Reading List Archives - Page 4 of 4 - Digital Payments, Payment Security and Lending

Account Takeover Frauds- Adaptive Protection Approach

Sujit Kumar Mahato / August 31, 2022

Once a fraudster has gained access to an account, they eventually end with either or combination of the following : – Make fraudulent orders – Reload digital wallets – Use loyalty points – Sell the confirmed account – Extract customer data to sell The process of gaining access to a victim’s login credentials to steal funds or information is referred to as Account Takeover Fraud (ATO). Fraudsters can take over any account type — bank, e-commerce, etc and have multiple ways at their disposal to trick gullible victims. Account takeover fraud is not new, but it is becoming more common. In 2018, account takeover fraud losses totaled around $4 billion. By 2021, this figure had increased by more than 200%. (PaymentsJournal) Fraudsters are finding innovative ways to carry out their trade. Screen-sharing apps are one of the newest additions to their arsenal as more and more individuals adopted digital payments during the pandemic for daily transactions. These screen-sharing apps were developed with the intention to provide tech support using the screen-sharing feature. However, these apps are now being used by fraudsters to access the mobile devices of their targets and make transactions without waiting for victims to share OTPs. Often gullible consumers fall prey to fraudsters pretending as bank officials who create urgency on the pretext of account/card block and ask users to download screen-sharing apps for account retrieval. Once installed, fraudsters have a clear view of not only the account credentials but also the OTP messages received over the phone, and consumers eventually end up with debit messages of their hard-earned money. One of the growing concerns is that ATO frauds are happening through screen-sharing apps despite the constant efforts from government agencies and banks to educate consumers not to share sensitive financial information or download apps from suspicious sources. Apart from the recent Screen Sharing Apps, a few of the other methods deployed by fraudsters to conduct Account Takeover Fraud (ATO) are : – Phishing: Impersonating as representatives of well-known brands/ businesses, the fraudster persuades the individual to click on links that redirect to spoof websites or install malware that does the credential harvesting. – Credential Stuffing ( Brute-Force): Dark web provides bank account/card details at a cost as low as USD 15. Once the fraudster has sourced a list of stolen credentials from the Dark Web, bots are used to run automated scripts to guess the correct account password by making multiple login attempts with a different password each time Account takeovers can significantly damage customer trust and brand reputation. Often, businesses introduce tighter security measures and add verification steps, but too much of either can harm the user experience. The need of offering an experience that is welcoming to consumers and hostile to fraudsters can be addressed through an adaptive protection approach. Billions of transactions take place across the globe generating valuable data points which are utilized in the concept of adaptive protection and the ability to run through layers of controls in real-time — including consumer behaviors and network anomalies — to determine whether a user should be pushed through with no friction, declined or given an alternative experience. Differentiating between good users and fraudsters helps in avoiding account takeover fraud. Wibmo’s TRIDENT FRM, an enterprise fraud, and risk management solution, evaluate diverse data points across channels and devices for the risk associated with each transaction. Learning and adapting to evolving consumer behavior as well as fraud patterns, TRIDENT FRM helps to detect and predict fraud while ensuring a delightful user experience. Author: Sujit Kumar Mahato, Product Manager Wibmo A PayU/Naspers FinTech Company Account Takeover, Fraud Detection, Fraud Prevention, Online Payments

Reading List, Stories

RETURN FRAUD- The e-commerce way of Shop-Lifting

Sujit Kumar Mahato / August 24, 2022

The pandemic changed the way consumers shopped. A black swan event changed consumer behavior and Online shopping is one of the segments to reap benefits. The pandemic and the exponential growth in e-commerce forced traditional brick-and-mortar shops to adapt to the evolution. Pre-pandemic brick-and-mortar shops kept a cautious eye on shoplifters but the e-commerce boom came up with its own shoplifting nemesis, say Hello to RETURN FRAUD. Fraudsters abuse the retailer’s fraud policy which was actually created for customer delight and it’s the smaller e-retailers who bear the brunt of Refund Fraud. The modus operandi of Refund Frauds differs from traditional frauds as it takes place post transaction — once the goods have exchanged ownership from the merchant to the consumer. A thriving ecosystem, Fraud-as-a-Service (Professional Refunders) has come into place to support those who wish to take advantage of lax return policies without actually having to go through the process. Reddit and Discord channels are leveraged as promotional grounds for these Illegal Life Pro Tips (ILPT) Modus Operandi 1. Everything is legitimate during the online transaction. Fraud is initiated once the good is received by the consumer. 2. Consumer goes to a Professional Refunder who charges a percentage cut on the refund value. 3. Refunder impersonates the Consumer 4. Refunder initiates the escalation with the merchant and uses the PERFECTED METHODS to get a refund without returning the product. A few of the Perfected Methods : a) Substance Leak — With doctored images/videos refunders report hazardous breakage such as monitor capacitor leakage, or battery acid leakage, thus making the product legally un-shippable. b) Partially Empty Box — Generally used for tracked shipping where the package is claimed to have arrived but has missing components. c) Fake ID Tracking Numbers — A properly weighed package is returned back without the actual goods. The shipping address is doctored to a new but incorrect address. Refunder then initiates a return claim with the merchant — to whose naked eye the package appears to be shipped and delivered back. d) Blood or Maggots — Claiming of finding questionable substances (again, doctored images/videos) in the product received and thus a reason for why one can’t possibly handle the opened package. Refund Fraud not only is a concern to merchants but also runs a risk of putting consumers’ virtual assets at risk such as email, passwords, card details, etc — as refunders offer Fraud-as-a-Service, access to the buyer account. Apart from the complicated methods listed above employed by professional refund fraudsters, consumers, with a Robin Hood mentality, too are learning about refund fraud and executing Refund Fraud as : a) Bricking: A working item ( generally electronic items) is purchased with the intention to be returned after stripping down the valuable component and rendering the item eventually unusable. b) Wardrobing: Majorly observed with expensive clothing. An item is purchased, used, and eventually returned. c) Switch Fraud: Returning a previously owned defective or damaged identical item with the aim of cashing on to the refund. Be it the retailers or the e-retailers have a return policy in place but a fine balance needs to be maintained — neither overly complex nor overly relaxed. The process of refund dents a blow to the bottom line not only in terms of labor involved in the process but also in refurbishing the returned items. Trying to avoid Return Fraud by adding manual resources will be a mountain task in this era of data where organizations are sitting on a mountain of data as well as leveraging data from other sources. Multiple data enrichment tools provide services as quick reverse checks on multiple data points for instance email addresses. Current innovations in fraud detection software over the recent years have made it possible to curb the menace of fraud even with very little technical knowledge. Author: Sujit Kumar Mahato, Product Manager Wibmo A PayU/Naspers FinTech Company Fraud, Fraud Detection, Fraud Prevention, Return Fraud, Risk Management

Industry Insights, Product, Reading List

Importance of Fraud and Risk Management Solutions for Financial Institutions

Ravi Battula / August 16, 2022

Technology and trust must go hand in hand Technologies are undoubtedly transformative for businesses and their customers. But to fully deliver the promised benefits, technologies must consciously build trust amongst all legitimate users and stakeholders. Trustworthiness is becoming critical by the day in an increasingly digital world because of the rising incidence of online fraud. Just as quality at the source is a mantra for manufacturing companies, the detection, and prevention of fraudulent transactions as soon as they originate is important for banks and financial institutions. At the same time, customer convenience has to be balanced out. Regulators expect banks to enhance their digital abilities to detect/prevent frauds/crimes Regulators play a key role in ensuring the safe, smooth, and efficient functioning of the banking and financial systems within their individual jurisdictions. As such, central banks worldwide have begun to tighten various regulatory requirements in order to reduce the risk of fraud made possible by technological or process loopholes in the systems used by banks and other financial institutions. In March 2022, the Bangko Sentral NG Pilipinas (“BSP”, the central bank of the Philippines), published amendments to its “Regulations on Information Technology Risk Management” with the specific objective of enhancing customer protection. To ensure that digital banking channels are made safer and more reliable, the BSP requires banks operating in the Philippines to implement automated and real-time fraud monitoring and detection systems capable of identifying and blocking suspicious or fraudulent online transactions. Starting 1 September 2022, banks must be prepared to show BSP their action plans; and full compliance with a readiness plan is expected by 31 December 2022. While the Fraud Management systems implemented must commensurate with the bank’s operations and the scope of its digital platforms, BSP does expect that the solutions that banks put in place will, at a minimum, deliver the following capabilities: · Monitoring, collecting, and analyzing transaction data arising from all physical and digital banking and non-banking channels; · Integration with the bank’s Anti Money Laundering (AML) systems to provide a more robust and comprehensive mechanism to prevent financial crimes (and not just detect them); · Building customer profiles and analyzing behavior to detect frauds based on changes in usage patterns; and · Secure scalability to handle growing transaction volumes. FRM solutions must give robust Fraud detection and prevention capabilities without damaging customer relationships Frauds and other operational risks not only damage customer confidence in individual banks (and the banking system as a whole) but can also lead to financial losses (reparations, penalties) and harm your brand/reputation. Clearly, the costs of not having a state-of-the-art Fraud & Risk Management System (FRMS) are high. While there are many FRMS solutions out there, not all of them are equally efficacious. This is because each one uses different protocols to detect and analyze risks and thereafter, determine further courses of action. Wibmo’s Trident FRM platform offers multiple advantages Wibmo’s Trident is an enterprise fraud and risk management platform that uses advanced authentication protocols and ML-driven statistical models. Our platform makes approval/ challenge/ decline decisions based on rigorous, real-time assessment of more than 100 parameters related to the device, user, and transaction (e.g., merchant, location, IP address, time of the transaction, value, etc.). This Risk-Based Authentication (RBA) approach provides a more robust and reliable assessment of the risk of every individual transaction. The omnichannel capability of the platform is an added advantage wherein the bank’s operations team gets a central view of their customer’s transactions across channels For banks operating in the Philippines, Trident can ensure full compliance with BSP’s amended regulations within the stipulated timeframe. However, irrespective of where your bank operates, there are many other reasons why Trident could be the right FRMS solution for your bank: · Many banks rely on disparate legacy systems and point solutions for specific functions (e.g., AML, branch-based KYC transactions, etc.). Integrating data from myriad systems is neither easy nor efficient; the chain is only as strong as the weakest link. Therefore, our risk management platform is API-driven. What is more, it uses 360o degree customer data and insights to detect anomalous behaviors that might indicate fraud or misuse. · Trident is sensitive to the need for banks to deliver a seamless, speedy, and superior customer experience for every legitimate transaction; this minimizes customer friction– key to building loyalty and enhancing lifetime value. · Customers (and fraudsters) can use multiple channels to effect transactions (e.g., 3DS, mobile payment, ATM/POS, online retail/corporate banking). The FRMS solution your bank adopts must be able to function equally effectively- and seamlessly- across channels (to handle situations where customers legitimately switch channels). Our platform uses AI/ML to safeguard customers, merchants, card issuers, and networks in an omnichannel environment. Sometimes, frauds are perpetrated at the merchant level (e.g., by employees misusing customer cards for fraudulent transactions). The Trident platform can detect and prevent such misuse as well. Trident enables full compliance with FATF and AML-CFT, thus helping to prevent financial crimes. · Your bank works with various card networks (Visa, MasterCard, American Express, etc.). Trident is compatible with all networks; it gives you get a network-agnostic RBA score thus strengthening your bank’s overall ability to detect, prevent and manage fraud risks. · Trident can be fully deployed on Cloud, thus assuring high availability and scalability so that 100% of your bank’s transactions are processed in real-time to validate the authenticity and assess risk before completion. · Our FRMS platforms are rules-driven. This lets your bank respond quickly to emerging threats with the help of “quick rules” and “expression rules” for more complex threat scenarios. The bank will also be equipped with Rule Wizard wherein the operations team can build rules on the fly · Quick investigation and resolution of transactions are important to ensure customer satisfaction, and regulatory reporting/compliance as well as enhancing the bank’s preparedness to prevent future false positives. Efficient and workflow-driven case management capabilities built into our platform allow investigators to track, investigate and resolve transactions quickly. This also reduces your bank’s operational expenses– a major benefit gave the pressure on margins. · Banks that adopt

Industry Insights, Reading List

Understanding ONDC and what banks must do to benefit from it

Wibmo / July 15, 2022

Introduction: what is ONDC and why it is a game-changer for India India’s digital commerce industry is growing rapidly. From around US$38 Billion in 2021, it is expected to touch US$120 Billion by 2026 (source: KNN India), and possibly cross US$200 Billion by 2029 (source: India TV News). Given the country’s demographics and internet penetration, digital commerce is still an underserved market in India. Thus far, its biggest beneficiaries have been large monopolistic marketplaces/platforms because of the massive investments needed. But there is a change in the air. Technology-led innovations such as India’s Open Network for Digital Commerce (“ONDC”) are creating open, network-centric digital commerce models to compete with existing platform-centric models. ONDC promises to revolutionize the country’s digital commerce landscape by democratizing access/participation. Over the next few years, the transformative effect will be similar to what UPI has done for digital payments. ONDC is a public infrastructure project being executed by a non-profit organization under the aegis of the Government of India’s Department for the Promotion of Industry and Internal Trade. In April 2022 pilot projects began in five Indian cities; 100 cities are to be covered by the end of August 2022. A number of public and private sector banks (e.g., SBI, PNB, Kotak Bank, Axis Bank, HDFC Bank) have already invested in ONDC. The “my way or the highway” approach taken by many proprietary e-commerce platforms has led to predatory practices. Smaller businesses are disadvantaged because they inherently lack bargaining power vis-à-vis these e-commerce marketplaces/platforms. ONDC aims to create a level playing field for thousands of small businesses across India as well as customers living in rural areas and smaller towns so that they can all benefit from digital commerce. ONDC is effectively a platform that allows you as a consumer to search and buy products/services that are currently offered only on multiple marketplaces, without having to log into each of them. You can conveniently browse and buy products that are listed on Amazon, Flipkart, Meesho, Myntra, Neu, or indeed anywhere else- using just one app. As a seller, registering on this platform gives you access to customers of multiple marketplaces. There is no need to list on multiple marketplaces, be tied to specific delivery partners, or comply with the different requirements of these platforms. The main beneficiaries of ONDC ONDC is designed to benefit three main categories of stakeholders: · Small businesses/suppliers of goods and services, who can access a larger market; · Customers across India (especially those in smaller towns and rural areas), who will get greater choice and better prices; and · Banks, who get another chance to be a relevant intermediary in digital commerce (both in the retail and SME space). Since the launch of UPI-based payments in 2016, proprietary payment platforms owned by non-banking players such as Google, Amazon, PayTM, etc. have accounted for a majority of digital payment transactions, especially in the retail space. Banks found themselves left behind. Both sellers/merchants and buyers/consumers are banks’ traditional customers, but third-party digital apps have effectively disintermediated them. By registering on ONDC, banks can offer solutions to both sets of customers. Banks get the opportunity to efficiently monetize their relationships with customers- a key source of competitive advantage in an increasingly digital, ecosystem-driven world. ONDC will give banks access to a much larger base of prospects and customers; it will also allow banks to offer these customers a larger bouquet of products/services (both banking as well as those offered by partners on the network). For example, banks can target retail customers with offers related to insurance, wealth management, loans, deposits, etc. Just as important is the opportunity that ONDC will provide banks to deepen their relationships with Current Account customers. India’s SMEs in particular have begun to gravitate towards fintech players and if this trend intensifies, it can spell trouble for corporate banks. Given that ONDC is designed to attract large numbers of SMEs, it affords banks a good opportunity to build and strengthen their relationships with customers in this segment by offering a larger portfolio of services, including working capital loans, Capex loans, export credit, etc. Thus, banks that choose to be part of ONDC can expect to capture greater mindshare (and hence, wallet share) of customers who choose to be active on the ONDC network. Given the “all-digital” nature and national/global reach of the ONDC, banks no longer need to worry about catering only to “local” customers (whether retail or corporate). Across segments, ONDC can help banks reduce costs of customer acquisition and service delivery, thereby boosting profitability and margins. Banks will need to upgrade their technology stacks to benefit from ONDC To offline merchants/sellers, banks either offer QR codes or PoS-based payment solutions or Open Banking based Payment Gateways to e-commerce players. Therefore, banks need a deep integration of their mobile apps with those of partner merchants and/or aggregators to enable customers to use their mobile banking apps. The objective is to build stickiness for the banks’ mobile apps, but the absence of an industry-standard protocol makes this expensive and time-consuming. All this will change with ONDC. Instead of direct integration with merchant apps, banks will need the capability to connect with the ONDC platform using a standard Beckn protocol, which is an “open, interoperable and universal transaction protocol to enable a decentralized digital economy,”(source: beckn). This will enable customers to use the bank’s app to: · easily register on the ONDC platform and discover products/services; · search for products/services they need using criteria such as geo-location, sellers, price ranges, etc.: · Make purchases; and · Manage returns and resolve disputes more easily and speedily. Provided banks are ready with the necessary technology components for ONDC, they can thus deliver access to a wider range of products/services as well as a smoother customer experience. Merchants joining ONDC will expect banks to provide a complete Digital Commerce solution that seamlessly integrates offline/online registration on the platform with transaction experience and banking services such as collecting customer payments and paying suppliers. Banks

Industry Insights, Reading List

Things you must know about Tokenization — talk of the town

Ravi Battula / July 6, 2022

After the industry requested more time to comply with the latest data security rules, the Reserve Bank of India mandated the implementation of tokenization of card transactions, with a deadline of June 30, 2022, which is further extended to September 30, 2022. So, what exactly is tokenization? And how would it aid in the security of online transactions? Tokenization is a process of replacing sensitive information with non—sensitive information [token]either completely or partially, rendering the token useless for the unintended users. Tokens are irreversible, original data cannot be derived back using a key, unlike the cryptographic process. It follows the principle of ‘pseudonymization’ [Pseudo Anonymization or simply put alias or surrogate] for sensitive data like Aadhar, SSN, Credit Card, Bank ac/c, phone, or DOB. A tokenization system links the original data to a token but does not provide any way to decipher the token and reveal the original data. For e.g. in the case of a card/PAN, Token PAN is generated using the Format Preserving Hash which is irreversible PAN, and Lunch’s check is passed on the same so all the card validations on the token are also successful and follow card network rules. Original PAN: 7654 1111 1111 1111 Token PAN: 6667 2397 1422 2655 [Identical to PAN but of no value for a bad actor as it cannot be used without the valid Token Requestor and Merchant Id combination.] Any token generated for a card will inherit the key attributes of the original card e.g. expiry date, product code, card art, etc. Tokenization is a secure method of storing payment information. In essence, a token (an alias or a Pseudo number) is generated for the stored payment card. As a result, simply possessing the token does not grant you access to the card information without first passing through the tokenization system. When we apply this to the real world, we can see the benefits. Consider a website that sells specific products but also offers recurring deliveries. When a client purchases from the website for the first time, they will enter their credit card information themselves; however, for recurring transactions (such as the delivery of specific cosmetics on the first day of each month, for example), the information must be stored by the website in order for a monthly payment to be made. If card information is not stored securely, unauthorized personnel or even bad actors can gain access, causing a nuisance for the consumer and a serious problem for the merchant resulting in chargebacks. To solve this problem in the simplest way possible, we turn to tokenization. When a client first enters his card details, the payment platform collects the information and sends it to the tokenization system, which returns the token to the website and processes the payment. The token will be stored on the website in conjunction with the information entered during the registration process. For a Standing Instruction when the merchant website needs to charge the client on a recurring basis, it will simply send the amount and the token to the payment platform. The payments platform will then send the token to the tokenization system, which will map the card number against the token and complete the transaction on behalf of the customer. The website does not need to store the actual card details to process recurring payments using this method, and the payment process is limited to the dialogue between the tokenization system and the payment platform, both of which have high levels of security. Tokenization inherently uses a pseudonymization process to replace sensitive data with random data. Card tokens are intent-based which is unique per merchant. Card tokens generated at one merchant cannot be used at other merchants. In case of any data compromise at a particular merchant/entity, it cannot be used for any other purpose. Even if the bad actor wants to use the stolen token at the same merchant, they will also need the cryptographic keys to initiate any transactions which are almost impossible to get access to organization cryptographic keys. Hence tokenization makes the data storage, data transmission, and data usage very secure without worrying about misuse. In this case, the user would simply delete/cancel the token for a particular merchant only as opposed to canceling the card and managing storage at all other locations Because online shopping is becoming more popular by the day, cybercrime has skyrocketed so as data proliferation, both businesses and their customers must now rely on secure online solutions for all types of transactions. This means that more credit card information is being stored and processed, providing more opportunities for cybercriminals. Security solutions such as tokenization are arguably more important than ever before, as they can assure clients that their sensitive data is much more secure, thereby fostering trust and loyalty between businesses and consumers. Benefits of tokenization on your cards : · With rising subscriptions and recurring economy, intent-based unique tokens enable users to manage multiple subscriptions (COF or SI) very securely · Can be used for an online card on file and device-based tap n pay contactless payment on mobile devices · Greater protection against data theft due to higher storage security · Higher customer control to view and manage tokens and set controls · Bring standardization for card storage across the ecosystem rather than every entity implementing their own standards The Wibmo Areion ‘Token Hub,’ built in accordance with EMVCo standards, is the only unified tokenization solution for merchants, acquirers, Issuers, and Fintechs. It ensures that you are in compliance with the latest RBI guidelines while also providing a frictionless payment experience. To find out more, write to: [email protected] Author: Ravi Battula, Vice President, Merchant Acquiring Business Wibmo A PayU/Naspers FinTech Company Card Payment, Card Token, Digital Payment, Online Payments, Tokenization

Industry Insights, Product, Reading List

Why is Biometric Authentication becoming the headline in the world of Digital Payments?

Shatrughan Sharma / March 24, 2022

The last decade has witnessed a progressive adoption of technology in almost all the industry. Few industries like banking and fintech have embraced the technology to grow in leaps and bounds. The revolutionizing spread of internet has ushered in an incredible increase in the number of the users and in turn the addressable market. The hitherto latent yet humongous body of rural population is today enabled with fintech services like online payment and transaction and even Ecom. The one word which has propelled the whole population into the digital payment however is rather old fashioned -TRUST Let’s dive deeper with an example. When a small business owner from a village in Bihar pays a vendor residing in another state, he needs be assured that the payment would indeed be done. Similarly, a migrant labourer, slogging in the southern state need to believe that his hard earned money is indeed going to reach his family in a matter of minutes if not seconds. However both the people also need assurances that it would be paid only to the intended parties and not to anyone else! Authentication: The foundation of trust in the digital payment space Authentication is used most commonly to assure the consumers of reliability. However, the question remains if the authentication mechanisms used currently produce the highest levels of trustworthiness. Let’s delve into the circumstances where multifactor authentication is the best option. The following two out of the three ways have proved to be a strong medium for payment authentications: · Possession: for example, a documented identify or device, etc. · Knowledge: for example, a password or secret, etc. · Inherence: for example, their fingerprint, hand, face, etc. History of Biometrics — An evolved tool used in payment securities Although biometrics go way back into human history, the contemporary commercial usage of biometric authentication began in the mid-nineteenth century using fingerprints by William James Herschel, a British administrator in India. Biometric authentication gained popularity among consumers and service providers with the rising usage of feature-rich smartphones and other devices enabled with high-resolution cameras. The instant gratification was stoked with the biometric authentication as it is based on the biological traits which are unique to every individual and cannot be faked. One of the most widely used examples of biometric usage is that of Aadhaar card in the Indian Market: All Indian residents are given an Aadhaar number, which is a 12-digit unique identification number. This figure is derived from their biographic and biometric data (a photograph, ten fingerprints, two iris scans). The concept was originally related to government subsidies and unemployment benefits, but as its authenticity is proved, it now includes a payment scheme. The growth of biometric payments in a post-pandemic world According to global surveys, the pandemic has heightened awareness and acceptance of biometric payments. This popularity doesn’t show any signs of abating as we step into the post-pandemic era, thanks to a focus on sanitation and contactless payments. Biometric authentication is popular due to the simple and uncomplicated process that it entails. Unlike the conventional authentication techniques, which suffer from glitches like not getting an OTP or issues with the strength of the internet network. Biometric payments are becoming more popular in large and densely populated countries such as Russia, South Africa, Kenya, Nigeria, Ukraine, India, and others. Consumers sense the simple and foolproof option of biometric authentication is safer, quicker, and simpler. Biometric authentication provides several advantages over knowledge-based and possession-based authentications: 1. It’s universal, as these metrics can be found in every human. 2. It is unique. 3. It is permanent, as metrics like fingerprint or dental don’t change. 4. It can be easily recorded if the consumer wants it to be so. 5. Finally, it can be measured for comparison and cannot be falsified. Conclusion: Though there have been cases where Biometric authentication based on statistical algorithms may occasionally provide false positives, resulting in erroneous results, the benefits of using biometric authentication for digital payments outweigh the drawbacks. This is causing a significant shift towards its adoption, and it seems to be continuously growing. In a diverse socioeconomic environment like India which has a population that is both cost-sensitive and aspirational, there is no other solution that can beat biometric authentication. Author: Shatrughan Sharma, Global Head- Payment Security Wibmo A PayU/Naspers FinTech Company Authentication, Biometric Authentication, Global Digital Payments, Payments, Secure Payment

Industry Insights, Reading List

Why cultivated BFSIs are moving from Cyber Defense to Cyber Resilience

Pravin Kumar / February 14, 2022

Cyber threats like APT (Advance Persistence Threat), Malware, hacking, phishing, ransomware, and distributed denial-of-service (DDoS) attacks have the potential to cause enormous challenges for organizations. Not only can companies suffer serious service disruption and reputational damage, but the loss of personal data can also result in huge fines from regulators. Some experts define cyber defence as preventing hackers from attacking your network and accessing your systems and data. Cyber resilience, they may view it, is about responding and recovering after an attack has happened. While they position cyber defense and cyber resilience as two separate activities, the reality is more complex than that. Cyber security can be seen as the first step in cyber resilience meaning any cyber resilience strategy must encompass cyber security. This blog explains more: If we map these two strategies with NIST -CSF (Cyber Security Framework), Cyber Défense is limited to Identify, Detect and protect pillars, however, Cyber Resilience also touches other two pillars i.e. Respond and Recover. It should be clear by now that cyber security and cyber resilience are different but symbiotic. Some companies do still treat them as separate and inter-related solutions, often establishing cyber security and resilience policy frameworks and strategies. However, there is more value when cyber security forms an element of overall cyber resilience. Why Cyber resilience over cyber security? Cyber resilience starts with nailing the cyber security basics; at Wibmo, we call it “doing the common uncommonly well.” This includes regular risk assessment, patching vulnerabilities, detecting and mitigating threats, and awareness on how to defend company assets. But we need to be doing these things continuously, not just once a year. The aim of cyber resilience is clear enough: to ensure operational and business continuity with minimal impact. But the reality can be harder to pin down because there’s currently a no good way to measure cyber resilience. As leaders, we need to have a certain level of confidence in our ability to respond to an attack, to maintain our customers’ trust, absorb the financial, legal, and brand impact and get back to business. But there is no widely-accepted cyber resilience framework, no maturity model, and I think there should be. The four elements of cyber resilience: I recommend a four-part approach to cyber resilience: 1. Manage and protect The first element of a cyber resilience programme involves being able to identify, assess and manage the risks associated with network and information systems, including those across the supply chain. 2. Identify and detect The second element of a cyber resilience programme depends on continual monitoring of network and information systems to detect anomalies and potential cyber security incidents before they can cause any significant damage. 3. Respond and recover Implementing an incident response management programme and measures to ensure business continuity will help you continue to operate even if you have been hit by a cyberattack, and get back to business as usual as quickly and efficiently as possible. 4. Govern and assure The final element is to ensure that your programme is overseen from the top of the organisation and built into business as usual. Over time, it should align more and more closely with your wider business objectives. Benefits: A cyber-resilient posture helps you to: Reduce financial losses; Meet legal and regulatory requirements: Improve your culture and internal processes; and Protect your brand and reputation Author: Pravin Kumar, CISO Wibmo A PayU/Naspers FinTech Company Cyberattack, Cybercrime, Cybersafe, Cybersafety, Cybersecurity

Product, Reading List, Stories

Faster and Convenient Authentication

Sujit Kumar Mahato / October 29, 2021

Before the invention of the steam-driven railways in the 1800s, mankind was dependent on animal pulled wagons to transfer goods. The Tanfield Wagonway in England, the first large-scale railway, used horses to haul coal-filled wagons from the mining village of Tanfield. On the lookout for faster and more convenient forms of transportation, evolved from horses driven wagons to steam engines, from steam to diesel, and from diesel-driven to engines driven on electricity. Fast forward to the 21st century, the world is experimenting with hydrogen-powered trains. Consider the banking industry. Though there is no trace of the word ‘banking’ before the 1600s, the practice of safekeeping, saving, and transacting money can be traced back to the temples of Babylon. The Arthsashthra, written by Chanakya around 300 BC, has mentions of ‘hundis’ or letter of transfer. Had the banking industry failed to ride the technological horse, money transfer initiated through hundis would have taken days or at least hours, to reach the designated payee through the fastest railroad. Thankfully, the banking industry learned to ride the technological horse and today with the help of electronic transfer can facilitate the process of money transfer. Electronic transfer not only made money transactions faster but also convenient for the people, who were saved from the age-old hassle of going to a nearby branch and waiting for their turn in the long queues at the bank teller. Can money transactions be made faster and more convenient for the customers? The movement of the electrons, involved in the electronic transfer, cannot be made faster with current feasible resources nor the customers can have a more convenient experience in making transactions from the comfort of their homes. The only way to provide a better — faster and convenient- banking service could be through optimization of steps involved in internet transactions. A large part of the processes involved in electronic money transfer is dominated by Authentication or security — ensuring the money transfer takes place from the genuine customer. The introduction of OTP has been a major advancement in the banking industry. However, it is the one step that may be loved by the banks but hated by customers, especially when the OTP fails to arrive on time or when the user makes a mistake. Removing OTP altogether poses a serious threat to security and thus banks still rely on OTP services for user authentication. This brings us to the question — How authentication can be made faster and more convenient? Is it possible to have convenient security? The answer lies in DATA. Let’s consider a simple case of house-rent transfer. A genuine user would be transferring the same house-rent amount month after month to the same account, using mostly the same wifi connection (ISP), the same laptop/mobile, and may be even on the same day of the month. A fraudster, for sure, wouldn’t be so generous to take the pain of paying rent on the user’s behalf. All the parameters above can be easily tracked and monitored with data. The answer to a “Faster & More Convenient Authentication/Security” lies in identifying the right set of data and formulating them into risk assessment. Higher risk should demand stricter authentication whereas lower risk should lead to faster and convenient -frictionless transactions, paving way for customer delight. The pandemic has accelerated the adoption of cashless transactions across the globe and is forcing the bank, more than ever, to evolve in order to meet the demands of smartphone-led online shopping culture, with cards and digital wallets rising in prominence. Banks need to leverage data and segregate high and low-risk transactions in order to provide ‘faster and convenient authentication to their customers. The demand for a fast, reliable, secure, and frictionless payment experience by customers requires banks to adopt fraud detection systems, which leverage the power of data through advanced machine learning technologies. When it comes to detecting subtle patterns which help in the identification of fraud transactions, machines are more effective than humans. Today, irrespective of the field, the power to leverage data, to provide ‘faster and convenient service, is one of the biggest assets for any organization. The faster and higher the convenience, the greater is the customer delight. The greater the customer delight, the higher is the customer loyalty. Author: Sujit Kumar Mahato, Product Manager Wibmo A PayU/Naspers FinTech Company Authentication, Digital Payment, Fraud Detection, Payments, Paytech