Fraud Mitigation in a Constantly Changing Environment

As Plaid’s Head of Risk Products, Rahul Hampole is bringing techniques he has learned over 15 years in the ad-tech business at companies like Yahoo and Yelp to fraud mitigation. The two seemingly disparate disciplines have much in common, Hampole says. Online advertising seeks to identify the right ad for the right person at the right time; fraud mitigation works to stop the wrong person from operating in the wrong place at the wrong time. The key to success in each is to analyze lots of data and make decisions based on signals in that data.

At Plaid, Hampole works with the fintech’s largest enterprise customers, including Google and SoFi, in an ever evolving environment. The digital payments market is expanding rapidly—and so are financial crimes. Hampole spoke with Modern Treasury about how leaders can mitigate risks by getting ahead of the fraudsters.

Why is fraud such a major concern in today’s digital finance landscape?

The shift to digital finance has created many new vectors for fraud in ways that impact all the different players in the ecosystem: banks, bank payment partners, fintechs, regulators. At the same time, digital fraud techniques are getting increasingly creative and sophisticated.

Fraudsters are constantly trying to find weaknesses. They start at places with the newest rails and try to pick at them.

They can find tools on the dark web and test them against new technologies, new fintech apps, or new payment systems. When something is totally new, it has the least network insights and the least amount of signals that can help identify fraud. There’s little understanding of the whole life cycle. It’s easy for fraudsters to take advantage.

What should finance leaders do about this never-ending problem?

It’s important to build tools to catch the fraudsters and then prevent future fraud to the extent possible. We’ve worked to make sure our partners understand that, and more and more are adopting such tools upfront. For the entire ecosystem to be strong, everyone should have access to great fraud tools.

For companies and leaders, I recommend three steps. The first is strong identity verification. When a user shows up, you want to absolutely make sure they are who they say they are. The second step is account verification. Does the user connecting a bank account own it? The third step is transaction risk scoring. What signals can you learn about the user? Is the same person connecting to the same account? If not, do you take action?

The promise of real-time payments is exciting—and opens up additional vulnerabilities. What additional steps are required for fraud mitigation?

If payments are happening in real-time, that means fraud can also happen instantly.

Organizationally, it’s important to understand signals about your users—not just for a specific transaction but across the network and across the three steps I mentioned: identity verification, account verification, transaction risk scoring.

On Plaid’s Signal app, for example, we look at the number of accounts connected in the last seven days versus 14 days and so on. If someone’s connected one or two accounts in the last 60 days and suddenly they’ve connected 10 accounts in the past week, that seems suspicious. Our customers will take that as a signal to be especially cautious about that user. These types of additional insights can help improve existing risk and fraud models.

Further, finance leaders should rethink their organizations. Many fraud teams are siloed instead of being cross-functional.

That’s a problem not just in engineering and product teams, but also operations. Leaders should also ensure their tools are up to snuff. If you’re trying to fight fraud at the time it’s happening, it’s probably too late.

I’m also encouraged that the US Federal Reserve, which is set to launch the new FedNow instant payment platform later this year, announced recently that it’s testing the platform for fraud. That’s a signal that the Fed is aware of the importance of fraud mitigation and taking steps to address it even before the platform launches.

What additional challenges do cross-border payments pose?

At Plaid, we operate across a variety of countries and markets. Many of our customers deal with cross-border money transfers. They’re dealing with different rules and regulations in every market—GDPR in the European Union, CCPA in California, for example. The way money movement happens is thus very different in each market.

When a customer builds for money movement across countries, they’re building unique experiences in each place, which can get pretty complicated.

Standardizing products across markets can make interoperability much easier.

As CFOs worry about fraud, how do innovation and regulation factor into the equation?

Ongoing rule-making is already fostering innovation by pushing toward open access so consumers have the right to their own financial information. Along with that, the network intelligence Plaid and others are bringing to the market is helping us get ahead of some fraud tactics. To build network insights, you need plenty of data. If data is siloed among a few large companies, getting to those insights becomes more difficult. But if users are willing to share data with fintech apps, as well as with network and cloud players, we can build better fraud prevention tools. That makes it much, much easier to get to a place where fraud is mitigated across the whole network. And that’s good for consumers as well as for the businesses providing financial services.

If leaders hold on to two principles—consumers own their financial data and can access it however they please, and companies can solve for fraud within the rule-making thanks to the ability to share data—they’ll be able to manage even the most complex use cases.

Finally, I’d say that new payment rails are coming, and they have many benefits. The work being done to set them up is innovative. While that’s happening, it’s important to keep fraud mitigation top of mind. Start planning for it to the extent possible. If you can do that effectively, you’ll not only prevent fraud but provide a unique value proposition so you can really win the market.