Telephone banking fraud

In the current climate of indiscriminate banker bashing it is nice to see that one small part of the industry – UK payments – seems to be doing a good job. The UK Cards Association has reported that in 2011 payment card fraud dropped 7% to £341 million, a 10 year low, while online banking fraud dropped 24% to £36 million, despite an 80% increase in phishing attacks. Both effects are in large part thanks to the foresight of the UK industry in jointly deciding to build an EMV chip and PIN infrastructure some 10 years ago and then deploying Remote Chip Authentication (RCA) on the back of it – USA take note!

Meanwhile it is interesting to see that telephone banking fraud rose 32% to £17 million. This is of course a familiar pattern – as fraud is reduced in one channel it tends to migrate to the next weakest link. The question is how to tackle it.

As discussed previously (Banking Automation Bulletin b288, May 2011) the best approach may be to combine RCA with 3D Secure (MasterCard SecureCode and Visa VbV). For obvious reasons, the static 3D Secure password commonly used to secure e-commerce transactions cannot be used safely over the telephone. But if cardholders used RCA to generate a dynamic 3D Secure one-time-password this could not be re-used even if intercepted by fraudsters. In other words this would be a single, strong, chip and PIN based solution, not vulnerable to phishing or hacking attacks, which could be used for all remote banking and payment transactions over the telephone as well as the internet.

There is another option, however. Many years ago I worked at Stanford Research Institute (SRI) on deploying what was at the time very advanced speech technology at banks. Our main emphasis was on using speaker-independent speech recognition technology as a way to automate routine telephone banking transactions; today this is quite widespread. But we also looked at the flip-side of this – using speaker-dependent voice verification to authenticate customers over the telephone. The holy grail would be to combine both approaches in a super-convenient identification + authentication + fulfilment transaction over the telephone (“hello, this is Nick Collin – tell me the balance on my current account, and make it snappy”!). In the mid 1990s, it must be admitted that the voice verification technology was not quite mature enough for large scale commercial deployment. But we move on, and it would be interesting to know if the technology is now up to the job, and if so, whether any banks are looking at this option again.

Banking Automation Bulletin Article, April 2012, by Nick Collin