Independent Banker - December 2021 - 24

PORTFOLIO
(such as a one-time passcode sent to
their phone) and something they are
(such as a facial or fingerprint scan).
With multifactor authentication,
a criminal who enters the right
password might be denied access for
not using a registered device or for
failing a biometric screening.
Crowe says MFA is a fraud
protection best practice. " We know
multifactor authentication is not
being done consistently across the
industry, so there's definitely room
for improvement here, " she adds.
Experts says third-party
verification can make a huge
difference, too. When it comes to
combating synthetic identifications,
look to solutions that compare data
provided electronically with the
Social Security Administration's
database in real time, says Joel
Williquette, ICBA's senior vice
president of operational risk policy.
These systems, he adds, make sure
that the Social Security number,
name and birth combination match
and that the individual in question is
not deceased.
High-tech and low-tech solutions
For community banks with growing
digital services, scrolling through
the sheer volume of customer
information can be a herculean task.
That's why an artificial intelligence
(AI) solution that analyzes behavioral
metrics can be useful for some banks.
Urbelis says behavioral metrics
are becoming more sophisticated,
going beyond the basics, such as
transaction history, to " more esoteric
information, " such as how long
it takes a consumer to perform a
routine task like wiring money or
adding a new payee. These timing
issues matter because " scammers
often take longer to figure out how to
do that kind of thing, " he adds.
On the other hand, while
Education as an anti-fraud tool
Marianne Crowe, vice president in the Secure Payments Innovation
and Research group at the Federal Reserve Bank of Boston, says
education is critical to preventing fraud.
" Everybody really needs to understand how remote
authentication fraud works and impacts ... their customers, "
she says.
For this reason, the Federal Reserve published three research
briefs on remote authentication fraud, the first of which came out
this summer (bit.ly/remoteauthenticationfraud).
" Our goal is to [continue] a dialogue with the banking and
payments industry on how better to identify and address fraud, "
Crowe says.
technology holds enormous promise,
so does a lower-tech approach:
educating employees and customers.
Scammers disproportionately
target those 65 years old or older,
so seniors should be taught to
immediately disconnect from a
remote session whenever they
become suspicious, Urbelis says.
If disconnecting seems tricky, they
could simply unplug the router,
instantly terminating a session.
Meanwhile, Williquette cautions
community bankers against
relaxing their know-your-customer
(KYC) practices.
" Don't assume that even if
someone has been a customer for
a long time that they are an actual
person or the person they say they
are, " he says. " Many criminals build
up a history with a bank over a
period of time so that they can go in
for a bigger score later. "
An ecosystem problem
To that end, Urbelis describes
remote authentication fraud as " an
ecosystem problem, " so he suggests
community bankers team up with
others to thwart it. For example,
he suggests banks could share
anonymized behavioral analytics
with remote access services.
Community banks may also hunt
for scammers and terminate the
services and infrastructure they use,
Urbelis says. " Many scammers use
domain names that are confusingly
similar to a bank's domain name, " he
adds. " It's possible to track and trace
these domains before they're even
put to illicit use. "
Every prevention victory makes
criminal activity less appealing.
" If the community banks come
together and create a consortium
to proactively hunt for, find and
terminate these threats, that's going
to take a significant bite out of
the returns these fraudsters were
expecting, " Urbelis says.
" Until we change the calculus for
these threat actors [and] until we
reduce the return on investment
that the fraudsters are making, "
he says, " we're going to see these
scams proliferate. " 
Elizabeth Judd is a writer in Maryland.
24 Q ICBA Independent Banker Q December 2021
http://www.bit.ly/remoteauthenticationfraud
Independent Banker - December 2021

Table of Contents for the Digital Edition of Independent Banker - December 2021
