How to enhance financial services fraud prevention in an age of increasing insecurity

In 2023, losses from attacks on the financial services industry were approximately $5.9 million per cyber incident, second only to the size of attacks in the healthcare industry. Cybercriminals are targeting the huge amounts of data moving through cloud-based services and using increasingly sophisticated attacks to target unsuspecting customers. 

Attacks target both internal systems, and external users or transfers of information. The most frequently employed threats are:

• SQL injections, local file inclusion and cross-site scripting: In this type of attack, which makes up 94% of observed attacks in the financial services industry, malicious code is injected into a website or application. This code creates a “back door” into a user’s device, which can allow access to information, or give the attacker control of the device.

• DDoS (Distributed Denial-of-Service) attacks: The strategy of a DDoS attack is to disrupt business services by generating such a high number of fake connection requests that the system is unable to respond to legitimate requests.  

• Ransomware attacks: When an unsuspecting user opens a malicious application (usually hidden in an email attachment) the application then encrypts all or part of any files or systems that the user has access to. Encrypted files are made inaccessible to the user and their organisation, and aren’t released until payment is made to the initiating attacker. 

• Phishing attacks: Targeted at individuals, these are messages masquerading as legitimate communications. In the message, attackers pose as representatives of a trusted brand and request sensitive personal information. Information acquired can be used to hack any accounts the user has.

The first two types attack an organisation’s infrastructure and systems directly, while the others attempt to trick humans into clicking a link, or sharing information. Other risk factors include the unprecedented amount of data being created and shared through multiple platforms, and compartmentalisation within organisations that creates gaps in visibility regarding data location and potential vulnerability. 

Though these threats are serious, there are a number of strategies that organisations can implement to minimise or eliminate risks.

Addressing the different types of threats - against either organisation infrastructure or against users - requires a combination of tactics: robust system defences, data protections and human awareness. Some common techniques include:

• Advanced encryption: Encryption techniques are continually evolving, because the hardware and software used to break existing codes is becoming more sophisticated. For example, as quantum computing gets closer to reality, quantum-resistant algorithms are in development to keep data secure from the threat posed by these exponentially faster computers.

• Multi-factor authentication (MFA): Sometimes the most straightforward solutions can be the most effective. MFA requires that users successfully provide two or more forms of authentication, adding additional levels of security and trust.

• Data integrity and security: Unless safeguards to protect data quality are in place, data sharing across different systems and platforms can cause data to become corrupted, resulting in missing or incomplete information. Implementing data quality management tools can prevent and/or flag issues, and ensure that data stays correct and secure.

Generative AI (GenAI) innovations in cybersecurity such as fully automated threat detection and response systems are likely years away, but it’s expected that by 2026, the emergence of new approaches such as “action transformers” (models that learn from human actions) combined with more mature GenAI techniques, will drive semi-autonomous platforms that will significantly augment tasks executed by cybersecurity teams. And, by 2028, multi-agent AI systems (AI systems composed of multiple independent but interactive agents) in threat detection and incident response will rise from 5% to 70% of AI implementations to primarily augment, not replace, staff*.

Many financial services institutions are actively exploring these and other ways that generative AI might benefit their organisations, and are beginning to develop long-range plans to implement its emerging applications.

Accelerated fraud detection and response is one of the most promising applications of generative AI in financial services. Current capabilities already include AI pattern recognition that can identify potential threats and generate automated responses. Future innovations will likely fully automate threat detection, investigation and response (TDIR). This early detection and response can significantly reduce the processing of fraudulent transactions.

Know Your Customer (KYC) is another example of how GenAI can be leveraged by financial services companies. KYC is the collective process of positively identifying that an entity is who they say they are. The process includes verifying that the entity is a legitimate legal entity, creating a risk profile of tracked events the entity has participated in, and using the risk profile to inform business decisions regarding the entity. Thorough Know Your Customer vetting not only ensures that an organisation is doing business with a legitimate individual or organisation, it can also identify signs of financial crimes such as money laundering and fraud.

Traditionally, teams of professional compliance officers would need to undertake the time-consuming and error-prone process of reviewing large numbers of transactions to identify and flag anomalies. When AI and machine learning workflows are integrated into a financial organisation’s transaction processing system, transactions can be reviewed and issues flagged faster. AI-enabled systems can cross-reference a variety of different information, as well as verify document authenticity and biometric information. If anomalies are found, the AI system can engage generative AI functions to query a user for additional information, and escalate to a human representative as needed. Not only does AI/GenAI streamline the process and minimise errors, it also gives human compliance officers the information to make more informed business decisions and undertake more complex investigations.

KYC procedures can cause difficulties and frustrations for customers, especially during the onboarding process, when the user may be asked for documentation to prove their identity. Though they’re important for safeguarding the user, extensive or difficult requirements can cause a barrier to entry that negatively affects conversion rates. One of the promising applications of AI is that it can help the user through this process. A combination of great user experience (UX) that exhibits clear design, along with a helpful AI model is an opportunity to raise conversion rates and deliver a superior customer experience. 

In practice, banks that have integrated AI into their KYC processes have seen the time to verify customers cut by up to 80%, and reduce false positives in their fraud detection by 60%.

As AI capabilities grow, its applications are likely to be adopted by more financial institutions, automating the repetitive aspects of the KYC process, driving employee satisfaction, cutting the cost of identity verification, and enhancing customer experience and trust.

Potential uses of generative AI in the financial services sector show promise, but they also bring unique risks. Some risks to be aware of:

• AI systems can be vulnerable to data poisoning, leakage, and data integrity attacks.

• Third-party hosted large language models (LLMs) and GenAI models require new security practices in content anomaly detection, data protection and AI application security.*

• Almost 90% of enterprises are still researching or piloting GenAI, and most of those have yet to put AI TRiSM (trust risk and security management) technical controls or policies in place.*

Additionally, high hopes based on misunderstandings of the current capabilities of generative AI can lead to unrealistic expectations. It’s important to remember that despite the ubiquity of the topic, GenAI is still a tool that requires ongoing training with clean data, and monitoring/adjustment by human operators.

Threats, mitigation techniques and emerging technologies come together over the course of a (hypothetical) cyberfraud prevention project. This scenario highlights an issue that a typical financial services company might face, notes a solution available and indicates the potential impact of this solution.

Engaging with a digital partner can help an organisation rapidly identify the most valuable and impactful ways to integrate innovative solutions that enhance security and protect customers into their existing infrastructure — and in parallel develop a plan to modernise lagging legacy systems where needed. 

Nearform has helped to deliver an enhanced customer experience for Travelex, develop and launch a game-changing online bank, build a new multi-platform investment management app, modernise the systems of a nonprofit association of insurance companies and more. Contact us today to discuss how we can help your enterprise.   

*Data source: Predicts 2024: AI & Cybersecurity — Turning Disruption Into an Opportunity, 4 December 2023 - ID G00800663 GARTNER is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. and internationally and is used herein with permission. All rights reserved.