You are on page 1of 6

New data on digital fraud trends

ISMG, Longitude and Javelin research reveals what keeps


security teams awake at night and what theyre doing about it
By Ellen Joyner Roberson, CFE, Global Marketing Principal, SAS Security Intelligence Practice

Addressing the risks of


convenience
Financialservicesfirmsandgovernmentagenciesareevolvingtomeetourexpectations
fortimelinessandconvenience.Nowtheyneedtoevolvehowtheyprotectthemselves
fromtheassociatedrisks.Asconnectivitytrendsshift,sodofraudtrends.Forexample:

NewEMVchipcardsmakeittechnicallyunfeasibletocounterfeitcreditanddebitcards.
Thedownside:Fraudstershavehadtoswitchtactics,drivinga130percentincreasein
newcreditcardaccountfraudfrom2014to2015,accordingtoJavelinresearchin2016
DigitalChannelThreatReport:DeriskingConvenience.

In2015,70percentofnewcheckingaccountsand80percentofcreditcardaccounts
wereopeneddigitally,Javelinfoundagreatconvenienceforcustomers.Similarly,in
moststatesitseasytoapplyonlineforfoodassistance,healthcarecoverageor
Medicaidprograms.Thedownside:Thefacelessnatureofthosedigitalinteractions
makesthemprimetoexploit,withhelpfromstaticinformationfrommassivedata
breaches.
Feworganizationsarefullypreparedforthischangingfraudlandscape,accordingto
researchbyInformationSecurityMediaGroup(ISMG).InFacesofFraud:TheAnalytics
ApproachtoFraudPrevention,ISMGreportedthatonly34percentofsurveyrespondents
havehighconfidenceintheirorganizationsabilitytodetectandpreventfraudbeforeit
causesseriousharm.

Sixteenpercentofrespondentssaidtheirantifraudtoolsandteamjustcantkeeppace
withevolvingfraudschemes.Threequartersofthemratedtheirantifraudcontrolasonly
averageoraboveaverage.And37percentsaiditsusuallycustomerswhodetectthe
fraud,nottheagencyorinstitution.

Whyhavetraditionalfraudpreventionapproachesfallenshort?AccordingtoISMGsurvey
respondents,itsbecausetodaysfraudschemesaretoosophisticatedandevolvetoo
quickly(56percent),customersand/orpartnersfallforsociallyengineeredschemes(56
percent),andsodoemployees(52percent).

A trilogy of rising risks


Organizationsthathavenotevolvedtheirfrauddefenseswiththetimeshavefeltthepain
inseveralways.

Mountingmonetarylosses.AccordingtoISMG,41percentofrespondentshaveseenan
increaseinfraudincidents,andtheyarenotveryspeedyaboutaddressingthem.More
thanhalfofrespondents(52percent)sayittakesdaysorweekstouncoverthefraud15
percentdontevenknow.

Sanctionsandfinesfromregulators.Nearlyoneinfiverespondentsinasurveyof120
bankssaytheyhavebeenfinedbyregulatorsorlawenforcementinthepastthreeyears,
accordingtoLongitudeResearchinCombatingFinancialCrime:TheIncreasing
ImportanceofFinancialCrimesIntelligenceUnitsinBanking.Thehitissignificant22
percentofthesebankshavebeenfined$1billionormore.

Tarnishedreputations.Lossofreputationisahigherpriorityformanybanksthan
limitingactuallosses,butitisthemostdifficultlosstomeasure,saidaseniorfraudand
financialcrimesexecutiveinterviewedbyLongitudeResearch.IntheISMGsurvey,31
percentofrespondentssaidfraudhascausedcustomerstoclosetheiraccountsandtake
theirbusinesselsewhere.

What is being done or should be?


AllthreeresearchstudiesfromJavelin,ISMGandLongitudefoundhopefulnewsin
fraudtrendsaswell.Financialinstitutionsandgovernmentagenciesarefightingbackwith
strongerinvestigativeteams,betteranalyticaltoolsandmoreskilledstaff.

Action Step: Establish a strong nancial crimes


investigation unit (FCIU).
BanksaresteppinguptheirinvestmentinFCIUs.Inadditiontoputtingmorefocuson
financialcrimes,FCIUsenablebankstocollect,shareanddisseminateintelligenceacross
borders,businesslinesandsilosofrisk,whereordinarilythatintelligenceisnotshared.

AccordingtoLongitudeResearchonthebankingindustry:TheFCIUisarelativelynew
conceptthathasgainedtractionsincetheglobalfinancialcrisis.Itsencouragingtosee
that82percentofthebankssurveyedhavesetupanFCIUorareplanningto.Ofthese
banks,98percentsaytheirFCIUisatopcorporatepriority.

Theresstillworktobedone.Just11percentofbankssaytheyhavefullyestablished
FCIUsacrossallgeographiesanddivisions.Nearlyhalf(49percent)saidtheywillhavea
fullyestablishedFCIUwithinthreeyears.

Action Step: Invest in advanced analytics.


Onewayleadingorganizationsworktokeeppacewithfraudschemesisthrough
advancedanalytics,suchaspredictivemodels,linkanalysis,machinelearningand
anomalydetection.Thesetechnologiessupplementthebasicconditionallogicand
businessrulesthatarecommonlyusedtoday.

Feworganizationsarethereyet.While74percentofrespondentstotheISMGsurvey
haveimplementedfrauddetectionandtransactionmonitoringsystems,acloserlook
suggeststhatthesetechnologiesmayberudimentary.

Morethanhalf(54percent)arenotcurrentlydeployingadvanceddataandanalyticstools
suchasbehavioralanalytics,predictiveanalyticsandsocialmediaanalysis(19percent
havenoplansto)45percentsaidtheircurrentsystemsallowforonlylimitedanalytics
and43percentsaidtheycantgetaconsolidatedviewofcustomeractivityacrossthe
enterprise.Soitsnosurprisethatnearlyonethirdofrespondentssaytheirorganizations
lackthetechnologycapacitytoproperlydetectandrespondtofraud.

Onthebrightside,26percentsaytheirorganizationswillinvestinbigdataanalytics.
LongitudeResearchconfirmsthistrend87percentofrespondentscitedbigdataanalytics
astheleadingtechnologytoolfortheirbanksFCIU.Otherpopularanalyticstoolsinclude
advancedsearchanddiscovery(80percent),machinelearning(70percent)and
unstructureddatamining(70percent).
AccordingtoTheForresterWave:EnterpriseFraudManagementQ12016,machine
learningisoneofthekeyfactorsthatnowdictatewhichprovidersleadthepack.
Investmentsherewillundoubtedlyhelpresolvesomeofthecurrentdeficienciesinfraud
detection.

Action Step: Build the skills to use those analytics tools.


Abrightnewanalyticsplatformwontdeliveronitspromiseiftheusersdonthavethe
trainingtousethemwell.Datascienceisthenew,hotdiscipline,andorganizationsneed
toinvestindatascientistsinternallyorcontractwiththirdpartyexperts.

Wheredoyoufindthem?Theskillsgapisreal.IntheISMGstudy,42percentof
respondentssaidtheirorganizationslackthestaffexpertiseparticularlydatascientists
whocanmanagethetools.

Itsonethingtofindquantitativescientists,butitsdifficulttofindquantitativescientists
whounderstandacertaingovernmentsectororcommercialbanking,saidDavidStewart,
DirectorofFinancialCrimesSolutionsatSAS.Longituderesearchconfirmsit:71percent
ofrespondentsreporthavingdifficultyhiringspecializedtalentfortheirFCIUsandits
evenmoredifficultforsmallorfastgrowingbanks.

Itsnotbecausetheyrenotlooking.Whentheyseektohirestaffmembers,85percentof
bankslooktoexistingcybersecurityprofessionals84percentsearchsoftwarecompanies
61percenttapuniversitiesand50percentlooktothegovernmentintelligencecommunity.

Theyarescouringdiversesources,butdemandforanalyticstalentissogreatthatgood
candidatesarehardtofindandhardertoland.Lookingtoboostexpertisefromtheinside,
94percentsaycombatingfinancialcrimeisatoptrainingpriority,accordingtoLongitude.

The war on fraud is gaining momentum,


muscle and money
Therearechallengesandbarriersinthewaronfraud.ISMGfoundthattwothirdsof
respondentsstillgrapplewithtechnicalconstraintssuchascontrolsindifferentpartsofthe
organizationthatdonttalktooneanother.Fortytwopercentdontwanttoaddanything
thatmightimpedethecustomerexperience.Fairenough.Customersmightsaytheywant
protections,butinpracticetheytaketheirbusinesswhereitsmostconvenient.

Strikingthedelicatebalancebetweentheorganizationssecurityandcustomer
conveniencewillrequirearesilientandadaptableantifraudsolutionwithrobustanalytics,
backedbywelltrainedpersonnelinawellestablishedFCIU.
Thegoodnewsisthattheexecutivesupportisthere,whichmeansthedollarsarethere
98percentofrespondentstotheISMGsurveysaidtheyexpecttoseeasteadyorgrowing
budgetforfraudpreventioninthecomingyear.Thesenewfundswillbeinvestedprimarily
innewantifraudtools(65percent)andstafftraining(61percent).

ReadthefullreportsfromJavelin,ISMGandLongitudeformoreonfraudtrendsfor
financialandgovernmentorganizations,theircurrentsecuritycontrolsandgaps,and
wheretheyplantheirbiggestantifraudinvestmentsfor2017.

Read More
FacesofFraud:TheAnalyticsApproachtoFraudPrevention.

LearnaboutSASsolutionsforfraudandsecurityintelligence.

Get More Insights


WantmoreInsightsfromSAS?Subscribetoour
Insightsnewsletter.Orcheckbackoftentoget
moreinsightsonthetopicsyoucareabout,
includinganalytics,bigdata,datamanagement,
marketing,riskandfraud.

You might also like