Mitigating threats impeding real-time payments adoption

Bankers deal with an ever-increasing, constantly evolving threat of fraud on multiple fronts, and as they move into a real-time payments environment, instant payments fraud has become a concern. Whether through stolen credentials, money laundering, card testing and velocity attacks (where multiple authorizations are generated over a short period of time to test and exploit the validity of card information), banks and their customers are increasingly being targeted..Add to the list one of the fastest growing threats: account takeover (ATO) fraud, where fraudsters leverage social engineering to corrupt text messages or emails and then direct payments to the wrong party, or gain access to customer accounts by obtaining two-factor authentication (2FA) or one-time passwords.Fraudsters are becoming increasingly proficient and are now targeting banks through new methods like credential stuffing, where username and password combinations are purchased on the dark web and then tested across multiple sites, including digital banking login pages. The use of AI is now enabling fraudsters to accelerate the pace and scale of these attacks as they utilize modern generative AI models to learn what types of social engineering are most effective at any given time (known as hyper-personalized mining or spearfishing).Irreversibility of instant paymentsFueling the focus on instant payments fraud is the fact that these transactions are non-returnable. Once the transfer is approved, the funds are gone.Banks technically are under no obligation to reverse the transaction but increasingly find themselves pulled into these situations as their customers look for help. Unlike card transactions or ACH, which have historical models of chargebacks and returns, instant payments — so far at least — remain non-revocable.As banks continue to adopt real-time payment capabilities, it is imperative they work to ensure that fraud mitigation is built into the process from the start. Some key considerations and best practices include:• Better education of customers about the importance of security measures like 2FA and one-time passwords. Text message payment reminders are a convenient tool, but can also easily be spoofed. Bankers must help their customers recognize what constitutes a spoof and what does not, and reinforce the importance of never sharing their credentials with anyone.• Security and safety must be key components that are built into all payment experiences. Through tools like individual one-time passwords and push-emails to confirm the legitimacy of the request, bankers can better protect their customers.• Thoughtful vendor management includes partnering with technology providers that offer robust fraud and risk controls. Bankers should have control over rules and logic that support their limits and control criteria for specific accounts, including age of account rules, transaction limits and dollar amount thresholds.Success and the right strategyWhen considering their real-time payments strategy, bankers should begin by examining their entire customer lifecycle in order to effectively mitigate fraud. For each customer, this involves understanding information such as when and how they typically log in; what safety and security protocols they have in place; what their normal patterns of behavior are; and then leveraging this data to define and create appropriate pre- and post-transaction rules.AI and robust machine learning engines can be useful tools to monitor this type of data but require monitoring of the ongoing health of those engines to track what they are catching and not catching. Bankers are often forced to find the right balance between security and convenience, evaluating too few versus too many alerts, as they better define their health threshold (or ideally, different health thresholds by different types of fraud or attack vectors).As an example, banks will typically have a different account takeover threshold level for someone trying to brute force an account versus an approach like credential stuffing. Having different thresholds in place that can be continuously monitored and evolved as needed enables bankers to adapt as threats change.CollaborationIn this new threat environment, collaboration among technology providers and financial institutions themselves will be essential. By openly sharing information about bad actors and working together to refine technology and build more robust fraud prevention systems, the industry will be much better positioned to stay ahead of fraudsters. Regulatory agencies also will play an important role by establishing the necessary guidelines and regulations to ensure the safety and security of instant payments as market adoption grows. Amanda Licona-Crocker is president of SWIVEL, an SWBC Company specializing in integrated solutions.