Risk Management

RETURN FRAUD- The e-commerce way of Shop-Lifting

The pandemic changed the way consumers shopped. A black swan event changed consumer behavior and Online shopping is one of the segments to reap benefits. The pandemic and the exponential growth in e-commerce forced traditional brick-and-mortar shops to adapt to the evolution. Pre-pandemic brick-and-mortar shops kept a cautious eye on shoplifters but the e-commerce boom came up with its own shoplifting nemesis, say Hello to RETURN FRAUD. Fraudsters abuse the retailer’s fraud policy which was actually created for customer delight and it’s the smaller e-retailers who bear the brunt of Refund Fraud. The modus operandi of Refund Frauds differs from traditional frauds as it takes place post transaction — once the goods have exchanged ownership from the merchant to the consumer. A thriving ecosystem, Fraud-as-a-Service (Professional Refunders) has come into place to support those who wish to take advantage of lax return policies without actually having to go through the process. Reddit and Discord channels are leveraged as promotional grounds for these Illegal Life Pro Tips (ILPT) Modus Operandi 1. Everything is legitimate during the online transaction. Fraud is initiated once the good is received by the consumer. 2. Consumer goes to a Professional Refunder who charges a percentage cut on the refund value. 3. Refunder impersonates the Consumer 4. Refunder initiates the escalation with the merchant and uses the PERFECTED METHODS to get a refund without returning the product. A few of the Perfected Methods : a) Substance Leak — With doctored images/videos refunders report hazardous breakage such as monitor capacitor leakage, or battery acid leakage, thus making the product legally un-shippable. b) Partially Empty Box — Generally used for tracked shipping where the package is claimed to have arrived but has missing components. c) Fake ID Tracking Numbers — A properly weighed package is returned back without the actual goods. The shipping address is doctored to a new but incorrect address. Refunder then initiates a return claim with the merchant — to whose naked eye the package appears to be shipped and delivered back. d) Blood or Maggots — Claiming of finding questionable substances (again, doctored images/videos) in the product received and thus a reason for why one can’t possibly handle the opened package. Refund Fraud not only is a concern to merchants but also runs a risk of putting consumers’ virtual assets at risk such as email, passwords, card details, etc — as refunders offer Fraud-as-a-Service, access to the buyer account. Apart from the complicated methods listed above employed by professional refund fraudsters, consumers, with a Robin Hood mentality, too are learning about refund fraud and executing Refund Fraud as : a) Bricking: A working item ( generally electronic items) is purchased with the intention to be returned after stripping down the valuable component and rendering the item eventually unusable. b) Wardrobing: Majorly observed with expensive clothing. An item is purchased, used, and eventually returned. c) Switch Fraud: Returning a previously owned defective or damaged identical item with the aim of cashing on to the refund. Be it the retailers or the e-retailers have a return policy in place but a fine balance needs to be maintained — neither overly complex nor overly relaxed. The process of refund dents a blow to the bottom line not only in terms of labor involved in the process but also in refurbishing the returned items. Trying to avoid Return Fraud by adding manual resources will be a mountain task in this era of data where organizations are sitting on a mountain of data as well as leveraging data from other sources. Multiple data enrichment tools provide services as quick reverse checks on multiple data points for instance email addresses. Current innovations in fraud detection software over the recent years have made it possible to curb the menace of fraud even with very little technical knowledge. Author: Sujit Kumar Mahato, Product Manager Wibmo A PayU/Naspers FinTech Company Fraud, Fraud Detection, Fraud Prevention, Return Fraud, Risk Management

RETURN FRAUD- The e-commerce way of Shop-Lifting Read More »

Importance of Fraud and Risk Management Solutions for Financial Institutions

Technology and trust must go hand in hand Technologies are undoubtedly transformative for businesses and their customers. But to fully deliver the promised benefits, technologies must consciously build trust amongst all legitimate users and stakeholders. Trustworthiness is becoming critical by the day in an increasingly digital world because of the rising incidence of online fraud. Just as quality at the source is a mantra for manufacturing companies, the detection, and prevention of fraudulent transactions as soon as they originate is important for banks and financial institutions. At the same time, customer convenience has to be balanced out. Regulators expect banks to enhance their digital abilities to detect/prevent frauds/crimes Regulators play a key role in ensuring the safe, smooth, and efficient functioning of the banking and financial systems within their individual jurisdictions. As such, central banks worldwide have begun to tighten various regulatory requirements in order to reduce the risk of fraud made possible by technological or process loopholes in the systems used by banks and other financial institutions. In March 2022, the Bangko Sentral NG Pilipinas (“BSP”, the central bank of the Philippines), published amendments to its “Regulations on Information Technology Risk Management” with the specific objective of enhancing customer protection. To ensure that digital banking channels are made safer and more reliable, the BSP requires banks operating in the Philippines to implement automated and real-time fraud monitoring and detection systems capable of identifying and blocking suspicious or fraudulent online transactions. Starting 1 September 2022, banks must be prepared to show BSP their action plans; and full compliance with a readiness plan is expected by 31 December 2022. While the Fraud Management systems implemented must commensurate with the bank’s operations and the scope of its digital platforms, BSP does expect that the solutions that banks put in place will, at a minimum, deliver the following capabilities: · Monitoring, collecting, and analyzing transaction data arising from all physical and digital banking and non-banking channels; · Integration with the bank’s Anti Money Laundering (AML) systems to provide a more robust and comprehensive mechanism to prevent financial crimes (and not just detect them); · Building customer profiles and analyzing behavior to detect frauds based on changes in usage patterns; and · Secure scalability to handle growing transaction volumes. FRM solutions must give robust Fraud detection and prevention capabilities without damaging customer relationships Frauds and other operational risks not only damage customer confidence in individual banks (and the banking system as a whole) but can also lead to financial losses (reparations, penalties) and harm your brand/reputation. Clearly, the costs of not having a state-of-the-art Fraud & Risk Management System (FRMS) are high. While there are many FRMS solutions out there, not all of them are equally efficacious. This is because each one uses different protocols to detect and analyze risks and thereafter, determine further courses of action. Wibmo’s Trident FRM platform offers multiple advantages Wibmo’s Trident is an enterprise fraud and risk management platform that uses advanced authentication protocols and ML-driven statistical models. Our platform makes approval/ challenge/ decline decisions based on rigorous, real-time assessment of more than 100 parameters related to the device, user, and transaction (e.g., merchant, location, IP address, time of the transaction, value, etc.). This Risk-Based Authentication (RBA) approach provides a more robust and reliable assessment of the risk of every individual transaction. The omnichannel capability of the platform is an added advantage wherein the bank’s operations team gets a central view of their customer’s transactions across channels For banks operating in the Philippines, Trident can ensure full compliance with BSP’s amended regulations within the stipulated timeframe. However, irrespective of where your bank operates, there are many other reasons why Trident could be the right FRMS solution for your bank: · Many banks rely on disparate legacy systems and point solutions for specific functions (e.g., AML, branch-based KYC transactions, etc.). Integrating data from myriad systems is neither easy nor efficient; the chain is only as strong as the weakest link. Therefore, our risk management platform is API-driven. What is more, it uses 360o degree customer data and insights to detect anomalous behaviors that might indicate fraud or misuse. · Trident is sensitive to the need for banks to deliver a seamless, speedy, and superior customer experience for every legitimate transaction; this minimizes customer friction– key to building loyalty and enhancing lifetime value. · Customers (and fraudsters) can use multiple channels to effect transactions (e.g., 3DS, mobile payment, ATM/POS, online retail/corporate banking). The FRMS solution your bank adopts must be able to function equally effectively- and seamlessly- across channels (to handle situations where customers legitimately switch channels). Our platform uses AI/ML to safeguard customers, merchants, card issuers, and networks in an omnichannel environment. Sometimes, frauds are perpetrated at the merchant level (e.g., by employees misusing customer cards for fraudulent transactions). The Trident platform can detect and prevent such misuse as well. Trident enables full compliance with FATF and AML-CFT, thus helping to prevent financial crimes. · Your bank works with various card networks (Visa, MasterCard, American Express, etc.). Trident is compatible with all networks; it gives you get a network-agnostic RBA score thus strengthening your bank’s overall ability to detect, prevent and manage fraud risks. · Trident can be fully deployed on Cloud, thus assuring high availability and scalability so that 100% of your bank’s transactions are processed in real-time to validate the authenticity and assess risk before completion. · Our FRMS platforms are rules-driven. This lets your bank respond quickly to emerging threats with the help of “quick rules” and “expression rules” for more complex threat scenarios. The bank will also be equipped with Rule Wizard wherein the operations team can build rules on the fly · Quick investigation and resolution of transactions are important to ensure customer satisfaction, and regulatory reporting/compliance as well as enhancing the bank’s preparedness to prevent future false positives. Efficient and workflow-driven case management capabilities built into our platform allow investigators to track, investigate and resolve transactions quickly. This also reduces your bank’s operational expenses– a major benefit gave the pressure on margins. · Banks that adopt

Importance of Fraud and Risk Management Solutions for Financial Institutions Read More »

DevSecOps — A necessity in the current landscape

Let’s start with the basics here. Traditionally, we followed Software Development Life Cycle, in short SDLC, a structured approach to develop quality software that meets customer requirements. With a rapid evolution in lifestyle, we moved to the Agile method which is one of the variants of SDLC to develop software in an iterative and fast way. While the agile methodology aims to develop a software or a component of software quicker, there is a need to deploy that component at equal speed in production set up to make it available to the user community. This development process along with the deployment process is together referred to as DevOps. Essentially, DevOps refers to the continuous integration of a software component and its continuous deployment. Now, thinking of security from the early stage of the development cycle instead of retrospectively fitting at the end of the cycle, transcends DevOps to DevSecOps. Here, we are shifting Security at the early stage of the cycle, i.e., shifting to the left of the cycle, which is referred to as Shift Left. To establish an analogy, may not be exact but a crude analogy to understand better, let’s look at some of the household work like cooking. I cook in my free time at home. After cooking, I request my wife to serve the food to family members. Here, the cooking process is Development, serving process is Operations, together with cooking and serving process is DevOps. Now, it’s important to understand in this example what is DevSecOps. While cooking, I am concerned about the hygiene of the food from the beginning, else, retrospectively fitting hygiene is very difficult. Therefore, the cooking and serving process along with maintaining hygiene in the entire process is DevSecOps. In a rapidly moving world where technology is easing the way we do business and lead life, there is a rapid increase in threats to the technology landscape by fraudsters or individuals with malicious intent. Therefore, it’s imperative that security is looked at from the very early stage of the development cycle and all possible threat vectors are identified and appropriate controls or safeguards are built into the software to protect the software and therefore protect its user community and ultimately customers. Let’s look at some of the benefits of DevSecOps. Continuous integration (CI) — merges code changes to ensure the most recent version is available to developers. Continuous delivery and continuous deployment (CD) — automate the process of releasing updates to increase efficiency. Microservices — builds an application as a set of smaller services. Infrastructure as code (IaC) — designing, implementing, and managing app infrastructure needs through code. Common weaknesses enumeration (CWE) — improves the quality of code and increases the level of security during the CI and CD phases. Threat modeling — implements security testing during the development pipeline to save time and cost in the future. Automated security testing — test for vulnerabilities in new builds on regular basis. Incident management — creates a standard framework for responding to security incidents. Fast delivery — achieve ensure fast delivery of application by embedding automated security controls and tests early in the development cycle. Enriched efficiency — higher efficiency by scanning code for vulnerabilities as it’s written. Automotive: reduce lengthy cycle times while still meeting software compliance standards. Digital Transformation: enable digital transformation efforts while maintaining the privacy and security of sensitive data per regulations such as GDPR. Code analysis — deliver code in small chunks so vulnerabilities can be identified quickly. Compliance monitoring — be ready for an audit at any time that means being in a constant state of compliance, including gathering evidence of GDPR compliance, PCI compliance, etc. Threat investigation — identify potential emerging threats with each code update and be able to respond quickly. Vulnerability assessment — identify new vulnerabilities with code analysis and accordingly analyze how quickly they are being responded to and patched. Security training — train software and IT engineers with guidelines for set routines. Source: https://accelera.com.au/ To conclude, DevSecOps is a cultural shift which means security is a shared responsibility, and everyone participating in SDLC has to a play very vital role in building security into the DevOps workflow. Author: Ravi Bhushan, Head- GRC and Ritesh Prasad, Manager DevOps+SRE Wibmo A PayU/Naspers FinTech Company Compliance, DevOps, Infosec, Risk Management, Security

DevSecOps — A necessity in the current landscape Read More »