Defending against digital fraud. Jon Karl Co-Founder and Executive Vice President Iovation, a TransUnion Company

Transcription

1

2 Defending against digital fraud Jon Karl Co-Founder and Executive Vice President Iovation, a TransUnion Company

3 3

4 PERSONAL Identities HAVE UNITED WITH DIGITAL Identities 4

5 Unifying personal and digital data into single customer view to build a defined identity strategy 1 billion worldwide consumer records 650 million consumer credit history records 4.8 billion petabytes of data 30+ monthly data updates 33 countries 5 billion devices seen by network 35 billion total transactions protected 23 million transactions protected per day 55 million fraud reports placed by network 35,000 websites and apps protected 5

6 Financial Fraud Past, Present and Future Since 2010 over 10 billion data records have been exposed, according to Gartner Check Fraud ATM Compromises Point of Sale Fraud Virus, Worm, Trojan 2010 Counterfeit Cards Botnets Stolen Identities 2018 CNP Fraud Synthetic Fraud Account Takeover New Account Fraud Social Engineering Future True and Synthetic Identity Fraud Account Takeover Automated Attacks 59% of organizations in Asia detected a business interrupting security breach at least once a month in Source: ¹ Gartner: Market Guide for Online Fraud Detection, Jan Telstra 2017 Cyber Security Report

7 1800 Data Breaches and Consumer Complaints of ID Theft & Fraud Consumer Complaints 1 Data Breaches Source: 1 Federal Trade Commission, Consumer Sentinel Network Databook Jan-Dec Identity Theft Resource Center

8 Global Fraud and Authentication Trends IOVATION REPUTATION REPORTS % Increase of Reputation Reports Placed 215% 200% 189% 150% 158% 143% 131% 100% 97% 63% 61% 50% 0% Synthetic Identity Account Takeover True Identity Theft Identity Mining & Phishing All Industries Finance Industry Only

9 Fraud Isn t Just A Business Problem. It s Also a Customer Experience Problem. Business Impact Consumer Impact Increased OPEX for tools and review-staffing Higher cost products and services Sub-optimal consumer experience design Frustrating experiences with online businesses Lost customers and lost revenue opportunity Lost time repairing damage

10 Identity theft victims up 1.3 million.* 6 in 10 banks in Asia Pacific said they are experiencing application fraud from synthetic identities.* $120B - $200B was lost to cybercrime in East Asia and the Pacific.* * 2018 Identity Fraud Study, Javelin Strategy & Research * FICO Survey APAC Banks Say Fraudulent Synthetic Identities on the Rise; * McAfee Economic Impact of Cybercrime No Slowing Down Report

11 Consumers are moving to online/mobile 2018 TransUnion LLC All Rights Reserved 11

12

13 13

14 Consumers are moving to online/mobile Fraud threats are rising, while user experience suffers 83% of Millennials say they would switch banks for a better digital experience.* * 2017 SalesCycle Report 2018 TransUnion LLC All Rights Reserved 14

15 Friction in online forms drives consistently high abandon rates across industries Abandonment Rates by Industry (Q4 2017) Abandonment Reasons 90% Form is too long 27% 80% 70% 60% 50% 76% 66% 82% 79% 82% 77% Too much personal info Distracted / Changed mind 20% 24% 70+% of abandonment 40% Visit branch / send in information 16% 30% 20% Language is too confusing 9% 10% Other 4% 0% Retail Fashion Travel Non-Profit Finance All Sectors 0% 5% 10% 15% 20% 25% 30% Source: SaleCycle (2017)

16 v v v Account Takeover

17 Account Takeover Fraud Losses (Billions) $5.1B $2.3B 2 $1.4B Source: Identity Fraud Hits Record High with 15.4 Million U.S. Victims in 2016, Up 16 Percent, Javelin Strategy & Research, 2018; Identity Fraud Hits All Time High With 16.7 Million U.S. Victims in 2017, Javelin Strategy & Research, 2018 Ibid.;

18 ATO Case Study (Communications Industry) my1pass Lost merchandise Chargeback fees Operating Expense 18

19 Business Cost of an ATO Attack Single Device 2,500 Affected Accounts $50K Revenue At Risk $75K Personnel Cost To Repair $5,000 Chargebacks $$$ Bad Brand Reputation 19

20 Consumer Cost of ATO 16 HOURS 62.2M HOURS $290 OUT OF POCKET COSTS $3.8M CONSUMER LOSSES 17% ATTRITION RATE Source: Javelin 2018 Identity Fraud: Fraud Enters a New Era of Complexity 20

21 v v v Synthetic Identity and First Party Fraud

22 Gartner Report - The Growing Problem of Synthetic Identity and First-Party Fraud Masquerades as Credit Losses March 2018 Credit Write-offs are Rising Loan Loss Y/Y % 2% a top 5 US Retail Bank reported a 26% increase in credit losses in Q Q2 Q3 1 First Data US Financial Institution Quarterly. December Volume 1, Issue 4 2 Surprise Surge in Card Defaults Sinks Capital One, Bloomberg.com 22

23 Possible explanations for increase in credit write-offs Unintentional Fraud Synthetic Identity Fraud First Party Fraud Stolen Identity Fraud

24 Possible explanations for increase in credit write-offs Unintentional Fraud Synthetic Identity Fraud First Party Fraud Stolen Identity Fraud

25 First Party Fraud Stopping first party fraud is a delicate process of determining the customer s intent But, how can you really know a customer s intent? First Party Fraud DIFFICULT TO DETECT Competing priorities: Customer experience (don t unnecessarily offend) Grow business - don t slow down approvals Stop the flood of never pay accounts and chargebacks

26 Synthetic Identity Fraud Address What is it? Creates a fake identity using elements of real and fabricated identities Synthetic Identity Fraud Deliberately defrauds by applying for credit with no intent to pay Frankenstein identity Phone Gov t ID #

27 Balances for Synthetic accounts have grown 300% since 2012 across all lines of business Balance Growth Q to Q Annual New Account Exposure ($ Millions) 1000% $1, % 800% 700% 600% 500% 400% Synthetic Consumers All Consumers $1,600 $1,400 $1,200 $1,000 $800 Bankcard Credit Limit Retail Card Credit Limit Auto Loan Amount Unsecured PL Loan Amount 300% $ % $ % $200 0% Bankcard Retail Card Auto Unsecured PL $ Source: TransUnion s Analytics Database 27

28 Synthetics are now charging off earlier in duration, indicating previous years were build up versus current cash out Cumulative Charge-off Rate By Account Open Quarter Dec 2012 vs. Dec 2015 Synthetics For synthetics present in 2015 and now have a charge-off, 70% of the accts were opened that same year For synthetics present in 2012, that rate was only 20% Source: TransUnion s Analytics Database 28

29 By 2021, first-party fraud and synthetic identity fraud will account for 40% of credit write-offs, up from an estimated 25% today. Source: The Growing Problem of Synthetic Identity and First-Party Fraud Masquerades as Credit Losses, Tricia Phillips, Danny Luong, 1 March GARTNER is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. and internationally, and is used herein with permission. All rights reserved. 29

30 Why does it matter what drives credit write-offs? Traditional underwriting, credit processes, and models are designed to determine credit worthiness NOT to detect fraud 30

31 v v v What to do?

32 Most fraud prevention methods can be burdensome on good customers 2018 TransUnion LLC All Rights Reserved 32

33 Online Banking Buyer s Journey Typical Issues: New Account Fraud Application Fraud Loan Stacking First Party Fraud Typical Issues: Account Takeover Customer Friction Typical Issues: Customer Friction Typical Issues: Account Takeover Call Center Fraud ACCOUNT CREATION / LOAN ORIGINATION LOGIN CHECK BALANCES CALL CENTER / CHANGE ACCOUNT DETAILS WITHDRAWL / TRANSFER MONEY Typical Issues: Wire Fraud Payment Fraud Bust-Out Fraud PAY BILLS Typical Issues: Payment Fraud MAKE OR SCHEDULE DEPOSITS Typical Issues: Customer Friction 33

34 Strategy for managing fraud at the front door IDENTITY ASSURANCE IDENTITY RISK SCORING DEVICE REPUTATION TRANSPARENT AUTHENTICATION MULTIFACTOR AUTHENTICATION

35 v v v Device Reputation

36 IF A DEVICE CAN CONNECT TO THE INTERNET, WE CAN RECOGNIZE IT... WITHOUT USING DIRECTLY IDENTIFYING PERSONAL INFORMATION TOR browser detected Proxy detected Emulator at work Watch list flag 36

37 The Association Effect Use a shared Device Web to reveal hidden associations FRAUD A user account on a mobile or web app ASSOCIATION ASSOCIATION User account #528 User account #921 User account #150 Leverage community intelligence FINANCIAL 1.1 Credit Card 1.2 ACH/Debit 1.3 Friendly Chargeback 1.4 Insufficient Funds 1.5 Fraud Other 1.6 Potential Fraud 1.7 Shipping Fraud 1.8 Counterfeit Money Order/Check 1.9 Click Fraud 1.10 Affiliate Fraud 1.11 First Party Fraud 1.12 Loan Default POLICY FRAUD 5.1 Application Fraud 1st Party 5.2 Application Fraud 3rd Party 5.3 Claims Fraud 1st Party 5.4 Claims Fraud 3rd Party B2B FINANCIAL 10.1 Business Identity Theft 10.2 Fictitious Business 10.3 Business Takeover 10.4 Dealer Fraud 10.5 Payment Evasion 10.6 Business Misrepresentation IDENTITY THEFT 4.1 True Identity Theft 4.2 Synthetic Identity Theft 4.3 Identity Mining (Phishing) 4.4 Account Take-Over / Hijacking 4.5 Failed MFA

38 IDVision with iovation data sources create a global network of fraud and risk insights Devices Analytics Communities Behaviors Risk Identity 2018 TransUnion LLC All Rights Reserved 38

39 v v v Device Based Authentication

40 Recognize Online Devices for Identity, Risk and Reputation 40

41 Device-based Authentication Customer Persistent Access Session Token User Access *** Account-to- Device Pairing & Risk Evaluation Match Grant Access Device Registration SUCCESS Step-Up No Match or Risk Signals *** 41

42 Security Risk Evasion IP Address Associations MyMyMobile Account Geolocation Total balance: Due Nov 2, 2018 $ Upgrade Your Device Jailbroken SEE MY BILL PAY MY BILL My wireless Plan: Family Ultra GB Used: CHANGE PLAN Initial Registration My Family Dan Sue Joey ADD LINE UPGRADE Authenticated 42

43 Measure Results ClearKey Authentication Consumer Experience Online Banking 100 Positive match, minimal change Many users benefit from improved experience No device associated with the account New registrations as a % 0 % Match % Non-Registerd % No Match % Registered Device is Registered, but these devices do not match 43

44 Transparent & Frictionless Simplify access for good users Lower barriers to usage Improve customer experience Transparent Auth Checklist Context & Risk Make sure you can react to context of the transaction and the user s behavior Configure risk rules to balance risk to user experience Use tools to detect attempts to evade recognition or mask identity Adaptive & Dynamic Dynamically react to changes in risk Deliver the right level of assurance Minimize account takeovers 44

45 v v v Multifactor Authentication

46 Multifactor Authentication Basics Something you KNOW Something you HAVE Something you ARE 46

47 LaunchKey Unified, Simplified, and Personalized Multifactor Authentication How can I provide strong, unified authentication for security-conscious customers? Through any channel, digital or physical 47

48 Call Center Reality What color was the sweater that you wore on May 15, minutes $1 per minute In which city is the address 28 Canton Road? Average call length of a Average cost per minute telecom help call of a customer service call in in 937 Average Good customers number of being fraudulent overly burdened calls Source

49 Use a Simple, Unified Experience Unify experience across online and offline touchpoints Reduce friction from multiple authentication modes Be contextual: With enough information, you shouldn t need to reauthenticate so often Multifactor Checklist Secure by Design Remove credential stores that can be compromised and exfiltrated Lock down with top grade cryptography Align with standards like OAuth and OpenID Strengthen App Equity Add functionality within existing customer experience Make sure it s future-proofed: Can you choose from a number of interactive or passive authentication options? Can you provide a customer experience to your customers? 49

50 v v v Fraud Prevention Without the Friction

51 Optimized Online Banking Buyer s Journey Solve For: New Account Fraud Application Fraud Loan Stacking First Party Fraud Solve For: Account Takeover Customer Friction Solve For: Customer Friction Solve For: Account Takeover Call Center Fraud ACCOUNT CREATION / LOAN ORIGINATION LOGIN CHECK BALANCES CHANGE ACCOUNT DETAILS IOVATION FRAUDFORCE FRAUDFORCE FRAUDFORCE Solve For: Wire Fraud Payment Fraud Bust-Out Fraud WITHDRAWL / TRANSFER MONEY PAY BILLS MAKE OR SCHEDULE DEPOSITS Solve For: Payment Fraud Solve For: Customer Friction DEVICE-BASED AUTHENTICATION MULTIFACTOR AUTHENTICATION DEVICE-BASED REPUTATION 51

52 Establish identity Authenticate consumers Prevent fraud Verify identity against a broad set of personal and digital data Utilize when an account is originated or provisioned Form a basis for greater identity confidence Validate the claimed identity is who they say they are Utilize authentication at specific touchpoints Employ methods that match the risk level Assess fraud risk of online transactions or identities Identify potentially fraudulent actions or behaviors Investigate suspicious behavior and inconsistent data elements 2018 TransUnion LLC All Rights Reserved 52

53 Q&A

54