Fraud targeting banks’ customers

While fraud targeting end customer has always been a concern for banks, its rise in the past two years has been exponential and has led to scrutiny from regulators across the world.

According to the FBI, the amount of reported fraud losses in USD-denominated payments globally reached $10.3 billion in 2022, representing a huge rise from $1.4 billion in 2017.

The rise of e-commerce, open banking and new payment methods has provided additional avenues for fraudsters to target people and companies. Fraud can now impact C2C payments, B2B payments, or even FI payments. According to the AFP Fraud Survey 2020, the proportion of wire payments involved in B2B fraud had multiplied eight times, representing less than 5% of fraud cases in 2012 and reaching 39% by 2020. This trend applies to all payment types as digitisation has continued to accelerate, enabling fraudsters to scale up their attacks using digital channels.

At the same time, fraudsters have used more sophisticated methods to defraud bank customers, resorting to social engineering, impersonation and manipulation for example. Such cases of authorised fraudulent payments or scams leave anomaly markers more subtle and difficult to detect as they can appear similar to legitimate payments. Worse than that, victims may not even recognise themselves until it’s too late.

Fraud targeting your customers and counterparties is a pressing issue, with regulators and law enforcement agencies across the world warning banks and their customers of the growing threats of impersonation, social engineering and phishing attempts. Some regulators have reached the stage of proposing regulatory updates, including imposing refunds or additional mandatory controls on banks.

Beyond the regulatory angle, fraud and recovery processes are also a high source of cost for banks. When your clients fall victim to fraud, there are direct financial losses for your institution and your clients, with an associated impact on the client experience, as well as indirect costs associated with recovering funds and reporting transactions. It’s estimated that for every dollar of fraud loss, it can cost a bank up to four dollars to respond. These costs represent the transaction value for which firms may be held liable, fees and interest incurred, fines and legal fees, labour and investigation costs, and external recovery expenses.

Fraud affecting end-customers can manifest in many ways. Sometimes they happen in bulk, with many affected customers but only one fraudster; sometimes they are isolated; sometimes the amounts involved are small, sometimes not. For that reason, Payment Controls’ approach offers different logics designed to detect the various markers of anomaly that can hide fraudulent activity. Interestingly, some of these logics can be used for other purposes such as operational issues.

• A first logic consists of detecting repeated payments of the same amount and currency from or to the same account, or between two given accounts. For instance, you can choose to be alerted if one of your customers is about to send a payment to a beneficiary account that received a payment of the same amount and currency from accounts owned by other financial institutions – which may indicate they have been a victim of a mass-scaled scam. The logic of detecting repeated payments via Payment Controls can also help banks alert and block cases of operational issues, such as sending a payment multiple times by human error.
• A second logic looks at new accounts on the Swift level, as not all of a banks’ customers send or receive payments via Swift. Payment Controls enable banks to detect scenarios in which customers send or receive funds for the first time across the Swift network – which may be indicative of fraudulent activity or simply of operational mistakes – for example, if the wrong beneficiary or ordering account was encoded.
• Other logics are being progressed and will be available soon. These will include the detection of unusually high volumes of funds or an abnormally elevated number of payments sent or received by a given account.

Millions of accounts do transfer and/or receive funds via Swift. Apart from exceptional situations, financial institutions do not and cannot afford configuring anomaly detection logics per account. For that reason, all the above-described Payment Controls logics operate in a generic fashion scoping by default all accounts a financial institution does business for or with. Of course, as exceptions can prevail, such a generic approach can be tuned to focus or exclude some given account(s).

As previously mentioned, Payment Controls enables you to leverage account insights from the entire Swift community (subject to country limitations – for more information, please contact your Swift account manager).

Previously, FIs could leverage institution-centric views whereas community-wide insights remained a blind spot. With institution-centric views, financial institutions were using their own information without having access to other financial institutions’ information; they could identify anomaly markers if their own data was highlighting unusual patterns. With end-customer fraud, many patterns can only be seen on the beneficiary side, making it difficult for originating institutions to catch fraudulent transactions before releasing them – leading to the additional indirect costs described earlier.

With the introduction of these new account-based logics, Payment Controls allows users to benefit from the power of the Swift network by offering insights that only networks can offer. Originating institutions can be warned if their transactions contribute to an abnormal behaviour observed at the network level and leverage this information in their anomaly detection processes in order to potentially avoid the indirect costs linked to the recovery of fraudulent funds.

With these new developments, Payment Controls will offer you more flexibility, as well as network-level insights, to target the detection of payment fraud impacting your clients and account holders. This transformational development is the first of several enhancements we have planned to improve our community’s response to financial crime and fraud.

It’s important to note that these new account-based functionalities don’t replace other existing logics offered by Payment Controls. Thanks to the Payment Controls rules combination framework, users can even use the new account analytics to refine their already existing screening policies.

Lastly, all these logics could not be offered without ensuring compliance with existing regulations on party data information. For more information on this, please consult Swift Pseudonymised Account Statistics – Information Notice.

For any other questions, please contact your account manager.