July has come full of expectations. The long-awaited FedNow is (apparently) on the brink of launch. Despite The ClearingHouse launching its own Real-Time Payments (RTP) Network in 2017, there is a sense that FedNow will be different.
“The US is a big place, and it has over 10,000 financial institutions and thousands of credit unions,” said Craig Ramsey, Global Head of Real-Time Payments and Banking at ACI Worldwide, during a recent Fintech Coffee Break podcast episode. “To reach everyone, it’s hard. FedNow will help support the US growth of instant payments, and it will enable the smaller institutions to compete with the larger financial institutions.”
“I think that’s that’s where FedNow will be very successful as it is supporting those institutions that want to offer great products and services to their consumers that they’re used to only seeing in the larger banks.”
RELATED: The Fintech Coffee Break – Craig Ramsey ACI Worldwide
Globally, real-time payment systems have been implemented for decades, giving FedNow a blueprint for development. While adoption has varied, nations have used the technology to revolutionize the world of payments. But its failings have also become very clear.
While fraud levels related to traditional payments have slowly come down, real-time payment-related fraud has skyrocketed. India, one of the primary innovators in the space, recorded a 23% rise in fraud related to its real-time payments system in 2022. All other types of fraud declined. They are one of many nations experiencing the same.
FedNow’s delay has given it an advantage. Financial entities, gaining an idea of the risks its implementation might hold, have had time to strategize.
RELATED: FedNow brings innovation, fraud concerns, and conspiracy theories
A Collaborative Approach
Ramsey’s belief that FedNow will bring faster payment capabilities to smaller institutions could be a double-edged sword.
On the one hand, smaller institutions could have the opportunity to innovate, giving them the ability to bring much-needed products to loyal customers. However, these same institutions could be more susceptible to fraud.
“Smaller and medium entities could be more vulnerable because they don’t have the resources of top-tier mega banks,” said Greg Woolf, founder, and CEO of FiVerity. “So the fraudsters focus on attacking the small and medium-sized institutions because they know they’re more susceptible.”
“Then they’ll take fake accounts they make to attack one institution and then apply them to other institutions of the same size. And then, frankly, they’ll apply them to the big banks as well.”
Already, institutions have cottoned on to this threat, creating networks of information sharing to fight crime. FiVerity created its network some time ago, and more recently, the likes of Plaid and Sardine have also launched solutions.
“I think the industry has come to the conclusion that they need to work together better,” continued Woolf. “Entities are really concerned that the appropriate controls are not in place. And operating in a silo, as an individual institution doesn’t cut it anymore.”
Within these networks, institutions flag suspicious entities across their shared network, reducing blind spots in an attempt to eradicate repeat fraud.
RELATED:
APP fraud: the quiet, increasing danger
The ClearingHouse, having launched its RTP network in the US some years ago, is close to being a veteran. They claim their levels of fraud have remained low.
“We track unauthorized payments. And our rates are substantially lower than the UK Faster Payment rate, which is roughly around two basis points,” said Lee Kyriacou, vice president of RTP product management for The Clearing House. The UK has had its Faster Payments System in place since 2008.
Kyriacou explained that the Clearing House’s low level of fraud is due to its main user base being largely made up of commercial centers, a sector that already has low levels of account takeover.
According to ACI Worldwide’s Real-Time Fraud Payment Trends report, the outlook for unauthorized payments is positive across the board. Between 2021 and 2022, almost all areas of unauthorized payment fraud had seen a decline.
However, authorized transactions are a significant issue, particularly for instant payments. Fraudsters can scam users into authorizing payments, and due to the real-time nature of payments sent on the network, funds are almost impossible to recuperate once the scam is uncovered.
ACI’s report found that between 2021 and 2022, Authorised Push Payment (APP) fraud and scams had risen by 12.5%. APP fraud had almost tripled, now accounting for 18.6% of all fraud worldwide.
The report stated that the US, making up only 1.2% of all real-time payment transactions, had, for now, avoided the effects. However, it stated too that “there is no reason to assume that without action, the U.S. will not follow the path to crisis levels of APP scams as seen in other markets.”
Kyriacou said that currently, The Clearing House does not track rates of authorized payment fraud, and he explained that to do so would be a lot more complicated. However, due to 80% of their network being made up of commercial centers, the level of fraud was likely to be low.
The approach to determining APP fraud is complex, and the financial system, so far, is washing its hands with it, stating it is not its responsibility to manage.
In a recent UK court case, judges ruled in favor of banking giant Barclays over their responsibility to customers over APP fraud. A customer of the bank had attempted to sue Barclays after being defrauded into sending £700,000 to the UAE, stating the bank should have steps to ignore her attempts to send funds if they had grounds to believe them to be suspicious.
APP fraud is now the UK’s most prolific fraud type, rising 39% between 2020 and 2021.
Supreme Court Judge George Leggatt said would be “inconsistent with first principles of banking law” to rule against Barclays.
“Where the customer has authorized and instructed the bank to make a payment, the bank must carry out the instruction promptly,” he said. “It is not for the bank to concern itself with the wisdom or risks of its customer’s payment decisions.”
However, statistics show levels continue to grow, with fraudsters cashing in on the weak spot in the system.
RELATED: The global state of real-time payments
AI and Behavioural Monitoring could make a difference
Artificial Intelligence could be a key driver in addressing this threat, allowing for fraud detection to work faster with more data points.
“Comprehensive onboarding, as well as interdicting throughout the client lifecycle, and ensuring that you really are monitoring all throughout that session and interactions and changing information will really help give you the holistic view,” said Sara Seguin, Principal Advisor, Fraud & Identity Risk at Alloy. “So you understand your client and if this is typical behavior or not.”
Alloy focuses on identity risk, allowing institutions to monitor the financial behavior of customers and flag transactions as suspicious if they deviate from the norm. “We can ingest data, ingest the information, and provide that real-time response back to the client.”
This approach is particularly important for account takeover fraud and could become a point of friction to reduce rates of fraud related specifically to real-time payments.
While ongoing monitoring of account behavior, as offered by Alloy, could provide a strong tool against APP fraud, location data has also proven to make a mark.
Ingcognia, a fraud prevention software operating in Brazil and the US uses location data as its primary area to detect fraud. Working with a similar approach to Alloy, the company tracks consumer behavior, registering “safe places” clients regularly use to make transactions. If transactions are made outside these areas, it flags the financial institution for potential fraud.
Working in Brazil, Incognia has extensive experience with PIX, the national real-time payments system.
“Location is certainly one of the most powerful signals to fight fraud in this new environment. Now with PIX, people are moving money on the go all the time. However, our behavior is actually quite predictable,” said Andre Ferraz, founder and CEO of Incognia.
“For example, we see that when it comes to PIX transactions, over 95% of those transactions occur from places where the user goes at least once a week…understanding those patterns, and then applying this to machine learning models that would determine risk is super important. You can only do that if you have really precise information.”
Eventual solutions are likely to be “reactive.”
FedNow, as far as has been made public, has no specific plans to bake fraud detection into the technology, meaning the response is left to financial institutions themselves.
“Building for detection capability into a new payment rail is generally done as an afterthought,” said Woolf. “Unfortunately, it’s not going to exist as part of the the FedNow rollout
“I think it’s going to be more a reactive piece where financial institutions are going to have to rely on more sophisticated fraud detection that can aggregate data across multiple signals. They’re gonna have to do it themselves.”
However, there is still time.
The skyrocketing adoption seen by PIX in recent years is deemed unlikely to be matched by FedNow. The Brazilian government mandated the adoption of the real-time payment system by all financial institutions, also giving significant incentives for consumers to switch. The Fed is yet to make such a decision.
The possibility of slow adoption means that institutions and regulators, keeping track of fraud levels (both authorized and unauthorized), could respond accordingly to the threat. With the ongoing development of emerging technology, they may be able to restrict the rise of real-time fraud before it becomes overwhelmingly rampant.
