BROOKFIELD, Wis.—Consumers want faster payments settlement. But the move to same-day ACH brings concerns about greater fraud risk.
“Faster payments settlement introduces more fraud risk,” said Andrew Davies, vice president of global market strategy, financial crime risk management, Fiserv. “That is what we typically see in markets where same day payments have been introduced over the years. In the U.K., for instance, when same day payments was introduced in 2007, we saw an almost immediate spike in fraud. And the country has not seen its fraud levels return to pre-2007 levels yet.”
Davies said the numbers should not dissuade banks and credit unions from embracing same day ACH, saying they can simultaneously meet consumer demands for speed and efficiency while monitoring for fraudulent activity.
“The threat of increased fraud looms, because with real-time settlement there's less chance to repudiate a payment. Once the money has gone into the market infrastructure and potentially moved among multiple parties quickly, recovery becomes difficult,” said Davies, who thinks fraudsters will exploit the ability to quickly move fraudulent money from institution to institution.
'Perfect Storm'
He said that crooks will likely first rely on one account within an FI that funnels into it many other account holders’ funds. The crooks will then quickly move the money to other FIs, and do that from one institution to another, even internationally.
“It will be more difficult to track the money this way and get it back,” Davies said.
Davies said what FIs face today is a “perfect storm” of factors that are requiring banks and credit unions to make important decisions on the future of their payments business: greater demands from customers of financial services, emergence of disruptive technology from fintechs, and increasing sophistication of criminals.
“People want fast access to payments,” said Davies. An Expectations & Experiences survey from Fiserv found 68% of respondents have needed immediate access to money from a check. But they also want peace of mind with immediacy. Eighty-one percent ranked security over convenience in payment methods. For commercial customers, there is a similar dynamic, with speed and security crucial from a financial management standpoint.”
As fintechs grow and offer alternative services, financial institutions must assess the effects on their payments business, and decide if they want to provide similar offerings, insisted Davies.
Andrew Davies
“Those alternatives may introduce risk, which may lead to reduced trust in the process,” he said.
And, no surprise, crooks are getting even smarter.
“As more channels are used, malicious software that monitors payment initiations could become a greater threat,” observed Davies. “The evolving criminal threat forces financial institutions to strike a difficult balance. They need to safeguard against fraud but also avoid negative experiences, all in an environment that demands greater efficiency and stronger management of false positives.”
More At Risk
With faster payments, there is more at risk for CUs than just individual member accounts. Davies said corporate credit union transactions could be a target.
“The risk includes me losing $1,000 sending money to a friend via P2P, all the way up to aggregation of payments at a corporate, meaning millions of dollars,” said Davies, who added that he expects in 2017 that there will be a significant increase on attacks on payment systems and on gateway systems, such as NACHA and Fedwire. “Moving to faster payments is just too inviting for fraudsters.”
Davies said that hybrid analytics help financial institutions tighten their security while limiting false positives.
“This is a sophisticated technique that leverages a broader set of data from a consortium of institutions to analyze transactions in real time. The process identifies the nuances of behaviors that indicate fraud. And it does so in an operationally efficient way,” explained Davies. “Essentially, hybrid analytics establishes a layered series of checks and balances across a transaction's lifecycle to help ensure what's happening with a payment is consistent with previous outcomes. It may not be enough to target one point of the transaction. Strong protection often depends on monitoring the entire flow.”