Don't Miss the Online Channel: Combating Cross-Channel Fraud at the Root

By: Erwin Roberts Click author's name for more of his/her articles

The latest threat to online banking accounts and online fraud detection involves fraudsters using a multi-step scheme that involves various interaction points with financial institutions.
Cyber-criminals commit this cross-channel fraud by first breaching an account via the online channel to pilfer vital information such as account balances, check images, or signature blocks, in order to carry out wire, check and other types of offline swindles that never get associated to the original breach online.
Sadly, the online channel's role in these frauds is often ignored. This is specifically what makes this kind of fraud so successful - and difficult to catch. Financial institutions simply register the final transaction fraud, and do not account for the original encroachment, which often occurs in the online channel. Add this to the detail that consumers don't know it is happening, and the fraudsters have a great opportunity to continuously get away with this scam.
Case in point is what occurred recently to a leading financial institution that serves tens of thousands of customers daily. Despite uncompromising efforts to protect its online environment, fraudsters carried out a startling cross-channel fraud scheme.
Here's how the fraud scheme took place:
1. The fraudster called the institution's customer service number and, by means of social engineering techniques, reset the online account password and contact phone number.
2. The fraudster entered the online account, learned more about the customer's online activities, and downloaded check images containing the customer's signature.
3. The fraudster then called on a separate institution using the stolen information to open a pristine account in the victim's name.
4. A wire transfer was arranged to empty the victimized account and credit the new account at bank #2. Because the names on the accounts were matching and the fraudster had provided a phone number under his/her control and a legitimate signature, an offline verification of the transfer by phone, as a supportive means of identification, passed and was authorized.
5. The fraudster withdrew his loot bit-by-bit, visiting separate branches in a state other than the victim's.
Legacy Fraud Detection Methods Blind to Online Activity
When fraudsters use schemes involving multiple interactions with different touch-points across an organization, they aren't caught for the reason that the precursor online channel violation is often overlooked.
Common industry practice registers the conclusive fraud transaction as the breach point, and case forensics employ partial resources to return insight that cannot discover the original breach to the online channel. When accessed only for investigation, the online channel records no "transaction" for detection. This is precisely what makes cross-channel fraud so successful - and so hard to catch. Moreover, as what kind of fraud is our preceding example to be logged. Is such a loss wire fraud, check fraud, or simply "online account fraud"?
A next-generation approach to online fraud detection and prevention is needed if we are to continue to inspire customer confidence in online banking security. According to Javelin Research's 2007 Identity Fraud Survey Report, it is an average of 60 days for consumers to even detect that fraud has occurred. This leaves fraudsters with a insidious opportunity to execute successful cross-channel fraud crimes if financial services providers don't take preventative steps to protect both their customers and their bottom line. New best practices and back-end technologies that focus on online behavior can better isolate and prevent cross-channel fraud at the source.
Modeling Individual Account Behavior Ends Fraud at Its Source
An emergent best practice of online fraud prevention is to employ predictive models of individual customer online conduct to detect when the "customer" logging in isn't who they say they are, even if they pass authentication. Beyond straightforward machine signature technology, user profiling technologies depend on trended analysis of behavior account by account. They start by being aware of what "normal" behavior is for each individual customer - and admit that there is no single pattern of "normal" behavior to write an anti-fraud rule against.
Dynamic, model-based analysis of account activity "does the math" - correlating what by themselves may seem like weak indicators of fraud until a unmistakable pattern emerges of online fraud detection. Behavior that deviates from what is expected becomes suspicious - the more the deviation, the more profound the suspicion. This comprehensive analysis allows for more granular risk scoring and better connection with offline activity patterns. A byproduct of this behavioral analysis through transaction monitoring software, also provides a rich history of online activity that aids case management and forensics.
Using these techniques, companies can identify the fraudster via the flags to online activity outside the customer's predicted behavior. Deploying strong analytics at the source - the online channel - ensures that fraudsters' assaults are shut down before any damage is done.

Article Source: ABC Article Directory

About The Author: Erwin Roberts is a online banking security enthusiast who writes on the online banking security topics. Guardian Analytics is the technology leader in the fraud detection and prevention of online accounts. They provide real-time risk management solutions that protect online channels. Guardian Analytics offers an risk analytics software solution that addresses the entire risk management lifecycle. www.guardiananalytics.com/products/online_fraud_challenge.php