Combating Fraud Attacks In Banking

0:02 You're listening to Leaders and Lending from Upstart, a podcast dedicated to helping consumer lenders grow their programs and improve their product offerings. Each week, here decision makers in the finance industry offer insights into the future of the lending industry, best practices around digital transformation, and more. Let's get into the show. Welcome to Leaders and Lending. I'm your host, Jeff Keltner. This week, I'm joined by Raksh mirage Car from Capital One and also from the CBA Fraud Committee. So we're going to talk about I'm not no bade and switching. We're talking about fraud and talking about fraud because I want to start. You know, you help lead the CBS Committee on Fraud. What's the topics that are top of mind for the committee this year? Imagine it's it's a pretty interesting time in the fraud space because there's so much turbulence in the market, overall interest times, fils a little thank you fund inviting thank you for joining us. So if I think a lot of the most prominent falcakes that could we have been discussing in the Fraud Committee. We have seen a very big resurgence of our So when we went into the pandemic. The banking industry saw substantial death infraduct to me, really, and that was because fraudusters were attracted by all the government funds that were available. Their whole focus was on PPPE, stimulus checks free and stimulus checks and anything, and then that money right up. And we always knew that they're going to come back at every financial the stations, and they did, and it was very The pace at which they came back was insignificant. The other thing that happened during that transition

1:38 is as an industry, we went and adopted a lot of digital ways of contracting, so consumers were transacting more and more, not in person but digital, and that's always an area where frousters like because they're not going to be required to be in person. So those two things happened that they wanted to back and find a new avenue, and we had opened up and created a lot of features that are digitally available, and so it created a perfect environment for them to come. So we've seen a lot of fraud and lots of different ways. Just a heard thing that had happened along these waves. Imagine that everybody started to work from Homeziba started doing digital activity. Consumer data was more large scale, compromised across lots of different institutions. So now frosters have this amazing set of cleaned ristine data that they carried against the financial stations.

2:43 So we saw fraud at scale. We saw a lot of fought activity. They saw a lot of week en identities come through the rules. As an industry, not a lot of banks have very sophisticated defenses, so they were able to recognize it prevented. But it's a nuisance factor constantly getting targeted and attacked on lots of different ways, and I know some of the banks had to rearly up their game move from badge defenses to real time defenses and all those ignorant happen. We saw also activity that we considered as traditional fraud. Checks fraud were like the old school the old schools where me saw the check fraud because a lot of stolen mail and for us to picking up the check from the mail and then making a connossy and then trying to call that at scale. And then we saw obviously some interesting fraud in the digital space.

3:45 We opened up digital, consumer started adopting digital and yeah, so that's what the fraud isn't going to go because it's real time, it's instant, and we did see that. And then the last thing I would say, which I think you have hold a lot in the industry is emergence or scams. So as as the fraud community realized that banks have built really sophisticated signals and defenses, so instead of coming against and trying to find gaps, they still do that in the bank's architecture, they started going and compromising the customers.

4:26 So a lot of impersonation, yeah, the weaker, the weaker link in the chain, so to speak, and the social engineering. We saw a lot of that has come up and they preclanding to be either the banks, of government agencies or whatnot. And so scam is through the roof as as an industry. Are these like real shifts from what you were seeing pre pandemic when you said, it's kind of fascinating me that the fraud kind of dial there was easier money to cheat for and so you targets of opportunity, right, and then it comes back. But when it came back, are these like different trends and you were seeing before it looks similar to what was happening in twenty nineteen twenty eighteen. In terms of the kinds of fraud, they are most prevalent. I think the difference that we found was it's most automated ZACT scale. The piece of the fraud activity is tremendous. So what they're trying to do is open act scale thousands and vidions of accounts and financial institutions, and then as they open it, they wanted to try and make fud.

5:30 Yeah, they're trying to nink accounts, they're trying to move money. So the base at which this is moving has really on a One of the trends we noticed in our systems. I'm curious if you've seen this more broadly, is a slow kind of I'll call it almost probing, and then there's like, okay, we're trying little things, and then when we can figure out the playbook, like if I do this and then this and then this and then this and then this and this and this very specific to our institution, then all of a sudden, band there's like one hundred thousand people. It's like we found a little hole and we're a jam as much fraud through that hole as we can until that I think the expectations of it will be closed relatively rapidly. But it's like, oh, we find a little hole we got to then then all of a sudden, just like how are there a hundred thousand applications an hour from like des Moine? Like that doesn't it doesn't make any sense. And we see a lot of things to National CAFIC come so IP addresses that are not US based IPS or the glue outside and when the banks amize that and they are putting controls, they picked the switch to IP addresses studifferent locations. So yeah, the scale of sophistication has gone up. Yeah. The thing that surprised me most when we saw shifting of IP addresses was shifting to even residential network blocks where either were talking about you know, Comcast households and whatever in midwestern city and you went, oh my god, like that's not even like a big server IPEd block or something.

6:47 It's like, it's very very hard to distinguish those kind of IP addresses from normal ones. I agree, And then I think the interesting thing that was different from bad one was scans as a very different thing. We haven't seen the scale all the scams. What kind of scams are you seeing like, what's the typical tack look like in that space? Good question. So the new ones that we have started seeing is because online marketplaces I've explored, they tried to be pretend to be sellers. So more than one puppy scans or concert ticket scans. Did your tailor swift tickets over in the swifty shiites again, so you think that you're actually paying were to somebody legitimate that you will get this really nice cute puppy with all the pictures and everything is very clear, and you send three thousand dollars to somebody and Okay, it's no show.

7:42 Yeah, so that has definitely gone up. The concert tickets is the same thing. So there is that level of scams that's happening. And then the other one that we have seen is typically fraudsters take advantage of the fear if consumers have so not of scam that we see is taking advantage of the fear. So we see things such as government scams, so they pretend to be from IRS or someplace. If conversation goes as, hey, you haven't paid access and we're sending FPI, it's going to be at your door in two hours, but you have a were like, you can actually send money right now, I can take care and prevent from happening. And it's really trying to pay the dynamics of whatever is the social situation in any residence that, oh my god, my spouse forgot to find the axes. I don't want the cops to come over and let me go ahead and make this payment, and they take advantage of that. We had a really good conversation yesterday around they're targeting vulnerable customers, particularly in the adult population, and there are lots of different variations of that that happens as well. Grandparent scamps is a classic one. So they pretend to be your grandkids calling in saying that they're in trouble and couldn't send some money to get him out of the tuble.

9:13 Yeah, yeah, um. And we have seen versions of I was actually visiting this country and they have arrested me for something, and here's a parent and taking oh my god, my parents something silly and there's a parents. Yeah, it was just something about that, and they have with send money and the money's gone. That's interesting, you know, it's this fascinating question to me. When the scams shift to the consumer, is the target, because there's kind of question of like how responsible is the bank ultimately like attack credentials or these are often like real customers doing real activities and you're saying, well, you want me to not do what you say with your money, and yeah, you don't. You want to be made whole when you're cheating a scam like this, and you know, there's I think consumers if we had a guest on recently who was talking about how they educated their consumers about some fraud and scam attacks because we were walking into the bridge, this is what you told me about the scammers on the fund right now trying to give my money in the bank. Was very proud they've done that. But do you see a role for government or other institutions to help on the consumer education side. It doesn't feel like it's entirely the responsibility of the banks to educate consumers end up help prevent on that attack factor because it's not in some real way attacking the bank. It's a very different kind of thing, and it's such a great question. We should all work as a community to help out within us. The banks definitely need to play a role, and I'll talk about that developments can't very huge role here, so they have clustered, they have fun they can reach moscare consumers in affective area and it's not about one

10:48 bank doing it, it's about the entire community getting ready for that. We have seen some really effective campaigns, particularly in the European countries. The good news is we have seen a lot more awareness and interest on moment. Agency particularly CFPP has shown keen interest in how they can leaning and how and they have budget as well, so we hope that they actually go in the direction of usually effectively effectively if I look on them. Education banks can play a lot of all two because consumers trust their banks. So we have been doing a bunch of campaigning and consumer education both in person in branches and for Capital and its cafes like also emails and reaching consumers where they are and telling them about common schemes and what to watch out for. And we see the huge impact of those campaigns. The other thing that I feel is important for banks to do is just like you're trying to spot fraud even if your consumer is making a transaction and you can recognize that in the moment, can you tell the consumers that watch out for these camps and the information right there and that has been extremely effective. Interesting, he wants a tuning the transaction and then they pause and then you pick on it and then you read about, oh my god, that's exactly what's happening to me. Maybe I should call my grandson before I send the money to get him out of prison and see if

12:18 maybe no, Mom, I'm home, no problems exactly, that's that's so what a helpful figure it back way. And then of course law enforcement can play usual as well. Um, some of these fraud and scam activity is happening internationally. Yeah, and while it's coming from international and they're partnering with the law enforcement in those respective comparty setting planning to break that cost for that world. But interesting, have you seen anybody I imagine the answer this is no, But it comes up like I know, and in many companies you get the IT security department sending seemingly like sending the fake scam, and then when you click how it, they go just so you know, yeah, like you failed the test and then we got at I've always enjoyed because there's a little button in our system where I could see, like I think this one spam and that they send you the target test and you get it.

13:13 They're like you will, Okay, I call it. You can't fool me with this one, guys. But I don't know if it's gone to that kind of shaking attacks on their consumer. It maybe too much for the consumer. But that maybe I don't know, that maybe going a little too beyond. But um, yes'm I also get design from d r T security. Yeah, but I think it is more about the education and how you can engage with the consumer months. Um, So me do a bunch of campaigns in our cafes, um and then we also plot every National Council of Aging for creating some virtue and workshops. But chicken in the oulderly populations and they understand how they can be impouting them to use tissue technologies. The other thing that we have observed we keep looking at what kind of frauds are coming up, But this tech support scam is a big thing. What is that?

14:09 So consumers when they're on their computers, they suddenly get or they can get a phone call or an email, but they say they give message saying hey we detected virus on a computer. Some things around happening. This is Amazon all officially what the tech company is callers, and then the consumer calls. Of course they're talking to the camera, and then the camera says pretends to be doing a service for them and say that I need to get into you ntin it? Oh god. So they give live access remote access of their computer, so a gains. All the frausters are coming in and they're putting all these kind of fake analytics on their computer saying, hey, we detected thousands of virus, and then they show a ticker as if it's cleaning up those virus. At this point, the emails a completely beaming that oh my god, that was in a bad shave tank. God, this listener is helping me. And then now they have anymore access and they get into a mansion organization. Stop thinking confection, Oh now it's I mean, I just spent a lot of time with my kids. If I'm like when you get an email, like if I get a call from American Express, when I get an email from MX or Capital wants, hey, you've got to confront of your card. What do you do? You think I do this?

15:24 You call the number in the back of the car. You don't, yo, who respond to the email. You don't call the number of the email. You pick up your card and go call on this number. So just trying to teach the basics. I loved your point about the real time intervention for scams when you can like help someone in the momentum who's maybe about to complete the transaction to a scammer, and you say, hey, have you thought about this or have you is this what's happening? Um? The thing that occurs to me is that kind of real time identifying of that and reacting to it requires quite a bit of both data and the intelligence in terms of real time systems, an analysis to see it in real time, and then the data to actually be able to analyze that and look at it. There's a lot of bit investment in that, and I'm curious how you think about the investments that are being made and the technology shifting and where the priorities are, because it's like that's a very sophisticated thing to be able to do.

16:14 But if you said, hey, we do a batch process every night, so tomorrow morning, I'm going to tell fifty people that I felt victim to a scam, But it doesn't help me in the moment, how or how do you see people investing. What are the recommendations you have for how you invest the technology to allow you to move to kind of like that real time nature, because that's not that's pretty sophisticated. Batch is completely old school avality. It shouldn't think about that. When the world has more prio time, payments have more PRIOD time, you have been closed and each media, and it's important to even internalize what careod time really means because for some people earlier time could be that pretty second and for some people to be affuming itself and in the world of prid time, you and seconds matter. Yeah. Oh, I was talking to a coodique from one of the banks and they were having some fraud issue and I was asking them, but don't you have defenses that are in your time? And her response was as reach you. But by the time this thing happens and we get it into our defenses, there's a sifteen minute gap and then that's a real time in It is a too long a time for frances to take advantaitore. Yeah, I think the way we want to think about this is just as the technology and data has exploded, you can take advantage of that because you get access to thousands of features and variables on any given transaction that consumers are trying to do. And if you're creating your systems that can listen and consume those signals in real time,

17:48 use them, consume them, create analytics, create models, and then credit that is this really something that your consumers are trying to do or is it somebody else? The power of that real time detection can be tremend us. A lot of technology changes are happening. We can now consume large sets of data and the big seconds micro seconds. The computing power has increased, so we can crunch the data into your time like I hear it wasn't possible a few years ago, and the morning techniques having drammatically gbms and others, it can be very surgical. I always get into this conversation. Also, we have fraud colleagues from the banks that there is tremendous pressure on cost efficiencies and things doing bad. But if you think about what you're doing with fraud risk controls, aid's the right thing to do. You're preventing acting the consumers is a bottom line impact. You're preventing bank against our losses, But the real impact is what you can enable on the other side with their business. Meaning, so if your fraud controls are tremendous, you can enable a lot more things for consumers to do. You can now allow and open up your time activity. It's why a clouds actions can do everything sitting in the living room a small device in their hat. The only reason we don't allow them to do as much is because we fear that we won't have fraud. The other

19:21 thing I'd love to get your take on is I think when you move to the kind of model based world versus kind of an old school rules based approach, you end up with this kind of layering of defenses, which is like, I don't have to be a one hundred percent sure and the real times I wanted to be the guy got a bunch of signals, and each signals like pushes me a little bit. This looks more like fraud, a little bit more like fraud. And I don't have to say you can't complete the transaction, mister Cosmo. I'd like you to talk to an agent first, which I may do a little bit, or I need you to do a knowledge based authentication, or I need to get a text message, like there's all sorts of layering of what is the kind of friction I might put in the process. I don't have to be like one percent sure this is fraud, I'm stopping now, I'm this looks like a higher risk. What what level of friction or additional process can I layer in? And there might be multiple of those layers, So talking about how you design that, because I think that's so important to say, how do I go from yes, no, like this is or isn't fraud, I'm going to stop it or allow it to Like, how do I introduce a little friction to try and reduce the likelihood that the frauds are can complete a transaction as my risk perception increases.

20:22 So there are some transactions or signals that people think are Bay BAYPO signals if you can take a decision, yeah, just and clearly of the m customer and customer. Yeah, it's somewhere in the mind that when all this complexity comes in and for us, the way we want to think about this is we are in this together without consumers. So when you are in that kind of uncertain phase, how do you reach out and engage with the consumers to confirm Because there's one person who can always tell you if they are making the confection or not. It's consumers um. But then you have to create systems that you dejected to time. How can you reach the consumer serio time in the channels that they prefer, so that it's not just limited to one And then when they're responding, how do you consume that response and then let them continue with the transactions that I kind of do. So that system that requires such an often investment and thinking and design and cladique of messages for the consumers, all of that you have to think one. Yeah, I also love your point about thinking about the other sides. I feel like this when we approach this, it's always this kind of battle between how much can you make things instant and immediate? And of course you can do one hundred percent, it's really easy. You just have a lot of fraud and you can have you know, zero risk of fraud and everything be super painful. In the battle is like how far can I push the limit on instant and keep the frauds low at the same time. And I do think in the world

21:52 of digital you're in a world where like the instant actually is a pretty tremendous differentiator or at least requirement to be competitive in certain environments. So allowing the lack of sophistication on your froadside to prevent that is like that's becoming a large or larger liability. I think for banks not to be competitive on the consumer side, I totally agree on that one, and I think it's a share of response. It's not just banks job to do it. I think it's consumer's job to prevent and protect them as well, for sure, And it is a government's job to actually helpless designer solution or an environment that's going DC banks and consumers to welcome this thing together. So collectively, I think you can do it. The international countries have made tremendous focus on those events.

22:36 I go to India vacations and I see that in India's completely digital now and they have all created really sophisticated ways of banks and consumerusly acting and interact. Interesting. I do want to slide back to your comment on the shift to digital, because with a lot of what we talk about is digital influenced. But I'm curious what are the is more and more transaction are going digital, what are the trends and fraud are the investments you see people making that are related to the kind of like I think so many of particularly smaller community banks, maybe not Capital one, but are you know, have a little more just like in the lending space, we bring you in and check your ID and like feel pretty good when Jeff comes in with Jeff ID and jeff social security number. And there so many of the processes that are kind of the fraud mechicines are oriented around in person experiences and as you move digital, you got to find a new way to handle that. And I'm curious what you're seeing as the trends in that kind of shifting the fraud detection as we move and the prevention as we move pure digital, and so many of our transactions that used to be face to face mediated and it had very different mechanisms of protection that aren't available. I agree with you, but I would also say that digital it provides its own unique way of kind of slumming the identity of an individual. Your device has so many signals. If you're able to bind deer device to your consumers very very cry, then that is actually a tremendous way of detecting who is performing the transaction, not frosts are always trying to

24:07 emulate devices and see if they are care or not, but there is I actually think that in some regards, the transactions that happen digitally can be safe if a bank is able to consume all the information from those adigional transactions. And bigger banks have put a tremendous amount of investment to presume those real time. But even for smaller community banks, there are lots of players that are out there in a fit that can actually make it easy for them so they don't have to do it on their own. But there are so many cares, Like even in this conference, you're seeing that there are so many players out there reading solutions then the banks can plug into. Yeah, maybe the advice I would give to the smaller banks and listeners like one of the one of the flaws I is trying to when you digitize, I think of digitizing the current approaches and to your point, I think it's like you lose a few signals I get, but trying to replace those by uploading a driver's license and having a video call at the same time saying Hey, I'm trying to do the same thing in the digitally, It's like well, no, there are now unique signals that were not available to you before, and you should be you should be taking advantage of those and rebuilding your approach based on that.

25:22 Otherwise you can, like, I don't think they're trying to make it feel like you're in the branch on your photo idea is gonna it's gonna be the way to do it and not us. These technologies up getting on and more sophisticated. You should an indignation on the apples me. It's so many thanks, so much more fluent. Yeah, and as this technology jstaing Bulo is, you can wind did entitys and indivisio very clearly and enable that friction less in real time transaction capability. So last question for you, what's like for people out there listening go, hey, I see these problems to I said, what's your advice on how they prepare for the future investments that they should be focused on making to be in position to you know, actually defend most effectively against these kinds of things moving forward. Yeah, So I would say that it's a never ending makes it fun, makes it fun, but there is there's so much of advantage that you get when you get it right but don't rest on your moils. So you know at sart is always going to change. Now we have seen things such as chat, GPT and all these artificial intelligence tooths I'm going to come, so we will see a very different level of challenge. The moist recognition is going to be difficult. The almost late in old school, you would get a spoofed email. It will have typo errors and you would know that if least nabled person reads the email

26:56 out that I don't think this is a professional email. But big things like chat, GPT, that thing is going to feel more professional. Field war yea. The populated setting it so trends will keep changing and you almost have to be on front of that trand change and disappeared where it is going and start building your solutions right away. It's a race that's going to happen between the banks as well as between the front community on how do you left place the technology to be ahead of either. So there is no point in relaxing and saying, oh I did all this investment, I can relax north like them, you would constantly be on your toes, so I think for but take advantage of it. So there's a tremendous amount of capability that's coming to the banks as well. The second thing I would say is engage with your consumers. It's important to educate your consumers. It is important to take them into confidence. The more your consumers are digitally savvy and know what to watch out for, the better you would be. So it's an alienating important to do that. And as a consumer, I would say, just we have attension. It's your money. You need to take a look at it.

28:10 I always tell about thanks and family that look at your banking accounts, how much habit to look at them almost every other week, even if you're not using them. You don't know who else is your So just holding umber statements and see how how your transactions are because it's irresponsibility. If you find something bad are unexpected, you're the one who need to contact the backs and tell them, yeah, I've I've actually pushed myself and my family working more like real time alerts, like you know I find looking through my likes a credit card. It's a simple example. Looking through the statement once a month takes a lot of time. Getting real time alert saying hey you just bought something away. I know, no big deal. And real time much says you just bought something I did? Yeah? Uh quit Wait, so I'm accusially called my wife on I don't recognize this company for this charge this I'm not, I'm not. It's not a problem. It's okay to spend the money, Like, I just want to make sure that was you and not somebody else. But that real time nature, for me is makes it more digestible, right, more not so much as saying, hey, what all did we spend last month? Did they go to the gas station on the thirty first? Yeah, so you've been trying to do that as a consumer cognizant is important. And how about the community among banks? It feels like this is a bit of a collective problem and a collective sharing of information is Is there a good collaboration among peers to help like identify what's coming and see how we can all respond effectively. Yeah, is one. We have the banks collaborator pretty heavy as we are finding the same game against the bad people.

29:38 So we had all in it together, so we shared. Our best practice is connect to you, maybe go off there the fun stars hun good coming to you out here. And CBA is a very lidability community. So excellent. You share that plan and so what's happin how do we lene from each other um to look that we are doing as banks collect you on Zell and BNC conversations on fraud and stands on Zell has been tremendous. The performance dad has been amazing. Fund industry to FA levels. How tremendously come bound there. Now it's showing up in other nadias. I'll flout other B to B companies, but Verdio collaborate and you work together. I think you have named blond page or the bad case. Excellent. O gosh, thanks so much for joining me to this is a fascinating conversation. I appreciate your bag at the time. Thank you for inviting me. If that's fun. Upstart partners with banks and credit unions to help grow their consumer loan portfolios and deliver a modern all digital lending experiments. As the average consumer becomes more digitally savvy, it only makes sense that their bank does too. Upstarts AI lending platform uses sophisticated machine learning models to more accurately identify risk and approve more applicants than traditional credit models. With fraud rates near zero, Upstarts all digital experience reduces manual processing for banks and offers a simple and convenient experience for consumers. Whether you're looking to grow and enhance your existing personal and auto lending programs, or you're

31:12 just getting started, upstart can help. Upstart offers an end to end solution that can help you find more credit worthy borrowers within your risk profile. With all digital underwriting, onboarding, loan closing, and servicing, It's all possible with Upstart in your quarter. Learn more about finding new borrowers, enhancing your credit decisioning process, and growing your business by visiting upstart dot com Slash four dash banks. That's upstart dot com slash foward dash Banks. You've been listening to Leaders and Lending from Upstart, make sure you never miss an episode. Subscribe to Leaders in Lending in your favorite podcast player using Apple Podcasts. Leave us a quick rating by tapping the number of stars you think the show deserves.

31:55 Thanks for listening until next time.