Enterprise fraud management (EFM) is constantly evolving to keep up with the changing tactics of fraudsters, regulatory mandates, and advancements in technology. In the last few years, we have witnessed these three trends align to create a perfect storm in the EFM landscape.
The bottom line: Legacy EFM ecosystems are not standing up against today’s market forces and the changing landscape. The challenges financial institutions face from all sides requires an evolution in EFM strategy, and no single solution is sufficient to address the vast number of fraud typologies that can target an organization.
While some research firms have attempted to analyze the “big picture” in the EFM vendor landscape, criteria remains largely focused on first-generation system architecture and fraud management capabilities. However, you can’t manage what you can’t see. Financial institutions are struggling to improve fraud detection capabilities in areas where existing EFM systems are failing to deliver, resulting in increased fraud losses and high false positives.
In this blog, we dive into how the three trends above are shifting the dynamics of EFM and changing how financial institutions respond to the threat of fraud and financial crime.
Changing Tactics of Fraudsters: Authorized Push Payment Fraud Explodes Globally
Perhaps one of the most profound and recent market shifts that has had a direct impact on enterprise fraud management as we know it is the global emergence of authorized push payment (APP) scams. Human stories of victims losing their life savings to scammers have dominated headlines in recent years – catching the attention of regulators and consumer advocacy groups and fueling heated debates about the standard of care financial institutions must assume.
APP scams take on many forms, but one of the most common is the bank impersonation scam. These scams typically originate with a text message or phone call where the scammer pretends to be from a bank’s fraud department and is contacting the consumer to warn them of a fraudulent or suspicious transaction. The scammer then attempts to manipulate the consumer into transferring their money into a new account that has been set up by the bank to “protect” their money. The account, however, is actually a mule account controlled by the scammer.
In the UK, APP scams continue to be the top form of financial fraud impacting banks and consumers. The U.S. has seen significant growth in these types of scams in recent years as well. The Federal Trade Commission reported that bank impersonation text scams accounted for 10% of all text message scams reported in 2022 – which is 20 times more common than it was only three years previous. APP scams are impacting other regions as well including Latin America, Australia, Singapore, Canada, South Africa and more.
So, why is this change in fraud tactics so important? There are several reasons including:
• Legacy fraud detection technology is not designed to detect APP scams. In these types of scams, the legitimate user is being deceived to make the payment. Thus, traditional authentication checks that rely on device, location, and network parameters will not deliver high-risk signals.
• These payments are mostly considered authorized leaving many consumers to bear the loss. While many countries have some mandate for financial institutions to bear responsibility for unauthorized transactions, APP scams are often viewed as “authorized” payments, regardless of how the consumer was deceived. Thus, banks are not typically responsible, and any customer reimbursement is entirely voluntary.
• Mule networks have risen in tandem with APP scams. The role of mule accounts is a central, but often overlooked, component of the entire fraud ecosystem. Without a mule, APP scams, or any type of fraud for that matter, is not possible. If you can’t send the money, you can’t steal the money. As APP scams proliferate, mule networks have sprung up at an alarming pace to support the ability of fraudsters to launder stolen money. This has created an increased burden on banks and a renewed focus from regulators on the money laundering problem.
Regulatory Mandates: Scrutiny (and Potential Liability) on Receiving Banks is Growing
The rise in APP scams combined with the increase in supporting mule networks has caught the attention of regulators. The most prominent action that has been taken to date is the mandatory liability shift announced by the UK Payment Services Regulator (PSR) in 2023. Under the new rules, expected to go into effect in October 2024, payment service providers will be required to reimburse customers 100% for APP fraud losses, with both sending and receiving firms sharing 50:50 liability.
Prior to the mandate, UK firms operated under the Contingent Reimbursement Model (often simply referred to as “the Code”). As of 2023, APP scam reimbursement rates in the UK were 62%, and the goal is to bring it to 100% in 2024 under the new rules. A recent study by Javelin Strategy & Research of more than 500 scam victims shows that U.S. banks are voluntarily reimbursing scam victims fully or partially at a rate of 67% - nearly on par with the UK under the voluntary Code.
Following the UK’s lead, many countries are signaling they are ready to take similar action by recognizing that while scams are a problem, mule account management is an equally significant part of the fraud epidemic. Potential liability shifts provide banks with more incentive to implement mule controls. Recent research by Datos Insights of fraud executives across several markets recognized there is an elevated amount of scrutiny from regulators into efforts that they have in flight or planned to improve proactive mule detection and treatment controls and establish a minimum standard of care as it pertains to APP scam reimbursement (see table below).
Note: Unlike other regions, none of the fraud executives in the U.S. cited pressure from regulators. However, a very recent announcement from the Consumer Financial Protection Bureau (CFPB) is creating waves among the U.S. financial industry.
Advancements in Technology: Rise of Cyber Fraud Fusion Centers
Regulatory action is typically the biggest driver of change for financial institutions, and as some countries start to take steps to push financial institutions to implement proactive mule detection controls, the anti-money laundering (AML) function will be flipped on its head. Controlling for mule accounts will no longer just be a downstream practice where investigations take place post-payment. Real-time detection controls will be necessary, thus expanding the responsibility of the fraud team and forcing increased collaboration between fraud, AML, and cybersecurity teams.
Today, most financial institutions are lagging when it comes to better coordination and integration between their fraud and AML functions. According to a Forrester study, 69% of financial institutions report that the number of days spent on AML investigations has increased. In addition, three out of four responded that financial risk to their organization increases significantly with each additional day needed to investigate financial crimes. Despite the inherent risks, less than ten percent of financial institutions noted that their Fraud and AML functions are fully integrated.
At the same time that collaboration and information sharing has become pivotal, financial institutions are also faced with the pressure to consolidate technology and reduce the number of vendors they work with. This is evidenced by the growing number of financial institutions investing in cyber fraud fusion centers to create a centralized environment that aligns the data, technology, and operational capabilities of traditionally siloed teams. According to Gartner, by 2028, 20% of large enterprises will shift to cyber fraud fusion teams to combat internal and external adversaries targeting the organization, up from less than 5% today.
Conclusion
Given the complexity of cybercrime and the differences in financial institutions and their unique requirements, EFM strategy requires a layered approach and flexibility in the solutions that support it. A layered defense allows financial institutions to address different aspects and stages of fraud attempts across the digital lifecycle and cross-verify suspicious activities to increase confidence in risk decisions.
The importance of behavioral biometrics intelligence within the EFM ecosystem can no longer be ignored given customer adoption and success. Many forward-thinking institutions have implemented the technology to bolster or complement existing EFM systems, detect emerging fraud types, and elevate customer safety in digital banking.
Learn More
To learn more about these shifting global dynamics and how fraud executives are responding, join our latest discussion with guest speaker, Trace Fooshee, Strategic Advisor in the Fraud & AML practice at Datos Insights. Join the conversation today!
More information related to these topics can be found by accessing the resources below:
Taking Action on Money Mules: Four Key Components to Building an Effective Program
Authorized Payment Fraud: A Global Guide to Customer Reimbursement Models for Financial Scams
