- FST Media
Transcription
- FST Media
Fighting next generation fraud with visibility and data intelligence Top row (from left to right): Michael Douman, Head of Business & Clinical Analysis, BUPA; Jim McGugan, i2 Business Unit, IBM Global; Matthew Keaney, General Manager, Financial Crime Management, CBA; Matthew Tregoning, Regional Manager – Investigations, Westpac; Geoff Campbell, General Manager, Security Advisory & Investigations, CBA; Richard Collard, World Wide Business Development – Fraud, AML, Risk, IBM; Ross McKenzie, Head of Security Governance, Westpac; Trevor Fairall, Head of Financial Intelligence, Macquarie Bank; Nigel Phair, Director, Centre for Internet Safety. Bottom row (from left to right): Nagib Kassis, Head of IT & Business Alignment, Allianz; Erin Dogan, Chief Engineer, Network, IAG; Michelle James, Head of IT Risk & Operations, AMP; Jenny Lambert, General Manager, Claims Services, Operations, Allianz; Shane De Kauwe, APAC Business Executive, Financial Crime, Law Enforcement and Security, IBM; Tony Vitiello, ANZ Sales Lead, IBM. FST Media and IBM hosted an exclusive roundtable luncheon with Divisional Heads of Fraud, Risk and Security from Australia’s leading banks and insurance companies to discuss trends and emerging fraud, risk and security threats facing the industry. The discussion featured Nigel Phair, Director, Centre for Internet Safety, University of Canberra as guest speaker. Nigel Phair, Centre For Internet Safety: Exactly 10 years ago I was sitting down in Canberra at the Australian High Tech Crime Centre which Financial Services Technology Media where the market meets was part of the Australian Federal Police and we had a phone call that kicked off our first phishing investigation. It was a young guy living in Surry Hills. He was a Russian, and he was responsible for a pretty dodgy looking Commonwealth Bank website. We had never come across phishing before, we did not know what it was, or what was going to happen next. We worked with the New South Wales Police, went out to his house, seized computer equipment and arrested him. Unfortunately we lacked evidence to proceed with the matter. Fighting next generation fraud with visibility and data intelligence “[customers] are demanding more and more from whatever device or service they are provided.” – Geoff Campbell, CBA We were trying to get police interested in doing online investigations across the whole spectrum. We were often told, “Well, they are too hard to investigate... The people are overseas,” These days there is much richer data out there and we leave much more information about ourselves in the public domain. I would argue investigations should be getting easier for that reason, and there should be more of them. And that goes for organisations doing their own internal investigations. If I was a criminal, I would be looking at it from the other perspective. People put so much information about themselves in out there, that it is pretty easy to start guessing things like password resets, a mother’s maiden name, which school I went to, favourite pet’s name, all those password prompts are probably on my Facebook page if you looked close enough. It is that generational change where people are prepared to go to those sites and put all this information about them out there on the pretext that their friends will do exactly the same. It is really rich data both for investigators and criminals. Shane De Kauwe, IBM: “How is it that people volunteer all that personal information to Facebook…” – Nagib Kassis, Allianz 2 The Commonwealth Bank was the first to market in Australia with an application to allow Facebook users to transact. Obviously there is a commission and fee benefit to the Commonwealth Bank by capturing potentially new customers, especially young. The fact is there is just so much information out there and identity theft so easy. But there is a flip side. For instance one of our security guys is also looking at it as a source of authentication. Your photos on Facebook for instance, they are all tagged, they have got names. If you are able to pull that data out and authenticate someone, you could pull up three photos and say ‘Pick your friend.’ There is a whole new set of risks but there is also a whole new way of doing business. Geoff Campbell, CBA: The only challenge with that is the customers themselves. They are demanding more and more from whatever device or service they are provided. They do not want these additional ‘click on this’ questions. They just want to get on with what they are doing, and they expect the service provider to deliver the security in the background. Jim McGugan, IBM Global: Well, it is interesting, because we have been quite excited by facial recognition, which is the state of the art. It has advanced by leaps and bounds in recent years, and it works pretty well now. Unlike biometrics there is not the same consumer resistance. How many bank customers are really prepared to come in and have their fingerprints taken or have their retinas scanned? That is not going to happen. But facial recognition is something that you can essentially capture more passively. So for instance at an ATM you could take 10 images from 10 successive uses of someone’s ATM card – and then you could have their face really well characterised. If on the 50th use you see a face that does not look like the registered face and you can raise an alarm. To Geoff’s point, that is very non-invasive, you are not asking additional questions or introducing a whole bunch of additional rigmarole. But it adds to security. Shane De Kauwe, IBM: With a bank that we are working with in Singapore – and hopefully we are going to start with some financial institutions in Australia – we will be able to provide one to one facial recognition linked to a credit card or a Facebook account, that is almost instantaneous. We are working with this particular bank, and our software allows us to take 10 images of someone using an ATM. As those images are taken it is makes a composite view of that one to one facial recognition relationship. If someone other than the card holder uses the card in the ATM – for instance in a skimming operation – this systems would reject it. Or you could have a business process that sends the customer a text so they can authenticate themselves. It depends on the bank. It ultimately has to be customer opt-in or optout. You also need to remember from an IBM perspective and from an Asia Pacific view, that not all countries have the protections that we do. Basically a credit card fraud in Australia, has $50 liability for the consumer depending on the terms and conditions of the card. Whereas some countries, if someone empties your bank account – you are the victim – that is it. So I would be interested in a discussion around the safeguards that this new generation would be happy with? Would they actually think that using a photo of themselves to authenticate a transaction is okay. Many customers probably would be fine because of the gizmo effect of it. I am pretty sure most of you have no idea that we had a facial recognition product that you could attach to Facebook, or could work on a credit card to reduce skimming. I guess that leads to another question. Is technology moving too fast to catch up? Is it happening too quickly? Nagib Kassis, Allianz: I could say it is probably in the execution. So if you take Facebook as an example, how is it that people volunteer all that personal information to Facebook, and some of it is quite personal. After all if you were asked by someone off the street to provide all that information you would say no, because you do not know what that company is going to do with the information. Facebook’s success really relies on the fact that it tells you what they know about you. When an individual knows and can see what a company Fighting next generation fraud with visibility and data intelligence knows about them, they are more inclined to voluntarily provide that information. There is also a question about whether someone would be comfortable with their photograph being taken and used as an authentication mechanism through facial recognition. If they are told that that is how the information is being used, and it is for their own benefit, then they will probably be more inclined to participate. You need to tell people what you know about them. If bank’s were a bit more forthcoming for example about what information they know about an individual, then people would probably be more comfortable because you are volunteering that this is the information we know about you. There is that element of distrust, and Facebook provides all that feedback directly to its users. This is all we know about you, this is what we think you would like. In some countries Facebook users are already using facial recognition to do their own authentication, but they are using the recognition software that Facebook has provided to identify friends. It is already in trial, and people are participating actively so that Facebook can further enhance the algorithms that are working in the background. It is social participation and it is voluntary participation if you like. Jim McGugan, IBM Global: I have to agree. I find the younger generation’s willingness to put everything out on Facebook or Twitter remarkable. In fact I had a fascinating conversation with a couple of insurance claims investigators who told me about investigating staged accidents, where two people purport to have run into each other and claim not to know each other. They told me that one of their best investigative tricks is to go on Facebook since everybody is made their friends network completely open. You discover their friends on Facebook, or that they are a friend of a friend on Facebook, and it just totally blows a hole in the claim. They said that this happens remarkably often. Jenny Lambert, Allianz: Yes, I can validate that. I mean, social media for us from a claims fraud point of view is an invaluable tool. Just in the last quarter I could list 30 claims where we have either reduced the payment or repudiated a claim as a result of social media. So we had a guy who had CAT scans of a spinal injury, while his Facebook page showed him doing commercial cleaning and surfing at the same time. Nagib Kassis, Allianz: Even the geo-coding of images has helped dramatically. For instance someone says this is a photo taken at point of incident but because they took it on their iPhone, from geocoding we know that it was taken round the corner from their house, as opposed to the location they claimed. So it does add value, without a doubt, but it does introduce risk. It is a matter of finding the balance around preventing leakage, but also increasing revenue retention, increasing acquisition and reducing acquisition costs. Technology definitely plays a vital role in that, but at the same time people will find ways to exploit that technology to their benefit. Matthew Tregoning, Westpac: Today’s generation will put everything out on Facebook, including their date of birth but on the other hand they are so mindful of authority and not telling anyone in authority their information. In that sense they are protective of their information. We do a lot of work with Facebook, it is so good to be able to link to it. That is particularly the case with ID takeovers. We do a lot of work with ID takeovers and social media and linking crooks together. We use social media to see who they are associated with. “I find the younger generation’s willingness to put everything out on Facebook or Twitter remarkable.” – Jim McGugan, IBM Jenny Lambert, Allianz: Staged accidents certainly do occur. The recent includes its use for money laundering and the involvement of organised criminals. This happens a lot in Victoria. But predicting where the next one is going to be is really hard. If anybody has managed to do that, good luck to them, and sharing that detail would be great. Staged accidents tend to come in waves. The odd one may come frequently, but the organised ones that are really around large amounts of money are sustained over a period of time. Using the information around known associates to prevent the underwriting of risk is something that we are starting to use now. We are just starting to take the intelligence information that we have and using that at the front . Shane De Kauwe, IBM: Yet it is self-evident right? Jenny Lambert, Allianz: It does not mean there is something wrong, but why take the chance. Shane De Kauwe, IBM: I would suggest that you would make a financial decision on someone’s associates. But maybe those associations would flag that you should take a second look before approving an insurance claim. From a banking sense, when you are about to give someone a credit card or a loan you score them then you might say “Well, this score is a little bit too close, considering the additional risk”. Maybe we need to ask a few more questions before we let that cash leave the door. From an information management perspective, it is just data, and you guys are actually building up this repository of really cool data. What I want one of you guys to do is link it back to the start of the process. “We do a lot of work with ID takeovers and social media and linking crooks together.” – Matthew Tregoning, Westpac 3 Fighting next generation fraud with visibility and data intelligence “You could be making a difference tomorrow just by sharing your information between your disparate business units.” – Shane De Kauwe, IBM Nagib Kassis, Allianz: You raise a good point. We are building up good quality data, we are enriching that data with third party sources that are now available, that helps us do some of that decision making up front or at point of claim. But my comment back to the forum is, if we deny a claim from an insurance point of view because it contains fraudulent activity, or potentially fraudulent activity, that individual might go to a bank tomorrow and request a credit card. That information is not shared. So we continue to allow this propagation of potential fraudulent activity outside of the sphere of insurance, even though we have a view that the individual is trying to defraud the organisation. How, as an industry do we respond to it? Shane De Kauwe, IBM: Before you start looking at sharing information outside of your organisation what if I was to tell you that most of you do not even share your own information between your insurance arm and your credit card arm? Which you are entitled to do. So let uss not even look outside yet. The Commonwealth Bank for instance has 17 business silos just in Australia. I have formed the view that they are not sharing information across those silos. So is that great for a fraudster? Yet the intelligence and the board group all fall under one group head. Ultimately, while it would be great for you all to share your information, I think you could be making a difference tomorrow just by sharing your information between your disparate business units. Tony Vitiello, IBM: Why is this any different to the credit reference association? Matthew Keaney, CBA: “Fraud, from most examples we have been talking, is small dollars.” – Michelle James, AMP It is not, it is not. So there is already an existing service. I would have to check whether insurance is involved. But certainly between financial institutions, and the telcos leveraging off the VADA service, there is the sharing of fraud information. Jim McGugan, IBM Global: You just look at credit reporting agencies, and in most countries there is now a web of regulations. People are allowed to see their credit report, they are allowed to see what people have reported on them, allowed to challenge it. There is typically an ombudsman somewhere that will get involved, and there is a huge web of regulations around that. Jenny Lambert, IBM: 4 From an insurance point of view, it is interesting how often claims are withdrawn or reduced as soon as you mention it is going to be investigated. But if you look at the overall percentage that go through to a criminal conviction, which is the proof of the fraud, it is a very low percentage. As to the capacity of the insurance industry to be able to go ahead and do the brief, you have virtually got to have everything tied up with a ribbon on top for law enforcement to proceed successfully. And a lot of it is small fraud. Michelle James, AMP: I want to bring you back to your first question of what is important to individuals in the fraud space. So I would ask the question of internal versus external, and the appetite of your business to wear these costs. So fraud, from most of the examples that we have been talking, it is small dollars. It does add up, but quite often the businesses are willing to accept that risk. My viewpoint is to ask which is the bigger issue, internal or external fraud, and why? My concerns from a fraud perspective are the newer threats, for instance around the activists, and the threat of the damage to the organisation. So whilst we have to continue to address individual fraudulent activity much of it is small bikkies compared to the damage someone can do to you by damaging you in the public arena and causing the customers to lose faith and trust in you. From an AMP perspective, we are looking after their retirement, or their nest egg, and I suppose it is the same with the banking. It is like if we screw up, they can really lose out. We have been talking a lot about individual fraud. Well we have got the fraud team, and then they are on that type of fraud. So what I am more worried about is the fraudulent behaviour by activists or hacktivists, and the serious damage they can do if they get in take our data, not necessarily for monetary gain, but for their cause. Jim McGugan, IBM Global: I like your point, and I would say from the customers I have talked with, there is a fairly bright line around things that involve reputational risk, like internal fraud, or somebody skimming trust accounts of the elderly. And I would say money laundering would be in the same category. With external fraud however, I think that is something that more often than not involves a rough and ready ROI analysis. As you say, most frauds are small. You obviously need to deter them, but at least most places I have been people apply more of an ROI mentality to the external fraud, would that be fair? Michelle James, AMP: I would agree, and that is what my concern is, because some of the controls against those small time frauds are the controls we need against that larger reputational risk attempt. The board has agreed to a certain level of risk appetite. What I am worried about is the fact that it takes a while to get those numbers up. Matthew Keaney, CBA: The issue that keeps me awake at night from a reputational perspective is not hacktivists, but it is the anti-money Fighting next generation fraud with visibility and data intelligence laundering, it is the sanctions that we have seen impact Barclays, the HSBC and others. That is the one thing that I think has a true, real, opportunity to negatively impact brand, value and reputation. Michelle James, AMP: So it is internal. It was poor processes. When you look at it in hindsight there was obviously so many areas where it should have been picked up. But that is what I am saying, because when people lose faith in your ability to manage that business, they will walk away. Jenny Lambert, Allianz: I think that depends on how you actually manage the scenario. I am sure every organisation around this table has had incidents of large internal fraud – it depends upon the organisation what constitutes “large”. It is how you deal with it that affects your reputation. So you have to demonstrate that you have a zero tolerance, and that you are prepared pursue it through to criminal charges, and that you do not accept it. Then you put your hand up and say “Yes, there were procedural breakdowns internally.” If you do that I do not believe that your customer base will say “This is a bad organisation”. If you have recurrences of that over time, for instance three $17 million incidents then yes it is going to hurt you. But it is how you present yourself to the public and to your customers that is important from the perspective of reputational damage. What about the slightly different angle on that. There is a recent case where an activist took some ANZ bank letterhead paper, and made a press release, right? Michelle James, AMP: But it is not even just the journalist, because this is the thing in the age of Facebook and Twitter. As soon as this news comes out, that is out there. That is the thing that does the damage. We can have a great response, we have got this media person that is going to front up and tell them it is a fraud, it is a mistake, however it has gone out, the ripples are hitting out in the pond. That is probably the new risk. Will we see a surge in cybercrime as a service? We might actually start to see people buying these services just to add reputational damage of other organisations. And that is a risk. Nigel Phair, Centre for Internet Safety: I think a lot of organisations do not rehearse their incidence response. They do not practice getting out there on the front foot with the media. You can also extrapolate that into fraud. If you look at the Australian Crime Commission’s work into serious and organised investment fraud, it is exactly the same thing. People set up all these dodgy websites, and they are on the phone to investors. These are seasoned, mature investors, who then get on the phone to their investment advisors who then type the same thing into Google. They get the same websites, and they are self-validating each other And they get suckered into it. Matthew Tregoning, Westpac: If I can just go back to Michelle’s previous question about internal versus external fraud. From my perspective, or Westpac’s perspective the biggest thing is that internal fraud is starting to flow into external fraud. We have a fairly close working relationship with the other financial institutions, I think that it is probably affecting them as well. And that is where the real reputational risk comes from. You might have a staff member who sells information, as a result, $200,000 is lost, but then you have got the reputational side of trying to restore our reputation to where we were prior to the fraud, and that is probably going to cost a lot more than $200,000. Matthew Keaney, CBA: The amount of money that we would lose to external fraud today is the same as we were losing 10 years ago. And you think about the growth of the bank and its business in that time, that is a pretty good effort. So I think the challenge we have is this; I think we are very good at using the information that we know about, so we know that that address is bad, we know that customer is bad, we know that licence is bad. To your point earlier Shane, there is just so much information we have got access to now, how do we identify the right bits that we should leverage into our forward looking capability. Then how do we build that ROI to actually warrant the investment? Because our external consultants and our internal IT resources are just so expensive. So you cannot build the business cases, that is the reality. But how do we use that grey information around social networks and the relationships that people have? Because as I say, the black and white information we are really good with. It is the stuff in the middle, and there is so much of it, we are not so good with. Shane De Kauwe, IBM: I work with the Singapore government and the Ministry of Home Affairs, and they have a division which just blows me away. They are looking at fraud and crime across the whole world, and then proactively saying to themselves “Can this apply to us?”. They look at terrorism the same way. “This attack that just happened, could it happen here today? How would we respond, how would we rate ourselves?” We do extreme scenario planning. We ask what if this event happened here. For instance what if Sydney got taken offline? What would happen? You obviously need to take into account what the risks and probabilities of those sorts of events are, and then plan potentially for the worst case should that ever occur. “A lot of organisations do not rehearse their incidence response.” – Nigel Phair, Centre for Internet Safety “The amount of money that we would lose to external fraud today is the same as we were losing 10 years ago.” – Matthew Keaney, CBA 5 Fighting next generation fraud with visibility and data intelligence “The business case for justifying security investment would be straight forward if you knew how much security incidents cost.” – Ross McKenzie, Westpac But I think back to business cases, ROI and future threat. I certainly do not have the answer, because we battle it every day. But how do we better take business cases forward? How do we factor in a realistic pragmatic way, the future threat environment? So we have business cases that never get up until we have actually had the problem. And that is the challenge. I think sometimes we need be a little bit more innovative in our business cases, and partner with the business on another initiative. There is some major action happening at the moment just at a customer analytics level, and talking about external data. How good would that external data be if we got our hands on it from fraud detection or internal fraud perspective. Those teams would never get a business case up to say “Can I go out and get this”, “Can I purchase this data?”, “Can I put it through this massive sausage machine to get all these insights out of it?” But our business areas can because they can put the case together around revenue and ROI. Ross MacKenzie, Westpac: In the banking sector, we may not know how many internal security incidents have occurred on any given day or how much each of those incidents have cost an organisation – that would require industry wide sharing of internal data. The business case for justifying security investment would be fairly straight forward if you knew across the industry how much each security incident costs. Matthew Keaney, CBA: You are talking about ROI and business cases, then back to your first comment, Shane, which was zero tolerance, which you said you did not want to talk about. But it kind of leads us into that sort of space, that if it is based on a business case then is there really a zero tolerance? Is zero tolerance Utopia? “I am aware of different frauds around the globe because I have a great worldwide team which is feeding me that information.” – Michelle James, AMP 6 Shane De Kauwe, IBM: Look, the only reason I talk about zero tolerance, is because I do not believe the other method works. That is a personal thing. Because all fraudsters know the numbers when they can try and get away with. And they know that even if you find out, you are not going to do anything about it. So they will just hit you time and time again. They are like ants eating an elephant. Eventually the ants are going to overwhelm the elephant, it just takes longer. Matthew Keaney, CBA: I would challenge that Shane. I think that particularly around retail banking we have a very good sense of how much fraud costs us; we have a very good sense of our appetite for how much we are prepared to lose. And, we have very good measures by which we can manage that day to day. Again I would challenge your comments from earlier that “We do not know what happened yesterday”. Geoff Campbell, CBA: But that is where I would throw it back to the IBM people around the table. This is where you can add value to these business cases. This is where you as a global organisation can bring to the table the over-the-horizon piece. You can demonstrate what you have seen around the globe, you can provide the specific examples, and that helps to build the business case. That way we do not have to go round trying to build it all ourselves because you are supplying that information to us. Michelle James, AMP: I think that is a fair criticism. I am aware of different frauds around the globe because I have a great worldwide team which is feeding me that information. And we do not actively go out to our customers and say to them “Hey, this is where we are seeing a growth in this particular threat.” I think that is a valid criticism. Nagib Kassis, Allianz: Because you could do that by not revealing which company it happened to, just the nature of the threat, and the nature of the threat alone is enough for our organisations to at least be aware of it and put it on our radar. And if there is a potential impact we can then put some provisions in place to protect against it. Jim McGugan, IBM Global: Well, I would say if you read the Financial Times then you will know most of the world wide trends. For instance every bank in England is currently reviewing its AML, that is no secret. First party fraud is a big deal. We are hearing from most of the US banks and a lot of the European that they need to do more about first party fraud. Matthew Keaney, CBA: We have been hearing that for about a decade. That is not meant flippantly, but that is a fact, and I have not seen anyone come up with an approach yet that aids institutions in working through that. And institutions have not helped themselves either. Shane De Kauwe, IBM: Well, going back to my original statements, I do not believe zero tolerance is achievable. As a business if you have levels that you are measuring, and therefore you have some sort of tolerance support mechanism, I think that is a fair answer. To risk, I think fraud is a term that needs to just morph with risk. If we were looking for one name to put over the top, it seems to me that it is risk. I do not see from a technology, or a fraud investigator’s perspective that the process to fix it is different. At the end of the day, it comes down to three tenets; analytics, case management, and being able to visualise or simplify a complex event so that you can do something about it. And I do not think there is any vendor in the world that does it all. Fighting next generation fraud with visibility and data intelligence They have these specialisations that make sense across the board. If there was one thing that you all could do it would be to honestly create that central repository where all your lines of business are getting access to data. In five years if organisations were taking that repository back into the business proactively so that it becomes an asset, I think losses would be lower. As I mentioned in my opening remarks, it is like drinking from the fire hose. And we are adding to the fire hose every day. That does not mean it is not achievable. Just before you go Nigel, can you talk about the difference between a curated and a non-curated app store. Nigel Phair, Centre for Internet Safety: So if we look at apps there are essentially four main platforms in Australia. We have got the Apple store, which has got about half the market share. We have got the Google owned Android store, which has got about the other half. Basically you have got Apple and you have got Google, two completely different ecosystems. Apple has a highly regulated ecosystem for various reasons. They take a third cut of apps, and they look at what goes on in there. If you look at Google Android, it is the complete opposite. It is an open store. The stats tell us that whilst they have both got about the same amount of market share, developers make five times more money out of an Apple app then they do out of a Google app. And that is because of the culture of the people on Android. Those users are the younger generation and they are less likely to pay for apps. So vendors are making their money out of in-app advertising or selling your details to marketers, or from a freemium model. So that in a nutshell is the curated versus non-curated market that we have now. The Android one is quite insecure, because you can put up anything, basically. “The Andriod is quite insecure, because you can put up anything, basically.” – Nigel Phair, Centre for Internet Safety Shane De Kauwe, IBM: In summary, fraud is multi-channel. It is internal, external, AML, sanctions, digital. The take-out is that it is a multichannel challenge for organisations which is constantly evolving. We are certainly trying to get on the front foot as an organisation within IBM and to bring ideas out to market to help you take on some of those discrete challenges along the way. * Financial Services Technology Media where the market meets About FST Media FST Media produces the most successful technology conferences, roundtables and publications for the banking, insurance and wealth management sectors across the Asia Pacific region. With extensive management experience in conference production, journalism and business development, FST Media prides its reputation on unparalleled access to senior financial services executives, and the delivery of high-quality information on trends and disruptions in the financial services sector. About IBM IBM is a global technology and innovation company that stands for progress. With operations in over 170 countries, IBMers around the world invent and integrate hardware, software and services to help forward-thinking enterprises, institutions and people everywhere succeed in building a smarter planet.