Fraudsters new targets:
- the fraud tariff: credit card data $3, online identity $200

Technology isn’t just making things easier for banking customers. It’s also transforming the opportunities for fraudsters. Andrew Stone talks to one bank’s leading crime fighter.

In the war between the banks and those who seek to defraud them, the banks are winning some notable victories, not least on the transaction fraud front. But Jason Costain, Head of Fraud at the Clydesdale and Yorkshire banks (part of the National Australia Bank Group), is not resting easy.

“We’ve reduced our transaction fraud losses by half, and have seen our losses falling at twice the industry average. While we feel we’ve got a good grip of it, these threats are always dynamic. Internet banking fraud is an area we have to watch, along with all banks.”

Fraudsters are increasingly targeting genuine customers and stealing their identities to conduct their fraud, says Costain. “The rise of social networking increases the vulnerability to phishing. It makes fraudsters’ jobs quite easy and ours more difficult. After all, why go to the bother of creating a new identity when you can get someone to tell you theirs?”

A measure of just how much the fraudsters have refocused their attention comes from intelligence gathered by the agencies combating serious organised crime, he says. “From information we are getting from them, the market for stolen identities is now far more profitable than the market for stolen card data. It has almost overtaken card fraud as a potentially lucrative means of fraud. Where card details were changing hands for US$40 a time on the black market a few years ago, now they are fetching two to three dollars while customer identities are being traded for as much as US$200 online.”

As fraudsters move into this area, there’s a need to deploy ever more secure account protection systems and technologies, says Costain. “We’re looking more closely at identity management at the moment. Authenticating the customer in a virtual world is vital.”

The introduction by the industry of devices working with chip and pin technology that generate a unique password is a step in the right direction, he says. “It’s a pretty solid example of the way things are going and it could be expanded for use in other remote channels. While there are lots of other potential technologies out there, gradually the market is becoming clearer with a handful of solutions emerging.”

The industry is still some way from deploying an ideal system, however. “Presently we use a mix of technology and lots of bits of information about a customer only he or she would know,” he says. “Ultimately I think the ideal would be almost like an electronic ID – a federated identity – the notion that your identity is held in the cloud securely and whenever you go to access a service through a bank or government there’s some way of knowing the person applying is real and genuine. As an industry, we don’t have the answer yet, but we’re getting closer.

“A silver bullet would be technology you can use over the phone, which is still a big challenge for banking, as well as online and using devices like smartphones. We’re currently trialling knowledge-based authentication in which higher-risk transactions go through an authentication that involves more demanding questions from a list of a hundred. This kind of step-up authentication makes it difficult for fraudsters to answer but only takes a few seconds for authentic users and it has practical usage on the phone.”

Identity fraud is not Costain’s only area of concern. Bank customers also indulge in their own versions of fraud, particularly when it comes to borrowing money. According to the latest Experian figures, 96 per cent of mortgage fraud is committed by the first party by such tactics as declaring falsified income or by hiding adverse data.

New approaches to lending are needed, he says. “The future for banks is to rely far less on borrower-sourced documentation and a move towards checking information that is material to the credit decision independent of the borrower. We’ve always been a conservative lender with a good loan book and prudent lending remains paramount.”

This caution applies as much to commercial lending as to domestic customers, he says. “When we see losses emerge in commercial lending, it’s important we understand the reasons for them. The industry is working with the Council of Mortgage Lenders and the Solicitors Regulatory Authority to ensure we have a good view of the role of valuers and solicitors in the property space. It’s fair to say there have been some incidences where professional firms have had less adequate checks than they should.”

The challenges of meeting all these threats and risks is as great for NAB in the UK as it is for much larger rivals, and there’s a need to get results with a smaller team than others have, he says. “We’re a full service bank providing services to business and personal customers – from multi-million pound finance deals to the smallest accounts, using exciting channels like internet banking. It’s a big remit from a fraud perspective. We need to take as many decisions as a bigger bank but with fewer people. Luckily we have a talented and knowledgeable group of people here under one roof – we can make decisions quickly.”

CREDENTIALS: Jason Costain
Clydesdale and Yorkshire Banks 2009-present: Head of Fraud
Costain Risk Consulting 2008-2009: Director – Fraud & Risk Consultancy.
Barclaycard International 2006-7: Head of Centre, Barclaycard International’s largest contact centre, servicing nine European markets.
M&S Money 1998-2006: Multiple management roles culminating in overall responsibility for Fraud and Chargeback operations for the M&S Money Credit Card, Loans and Chargecard Portfolio.
NatWest Bank 1987-1998

Back to Special Report contents
Back to Magazine contents