Transcript
Speaker: I think sometimes people get a little bit lost in the weeds and the metrics and forget as they're striving to just hit that day -to -day quota of what they're supposed to do. It's hard to sometimes remember that why we got into this is to fight the bad guys and to help people.
Speaker: Have you ever wondered whose responsibility it is to prevent, detect, and respond to online scams that are threatening our financial and emotional security? In the next few episodes, we will talk about liability, responsibility, and ownership of mitigation points across the scam lifecycle, starting from proactive education to blocking of scam calls and messages to scam payment transactions and recovery attempts.
Speaker: Scam Rangers, a podcast about the human side of fraud and the people who are on a mission to protect us. I am your host, Ayere Figur Levine, and I'm passionate about driving awareness and solving this problem.
Speaker: Welcome to episode four of Scam Rangers. Today's Scam Ranger is someone I've known for a few years now and have had the pleasure of working with. She fights scams with knowledge and data and helps financial services organizations connect the dots better between trends and risks in the industry, technology solutions, and consumer perspective. Julie Conroy is the Head of Risk Insights and Advisory at Ita Novarica Group. Prior to Ita Novarica,
Speaker: Julie spent a number of years leading the product management team at early warning services. And prior to that, was in product and process management roles at a large credit card issuer, as well as an ACH wire and swift processor. Julie is also on the board of advisors at the Noble, a network of financial crime experts passionately fighting human crime, such as human trafficking, child abuse, elder exploitation, and scams.
Speaker: So great to have you as a guest on the podcast, Julie. Welcome. Thanks so much for having me. So as part of your work, you and your team have done some research about online scams and the perspectives of both financial institutions as well as consumers. Before we jump into that, I wanted to ask if you can tell me a little about yourself and how you're involved in this world of financial scams and financial crime.
Speaker: Yeah, so I'm kind of the ultimate payments and fraud geek. As you could tell from my bio, I've spent my entire career there. One of my early mentors told me to always look for opportunities to
Speaker: do well by doing good. And that was some of the best advice I ever got. And so, you know, it means a lot if you can wake up in the morning and know that you're doing work that helps make our world a better place. Absolutely. So what is a day in your life and the work that you do around scams?
Speaker: I am fortunate to spend a lot of time talking to the folks that are on the front lines, be it at banks or credit unions or FinTechs or merchants to understand what their challenges are and how they are leveraging technology process, everything from people to technology to help make a difference.
Speaker: and to help fight the bad guys while also not making horrible customer experiences. My team and I, that's kind of the day in our life. And then we spent a lot of time writing about what we're learning in that regard. Tell me a little bit about the novel and your role in the novel and the board of advisors.
Speaker: Yeah, so The Noble was founded by my friend Ian Mitchell going on four years ago at this point. And it's really all about the fact that we have this amazing collection of financial crime fighters that are out there
Speaker: Fighting the good fight, I think sometimes people get a little bit lost in the weeds and the metrics and forget as they're striving to just hit that day -to -day quota of what they're supposed to do. It's hard to sometimes remember that why we got into this is to fight the bad guys and to help people. The noble is really to mobilize this amazing network of people that we have and find better ways to
Speaker: better ways to cut through some of the obstacles to doing this all more effectively. It's a nonprofit that was started by business folks. But one of the things I love is it's very action oriented. And so it's a lot of work streams that are sprints, but action oriented sprints so that we can see some meaningful outcomes. And we've seen a number of those. So how have you seen the community come together to tackle this problem?
Speaker: So the Noble now has more than 5 ,000 financial crime participants that are participating in these sprints. A great example of some of the action -oriented outcomes is a human trafficking work stream that was stood up around the last Super Bowl in 2022. These sorts of massive sports events are massive opportunities for folks like human traffickers.
Speaker: They brought together 30 financial institutions and as a result of the collaboration around that event, there were over a hundred referrals to law enforcement and a number of arrests and also a number of victims saved as a result of that coordinated effort. So that's just a small example of the art of the possible, if we can do more around collaboration in this space.
Speaker: and have definitely seen the organization raising awareness. And I think there is a plan to do the same at this Super Bowl. Yes, yep. So I'm sure that online scams is a hot topic with financial institutions. And how do they grasp their responsibility for handling scam complaints? I know this is a kind of a topic of conversation with reimbursement, et cetera, but how do they grasp their responsibility to make good with people who are scammed?
Speaker: You know, it's a good question. Scams has probably been our number one inquiry topic from our financial institution clients over the past 12 to 18 months. It's been a very active topic in the UK for many years. And what starts in the UK doesn't stop in the UK. It's spreading globally, very actively.
Speaker: There's lots of points of consideration for financial institutions and so it's the desire to protect their clients from themselves in many cases.
Speaker: the desire to make sure that they're still providing good customer experiences, the concern over potential shift in liability. And so as a result of all of the uptick in scam activity, the regulatory scrutiny, you know, we've seen a lot of financial institutions reexamining what their reimbursement policies are.
Speaker: for scams. There's a couple such as Chase that have come up publicly and said that if it's a bank impersonation scam, they will reimburse for those. But there's also a flip side to those sorts of proclamations. And so another one of our bank clients actually had already made the decision to reimburse for bank impersonation scams before Chase made that public announcement.
Speaker: And very quickly, after they made that decision to switch their policy on that, they saw a very sharp uptick in first party fraud associated with bank impersonation scams. So there is no easy answer here because whatever move you take from a bank perspective, you're going to see a counter move.
Speaker: from either organized crime or opportunistic fraudsters. And there's the other challenge of just how far do you have to go to save a customer from themselves? Because in so many cases, I've talked to bankers that they've gotten the indications that this is a scam and they can't talk their customer out of making the transfer because the customer is already emotionally manipulated and dead set on sending the money to wherever it's going.
Speaker: Yeah, I've heard many examples of that, like the grandparent scam where a grandparent thinks their child is arrested and they want to transfer the money and don't tell me what to do, all the way to just regular impersonation scams where the bank is calling and they think they're already talking to the bank, so it's very confusing.
Speaker: It's a trust issue that is not, it's too late. It's often too late when someone is under that emotional impact of the scam to convince them otherwise. It's kind of holding on to reality in a way. Yeah.
Speaker: Well, and the other concerted shift we've seen banks trying to make is about education. And again, the UK is on the leading edge of this. They're getting much more
Speaker: kind of in your face with their education. It's not such a soft approach. As is often the case with things in the UK, the government is actually participating and helping with mass market education on this front. Unfortunately, in markets like North America, we probably won't see that level of government participation just based on the structure of our market. But we have seen a few institutions in the US specifically starting to get a bit more blunt
Speaker: about this problem. And I think that's really what needs to happen. But even with that, we did a consumer survey earlier in 2022, and we asked consumers the extent to which they felt like they had ever seen any sort of education about scans.
Speaker: And only 28 % of consumers thought that they had ever received anything educational from their primary financial institution about scams, which we know probably well over 90 % of financial institutions are doing something on this front. But that just indicates that it is absolutely not sinking in or resonating.
Speaker: Yeah, I think there's a gap there between what banks think they're doing and how it's being received by consumers. And we'll talk a little bit more about that in just a bit. Do you see a difference in the attitude of financial institutions towards how much they need to be out there in front of customers talking about risks?
Speaker: I see a lot of fun, interesting campaigns from, let's say, HSBC and Santander in the UK really being out there and innovating to find it engaging and be in front of their customers. Whereas in the US, it's more kind of lightweight. It's an email. It feels a little more check the box. I said it. Do you see a shift a little bit in the US happening towards getting more out there?
Speaker: I think we're early in that shift. And I do think it's reflective of the fact that the UK has been absolutely on the frontlines of the scampocalypse. They've been dealing with it much longer. Back in 2021, that was the first year that authorized push payment fraud, which is almost entirely scams.
Speaker: exceeded card -based fraud for the first time ever, which, I mean, that's a massive shift. We're not there yet in North America, and I hope it doesn't take us hitting that tipping point to do some more in -your -face type of education, because that would actually mean a massive
Speaker: amount of losses in terms of scams because we have a massive amount of losses in terms of card fraud. And as I said earlier, I think we are seeing a couple of institutions getting a bit more blunt in the US, especially when it comes to kind of in -line communications around cell transactions. Hopefully, that's just a starting point because I do think we need to
Speaker: emulate what we're seeing with folks like HSBC and not just get blunt, but get fun with it so that people pay attention to it. It's kind of like a few years ago when Delta was doing those kind of off the wall flight attendant educational videos that were completely quirky, but people paid attention to them versus tuning them out, which we all do on airplanes.
Speaker: That's the kind of stuff we need to do around scams so that people start listening and realize that they're being educated about this. I love that analogy. I think it's a brilliant one. Let's stay with the banks for one more minute. I wanted to ask you, based on research that you recently conducted, what are some trends that banks are seeing in the pervasiveness of social engineering payment scams?
Speaker: It's absolutely on the rise. So we actually have some research we conducted late in 2022, looking at the increases in social engineering payment scams, as well as BEC, business email compromise, which it's also a scam just targeting small to midsize businesses. 82 % of financial institutions that we surveyed said that they had seen increases year over year.
Speaker: 56 % of those said that the social engineering payment scams were up 10 % or more. And this is a survey we conduct every year. And we saw similar increases between 2021 and 2020. So that just really highlights the extent to which this is one of the criminals' favorite attack vectors at this point. Because again, you're going after the weakest link, which is the customer.
Speaker: Right. And they're successful. They're extremely, unfortunately, very, very successful. So what beyond the fraud losses, beyond the potential reimbursement, are the main pain points for financial institutions around online scams?
Speaker: The customer experience is one of them, both in terms of making sure that you're not impeding good payments. There are some detection routines that will flag something that might be indicative of a scam, but it's actually somebody's
Speaker: having contractors work in their house and they're sending 10 P2P payments to their various contractors. So it's a hard calculus. Most of the traditional fraud detection controls
Speaker: have been orchestrated around detecting unauthorized access to an account, not authorized access. And that's one of the things that makes scams so hard is it's the genuine customer that is willingly sending this money. The other aspect of it is once somebody does get duped and they send the money,
Speaker: then it's about, does the bank decide to reimburse them? Because they did willingly send this money. And that's one of the very tough questions. It's where the regulators get involved. It's also where you get customer experience complaints involved. So there was one bank client of ours that they're a midsize regional, and it was a husband and wife that got scammed by the same scam.
Speaker: in the same week. The husband was doing business with a very large multinational bank. This bank detected the scam, stopped the payment, didn't send it. Our clients, the midsize regional, did not detect it, sent the payment, and then didn't reimburse. And that, as you might imagine, then led to this escalation to the CEO's office. So it's just such a complex calculus about how you handle all of this.
Speaker: I'm sure that that set a lot of alarms off in a smaller bank where they had to rethink their
Speaker: their controls and reaction if they want to stay competitive, right? We'll talk about consumer perspective of reimbursement in a bit, but I also wanted to ask about other pain points. For example, is there brand concern? Are there concerns about volume of reporting and scam cases that they need to investigate, operational overhead? Are those pain points that you hear about as well?
Speaker: You know, it's not quite there yet. And that's really reflective of some of the nascent state of the controls for scams. Traditional fraud controls are all about detecting unauthorized behavior. And so while there are some really encouraging solutions that are out there to detect the authorized and detect the intent behind the transaction, which is super hard.
Speaker: The control ecosystem is not yet at a point where I see that it's having an operational impact because, again, it's so hard to flag so much of this stuff. I think that will come. I think one of the members of my team, Trice Fiché, has kind of likened where we are with scams to where we were back in 2010 with ATO, when we started seeing the fully industrialized account takeover account attacks.
Speaker: We had a fairly immature control ecosystem back in 2010, but we saw lots of innovative solution providers very quickly come to the table with solutions. We now have a immensely robust solution ecosystem for ATO. We're kind of in that place with scams right now.
Speaker: So let's change perspective to talk about the scam victims and consumers. And Aita Novarika recently conducted research about this topic from the consumer side. So what do you think are some gaps between how consumers see the bank's responsibility and accountability and the consumer's perspective?
Speaker: It kind of emphasizes why it's so hard to be a fraud executive at a bank because consumers are a bit unforgiving of all of this stuff. And yet, in some cases, take very little responsibility for their own actions.
Speaker: They know that ultimately for most of the unauthorized activity, either the bank or the merchant has their back by regulation or by preservation of the relationship or both. We asked a couple of questions and one of them was, if you do fall prey to a scam and your bank doesn't reimburse you, how likely will you be to change that banking relationship?
Speaker: And across all three of those countries, again, the majority of consumers said that that would be a deal breaker for them and they would leave that bank.
Speaker: This I think is something that financial institutions need to pay attention to because it's tricky, right? From one perspective, you have the whole liability issue and regulatory and there are pressures and in the UK right now, there is regulation coming out to mandate banks to reimburse 100%. It's in draft right now, but it's coming out soon.
Speaker: In the US, there have been conversations in the Senate, and banks are trying to take some responsibility and show regulators that they're doing the right thing. But I'm also hearing a lot of voices saying, how can we take responsibility for actions of our customers, although we're educating them, we're telling them,
Speaker: At the end of the day, how far can we go to take responsibility for our customers' actions if they can't protect themselves? And I think this is a big dilemma. It's not straightforward to say, well, you got the money, it's your fault, but also banks do have visibility into a lot of this data, a lot of transactions and the technology to analyze the data.
Speaker: It's important to keep in mind though, that the customer perspective is if the bank doesn't protect me, I'm not going to stay. This is at the end of the day, an issue of trust.
Speaker: It is, and you've hit on such an important point with that trust issue. The bank's reputation is having the trust and the fiduciary responsibility. From a regulatory perspective, from a bank perspective, it's a really tough dilemma because I think if you
Speaker: go too far from a regulatory perspective, then what you're going to start seeing is that the banks are going to start dialing back on services. Some of the things that are super convenient to some consumers, but for some of your underserved population, it's actually monetary lifeline. If you're a gig worker and you're getting paid real time on the same day,
Speaker: That's super important. And if some of those services go away, that's going to have impact on some of those underserved populations. So it's a really tough problem that we're facing here.
Speaker: Yeah, you mentioned the contractors, for example, and paying with Zelle on the same day. And this is, this complicates the whole things and going back light years in, in banking and payments and definitely something that none of us want. What do you think we can take from the credit card industry? You know, we, we had a lot of first party fraud there when they started to take liability and reimburse customers for, for transactions. What do you think we can learn from that or we could take from that?
Speaker: One of the things that springs to mind is what's going on right now with first party fraud and credit card is you do have a liability shift that's coming up in a few months so that if merchants can show compelling evidence that this is first party fraud, that they're showing a history of the same IP address, the same device, et cetera, et cetera, the liability goes back to the bank and ultimately down to the consumer.
Speaker: the bank will pass it down to the consumer. The data sharing piece of that is immensely powerful.
Speaker: We are not even close to doing that on anything that is not card reels at this point, because we just don't have the network. We don't have the infrastructure. But that's sort of a collaborative and consortium -based approach to understanding behavior and intent, as well as a consortium -based approach to fraudulent data.
Speaker: That could be super helpful. And I come from a consortium and collaborative background. So I'm always biased towards those solutions. But I think that would be amazing. But unfortunately, we're a long, long way from making that reality. So that leads me perfectly into my next question. So what needs to be done to create real change? And I think that what I'm seeing, again,
Speaker: We bring up the UK all the time, but it was really great to see alongside with the regulation that or the draft that they put out. At the same day, they also had a tech scrum with leading financial institutions and regulatory bodies and vendors to think about ways where they can collaborate and create solutions and technology
Speaker: providing some use cases around scams and definitely data sharing came up as you mentioned. What do you think we could do globally or what needs to happen and who could even lead this to create real change?
Speaker: So the good news, bad news from the UK's perspective is that they are a little bit of a blueprint for the rest of us, because they've been dealing with this for so long. I think another bit of good news that came out of the UK last year was when they released their biannual Fraud the Facts report. And it showed that for the first time since they started tracking APP fraud, it came down. Not hugely, but it did come down. And they had a
Speaker: a page full of things that had been done over the past few years that they attributed some of this decrease to. Some of it was the introduction of confirmation of payee, which as I talked to the UK banks, that's still not great. It's very noisy. It's got a lot of false positives, but it's one further step. One of the other things was having a dedicated line that
Speaker: branch personnel can call when they think that they've got somebody that is sitting across from them or on the phone. That is the victim of a scam and it goes directly to law enforcement. There's a UK bank that I spoke with just a couple months ago that last year deployed an ensemble model looking at behavioral patterns as well as
Speaker: ingesting some inputs from point solutions. And with that model, they saw a 600 % increase in their scam detection rate. To the point you made earlier, having some just really creative and in -your -face sort of advertising about this that actually penetrates consumers, their awareness,
Speaker: And then over time, again, a bit more in the way of data sharing collaboration, that's the hardest bit of it all because you've got so many regulations that can impede that. But I think there's no silver bullet for this, but some combination of all of that will hopefully help put a dent in this.
Speaker: I think you mentioned a really important point or an interesting point about the regulation around data sharing and data privacy and all that. And I think we have seen, especially with the UK, breaking it out of
Speaker: the EU an approach of let's first get the right things done and definitely adhere to privacy and regulatory requirements, but let's not get it to a point where it's impeding protecting the people, right? At the end of the day, we want to protect their privacy, but we also want to protect their security. We want to protect their financials. We want to protect our economy.
Speaker: And we need to enable the data sharing to do that. And I'm wondering if you hear more conversations around that in the industry. I do. But unfortunately, that's the piece that I think is going to continue to move the slowest. There are conversations that actually the noble has been facilitating. They've got regulators at the table trying to help increase understanding of
Speaker: how regulation in some cases or many cases impedes effective financial crime detection. But that's the piece that I'm probably the least bullish on because there's a lot of education to be done. There's a lot of justifiable concerns on the other side of things about how data sharing can work against consumers. So it's
Speaker: Yeah, it's a piece, especially in a market like the US. I don't see that moving quickly anytime soon.
Speaker: And one of the challenges that I see is who is responsible for taking charge in this? It's definitely not the small nonprofit organizations that came out of ideology and passion. It's probably the governments, but then there's funding and politics and where does the money go? And it seems like financial institutions are very well positioned to take charge, but it's not really their responsibility. It's very tricky here. So who do you think can lead the charge in solving this problem?
Speaker: Ultimately, the responsibility lies with the consumer.
Speaker: It's personal responsibility, but there's a collective of people that have to be involved to help educate the consumer about the risks. One thing I would love to see in the North American market is the governments here getting more involved with the education. That is a massive gap. Unfortunately, it's a gap I don't see getting closed anytime soon. And if you look at the UK, who is having this public -private partnership of SCAM education,
Speaker: That's a great example of where government can make a huge impact. And this isn't the first time that we've seen something like this out of the UK. Back in 2007, when the UK moved to Chipcart, there was another very successful public -private partnership to educate people about what this thing called a chip is and what you do with it. And it went swimmingly. So that's where I would love to see government get more involved.
Speaker: I do think we'll probably see them get involved and weigh in on the regulatory front, as many governments across the globe are doing. I just hope they take a measured approach and don't get too draconian, because again, I think if you do get too draconian and prescriptive as you weighed into this, it's going to have a whole bunch of adverse consequences.
Speaker: And some banks announced already that they might need to roll back Zelle, for example, if reimbursement is expected and they're just going to stop being part of the network. And we definitely need to help them find ways to still offer these services, but also do what they need to do and protect their customers, protect themselves and liability.
Speaker: Yeah, and it was a coalition of smaller financial institutions that put that statement out, which again, you know, that again creates pockets of inequity because we've already seen that younger people are disproportionately banking with the large nationwide banks because, you know, generally they get
Speaker: you know, maybe more robust digital channel services. And if all of a sudden you roll back P2P capabilities for smaller banks, that puts them at a massive competitive disadvantage. Okay. So I wanted to end on a positive note. What are you hopeful about in all this? Some of the things like the fact that, you know, some of the modeling around behavior is working and it's helping with detection.
Speaker: That's super encouraging. If we can get more interactive with our customer education and make them actually realize that this isn't something that happens to somebody else, this can happen to anybody. Some of that could make a significant dent in this.
Speaker: And I also just kind of the innovation on the technology front. I think, again, going back to Trace's analogy that we're kind of where we were with ATO back in 2010. And now ATO is still an issue, but most of the institutions that I talk to feel like they have a pretty competent control framework to address ATO. So hopefully it doesn't take us 12 years to get there with scams.
Speaker: But there's a lot of innovation going on out there that makes me hopeful. That's great. Well, thank you so much, Julie, for joining today and for sharing these great insights from both the bank's perspective and consumer's perspective in the industry. My pleasure. Always good to speak with you. Thank you. Have a great day.
Speaker: In the next episode of Scam Rangers, we will dive a little more into both the banking and telco industries to get their perspective on responsibility and ownership of online scams, as well as regulatory aspects. Be sure to subscribe to the podcast, and if you want to keep current with the latest news on online scams, follow me on LinkedIn, yet at Bigger Levine. Have a wonderful week.
