BS BFSI Summit: More checks, balances needed to curb fraud, say experts

Payment and security experts explain widespread scams, bat for better cooperation and education

India's digital platforms and ecosystems need to be a step ahead of the fraudsters with more layers of protection and a strong focus on education, as the country grows leaps and bounds in digitisation, said industry stalwarts at a session in Mumbai on Thursday. 

Speaking at the Business Standard BFSI Insight Summit, the key players in the payments and security ecosystem agreed that it required greater cooperation to beat the fraudsters at a time of proliferation of personal data.

  They spoke at the session titled 'Securing Payments in the Digital Age: Mitigating Fraud Risk and Emerging Landscape of Financial Crime.' 

“Indians have a very inherent cultural thing of seizing the moment, where we say the best opportunities are sometimes the ones which you don't take. So, in a growth economy, where people have ambitions and as they're coming into the fold, they are more vulnerable to getting scammed, fear, greed,” said Karan Sapra, Head of Consumer Payments and Financial Services, Google Pay.

  The panellists cautioned customers on the breadth of the scams and frauds, and the rising possibilities of falling for such tricksters.

  “Fraud includes identity theft, or combines fake data with real information to deceive the system. There are also cases of ghost accounts. Loan disbursement fraud is another area of concern, with fraudsters often tricking businesses into transferring funds into specific bank accounts, sometimes with insider involvement,” said Natasha Jethanandani, CTO, Kaleidofin.

  Loan repayment fraud is especially challenging, particularly for less tech-savvy customers. The breadth of frauds just span the entire credit life cycle, she said, adding that many believe that the current checks and balances are not adequate or are too easy to breach through.

  “I have a huge problem with this word called easy KYC. The reason for KYC to exist is to control fraud. Make it a happy friction to some extent. Because friction allows you to control fraud,” said Ashok Hariharan, Founder, CEO, IDfy. 

With increasing and higher ticket size transactions, it is fine to increase friction. Add a face match on top. You will actually prevent some fraud there. Instead of just an OTP, OTP is not good enough, he said.

  "People get social engineer OTP, but they cannot put a social engineer face. There are enough checks and balances to figure out likeness of a person at the point of a transaction,” he added.

  “We are both excited about the opportunity that the digital wave brings, but extremely worried about the state of our security. OTP on SMS is using a communication protocol to establish identity. It's extremely prone to phishing. It's extremely dangerous, basically trying to do authentication based on a password and pin,” said Sivaram Kowta, President-Banking, Zeta.

Kowta warned on the easy distribution of personal information of users like Aadhaar and PAN data.

  “With near-complete universal proliferation of our personal information out there, we have now given everything to the scamster. He's got all the ammunition,” he added.

  Ramesh Laxminarayan, CIO, HDFC Bank, highlighted the increased focus of banks on leveraging technology and the investments to curb frauds.

  “Today it (investments) is roughly 20-22 per cent — the opex and capex — where banks are spending on security budgets compared to less than 5 per cent five years back,” he said.

  “The past 9 to 12 months have been challenging for the banking industry. Although the data isn’t published openly, fraud has become pervasive. Not just payment financial frauds, but a lot of other things — like money mules - is a very big challenge that the industry is facing,” he said.

  Guiding the way forward for addressing the gaps, Laxminarayan said time has come to put together some kind of framework that allows collective participation in real time.

  "That is a missing point. Can you stop a fraud? Can we make it community-driven — every single ecosystem is able to provide triggers and you are able to inform the other party in the chain in real-time. That to me will be the real way to take accountability  and move forward," he said.

  The experts called for network operators to take a more active role in the protection and the use of more secure options like FIDO-compliant devices and leveraging technology to identify possible frauds.

  “At Google Pay, we have models which are best in class, and between last year and now, we have saved Rs 13,000 crores of fraud. That's a number which we have validated internally.

  Over 41 million real-time alerts given, real-time, within milliseconds, seeing the sender, seeing the receiver, seeing patterns, juxtaposing with multiple similar patterns which would have happened, and nudging the user, saying, something is off, is what technology can do,” said Sapra of Google Pay.

  The industry voices agreed that the range of technologies in India compared to the world such as UPI, bank to bank transfers, and account aggregators, the role of checks and balances is more crucial as fraudsters will try to figure a way out, making it a catch-up game for the platforms and players.