Preventing P2P Fraud with Aite Group

Shirley Inscoe – Senior Analyst Aite Group
Eric Tran-Le - Vice President Product Management
How to Prevent Peer-to-Peer
Payment Fraud in Real-time

© 2018 Guardian Analytics. All Rights Reserved - How to Prevent P2P Fraud in Real-time 2©2018 Aite Group LLC.Page 2
Shirley Inscoe
Senior Analyst
sinscoe@aitegroup.com
+1.617.398.5050
www.aitegroup.com
Aite (pronounced “eye-tay”) Group is an
independent research and advisory firm focused on
business, technology, and regulatory issues and
their impact on the financial services industry.
Visit us on the web and connect with us on Twitter
and LinkedIn.

Agenda
• Growing importance of mobile channel
• Payment evolution
• Impact on fraud prevention
• How to combat real-time payment fraud
• Key takeaways

Faster payments have arrived; they are not a future event
• Payments are evolving to keep up
with market demand
• Payments are becoming faster and
can be initiated via mobile – the
device of choice
• Fraud always attacks new payment
methods; that is to be expected
and planned for
• Most FIs are not ready for real-
time payments, so must prepare
Mobile-first is consumers’ choice

Digital P2P Payments Market Snapshot
$100.3
$147.1
$178.2
$215.8
$261.4
$316.6
2015 2016 e2017 e2018 e2019 e2020
Digital P2P Payment Market Snapshot, 2015 to e2020
(In US$ billions)
Source: Aite Group

Payments are evolving, accelerating…
• New payment types are surfacing quickly in the market
- Designed to meet the needs of both consumers and businesses
• Everyone wants in on the action
- Apple Pay, Samsung Pay, Walmart Pay, Venmo
• Payments are mobile, allowing payments to occur anywhere
- Square Pay, Anywhere Commerce, Clover, PayPal Here, CardPointe
• Cryptocurrencies are becoming more mainstream
- Bitcoin, Litecoin, Ripple, Dash, Zcash, Monero

It is all about faster payments…
• Payment speeds are accelerating
- Same day ACH
- Zelle – real time P2P
o Over 100 FIs have implemented or committed to implement
o FI doesn’t offer it? – simply download the Zelle app
o Partnerships with core processors extends capability to smaller financial institutions
• FIS, Fiserv, Jack Henry
- The Clearing House’s Real Time Payments (RTP)
o Payments originated by businesses
o Incubator service with FIS
o SWIFT gateway makes payment railway accessible
- Payment hubs increasingly used for least-cost routing

Payments competition is
increasing rapidly
RTP
• Competitors are entering the market to
take advantage of payments demand
• Some players are owned by FIs, but
many are not
• Consumers and businesses want payments
they can trust and that are secure
• FI-controlled payments may be more
secure due to prior fraud experience
• Innovation is needed, and consumers
value ease of use; customer experience is
very important during the adoption phase

Methodology
Source: Aite Group interviews with 19 large North American FIs, July to September 2017
$25 to $99
37%
$100 to $499
42%
$500+
21%
Respondents by Asset Size
(N=19; in US$ billions)

Digital channel losses are on the rise
Source: Aite Group interviews with 19 large North American FIs, July to September
2017
Up
74%
Flat
21%
Down
5%
Q. Are your online/mobile fraud losses trending up, down, or are they
flat over the past 2 years? (N=19)

Fraudsters never give up…
No matter what measures are taken, fraudsters will find a new method…
Fraud prevention
measures cannot be
stagnant, but must
change to meet
current market
demands.

The bad guys use a variety of tactics
89%
42%
32% 32%
21%
16%
5% 5%
ATO Application
fraud/
ID theft/
synthetics
mRDC First-party
fraud/scams
CNP fraud Money
movement
ACH ATM
cashout
Q. What are the top 3 types of losses being incurred in digital channels?
(N=19)

Authentication is the
foundation for fraud prevention
• You must be able to determine:
• Is this applicant a real person or a bot?
• Is this a real person or a synthetic identity?
• Is this person who they claim to be?
• Is this person a known fraudster?
• Is this person registering for Zelle my good customer or an impersonator?
• Is the person initiating a Zelle transfer to a new payee my true customer or
an account takeover fraudster?
Doing this to
some degree
26%
Do a form of this;
needs improvement
32%
Not doing this,
but plan to
10%
Not doing this
at all
32%
Q. How is your FI working to orchestrate authentication, if at all?
(N=19)

FI fraud prevention moves to mobile-first
The mobile device can serve as the foundation for authentication in…
All channels, including:
• Online
• Contact centers
• POS
Aspects of authentication:
• Device fingerprinting
• Biometrics on device
• Geolocation
• One-time passwords
• Mobile network operator data
• Behavioral biometrics

Transparent methods improve the customer experience
• Device fingerprinting
• Behavioral analytics
• Behavioral biometrics
Customer experience is more important than ever before and can
determine whether new fraud solutions are approved or not.

The quest: Optimizing the balance between risk and friction
Seamless
experience
Device
identity
KBA
Fingerprint
biometric
SMS
OTP
Identity data
verification
Token
2-D facial
recognition
3-D facial
recognition
Mobile
app
push
Device
malware
Identity
document
verification
Eye vein
biometric
High
Medium
Low
Behavior
patterns
Behavioral
biometrics
Level of security
Username
password
High
friction
Iris
biometric

Internal data, reconnaissance detection
Transparent solutions ( e.g. device identity,
behavioral analytics, behavioral biometrics)
Stepped-up authentication (e.g.
biometrics, one-time passwords)
Login security (e.g. biometrics, dynamic credentials)
A layered approach to security is essential. The challenge:
Making it holistic

It’s a brave new world of financial crimes
• Old fashioned fraud & money laundering techniques are inadequate
- Rules based models can still be useful, but are not enough
- Real-time detection is necessary to avoid large losses or huge regulatory fines
- Interdiction capability is required to stop transactions in real time
• Machine learning models continuously improve based on feedback
- Can help reduce false positives significantly
- Supervised models are best accepted by regulators (early days)
• Tailor fraud and AML detection to meet payment windows
- Suspend, decision, release or delete
- Prioritize alerts based on risk level
- Consider auto-decisioning once confidence in model is established
- Ensure no discriminatory effects from models

Key takeaways
• The threat environment continues to escalate; EMV, faster payments,
ongoing data breaches, and increased mobile functionality will only up the
ante
• The mobile device, properly enabled, can add much value in combatting
fraud
• Financial institutions must have sound strategies to implement real time
payments or fraud will mushroom
• Ensure your fraud processes are easily adaptable, fraud can change quickly,
and you must be able to make adjustments
• Review your authentication strategies and update customer contact
information as part of your faster payments implementation process
• Don’t employ too much friction; transparent solutions can enable strong
security as well as a great customer experience

© 2018 Guardian Analytics. All Rights Reserved - How to Prevent P2P Fraud in Real-time 20
Safe Harbor Statement
The following is intended to outline our general product direction. It is intended
for information purposes only, and may not be incorporate into any contract. It is
not a commitment to deliver any material, code, or functionality and should not
be relied upon in making purchasing decision. The development, release, and
timing of any features or functionality described for Guardian Analytics’ products
remains at the sole discretion of Guardian Analytics

What Does Guardian Analytics Do
• Alert Fraud Operation Team
• Stop Fraudulent Account
Activities
• Detect Fraud Risk Through
Behavioral Analytics

• Self-Learn Individual User’s Behavior
• Detect Anomalous User Activities
• Adapt to New Threats
• Do Not Depend on Rules
• Monitor Hundreds Events & Attributes in Real-Time
Detect Fraud with Behavioral Analytics

Financial
institutions
Commercial & retail
account holders
Banking
activities
450 40M 5B
Guardian Analytics at a Glance

Optimal The Balance Between Risk and Friction for Payments
Seamless
experience
Device
identity
KBA
Fingerprint
biometric
SMS
OTP
Identity data
verification
Token
2-D facial
recognition
3-D facial
recognition
Mobile
app
push
Device
malware
Identity
document
verification
Eye vein
biometric
High
Medium
Low
Behavior
patterns
Behavioral
biometrics
Level of security
Username
password
High
friction
Iris
biometric
Behavioral Biometrics is about identifying people
by how they do what they do rather than by what
they are (e.g. fingerprint, face) or what they know
(secret question, password) or what they have
(token, SMS one-time code)
Behavioral
Biometrics
Behavioral
Patterns
Behavioral Patterns is designed to understand the
normal behavior of each individual account
holder, calculate the risk of each new activity and
enable real-time intervention commensurate to
the risk
A Device Fingerprint is a set of information
collected about a device or user profile. The goal
is to create a digital identity which can be used as
the fingerprint of a mobile or desktop device

Enabling Friction Right & Real-time Intervention
FRICTION RIGHT PREVENTION
REAL-TIME INTERVENTION
FRICTION LESS FRAUD DETECTION
$
RISK ENGINE
• Friction Less Fraud Detection
• Friction Right Prevention
• Real-time Intervention
• Monitor Hundreds Events &
Attributes in Real-Time

Faster Payments and Friction Less
• Temporary
employee
wages
• Emergency
payroll
• Urgent B2C
(Disaster relief)
Utilities, DMV,…
charitable organizations
receive funds into their
account
Person-to-Business(P2B)• Immediate
bill payments
• E-commerce
purchases
• Just-in-time
payment to
suppliers
• Immediate
bill payments
Business-to-Business(B2B) Suppliers receive funds
transfers to their
accounts directly
$
Customer RECEIVES
$ IN MINUTES using
P2P Service
$
Person-to-Person(P2P)
• Non-commerce
payments
• Account-to-
Account
transfers
• Payment for
information
services
Business-to-Person(B2P) Workers receive funds
transfers to their
accounts directly
Friction Less

Example: P2P ACH Funds Transfer in a Nutshell
Bank A
P2P Service
Participant
Bank B
P2P Service
Participant
1- Bank A
• Debit Customer 1 acct. of $150
• Message P2P Service Provider
• Funds moved to settlement account
2- Bank B
• Credit Customer 2 acct. of $150
• Message P2P Service Provider
3- Bank A Settles with Bank B
• Bank A ACH to Bank B
in HOURS
Customer 1
Account Linked
$
Customer 1
SENDs Customer 2
$150
$
Customer 2
RECEIVES
$150
in MINUTES
Customer 2
Account Linked

Method of Compromises
Malware
Online Account
Take Over
Phishing
Email Compromise
Device
Account Take Over
Bank A
P2P Service
Participant
Bank B
P2P Service
Participant
Customer 2
Account Linked
Customer 1
Account Linked

Guardian Analytics Friction Less User Experience
FRICTION LESS
Device
Account Take Over
Online Account
Take Over

Guardian Analytics Friction Right & Real-time
Intervention
FRICTION LESS
FRICTION RIGHT
REAL-TIME
INTERVENTION
Device
Account Take Over
Online Account
Take Over
Malware
Phishing
Email Compromise

Current Guardian Analytics Use Cases
FRICTION LESS
FRICTION RIGHT
REAL-TIME
INTERVENTION
P2B & P2P Platforms
• Fiserv Checkfree (bill pay)
• Fiserv Popmoney (P2P transfer)
• Fiserv TransferNow (A2A transfer)
Mobile Platform
• Access Softkey, Fiserv – CFG SSB,
ACI – Mobile Banking
• ConnectFSS, Digital Insight - Digital
Banking
• Fiserv – Mobiliti, Jack Henry –
NetTeller
• Malauzai, Tyfone, Wescom Resources
Group
• ACI, Bottomline, Jack Henry
Online Platform
• Fiserv – Architect/CFG IBS/CDG SSB
• ACI – LFIN/Universal Online Banker
• ConnectFSS
• Digital Insight – Digital Banking (Retail)
• Fiserv- Corillian Online Hosted/Licensed
• Fiserv - Retail
Online/SecureNow(COASP)
Wire Platform
• Fiserv WireXchange
• Fiserv Wire Manager
• Fundtech PAYplus Connect (GFX)
• Fundtech PAYPlus USA
• Pathfinder WITS
• Ocean Systems – Fedlink
• Customers who can consume Wire API
ACH Platform
• ACI Enterprise Banker
• Bottomline Business Banking
• Fedline Advantage
• First Data - FundsXpress
• FIS ACH/BeB/CLK
• Fiserv ACH Manager/DNAWeb/PEP+
• Fiserv Premier ACH
• Finastra Fundtech ACH Plus
• Jack Henry Goldleaf/Silverlake

Actual Use Case
1. User Agent
2. Language
3. Color Depth
4. Screen Resolution
5. Timezone
6. Has session storage or not
7. Has local storage or not
8. Has indexed DB
9. Has IE specific ‘AddBehavior’
10. Has open DB
11. CPU Class
12. Platform
13. DoNotTrack or not
14. Full list of installed fonts & order
15. A list of installed fonts
16. Canvas fingerprinting
17. WebGL fingerprinting
18. Plugins (IE included)
19. Is AdBlock installed or not
20. Has the user tampered with its
languages
screen resolution
OS
23. Has the user tampered with is
browser
24. Touch screen detection &
capabilities
25. Pixel Ratio
26. System’s total number of logical
processors available to user
agent
27. Device memory
Device fingerprinting gets around
cookie-based privacy settings (e.g.,
Google's incognito mode)by instead
relying on information that all browsers
make readily available to client-side
scripting languages like JavaScript.
Information like operating system,
TCI/IP configuration, and browser
configuration. Guardian Analytics
combines this information to create a
semi-unique identification of online &
mobile users
Example of Device Fingerprinting

Example of Authentication and Logins Risk Models
Actual Use Case
20
15
10
5
0
HourofDay
Day of Week
20
15
10
5
0
HourofDay
Day of Week

Actual Use Case – Mobile Fraud
Activities:
• Login Failed (Bad
Credentials)
• Login Failed (User Locked)
Risk Factors:
• Operating System or
Browser Changes
• User Agent String Change
• Unusual Browser
Configuration
• Unusual Location
• New Location
• Network Provider
State remained the same with different city (usually this is not
suspicious), but as you scroll down you see a new provider, network
and OS/Browser. In this case it does provide you that an iPhone was
used, which has never been used for this particular account (normal
behavior for this account would be Windows 10 and Android).
Device Fingerprinting
User attributes
• Interaction Patterns
• Geolocation Velocity
• Time of Access

Implementing Friction Right with IBM Trusteer
Actual Use Case
Customer
Login
Fraudster
Stolen
Credentials
Login
IBM Trusteer Pinpoint Risk Factors
Phished Credentials
Malware Infections
(stolen credentials)
①
IBM Trusteer Pinpoint
Real-time Platform Integration
Transactions
Risk Factors
ACH ODFI/RDFI
• New Recipient Velocity
• New Beneficiary Location
• New Beneficiary FI
• Batch SEC Code
• Transaction Code
• Batch Amount
• Batch Count
• …
③
② ③+
ATO, BEC
Fraudulent Instructions
NACHA Files
Manipulation
ACCEPT
HOLD
REJECT
ACCESS
DENIED
① ②+
Device Fingerprinting
Risk Factors
User attributes
• Interaction Patterns
• Geolocation Velocity
• Time of Access
Device attributes
• UserAgent
• Language
• Color Depth
• Screen Resolution
• Full List of Installed Fonts
• A List of Installed Fonts
• Plugins
• OS/Browser
• …
②
Real-time API

Summary
FRICTION RIGHT PREVENTION
REAL-TIME INTERVENTION
FRICTION LESS FRAUD DETECTION
$
RISK ENGINE
• Friction Less Fraud Detection
• Friction Right Prevention
• Real-time Intervention
• Monitor Hundreds Events &
Attributes in Real-Time

Learn More
https://bit.ly/2KtcHPT https://bit.ly/2Mvap3h https://bit.ly/2lEr0Gz
https://bit.ly/2Ks8I9D https://bit.ly/2KeY4Um https://bit.ly/2tDrgdh

success@guardiananalytics.com
www.linkedin.com/company/guardiananalytics
www.youtube.com/user/GuardianAnalytics
@GuardAnalytics
Contact Us
Q&A

Preventing P2P Fraud with Aite Group

Recommended

Recommended

More Related Content

What's hot

What's hot (16)

Similar to Preventing P2P Fraud with Aite Group

Similar to Preventing P2P Fraud with Aite Group (20)

More from Laurent Pacalin

More from Laurent Pacalin (13)

Recently uploaded

Recently uploaded (20)

Preventing P2P Fraud with Aite Group