N. Mohan: Vis a vis the findings in the Asia Pacific Fraud Insights Report -2017, where do Indian banks and financial institutions stand in terms of their capability to fight frauds?
Vaishali Kasture: I think when we look at the various sectors, Indian banks have taken cue from their global counterparts. They have set up dedicated teams and installed necessary hardware/software because they are aware of frauds and they know that they need to invest in anti-fraud systems as they have suffered because of frauds. The BFSI sector is usually the guiding beacon of all the changes that happen and the other sectors sort of just follow in any kind of change, especially in technology, in terms of fraud, in terms of analytics. So, it is at the forefront of this change. I think there is lot of investment and thought going into fraud management and they recognize that fraud is key, and fraud is imperative especially in a scenario of modernization of the banking system, digitization, their wanting to become paperless, friction-free, etc. It is obvious that there are elements of this which makes the banking system more open to frauds. Even in paper-based systems, there are lot of frauds happening. So, I am of the view that banks today are prepared, they are investing in systems and they know no matter how much you do, the fraudsters are one step ahead.
As banking systems get more intelligent, so do the hackers. There is a realization of this aspect. Of course, there are lacunae. They are also aware ofsolutions available i – for example at Experian, we have a fraud detection tool Hunter, which can predict fraud patterns and alert banks of a seemingly likely fraud happening. Hunter works by telling banks and insurance companies that there is an intention to commit a fraud on the part of a customer.
Vaishali Kasture points out that more than 75% of frauds that happen at application levels are because of identity thefts
Do you think Indian banks are lagging their international counterparts?
I do not think you can paint all the banks in the same color. For example, a few banks in India are perhaps a bit more advanced in their thought processes and have gone digital faster than the other banks who are yet to start their digital journey in full steam. But, there is a huge amount of awareness among banks that fraud is prevalent and they need to protect their systems, their data, information and their customer interests. Some banks are ahead in the game because they adopted new methodologies faster than the others. In the last 4 to 5 years, there have been instances that have emphasized on the need for robust data security measure. Because though banks are becoming tech savvy, the hackers are becoming more tactical and intelligent as well.
The second point I would like to compare is that the population in the US or any of the countries in Europe, it is just a couple of millions but in India it is nearly 1.3 billion. So, the amount of data that is available with Indian banks is typically very huge compared to the global banks. Even if you compare data that we credit information companies collect and process, it may be much bigger than say the whole of Europe put together. Therefore, the pace at which the retail industry is growing, the pace at which digital is growing, the pace at which applications are growing is enormous. People say in 5 years, the retail book will double. And when you have so many channels in operation and others are coming, your growth becomes so fast that the opportunities to fraud at various levels are more. It is not static frauds that are happening, but frauds are dynamic in nature.
Today, more than 75 0/0 of frauds that happen at the application level are majorly because ofidentity theft. This would mean that one should be very careful in using and then disposing copies oftheir PAN card or Aadhaar or any such personal identification documents.
But, banks claim they have effective systems in place to counter this, like KYC, background checks. Do you think these are sufficient?
When you are going on the digital channel, you can do your eKYC, or Aadhaar verification. But, when you are doing paperbased applications, you have to take a copy of your identification proof. The reason why fraud is being caught is because lending institutions are doing these checks. Ifyou look at Experian’s Hunter’s database today, over the last 5 years, we have taken applications from 9() institutions, shared this information with banks and financial services institutions in a closed user group format and are currently, we are screening 3.2 million applications monthly on Hunter. Thus, through this robust fraud detection framework, we have saved BFSI companies from potential fraud worth Rs 10,200 crore in FY17.
Though the identification of these frauds were based on the comparison of PAN cards, Aadhaar cards or other multiple such attributes, there can also be instances of intelligent fraud. It can be done in a way where the PAN card, Aadhaar card and email address all match. There are solutions and tools available to do this which we offer and the industry is looking at these solutions in positive light. Everyone is not doing a biometric check. Just having your PAN number or Aadhaar number, one can only check whether the PAN or Aadhaar exists and not the bearer’s authenticity.
What could be the solution?
If you go to a telco outlet and submit your Aadhaar card, you are submitting your biometrics. The moment you use the digital method of verification, you can know that the person who is walking in is the real person. There is opportunity then for frauds to reduce. But for every internet transaction to happen it is not practical to do a biometric verification.
However, there are solutions like our proposed digital fraud detection tool Fraudnet, which is going to help you map a user’s device. So today, if I am going to do my bank transaction using a mobile device, and if tomorrow I am going to use another device, there can be an alert sent to the bank. Alternatively, if a fraud has been detected while using one device, this device can be blacklisted. The user group may be the same but this device through which the transaction has taken place can be suspected. There are such systems in the market in the west which really help prevent frauds. Since the future is all digital and since all transactions – whether taking a loan, or making a payment or opening an account – are going to be on the device, the focus would need to be on the device that is being used.
Do you think biometrics can be possible on devices that are being used for transactions?
I am sure this will develop and could be a reality. You have systems that are capable of face recognition or voice recognition. But the fact remains that penetration of the smartphones only will allow you to do finger print scanning or iris scanning. So, even these devices need to penetrate. India has some 500 million internet connections, but I do not know how many of them have smartphones. In India when a new technology comes in, we are very adept at leapfrogging. We can easily skip a couple of stages in its development. But, when you leapfrog through technologies, there are always gaps, and these can further lead to fraud.
What about the service Indian banks offer post-fraud?
From our recent Fraud Management Insights 2017, we have found that India is growing at a fast pace in digital adoption as compared to the rest of Asia-Pacific. We are growing so fast that instances of frauds are also quite high than the rest ofAsia. However, India’s digital trust index is surprisingly higher than the rest of the countries in the APAC region. Ifwe look at banking, the score is 5.12 for India as compared to 4.95 for the region on a scale of 10. This is despite the high rate of frauds. It is because when a fraud takes place, the concerned bank will normally bend backwards to make sure that the experience that affected the customer is not traumatic and amended. The banks will also make sure that the customer is not hurt financially, they will reach out to the customer and talk to him and arrange to file complaints and make refunds.
How would you foresee the future in the light of the increasing digitization?
I think we have a long way to go. I keep saying that whether it is insurance company or a telco or a bank, the fact that they are so fast on digitization makes frauds also grow in parallel. It is only by adopting new technologies and constantly trying to check one’s own databases and fraud prevention systems these institutions can overcome frauds to some extent. In fact, there are 2 parts – one when you are a bank and a customer contacts you whether online or in person, there is always a chance for a fraud. Second, is your own databases should be strong enough to prevent frauds. India will continue to grow at a very fast pace, especially since the government is encouraging digital adoption. Developments like the creation of technology stacks have happened in the last 2 or 3 years and we believe that the banks and the government should continue to invest in making our systems safe. It has to be a daily exercise to come in and to make sure your systems and customers are safe.
One thing I want to emphasize is that it is not just the bank’s responsibility to protect a customer’s digital identity. It is the customer’s job as well. I believe in India, people are a little careless while sharing vital personal information – like sharing passwords, storing passwords on mobiles or doing banking transactions in public Wi-Fi connections, or even copying Aadhaar or PAN cards and keeping them accessible to unknown entities.
A simple step a person can do in this regard is to obtain his or her bureau reports periodically, which give extensive information like the transactions he or she has made, loan applications he or she has filed and other open items under his or her name. For example, if someone else has gone and got a credit card or a personal loan in his or her name, the report will clearly say so. The person can then immediately point out to the bank or the concerned entity about this fraud. Like how you do your health check-up to protect your health and prevent further issues, you must have an identity check-up to protect your identity from being stolen or misused.
What holds good for fraud prevention in the future – artificial intelligence, machine learning, analytics?
I am of the view that it will be a combination of a lot of technologies coming together. When it comes to consumer level fraud, since the country is going to become more digital, a lot of the frauds can be prevented by tracking down people’s devices where fraudulent transactions have taken place. It is going to be a combination of hardware and software. Things like machine learning will help because it is learning from prior behavior. Credit information companies will also have a role to play. Because such companies sit on information of about 350 million people in the country. We understand consumer behavior as well.
What are the fraud-prevention products that Experian intends to bring to India?
We are in the process ofintroducing a tool, which is a digital identity protection tool for the consumers. It is very popular in the west, but it is yet to come to India. If a customer buys this tool, the customer can say he wants to protect email ID, Facebook profile and 2 credit cards and post that he shares data with Experian. What Experian will do is it will constantly monitor the dark web, where stolen identities are sold. So, at any time his identity finds mentions in the dark web, he knows that his identity has been stolen or compromised. Any person can call Experian and get this tool. This is a subscription-based tool. Even banks can purchase this product and offer it to their high value customers. In India-specific searches, we were surprised to find that there were lot of information floating on the dark web. India has a great penetration of mobile apps – there are on an average of3 apps per person on the retail side, which is the highest compared to any other country in APAC region.
What is Experian’s edge in the India scenario? How does it stand out?
Unfortunately, people still think Experian is only as a credit information bureau. When we look at India, given the pace at which credit growth is happening in the light ofthe financial inclusion agenda ofthe government, and given the growth of digital, I think we are well placed in terms of how we provide a solution to a client. If the client needs a onepoint solution that can help it in its lending journey – whether it is a bank or a NBFC or a P2P lending institution or any other entity – covering the full life cycle of the loan from origination to resolution, we can be of help. When lenders are trying to give loans, we can help them scan the market and do a market study for them.
We have consulting services in India and these services are effective because we understand consumer behavior. So, when a company is planning to get into the retail lending space in any manner, we can help it to map the market. Then, we can give it systems that can handle tasks right from origination to decision making to collection and walk it through the entire journey. We can help it to build customized score cards that are relevant to their products. We can host those score cards. So, ifa client needs a two-wheeler score card, we can build it and host it for the client, if it is a small company, and if it is a big company we can give the license. We can do a dynamic maintenance of the score card and keep tweaking it as required.
When it comes to collection, we have a system which is best in class, which will help an institution by connecting to the origination system, running the score card, devising strategies on how to do collections and providing a mobile app for the field collections. And of course, we are a bureau.
There is a lot ofinnovation we are doing in the space of alternate data to help unbanked/ new to credit consumers get access to credit or build a credit history even if there is no immediate need of loan. This is very critical considering the digitization and financial inclusion in the country helping organizations tap a large base ofunbanked population.
If I look at competition, I do not think any other entity has this range, this end to end model of data, which has the bureau at the center, software, analytics and consulting. I think that is our differentiator.