. So you can come into that business and if you have the money to set this up or the seed investment if you like to go and get your suppliers, you can come and do this with a very limited amount of expertise and that's what we're seeing to some extent at know organized crime levels that

These are collaborations of groups which are in many cases cross-country, international, that are working together to create an output and each one of them is getting paid a fee for doing what they're doing to go through this. So some of these groups, it's the old adage, in a gold rush sell shovels, some of these groups are making a huge amount of money out of just providing part of the value chain without actually having to physically steal anything. They're just maybe stealing credentials, cleaning credentials, providing scripts, et cetera.

And that's meant

Michael Salmony 10:53

and

Richard Harris 10:53

the barrier to entry to do this has come down. So if you're a, back in the late 90s, if you needed to go and hack a website, the classic hacker back then was a guy like me in a hoodie who was 22 years old sitting in a bedroom somewhere who was gonna hack something and steal some credentials or steal some money. Now you don't need any skills at all. You can just go and say, do I do this to the internet? And it will go, there are videos out there to teach you how to do this on Instagram. So it's not even hidden.

So that's part of the challenge. It's much wider spread. It's much lower barrier to entry. It's much bigger publicized. There are many more people involved. The expertise involved has gone up and it's been machinified. So it has literally become an industry.

Michael Salmony 11:36

I mean, that's a really scary story you're telling there. It's an incredible specialization in

that industry, right? Where everybody does a part of the value chain and they all coordinate really well and somebody does the technical attack and somebody does the human manipulation and somebody gets into the system and somebody is specialized in the automation. So that rather raises the question of how does one defend against that? Because, you know, the banks

typically been only looking at their own systems, let alone communicating with other banks to sort of spot fraud patterns. And of course, nowadays, we need to connect social media where some of these fraudsters get their impulses from, AI is involved, people call you on a spoof telephone number that pretends to be your banking advisor. So goes across industries, across countries, across disciplines, from psychology to technology. how are we ever going to get a handle on this?

Richard Harris 12:35

Well I think the reality is there's no silver bullet and there never is in fraud. So the key comes back to the fact this is all about layers of protection. So if you look at this over the years, a bank out there will have multiple layers of protection. First of all, they'll have the app or the website that they're allowing their clients to interact with them through.

So first of all, it comes back to basic levels of cybersecurity. Who's logging in? Do they have the right credentials? Are they an authorized person to be accessing the accounts, et cetera? Because that's where you're trying to fraud through somebody logging into someone's account when it isn't their account. So stolen credentials, that kind of third party fraud, if you like. So there's a huge amount of technology there. think we'll park this for a minute, but we're to see a lot of change in that space quite soon because with Agentic coming through.

you're moving away from saying, is this the right person who's using this? We're to be asking a different question quite soon is, is the machine on the end of this login, an authorized agent of the end user? So we're going to see change there, but that is something that's everybody's talking about. We're not seeing happening at scale yet, but it's coming. But at the moment you have that sort of barrier of defense of who's accessing the account. If you look at A2A fraud,

And then you've got a lot of other security controls in there. So if you're transferring money, do you know who this is? You're looking at checking the payee. Is the payee details, does it line up with the business you think you're paying, for example? You see that in most banking apps now. They'll do validations on those things to make sure. And then obviously you've got systems like the one we provide at Feedzai. Others are available.

that going to be using machine learning and AI plus rules plus other capabilities in the background to look at, does this payment look risky according to the population of payments we've ever seen? And doing that within the bank is pretty effective at the top level. What we're going to see next and where we're seeing the industry going is saying, how do you start to spread that out at a cohort level across, say, networks at a country level or even internationally?

We can talk about that in more detail because there are multiple political considerations around that which are pushing the industry in two different directions.

Ralf Ohlhausen 14:46

Yeah, and I have a question or two on that. But before going there, just sticking to the agentic AI for a minute, that I think a lot of the fraud detection on the bank side is is sort of based on human behavior and how they act and how fast they type and whatever which country they're coming, well, they're the IP address and whatever. So and all these human

related detection methods. I mean they're just I they they they're not useful are they? if an agentic AI is coming, so how do you change that? What what do you do in order to adapt to those away from behav human behavior to agentic behavior?

Richard Harris 15:34

So I think when you look at that, the behavior of the individual is one set of factors that you're going to take into account when you're screening a transaction. Obviously, the fundamental thing you're going to look at is the transaction itself. Who are you paying? What's your history of paying? So look, if you're using your agent to pay your rent and you're still paying your landlord in the same bank account for the same amount that you've been paying for the last 12 months,

I'm to be pretty confident that the agent's doing that because I can see that it's a consistent history of transactional payment. So whether it's you particularly pressing the button to do that or the agent's coming in and doing it for you because you set up an agent to pay your rent, that's not particularly an issue. So I think it's a case of looking at there are many, many different factors you're going to involve. The sort of behavioral biometric and the device ID that you're looking at are component parts of screening a transaction. There's all the transactional data itself, the specific transaction.

and then there's all the history of all the transactions you've ever seen, either for that individual, the cohorts that individuals aligned with, or for the entire population of the bank, or as we said at a network level, the population of the country, or the continent, or even the globe. So all of those different factors are going to play a part and

Yes, we're going to reach a point fairly seen with Agentic where some of those factors in terms of the biometric that you'll take from the human are not going to be necessarily useful anymore. All the others still remain. So it's not as if those things change and everything becomes impossible. just one bit of it becomes more difficult. However, on the other side, what we will see, I think, and this is where a lot of the industry is going, is saying, how do you provide secure tokens between you and the agent that you're employing to do your work so that there's a validation credential there to say that this

agent is acting on behalf of this individual and it's accredited to do so and provides a level of security and I think when those systems you know come through and they could work in multiple different ways when those come through that will actually provide a high degree of security so I don't think that behavioural biometric you know changing. Now what it does allow you to do is I think and this is something to talk about is the paradigm for years was where I was working was how do we spot the bad stuff?

So how do I know that this is a bad being on a credit card because it's been hacked? Or how do I know that this is a bad customer or a bad email address? You know, the reality is fraud went through probably 10 years ago, the same flip that cybersecurity went through a few years before, which is...

I remember when I worked at a card network, we'd spend all of our time trying to list bad IP addresses to stop people coming to the website from bad IP addresses. Nobody does that anymore. What you're doing is you're looking at the known good population, and if it exists outside the known good population, then you're going to give it degree of suspicion depending on how far away from that population it is. And that's what the best fraud systems are doing today. You're not trying to...

track everything because otherwise reality is you can only find something bad if it's already hurt you in the past. You don't want to stop the second fraud, you want to stop the first one. So what you're doing is benchmarking what good looks like within your organization or within the network or at multiple levels and then saying if it exists outside that how suspicious do I think it is and how far outside the norm is that and what reasons could there be for that and what level of risk do I think that represents.

So think moving to that approach over the last 10 years has been critical for the industry because otherwise everyone was just playing catch-up of saying, okay, this bad thing happened last month, let's block all of that as well. And then the next thing happens and you're behind. So the industry's flipped around to be far more proactive.

Javier 19:09

I I presume that service providers are aware of the criticality of this topic. So at the end, they are the ones that feel the pain because that they are the ones that usually pay. How do we reach still the what I see the most vulnerable vulnerable link in the in the chain, which is the human being, the general public? How how can we engage citizens to understand fraud and to

teach them?

How to better behave in order not to have the first the first fraud, not the second, the first as you said. How can we reach the general public?

Richard Harris 19:51

So, I think it's a really interesting one because I think...

you know, this is one of those challenges which comes in several different flavors. So on the one hand, there are general things that we can educate the public to do better and which I think banks do a lot of right now. When I was talking about, you know, looking after your credentials and never show your pin to somebody else, the bank will never ask you to review your pin, all of those things. You know, those good levels of baseline security, good practice, those types of things the industry tends to do a pretty good job of.

But we as consumers, and I include all of us, we get blasé, we get immune to those messages and we tend to ignore them. The real challenge comes when you're looking at lot of these A2A scams, and the clue is in the name, when you look at it, it's investment scams, it's romance scams, it's things along those lines. The people who are being affected in most cases by these are almost universally in some kind of distress.

in some way, shape or form. When I say distress, it means, you know, maybe you've lost your job or you're under pressure to pay the rent or, you know, people are looking in a way that they're not thinking in straightforward ways. And one of the big challenges is to be able to educate somebody in that particular situation who's under pressure, who's under stress and looking for an easy payment or, you know, they're looking for something that's too good to be true. And it goes back to that, although it looks too good to be true, it probably is. But the reality is people

are in those situations where they're under stress, under pressure, they want, they're expecting or hoping for an easy way out. In a lot of cases, this is just pure social engineering, and social engineering is as old as the human race. And some of this social engineering is extremely sophisticated. you know, never mind adding AI tools and voice changes and all of that fun stuff into it. You know, the reality is this social engineering has been going on forever.

and these people will be manipulated for months before there's a takedown and a payout. So this person will have built a friendship, a relationship, in some cases what they believe is a romantic relationship with somebody, and that trust is there and that trust will override any kind of external message from a bank or a government or an advertising campaign. So it's really very difficult to get through to that very small cohort of people who are in that situation. And that's why as an industry we've got several jobs to do, I think.

On the one hand, what we can do within the banking space is, and some of the things we do at Feedzai, you can use some of those biometric markers when somebody's moving that money themselves. You can see if somebody's on an active phone call. Does that mean they're being coached in what to do? Because the fraudster's talking them through how to move the money. You can see if they're hesitating and clicking backwards and forwards between buttons. And it's unlikely that a fraudster in that kind of scam is going to use an agent.

to do this because it won't have the security credentials to be able to cover these things. It's going to have to use that socially engineered individual because they think they're doing something genuine. So these biometric markers, these biometric capabilities are very useful in those situations because you can see if there's maybe coercion going on. The challenge is how do you intervene? Because...

you can just block the payment. I know banks and I've worked with banks who've gone to individuals in these situations and they've said, we don't think you should do this payment, we're gonna block it. And then the consumer comes back 24 hours later and says, nope, I still wanna do it. And if on the fifth day, the bank's like, sign this affidavit because I don't want you to do this, but legally I can't stop you. I think part of this is the challenge. Now on the other side, how do we get to prevention? Because I think...

This is about, you know, when we're looking at it from a banking perspective, we're looking at stopping the payment after the engineering's happened. On the other side, I think there's a huge amount of responsibility in, you know, in social media around how do we stop this kind of social engineering, because we put huge amounts of security into banking infrastructure to prevent bad actors.

There's next to no security in social media to prevent bad actors. And I think this is part of the problem is that, you know, it's the Wild West in social media. Anybody can go and befriend anyone and pretend that they're somebody they're not. And it creates a really sort of disproportionate dynamic where it's free to attack. And yes, they know it's hard to take down, but the attack rate is so cheap.

you're going to find people because as I said before, the old way might be sending a hundred letters to people to try and score them up. Now you can send a hundred thousand emails or a hundred thousand WhatsApps. You only need two people to respond. If you can get 2000 euros out of each, that's a good day's work. So, you know, if you're a fraudster, so I think that's part of the challenges. At the moment, we get very focused on the banking. We have a lot of regulation focused on banks, but I think...

there does have to be a look at how social media is operating and I think maybe we'll look back in 30, 40 years time on how social media operated in this age and go, how do we let that happen?

Ralf Ohlhausen 24:48

Yeah, well we are actually taking some steps of the new payment service regulation. It's trying to address this.

Richard Harris 24:57

Yes.

Ralf Ohlhausen 25:00

but so for example, I don't know, telecoms companies will have to cooperate, but the liability will be with the payment service provider. So banks and fintechs will pay the bill in the end for a scam that started on someone else's network.

well what would you or how

Richard Harris 25:18

And that's precisely the point.

Ralf Ohlhausen 25:20

well how could we make this more fair? How could we get these social media

Richard Harris 25:26

Well...

Ralf Ohlhausen 25:28

and and other players in in the in the fraud chain here to to pay their fair share?

Richard Harris 25:35

Look, I think it's pretty hard. think the reality is given where the social media and social network companies are based, you know, you're effectively going to be fined. Let's call it what it is. How are going to fine US companies for their subsidiary behavior abroad? It's pretty difficult. It's not impossible. You know, the European Union has managed to do it to some degree, but it's a long, slow process. I think there is a little bit of a halfway house or a model that's interesting in Australia, where they've brought the least of telco providers into this.

because they're saying effectively that the telco providers are providing the infrastructure where these payments are moving, because they're moving through, largely through mobile phones and social media. So the telco providers are dragged in, which, and potentially the telco providers have the ability to provide some pressure on those networks, because if it's, they distribute the products or provide the products if it's costing them money, it is a pressure point. I don't think it's perfect by any means, but it is an angle that the Australians are looking at with their legislation.

So I think that's an interesting angle. But I think, look, it's very hard. But I think the other one is there's also, when you look at the bell curve of who's affected by these scams to a large extent, I'm gonna sort of buck the current trend, because everybody talks about it being sort of focused on people who are older and not familiar with technology and those things. And there's certainly a cohort that are there, but it's often.

at other end of the bell curve as well. It's young people who are very inexperienced with banking and payments and fraud. So I think it's not to say that there aren't cases in the middle, but part of it is about experience and education with these tools. And I think we will move through to a period where the sophistication increases across the board for everybody, so it will become slightly easier. Because this is a deluge of things which are happening, the stories of being percolated, everybody knows someone now who's been affected by this in one way, shape, or form.

I need to go back to the proofs one, the big challenge here is still that people still go through life events that put them under stress and pressure, which make them look for a situation which might be the solution they need at exactly the right time. And I think part of it is that fundamental education that if it looks too good to be true, it probably is. But it's always going to be tempting, and it always has been tempting throughout human history with the way of technology. But I think...

Anything to broaden that is good. Anything to bring the social media aspect into that is valuable. Because otherwise we're just constantly at the other end in the banking situation trying to stop them, know, stop the money leaving the system while it's all been set up. And an awful lot of harms occurred to individuals before that even happened.

Michael Salmony 28:13

Scary stuff. Can I just ask you about crypto? mean, normally one can't talk about fraud without talking about crypto. And it used to be the

Richard Harris 28:23

.

Michael Salmony 28:23

method of choice of sort of funneling the money out of the banking system into the nether nether world where it can never be caught again. But I understand there's also a lot of fraud which happens entirely within the banking system. Can you just help us a little bit on positioning how that works?

Richard Harris 28:39

Yeah, I mean, look, I think crypto got an awful lot of bad press in this space because there is a huge amount of, there has been in the past, a huge amount of criminal activity associated with crypto, not least with pump and dump schemes and all of those things. So it becomes conflated to some degree. But on the other hand, look, know, criminals have always used the regular banking system to get their money out. They might want to put it into an easily transportable crypto.

token at the end of that in order to be able to move it across borders without detection. But it's quite often the case that it's not moving straight into a crypto token, you know, after it's been stolen on the next hop. It's too obvious. What you tend to see and what we see is, you know, and this is globally, whether it's in Europe, whether it's in Asia, whether it's in the US, networks of mule accounts will be created. And the mule account is effectively an account which the fraudster has control over. Either they've created it themselves as a, you know,

a synthetic identity, a made-up ID, a stolen social security number, stolen password, credentials or whatever, or it will be an account that they've effectively rented off someone who's agreed possibly unwittingly to let the fraudster use their bank account for a certain period of time. I remember back in the late 90s there were posters up in my university campus saying, know, mate, 10 pounds a day working from home, all you need to do is give us your bank account, and that was for, you know.

basic, that was mail order shopping fraud back then, it wasn't even internet, so I'm telling you how old I am, but those kind of accounts will then be used to take the proceeds of crime from that victim, so that scam victim, that money will be moved into another account and typically it won't just be one account, it will get split into multiple accounts.

And now with automation, number of accounts, you know, in the past it might be, okay, we'll take your 900 stolen euros and we'll split it into three payments of 300 euros and move those into three different accounts. Now you can automate this. I can split that into 90 payments of 10 euros and move those into 90 accounts. And I can move that money around two or three times through the banking system. And, you know, we work with Mastercard in the Philippines and we have a product that we work with them.

called trace and we can see that in you know that network effect happening is that where the money goes post scam and that's a very successful product of tracking that money down and getting money returned to consumers because it's breaking down that entire network view but in order to do that you've got to have all the data in the network which brings us back to one of Javier's points from earlier is how do you get that cooperation to try and fight against these things and you've got to do that in network level but

Yes, a huge amount of money that's stolen goes through the regular banking system through mule accounts. It may ultimately end up in a crypto wallet because it needs to move from Europe to whatever country the end organization is working in and wants to take that money away in. But once it's moved four, five, six hops, it's very difficult for the banks to trace that money back and work out that it was the proceeds of crime. Because as far as they're concerned, it's a clean transaction.

900 euros is now a 50 euro transaction from account A to account B. It's never going to trigger a suspicious transaction unless you can link it back to that initial crime.

Javier 31:53

I I fear that we have to perceive fraud something that will stay forever. It's I think we cannot eradicate it, it's like it's a disease. We we've like vr virus, we cannot get rid of of that. We have to learn how to live with it. I think this is a very pessimistic thought. But we have to adapt to it. But then what's the best approach to deal with this kind of sisyphus symptom syndrome that

we have to push the rock?

uphill but then it will roll down and we have again to push it uphill eternally I would say. How because it's it's somehow it's upsetting to see that yes you fight against fraud, you have some success, but then it will eventually fail and you will be attacked again and you will have again to fight against fraud, a never ending effort. How how what would be the best approach to do that?

Richard Harris 32:51

Well, if I knew the answer to that, Javier, I'd write a book and I'd be very rich. But I would say, look, I mean, it's basic economics. How do you make this too expensive? The return on investment needs to be painful. If you go back to the type of fraud that we had, as I said, in the early 80s, where this was all done, you know, that kind of fraud on a consumer was harder to do because the cost of doing it was quite high.

So how do you increase the cost of doing this? Well, we're not going to make sending instant messages more expensive or using social media very expensive. you know, I think that's, that side of it will not change. But I think what we have to do as an industry is do our best to reduce the chances of successful outcome. And I think to a large extent, if you look at what happened with credit cards, it's a good analogy. It's not that credit card fraud doesn't exist. It's that it's going down.

And part of the reason it's going down is because the security was improved, the networks did a good job of enforcing new security standards. Chips made it not impossible to defraud a card, but very, very expensive to defraud a card. So therefore, that approach didn't suit. So the problem is, as you say, the fraudsters don't go away and go, damn, I'll go and get a proper job. They say, right, where's the next weakest point? And the next weakest point was.

A2A because there were less security controls. was a newer system. Consumers were less understanding of it and what to do. So therefore they focused there. So I, you know, I'm confident that over the coming time, you know, with the amount of brain power and the amount of, you know, capability that the industry has focused on this, that we will solve this in A2A, but it will move somewhere else. It's a bit like playing whack-a-mole. You know, it's the, it will spring up again because there are enough people out there who are motivated.

know, smart adversaries who were looking for a way to get money out of the system. if you go back 200 years to, you know, or wherever, what did people do? Well, they stole gold from banks. You you went and blew up the side of the bank and stole the gold from the bank, you know. And if you go back to the mid 80s, what did people do? Well, they crashed big four by fours into ATMs and stole the ATM. it's, you know, money is going to get stolen from banks because that's where the money is, as the old, you know, apocryphal saying goes. It's not technically true, but...

It's always going to be there, just the moment this is the MO that is used to extract money from banks. It's a bit like, I don't know if you guys remember the handgun diamond heist. was one of those things where I think the criminal fraternity out there were absolutely blown away by the fact that people would go and do that because it was just so risky and so complex to go and steal. What I think in the end made them a few million when they could have sat in a

sun lounger in Brazil or Thailand or wherever it was and run a script and stolen probably just as much money with zero chance of being caught. that's the reality of the criminal fraternity now. It's like this is the low risk smart way to operate. You can operate below the radar, you can steal money and you can get away with it far more easily than you can putting yourself on the line to go and rob a bank or a safety deposit box or what have you.

We will put the controls, we are increasing the controls in the industry, it is getting much, much harder to do. It's just there's a great variation between banks globally in terms of the level of security they have and the level of their customer education, that it means that this is moving from country to country in terms of where's the weak spot, because the criminals are international.

Ralf Ohlhausen 36:23

Yeah, so the industry collaboration is increasing and it's also very much supported and even driven by authorities, ECB, ERPB, well, the Commission and and making, you know, making sure that GDPR doesn't get in the way of data exchange. And then there is well the EPC now having a big initiative going and but

So for you or companies like yours, do you see that as a welcome help or as competition?

Richard Harris 36:58

No, I think it's welcome because look, we're all in this because we have the vision that we want to reduce the fraud, stop the fraud, right? So anything that contributes towards that is a positive. And I think anything that we can do to help, look, there are already good provisions in PSD2, et cetera, around the provision of using data to prevent fraud, which would otherwise be covered as personal data or whatever in certain situations.

Those things already help the industry a great deal and make it easier to operate I think you know increased regulation in space definitely helps. I think there's a Collide collision, you know that's happening right now between fraud and money laundering as well because you know as we talk about moving money via mules and all those things that If that doesn't happen then scams are worthless to do because if you can't get the money out then what's the point of doing the scam? So

AML regulations, increasingly and better AML regulations which are coming through, are definitely going to create a pressure here as well. So it's not just about fraud anymore, it's about the entire value chain of the ecosystem that the criminals are trying to inhabit. And how do you make it hard for them to stay in that value chain so they get less money out? It's more hard work for them, lower ROI. So I think increased regulation in that space and support is always welcome with the regulators that we work very closely with the ECB. I won't talk about it in detail.

detail but there's a press release out there on Feedzai that we're working with you know on the digital euro with the European Union so I think that's you know an interesting area for the future that you can see regulators thinking ahead and say we are going to have a thing like this how do we embed security and fraud prevention in it from the very beginning so I think those things are welcome because I think when you look at the the rails for faster payments in a lot of cases fraud was kind of in a lot of cases bolted on afterwards

because it was a case of how do we get the payments moving and then somebody went, yeah, but everyone looks at the happy path as we call it, which is the good consumer doing the thing they're supposed to do. Nobody looks at, okay, how could you abuse this? So I think regulators are more aware of that now and thinking ahead and being more proactive, which I think is a really good thing.

Michael Salmony 39:09

Yeah, we're gradually getting towards the end of our time, but I actually have a question to Ralf because you've made a very good case that the fraud is now happening increasingly

in A2A. And you also mentioned that maybe we didn't think about security enough when that was designed. mean, like, for example, if my credit card gets compromised, I just throw it away and get a new one. In fact, my Revolut credit card number gets regenerated after every transaction, right?

If my bank account gets compromised and my IBAN is revealed, this bank account I've had for decades, I have no way of regenerating that. So Ralf, you're the big fan of A2A. What are you seeing is happening in your space to defend against this?

Ralf Ohlhausen 39:55

Well, I I think account to account is inherently more secure than cards because of various factors. One big one being the SCA or two-factor authentication that is coming into basically every transaction. There's very rarely exceptions, especially on an open banking perspective where there is zero exemptions from from SCA.

And so I I don't see I wouldn't say that there is a higher risk on on on my bank account than than than on cards. To the contrary, but I I think the i it's actually more to the other side. It's it's banks are trying to well put restrictions

on it that are maybe not even justified, especially from a fintech open banking perspective, we see that. So for example, in the in the UK, you know, faster payments, I think authorized push payment fraud has come down once they imposed the the the the re reimbursement. But now the question is, is that now because banks have invested more and are better in detection or are they just more restrictive?

Are they just sort of you know reducing the amount, the limits, and especially if it's open banking? So we we get lower limits than than non-open banking account to account, which is in my mind not justified at all, to the contrary, because of SCA. So I think at the end of the day, what is what the the real risk there is is in the authorized push payment fraud. It's it is it is not that it's getting hacked.

It is that you're socially

Richard Harris 41:48

100 percent.

Ralf Ohlhausen 41:49

engineered to give it away more or less voluntarily.

Richard Harris 41:54

Yeah, and this is,

and that's exactly it, Ralf. So look, in the UK, what do I think is that many of our customers in the UK, we have two of largest banks in the UK are our customers. So I think what have we seen? Yes, there is increased investment because banks have leveled up because they've seen that. Look, fraud is a basic algorithm for a bank is like they have a cost of loss that they can put on their balance sheet up to a point.

But they also want to recover. There's an ROI calculation here. And if they're going to be paying out a certain amount of money to consumers, that creates a bigger cost on the balance sheet. So they will invest to stop that as long as the investment is cost effective. many banks have invested to stop that. Other banks have maybe made the calculation that, OK, we're just going to reduce the limits, as you said. The less sophisticated ones have maybe said, OK, we'll just reduce what customers can do because that will reduce our exposure and therefore reduce our losses.

sophisticated banks have invested heavily in technology in order to you know maximize throughput the less sophisticated banks have typically Just tried to shut the trap door. You can't do as much so both things are definitely happening and I've seen examples of both I think on the other side is yes social engineering needs the problem So it's fully authorized push forward and this is the point is that authentication in itself is not a silver bullet and never was

in the credit card space up to a point it was good enough because there was already a...

know, complete guarantee on refunds and chargebacks to a large extent for consumers in terms of stolen credentials. So, you know, there was a high bar on merchants to look at transactions being scored because the merchant was going to lose money if they took a transaction that wasn't properly authorized or genuinely by a consumer. And 3D Secure effectively filled that SCA gap to a large extent in Europe, less so in the US, but in a lot of other parts of the world, you know, strong customer authentication, you know, 3D Secure did the job reasonably well because it gave coverage and it

gave security. But at the same time, I certainly worked with merchants in the past who would say as long as I can keep my fraud threshold to 0.99 of 1 % and stay the right side of the card schemes, I will just maximize throughput because of what I lose.

in product at a 1 % threshold fraud rate is less than I make out of maximizing the rest of the business. So there were merchants out there who would happily maximize the fraud loss that they were going to have because they knew that they would make the most money that way. And it was a simple mathematical equation for them. All they needed to do was not get fined by the schemes. So again, it's just capitalism. It's just basic economics. But I think we've definitely seen that with the banks. think what you do need is, you know,

If you're going to combat social engineering, then you need more sophisticated capabilities because just saying, yes, it's me, doesn't help when you've been socially engineered to send money to someone who's pretending to be someone who they're not. It's utterly useless because, of course, it's you sending the money. The problem is that you're sending it to someone who's pretending to be someone else and you're doing it completely willingly. So just authentication is never enough. Intent is the key and the reality of the recipient. So this is where the sophistication in terms of A2A fraud checks has got.

way more sophisticated than those banks. And at the same time you've got to look at recipients. So who am I receiving money on? Because the way that we've done it in the UK as well is that it's split, it's 50-50. So it's not just now, should I let this money be sent, it's should I receive this money? And that's putting a much higher bar as well as, what's the account this money's been received into? Is this a genuine account?

because there are a huge amount of fintechs in the ecosystem across Europe who were just measuring themselves by the amount of accounts they had. And let's be honest, some of them were not doing the job they should have been doing in terms of authenticating where those accounts came from. They were just very happy to report to their board that they had a growing number of accounts. Some of those accounts, probably a very small percentage, but some of them were being set up by criminals with the pure intent of mulling money from the other banks in the ecosystem. By putting that 50 % on those banks,

they had to massively invest in cleaning up their onboarding approach to say, these accounts genuine? Or other way, so it's not just about the transaction itself, although you can do far more there, it's also about the ecosystem, or where that money's gonna go, so that you spread that risk, which I think the way the UK's done it does seem to be having an effect.

Michael Salmony 46:13

Okay, I think we could gladly listen to you for another hour. There's so much fascinating

Richard Harris 46:16

Yeah, could keep going, we'll try again.

Michael Salmony 46:18

stuff. I remember you telling me how you detect server farms of hundreds of phones, all in racks, which all try to attack the banking system. What sort of

Richard Harris 46:26

It's the...

Michael Salmony 46:28

parameters you measure? I mean, we could just go on and on. It is an entirely

Richard Harris 46:31

We kid.

Michael Salmony 46:31

fascinating subject and thank you for being so lucid on this. Yeah, I mean, my main takeaway, it's all about layering, right? Because you're never gonna...

capture everything, has so many dimensions, you just got to put layer on layer on layer on layer to help the human element, the technical elements, the networking, the banking, and then it's a continuous whack-a-mole game. And so I wish you much luck that the fraudsters will go to other industries outside payments. I think that's probably too optimistic, but you're obviously doing a great job. Okay.

Richard Harris 47:02

I live in hope, but they've kept me employed for a very long time, Michael.

Michael Salmony 47:07

So thanks very much, Javier, Ralf, and I would like to thank you very much for being so lucid here. And thanks to everybody watching. Hope you enjoyed it and see you next time.