Leveraging AI and Machine Learning to Help Banks and Customers Stay Fraud-Free
by Edwardcher Monreal, Principal Solutions Architect, HID
The digital age has brought convenience and enjoyment to virtually every aspect of our lives: online shopping for everything from motor vehicles to insurance, shares, shoes and takeaways. But as we know convenience comes with a downside: the ever-present spectre of fraud.
It’s a global scourge: one study of nearly 80,000 incidents from 88 countries suggests stolen credentials were used in 61 per cent of all attacks in 2021.
Phishing remains a key weapon for fraudsters. Malaysians have reportedly lost a total of RM302 million to online scams on Facebook and Instagram from 2021 to June 2023.
As crime evolves, so must the weapons and strategy to fight it. Strong customer authentication (SCA) based on secure mobile push notifications protected by biometrics could have prevented many of these fraudulent transactions from being completed.
However, banks that are serious about mitigating risks from phishing and identity theft can go one step further and prevent attacks before they can occur.
Harnessing AI to Protect Customer Assets
Banks must take an in-depth strategy and view authentication as part of a comprehensive risk management ecosystem that takes advantage of artificial intelligence (AI) and behavioural intelligence. Combined, these can identify threats and minimise exposure to defend their customer assets constantly and proactively, which includes safeguarding their online identity.
How precisely can that be achieved?
The principle applied is simple: Identify threats early, know your users and stop fraudulent payments before they occur.
This should be followed by a user-friendly yet secure authentication: if only legitimate users can access their accounts, imposters cannot cause any damage. This requires SCA regulatory requirements, which demand that customers confirm their identities through multi-factor authentication (MFA) using something only they know or have (like a fingerprint) while continuously managing their risk as they navigate and use digital banking services.
This seems straightforward enough, yet many financial institutions worldwide still rely on less secure authentication methods.
According to a study, the leading authentication method used by the institutions was an SMS sent to customers’ phones — in spite of the security risks that SMS authentication entails. More traditional authentication methods such as secret questions and answers, and email password resets are also still widely in use today.
A more secure and user-friendly way to protect logins and financial transactions is push authentication, one of the delivery channels that enable the use of a mobile phone to perform MFA.
“Push” authentication uses cryptographic techniques to link a specific device to its owner’s identity, making it impossible for attackers to impersonate someone without physical access to the device.
The push user experience is seamless and straightforward. When notifications appear on the users’ phones, they must simply swipe to validate the request by making a binary choice — “Approve” or “Decline” — rather than referencing and retyping an OTP received via SMS.
In fact, the most flexible push authentication solutions enable banks to go completely passwordless by enabling device biometric capabilities and eliminating the threat of compromised credentials.
Using AI to Study Behavioural Patterns
Data from customer devices, customer behaviour and customer payment history should also be leveraged and together with known behavioural patterns (good and malicious behaviour), it can help build a bank’s customer behavioural intelligence database to be utilised by machine learning and AI.
Every person’s behaviour is unique and applies to how we all interact with frequently visited websites or favourite mobile apps. Specific customer behavioural patterns also include how a user types, swipes and interacts with his or her devices.
The benefit of using behavioural intelligence in real-time relies on being able to determine the user’s intent to identify fraud. Proper risk management during the user’s digital journey leveraging this insight helps arm banks with the ability to prevent, predict and become more proactive against cyber threats.
Simple Authentication Won’t Protect Against Fraud and Scams
Solely relying on simple authentication solutions is no longer enough to protect against evolving scams. Early threat detection, knowing your users and transaction analysis collected over time, combined with push-based authentication, is the best approach in preventing fraud today.
The beloved satirist Terry Pratchett wrote that many crooks would be very wealthy if they only applied their lawbreaking skills to legitimate pursuits. Unfortunately, cybercriminals will always be part of the digital banking landscape, but the damage they cause does not have to be.
Effective fraud prevention technologies that optimise user experience enable organisations to be proactive about risk, not just to protect their customers but to also preserve the financial and reputational integrity of their business.
