In less than a decade, paying for things with a phone or transferring money to a digital wallet has become part of daily life for millions of people. Fingerprints, facial recognition and aliases are often used to authorise these payments, allowing consumers to speed through checkouts or quickly send money to loved ones around the world. But as well as offering people better financial experiences, today’s digital world also creates new opportunities for fraudsters.
“Access to digital payments has increased and there are a lot of major players aiming to make money movement very fast,” Sue Onians, vice president of Visa Direct Ecosystem and Risk. “That combined with the fact that the fraudsters are coming up with increasingly sophisticated schemes has contributed to an ever-changing payments landscape.”
The pandemic accelerated many of these changes. With everyone stuck at home, the volume of remote financial activity hugely increased. In turn, criminals ramped up scams targeting people online. Many rely on harvesting personal and financial details and feeding them into phishing emails or smishing text messages that impersonate those from trusted organisations.
“Fraudsters are reaching out to people in a more intelligent way through social media channels and mobile communications,” says Onians. “Clever use of images and graphics can lead the individual to believe that it’s a legitimate message from, for example, their bank. And that unfortunately can lead to increased fraud.”
What’s the difference between unauthorised and authorised fraud?
Unauthorised fraud occurs when money is taken without approval, for example when a device is hacked and security details are obtained and used to make a transaction. In this scenario, the victim didn’t make or authorise the payment themselves.
Authorised fraud occurs when the customer is tricked into authorising the transaction by the criminal. An example of one such scam would be a criminal posing as someone to whom an individual owes money and convincing them to send a payment.
This impacts merchants and financial institutions as much as their customers. Even when a customer’s money is refunded, they may no longer trust that the merchant or financial institution will protect them in future, ultimately resulting in customer attrition and loss of business. The increased regulatory scrutiny that often goes hand-in-hand with fraud can also act as a brake on innovation.
Who’s really calling?
According to UK Finance’s latest annual fraud report, over £1.2bn was stolen from companies operating in or from the UK through authorised and unauthorised fraud in 2022 – equivalent to more than £2,300 every minute. The report also notes that 78% of reported authorised push payment fraud cases started online and 18% of reported case started via telecommunications in the second half of 2022.
Fraudsters generally try to create messages that will appeal to people’s emotions and create a sense of urgency. “One that we’ve recently come across is where the fraudster acts as the child and insinuates that their phone is lost or broken and they need money to replace or fix it,” says Onians. Once the fraudster has drawn the victim in, they either share an image of a payment card or bank account details and ask for the necessary funds to be transferred. By the time the parent realises they’ve been scammed, the money is gone.
Recognising signs of a scam
Most countries have regulations in place to protect people if their account is broken into and their money stolen. Visa, meanwhile, has a Zero Liability policy that guarantees consumers won’t be held responsible for any unauthorised payments made with their Visa card or card details. But getting money back is more complicated for consumers who fall victim to authorised fraud schemes such as romance fraud or crypto scams.
There is therefore a huge effort across the financial industry to warn the public of the dangers of such scams. Visa, for example, invests significantly in educating consumers on how to avoid authorised fraud.
“It comes back to those key pieces of advice – to be aware, to ask questions, be inquisitive, be curious,” says Onians. She also recommends that everyone closely monitors their account transactions so that they can quickly report any suspicious activity. “In our world, the faster a report of fraud comes in, the more likely it is that there will be a positive result.”
In 2022 alone, Visa helped to prevent an estimated $27bn (£21bn) in fraud. Visa’s regional teams help clients understand new and upcoming fraud and regulatory trends across the globe, which is increasingly vital in a world of real-time cross-border payments.
“We can see in terms of dispute rates and the outcomes of fraud where the challenges lie. And that helps guide our risk teams on where support is needed – even at a specific client level…[if] there are larger fraud issues that require additional support and input,” says Onians.
From October 2023, acquirers will also be mandated to report suspected authorised fraud to Visa, something Onians describes as a significant move. “When an acquirer and their merchant have detected an authorised push payment fraud, it will be reported through the Visa network. That will ultimately result in a report to the issuer… alerting them of push payment fraud and enabling them to potentially take action to deactivate accounts, track funds, etc.”
Simple pop-up messaging that asks consumers whether they truly want to carry out a payment is another means of combating authorised fraud. Velocity controls also limit how much a consumer can transfer from their account per day, week or month, which can stop fraudsters from stealing large amounts of people’s money in one fell swoop.
AI and machine learning tools, meanwhile, can transform the vast amounts of data that financial firms hold into efficient fraud prediction, detection and decision-making. “It supports a look back on transactional behaviours and patterns, and that drives then a decision-making flow that can help with the prevention of fraud,” says Onians. “The more information you put in, the more value you get out, which is a huge advantage with AI.”
Security from risk management tools
Visa provides its clients with a suite of tools and products that use preventative modelling techniques to score each transaction for potential risk of fraud and, if necessary, decline them. Clients can now enroll in Visa Advanced Authorisation and Visa Risk Manager – two products that, together, give issuers both fast, reliable risk scores to better inform authorisation decisions and tools for managing risk.
With money moving around the world with increasing speed, such tools can be essential to protect consumers from fraud and retain their trust. But it’s also vital that robust security measures don’t introduce unnecessary friction into transactions, which can frustrate consumers and undermine the speed and convenience offered by digital payments.
“The challenge will always be to balance fast money movement with a level of security that protects outgoing payments,” says Onians. But with support from Visa and other fraud experts, it’s one that the payments ecosystem can undoubtedly meet.
For more information, visit visa.co.uk
DISCLAIMER: Case studies, comparisons, statistics, research and recommendations are provided “AS IS” and intended for informational purposes only and should not be relied upon for operational, marketing, legal, technical, tax, financial or other advice. Visa neither makes any warranty or representation as to the completeness or accuracy of the information within this document, nor assumes any liability or responsibility that may result from reliance on such information. The Information contained herein is not intended as investment or legal advice, and readers are encouraged to seek the advice of a competent professional where such advice is required.
All studies, surveys, research, and materials owned or commissioned by Visa shall not be used, reproduced, copied, or recirculated without the prior written consent of Visa.
Visa Direct clients and participants should always consult and seek approval from their internal compliance teams on sanctions screening controls and processes, and are solely responsible for their own compliance with applicable laws and regulations. Optional compliance controls and risk management tools and services are provided solely for the convenience of the Visa Direct clients and participants, and Visa makes no warranties with respect to them or their results. Visa Direct clients and participants are solely responsible for their own compliance with applicable laws and regulations.
In less than a decade, paying for things with a phone or transferring money to a digital wallet has become part of daily life for millions of people. Fingerprints, facial recognition and aliases are often used to authorise these payments, allowing consumers to speed through checkouts or quickly send money to loved ones around the world. But as well as offering people better financial experiences, today’s digital world also creates new opportunities for fraudsters.
“Access to digital payments has increased and there are a lot of major players aiming to make money movement very fast,” Sue Onians, vice president of Visa Direct Ecosystem and Risk. “That combined with the fact that the fraudsters are coming up with increasingly sophisticated schemes has contributed to an ever-changing payments landscape.”
The pandemic accelerated many of these changes. With everyone stuck at home, the volume of remote financial activity hugely increased. In turn, criminals ramped up scams targeting people online. Many rely on harvesting personal and financial details and feeding them into phishing emails or smishing text messages that impersonate those from trusted organisations.
