By Ray Birch
SAN ANTONIO—With FedNow adoption maturing, the nation is quickly moving towards a ubiquitous real-time payments environment. But in turn, instant payments fraud is also continuing to grow and has become a major concern, one analyst points out.
“With today’s credit unions facing a host of constantly evolving challenges, it’s not always easy for them to know how to respond in this increasingly complex landscape,” said Wes Burton, VP of governance risk and compliance for SWIVEL Transactions, an SWBC company. “How do you create effective strategies for detecting, responding to and even preventing these fraudulent activities while staying ahead of the bad actors?”
Burton said credit union must first perform a proper risk assessment.
“I think it's always critical,” he said. “And when you're managing risk to understand what your risk really is—and know it sounds elementary—but you must really understand your products their risks.”
A lot of the fraud financial institutions today is being driven by either compromised credentials or someone unknowingly participating in something—consumers who are tricked into providing information or sending payments.
“I think education around those types of threats to their to credit union members is key,” Burton said. “If members understand what those potential threats are…educate them through the website and in face-to-face interactions.”
Members must always be thinking about protecting their credentials, insisted Burton.
“Make sure they are well aware of any request for payment that might be similar to what they know, but are actually fraudulent,” he said. “That is a big threat we're seeing in the credit union space.”
Robust Controls
Obviously, robust controls and monitoring are critical aspects, as well, Burton noted.
“That includes velocity checks on things like credential use, login attempts, machine IDs,” he said. “Automated challenge questions is another control that can be put in. You're trying to log in and you get a secondary request for login information. I think that's another good piece of information to put into your pieces of control.”
While that adds another layer of resistance against fraudsters, Burton said CUs should not be concerned about additional friction for members.
“Most members are used to the extra layers of security now,” he said.
And as the holidays wind down, what should CUs be watching for from crooks?
“The volume of attacks are increasing this time of year, we know that,” Burton said. “Sometimes that makes it more difficult to detect fraudulent activity. I would look for payments going out of your credit union from what we consider high-risk areas. If payments are going to areas common for fraudulent activity.”
From an account perspective, CUs should look for multiple transfers to unrelated accounts.
“Again, sometimes that activity is hard to see when your volumes are high,” Burton said. “So, any kind of specialized rules you can put in place to see where the money is ultimately going.”
Burton pointed to the importance of automating fraud detection, stating that some CUs are very sophisticated, while others lag.
“Faster payments makes are making things even tougher, because the risk of loss is very sudden,” Burton said. “Obviously, there's very little ability to recover losses in an instant payment world. So, the ability to score the risk of a transaction, and to give some sort of precursory indicator that it might be high risk, is important.”
Credit unions must also be very quick with their rules.
“They have to be real time,” Burton said. “You could give an indicator, you can pick a risk score that says anything above X score is considered high risk, and we need to either block it altogether or look at it. I would say speed is going to be critical, and if your systems are not set up to be catching fraudulent payments in real time…”
Lower Dollar Thresholds
Burton also addressed setting lower dollar thresholds for fraud detection on real-time payments, which could help limit losses.
SWIVL is also very concerned about authorized push payment fraud, Burton said. Authorized Push Payment fraud is a type of scam where a victim is tricked into sending money to a fraudster, who is pretending to be a legitimate payee.
“The whole piece behind this type of fraud is it looks like legitimate activity to a consumer,” Burton explained. “Let's say a member has made a daycare payment for $800 on a certain day each quarter and then all of a sudden that member gets an e-mail that says you're past due and you need to make this payment. It’s really critical for members to understand if something comes at you that is out of the ordinary, that even if the request looks legitimate they need to spend a little extra time and validate those payments requests—especially in an instant payments world.”