PaymentsJournal

Open banking continues to spread worldwide and is heading for the United States, in what some have been calling its “smartphone moment.” The infrastructure is falling into place to support open banking, and the Consumer Financial Protection Bureau has begun safeguarding the consumer protections necessary for this to happen.

In a recent PaymentsJournal podcast, Amit Shastri, Senior Director of Product Management at Worldpay from FIS, and James Wester, Co-Head of Payments at Javelin Strategy & Research, discussed the various payment rails that will facilitate open banking and what the benefits could be for banks, merchants, and consumers.

It’s important to understand the terminologies used in open banking, a new topic for many people. There are key differences between account-to-account (A2A) payments and open banking. A2A payments rely on legacy banking systems and often involve manual user steps, resulting in a suboptimal user experience. Open banking is not limited to the bank’s technology but can be seamlessly integrated into other apps with a stronger focus on conversion rates and experiences. A2A payments tend to lack interoperability across regions, whereas open-banking payments have the potential to be integrated into cross-border payments. In short: Although all open-banking payments are A2A payments, the reverse is not true.

In the United States, open banking is centered on the API-based connectivity that enables the sharing of bank account and balance information. U.S. consumers have become familiar with linking their bank accounts as part of the checkout process, then leveraging that connection to make payments again and again.

The term “real-time payments,” or RTP, refers to the underlying infrastructure that enables instant or near-instant transfer of payments between two parties. RTP operates 24 hours a day, weekends, and bank holidays. Open banking is effectively the overlay of services on these RTP rails, and it has the potential to revolutionize payments for consumers, retailers, small businesses, corporations, and governments. 

According to Shastri, open banking accounted for nearly $525 billion of e-commerce transaction value in 2022 and is expected to see a 13% compound annual growth rate through 2026. Some of the key successes of open banking around the world are seen in Brazil, which has a payment scheme driven by the Central Bank of Brazil, and in India with UPI, which was launched in 2016 by the National Payments Corporation of India and the Reserve Bank of India. In India, there were 10 billion open-banking transactions in September 2023 alone. 

If the market and the regulators support it, the potential of open banking worldwide is phenomenal. “The market-led approach that we have in the U.S. works very well for most consumers,” Wester said. “But what we are seeing is recognition that the open-banking model does work better, and that is where we need to be going, regardless of how it’s being led.”

Today’s consumers want improved, innovative shopping experiences, and they want instant gratification. Consumers want greater access to their financial data, and they’re willing to share that if it results in improved services and less costly financial products. Meanwhile, merchants are under extreme pressure to reduce their operational costs. Because open-banking transactions happen outside of traditional card rails like those used by Visa and Mastercard, there are no interchange and scheme fees. Open banking has the potential to save merchants millions of dollars annually. 

“At Worldpay, we do not discriminate between payment methods,” Shastri said. “We offer a plethora of payment methods to our customers because, ultimately, we want to drive financial inclusion. When consumers are successful, businesses are successful, and that’s what we are striving for every day.” 

Open banking is proliferating around the world, but it’s just getting off the ground in the United States. Shastri explained that there are four U.S. rails upon which to build an open-banking ecosystem: 

“For a payment method to be successful, it needs to reach the broadest possible consumer base,” Shastri said. “Shoppers don’t really care about RTP or ACH or FedNow. It’s for us as a payment service provider to solve that complexity for consumers and merchants, so that they have the broadest possible reach of the payment method in the country.” 

Perhaps the biggest challenge in this space is bank fragmentation. The United States has more than 12,000 banks, whereas countries like Canada are in the double digits. The legacy banking system that supports smaller financial institutions is not equipped to support real-time and clean data-sharing capabilities. 

Because no standards have been set, each bank can enable the sharing of data or enable payments in a slightly different way. “We could have tens of thousands of potential ways to connect to the bank account,” Shastri said. “The cost of integrating, managing, and maintaining these API integrations will be significant for the players in this space.”

With open banking, consumers are the ultimate owners of their financial data and can choose to share it with whomever they choose. But this leads to legal and ethical implications around sharing data with multiple third-party providers. “As an industry, we need to solve for some of these legal initial implications and assuage any concerns from a legal and ethical standpoint,” Shastri said. 

The legal basis of open banking flows from Section 1033 of the Dodd-Frank Act, which requires banks to make this data available to the consumer in a usable format. Earlier this year, the CFPB issued a notice of proposed rulemaking to allow consumers to have control over their financial lives and gain new protections against companies’ misuse of data. Consumers’ own data would be made available to them at no charge through digital interfaces that are safe, secure, and reliable. They would also have the legal right to share their data with whomever they choose and revoke their access to data as well. 

“This is the core basis for open-banking adoption in the U.S.,” Shastri said. “CFPB is doing a phenomenal job of regulating the space, making sure the ecosystem players behave and play by the rules while protecting consumers from malicious practices and data security.” 

Shastri expects to see action around the fragmentation of APIs, with common standards for the interfaces being adopted at least at a country level. That will be closely also aligned through the ISO 20022 messaging standard to improve the insights through data and conversion rates. 

“To me, this is like the smartphone moment of financial services,” Shastri said. “This is the start of the journey of building innovative products using data. Open banking will become more and more feature-rich. There is already work going on around variable recurring payments, which will enable person-to-business use cases across a number of industries. 

“Open banking is not just about sharing your banking data but sharing all your financial data, including mortgage, savings, and pension. We could even add other nonfinancial data, like your utility consumption or your Internet of Things data sources. Not just in the United States, but around the world, we will enable our merchants with tools that they need to create value for their consumers. We will create a better, financially inclusive ecosystem where everybody wins.”

Businesses often recognize that their success hinges on their ability to scale and expand. However, many businesses don’t anticipate the tightening of their profit margins on this journey to expansion.

At first glance, it may seem counterintuitive. After all, one would expect that increased growth translates to higher revenue and greater profitability. Yet the reality is that business growth comes with inevitable challenges. Chief among them are the mounting operational costs that chip away at hard-earned profits.

In a recent PaymentsJournal podcast, Nicholas Botha, Payments Sector Lead at AutoRek, and Brian Riley, Director of Credit and Co-Head of Payments at Javelin Strategy & Research, delved into what businesses must do to mitigate operational lag, how automation is revolutionizing reconciliations, and what the payment sector’s outlook is for 2024.

Efficiency and keeping operational costs low are paramount considerations for any business. When an organization starts to grow, managing the increase in transaction volume becomes essential.

“What we’re seeing is a lean towards more operational efficiencies—automation, new technology, cloud infrastructure—and that’s there to support this growth at an affordable rate,” Botha said. “This ultimately increases firm’s margins as they grow, and that’s how they can increase their revenues as they scale up.”

A company’s success ultimately depends on how well it optimizes its processes. Leveraging data is another key element businesses should prioritize.

“Rather than just dumping these transactions into the proverbial shoebox, one of the things I see about AutoRek is being able to help organize that and manage the process flow,” Riley said. “That seems to be very important, too, from an operational perspective.

“Certainly, squeezing the dollars and making it efficient makes sense, but also being able to use that data as a competitive weapon.”  

Most small payments companies initially rely on manual reconciliation processes that are typically straightforward. However, as these companies aim to scale, this once-simple process gains complexity, leading to time-consuming procedures and undue pressure on operations teams.

“When you’re performing data management processes, matching reconciliations, creating workflows, and reporting off the back of any reconciled items, manual processes—while they may work for smaller firms at an aggregate level—become a little bit more complex,” Botha said.

“There are a lot of intermediaries that become involved over time, and new technologies become available. It’s about ensuring that you use all these different elements to your advantage to create seamless, automated reconciliation processes.”  

C-suites and external stakeholders, including audit firms and internal teams, require strict control over these processes. Automating these procedures enhances efficiency across the board, ultimately delivering transparent reporting for internal and external stakeholders as well as customers.

“The workflow is really one of the most important pieces here,” Riley said. “Not just matching invoice A to invoice B but making that flow. Whether it needs multiple levels of approval within an organization or whether you split those transactions to route to one area or the other, what struck me as very interesting was how that has been engineered well and ready for setup.”

The United States has been behind the curve in adopting instant payments compared with other parts of the world. Although The Clearing House’s RTP Network was launched in 2017 and FedNow followed in July 2023, widespread adoption remains in its early stages.

In contrast, the UK’s instant payment system, Faster Payments System (FPS), has been in effect and widely adopted since 2008. The National Payments Corporation of India launched the Unified Payments Interface (UPI) in 2016. According to the World Economic Forum, this was the most preferred payment method for its citizens.

So what can the United States do to get up to speed with instant payment adoption?

“Communication, creating open forums between the different regulators, leveraging some successes and learning about some failures will make sure there’s widespread adoption across the U.S.,” Botha said. “We are seeing it a little bit in some of the states.

“If you think about New York, they’re a bit more ahead of some of the other states. But that adoption across the U.S. is going to be hugely important for the global payments space.”

Some of the developments seen in Europe and India are significant. “And it becomes a good test bed for the U.S. into faster payments,” Riley said.

The launch of FedNow has marked a pivotal moment for U.S. instant payments. As more financial institutions and networks join, the adoption of instant payments will grow.

Payment firms in the UK and the EU will face myriad regulatory changes this year, with safeguarding one of the most notable regulations.

Safeguarding is designed to protect customer funds held by payment service providers and e-money issuers in the event of the company’s insolvency. It encompasses a set of practices to ensure that customer funds don’t get mixed in with the company’s funds.

“What (we’ll) see is new jurisdictions picking up on this type of regulation,” Botha said. “We’re already seeing it in Canada, Israel, and Singapore. I don’t think that the U.S. is too far behind.

“In fact, I had a conversation with a client just last week, and they mentioned the safeguarding regulations. I’m not too sure where the Fed is on that. But I think changes to existing regulation, both state and federal, are going to be a huge thing for firms to focus on.”

According to Riley, the big buzzword right now is liquidity. Being able to isolate those transactions is also important. “We’ve seen a couple of big failures in the United States—SVB is a good example,” Riley said. “With the acceleration of payments, something that was not expected is that things like a run on a bank or a run on the institution can happen. It can happen a lot quicker than it ever happened before.

“Being able to have those guardrails is very important. Being in front of those issues and being able to isolate those transactions accordingly to make sure that the risk is minimal is important not only when you’re doing the process but also if you’re involved in the process with those sending those transactions.”

In 2023, the ACH Network added more than a billion and a half new payments, a year-over-year growth rate of 4.8%. With the economy doing reasonably well, employment levels being high, and payments continuing to migrate away from paper checks and cash, ACH is not just growing robustly but also poised to continue that growth well into the future. 

We asked Mike Herd, Executive Vice President of ACH Network Administration at Nacha, about what’s fueling that growth and where he expects ACH to be headed. Herd discussed these issues with Elisa Tavilla, Director of Debit Payments at Javelin Strategy & Research, in a recent PaymentsJournal podcast.

The ACH Network handled 31.5 billion payments last year and moved more than $80 trillion. Of that growth, Same Day ACH volume increased by more than 22% in 2023. Notable drivers of overall ACH expansion included:  

The dollar limit of a Same Day ACH payment increased in 2022 to $1 million, which has had an effect in the marketplace. “We have been seeing results from it continue through the present with increases in transactions and increases in dollar flows,” Herd said. “Since Same Day ACH started in 2016, we’ve now surpassed 3 billion payments, moving more than $6 trillion. Among the leaders in that growth are things like business-to-business payments and consumer-initiated debt—transferring funds, paying bills [and] loading wallets.”  

Herd said that the increase in Same Day ACH usage has been largely through payroll and other types of disbursements to workers and consumers. That might be a missed payroll, or paying shift or gig workers, for whom speed of payment is an important consideration. Or it might be something like an insurance payout, another instance where speed is an important factor.  

The pandemic was another factor that led to more ACH payments. “During the COVID era, we saw a pretty dramatic shift, impacting businesses that didn’t have staff present in person to issue or process checks,” Herd said. “That was a catalyzing event from a behavioral perspective, for businesses to not process checks at all, and to move to ACH in particular rather than other electronic payments.” 

Business-to-business payments have been one of the true success stories for the ACH Network. Over the past decade, there has been a documented decline in the use of checks for B2B payments. Nacha’s data shows where the action has moved, with ACH use for B2B payments growing by double digits over the past seven or eight years.  

In 2023, the growth was by almost 11% to 6.6 billion B2B payments, primarily oriented around B2B vendor payments. In the Same Day B2B payments, volume grew by more than 50% in 2023, up to 261 million B2B payments made. From a dollar perspective, that’s growth of nearly 60%, with about $1.4 trillion moved via same-day transfers. 

“From the Javelin side, we have survey data that shows, for example, that small businesses often face challenges with cash flow, and they think faster payments would help improve their cash flow,” Tavilla said.  

Herd added to “keep in mind that better cash flow for one side of the payment might mean worse cash flow for the other side of the payment. A payer that holds on to money longer to accumulate more interest is going to pay at the last minute, and that will have an impact on the receipt side.” 

What’s certain is that ACH will continue to evolve to meet users’ needs. “I like the analogy of how everyone used to have a landline,” Tavilla said. “Then we had the giant cellphones, then flip phones, and now we all have smartphones. It’s similar with payments. With the technology and the evolution and the different iterations of the products, I imagine the trend will be toward faster, greater efficiency and more precision and control for all who are making payments.” 

Nacha has several priorities on tap. It is looking to define additional expansions for Same Day ACH, including to encompass the full business day in the Pacific time zone. Most of the systems operate from an Eastern time zone perspective, and the current processing day closes in midafternoon Pacific time.  

Nacha will also propose changes and enhancements to the International ACH transaction to try to improve understanding and adoption. It is evaluating expanding its Account Validation services offered through Nacha’s Phixius and for the Payment Information Exchange Network. Finally, it is looking roll out new rules around ACH Network risk management, particularly around fraud monitoring and reporting, to try to raise the bar on monitoring the ACH Network for anomalies and fraudulent transactions. 

No one, from merchants to processors to customers, likes handling disputed payments. Visa Compelling Evidence 3.0 (CE 3.0) intends to reduce these pain points. It provides a standardized framework for all parties involved in the chargeback process, enabling merchants to substantiate claims by sharing real-time information and preventing disputes.

The latest update to CE 3.0 brought a new round of concerns from acquiring entities. PaymentsJournal turned to Carol Palmer, Head of Risk & Compliance Operations at Ubiquity, and Daniel Keyes, Senior Analyst for Merchant Services at Javelin Strategy & Research, for a deep dive into the introduction of CE 3.0.

CE 3.0 streamlines and expedites the resolution process for unauthorized disputes, focusing on addressing instances of friendly fraud or first-party fraud. In a collaborative effort, Visa worked closely with merchants and issuers to formulate this comprehensive rule change.  

Visa conducted a thorough analysis of the specific requirements for merchants to confirm a cardholder’s previous participation and identify the essential resources for notifying when a transaction is mistakenly labeled as fraudulent. The rule adjustment empowers small businesses by enabling them to present more robust evidence in such cases. The goal is to empower merchants to avoid or minimize unjust chargebacks, creating a fairer and more efficient system for all parties. 

“CE 3.0 delivers substantial advantages to merchants, ushering in a transformative shift,” Palmer said. “However, it’s important to note that issuers are still grappling with the challenges associated with billing errors and the burden of proof. Despite this, CE 3.0 introduces a significant improvement by meticulously examining personal data and seamlessly sharing it with the cardholder, mirroring the efficiency of CB processing.” 

Keyes agreed that the benefits outweigh the negatives. “CE 3.0 puts more liability and responsibility on issuers,” he said. “But there are also more tools and a process they can use to handle that effectively and have this ultimately come out as a positive experience.”

The CE 3.0 methodology aligns with Rapid Dispute Resolution (RDR) and order insight. Through RDR, issuers get the benefit of transaction retrieval without incurring the typical chargeback costs. This eases concerns over blocked chargebacks and enables issuers to present data from order insight as compelling supporting documentation. From a regulatory standpoint, however, it’s crucial to acknowledge that the burden of proof rests with the issuer. 

One prime advantage for issuers is real-time access to information and providing them with critical data promptly. This capability is a game-changer, significantly enhancing the issuer’s ability to navigate and respond effectively within the dynamic landscape of transaction disputes. 

The new policy carries financial advantages and disadvantages. CE 3.0 and Rapid Dispute Resolution allow transaction returns without imposing chargeback costs on issuing banks. This creates opportunities for substantial cost savings and heightened financial efficiency. 

Despite the advantages, it’s crucial to recognize that the responsibility of proof in billing errors and chargebacks still rests with issuing banks. This introduces an ongoing challenge, as issuers must still shoulder that burden, even with the introduction of CE 3.0. 

“I’m seeing a lot of issuers who are frustrated and have not adapted perfectly to the new rules,” Keyes said. “There are increases in chargebacks that haven’t been handled as well as they used to. There’s a lot of room for improvement on the part of issuers.”

Although CE 3.0 brings about real-time information benefits, the financial impact depends on the nuanced circumstances at play. The ability for issuers to leverage these changes to their benefit will be a critical factor in determining the overall financial outcome. 

Issuers face a challenge in implementing CE 3.0, particularly in instances where the evidence provided is limited. Limiting two or more undisputed transactions from the same merchant within 120 days poses difficulties for issuers in conducting a reasonable investigation, as Reg E requires. 

Palmer offered two examples to demonstrate how CE 3.0 operates. The first scenario asks this question: How should the agent proceed if the cardholder confirms authorizing previous transactions with a merchant but disputes one specific transaction, but Visa blocks the chargeback because of prior undisputed transactions? 

In the current process, Visa’s guidelines say the issuer must conduct a cardholder callout to verify whether the other transactions are disputed. If two or more pieces of information from order insight match, the agent can then proceed with denying the claim. 

“With the new policy, as per Reg E, the claim cannot be denied merely based on the awareness of previously authorized transactions,” Palmer said. “Also, the agent cannot submit an exception with a comment that the cardholder claims the other transactions are authorized alone. The comment for the exception should specify which cardholder information didn’t match.” 

Palmer’s second scenario considers a case where a transaction might be seen as undisputed due to the impracticality of initiating a chargeback for lower amounts within Visa Resolve Online. Consider a claim with three transactions of $100 each and two transactions of $10 each. The $10 transactions don’t meet the threshold for initiating a chargeback. Consequently, only fraud reports are initiated for the lower amounts, which poses challenges for issuers because these fraud reports are not recognized as “previously disputed transactions.” 

Unfortunately, this limitation can be leveraged against the issuer, leading to transactions being categorized as undisputed despite the practical challenges in initiating chargebacks for them. “Think of this rule change as a dance,” Palmer said. “Banks are still figuring out their steps, adjusting to the rhythm of fewer chargeback costs, while still dealing with some challenges. To ensure everyone is on the same page, there must be teamwork—a dance between banks, businesses, and customers.” 

Rest assured, this isn’t a one-time thing; it’s an ongoing dance. CE 3.0 asks banks to fine-tune their moves—understanding merchant documents better, updating how they handle mistakes, and making the most of the new features. 

As the financial dance floor changes, it’s essential to understand what this rule change is all about. “It’s not just about following the rules; it’s about staying in tune with the beat of change in the financial world,” Palmer said. “The music of CE 3.0 is playing, and banks need to groove along with the rhythm of new paradigms.” 

Faster and larger transaction flows have transformed the financial space into a lucrative superhighway, where bad actors can sweep in undetected and make off with substantial and ill-gotten gains.

Among the most exploited gateways for fraudsters are account-to-account (A2A) and peer-to-peer (P2P) payment systems. The increasing popularity of these methods for repaying friends, making purchases, or splitting bills has created an opportune environment for malicious activities. As more consumers opt for the convenience of these payment channels over traditional methods like credit cards or cash, bad actors are ready to seize the moment and strike.

The tolls of these attacks are not just financial; the damage extends to the trust and security of consumers. Recent data from the Federal Trade Commission revealed that consumers lost nearly $8.8 billion to scams in 2022, an increase of 30% from the previous year.

Kerry Thomas, Senior Vice President of Fraud and Decisioning Products at Mastercard, and Kevin Libby, Analyst of Fraud & Security at Javelin Strategy & Research, explored this topic during a recent PaymentsJournal podcast. They discussed the contributing factors that have fueled an increase in fraud attacks, why A2A and P2P fraud is rising, and what consumers and FIs can do to protect themselves.

Fraudsters are implementing manipulative tactics that aim to attack consumers at their most vulnerable points, particularly around peak shopping days like the holidays. Fraudsters are leveraging various channels, including email, and pretending to be a family member or friend in need of financial help.

Some are even fabricating fake charities, aiming to attract consumers and solicit donations for organizations that don’t exist.

“With the heightened transaction flows of the holiday season, it becomes this breeding ground for fraudsters to really start to take advantage. And what they’re really playing on is the emotion of the consumers,” Thomas said.

“We’ve also moved from a different form of victim fraud, where it used to be, I steal information via online channels or dark web to, ‘No, I’m going to get you to give me the information and I’m going to do that through manipulation, through the emotional pulls.’ When you think about the holiday season, what’s more emotional than, ‘Hey, I’m buying a gift for a loved one’? You’ve got this perfect environment for fraudsters to really play on those emotions.”  

Rising transaction volume and heightened emotional sensitivities create an ideal environment for a surge in fraudulent attacks.

“A prominent factor that’s presenting opportunities for criminals these days is that consumers are increasingly turning their attention online for everything—from socializing to shopping to banking,” Libby said.

“That presents criminals with opportunities to take advantage of the anonymity and ambiguity that online interactions provide. Criminals are very adept at social engineering, and I think the fewer cues you have from body language to appearance to environment in which you encounter a criminal, the fewer cues you have from which to discover their ruse, the better their chances are of taking advantage of you.”

The rising use of A2A and P2P payments has expanded the pool of opportunities for fraudsters to leverage their attacks. And that pool is going to continue to grow. According to the Consumer Financial Protection Bureau (CFPB), P2P mobile payment users will number 159.3 million in 2023.

Fraudsters are also exploiting a blatant vulnerability that has, surprisingly, been left unaddressed: Fraud detection systems and security checks are notably lax. This is because these payment systems prioritize speed and convenience. When customers are onboarded, it’s a streamlined process with fewer layers of customer authentication.

“It’s in large part attributable to the fact that P2P and A2A transactions are growing in popularity among consumers and criminals alike,” Libby said. “Consumers are increasingly drawn to P2P transactions because they’re most often free, they’re convenient, and you can move money between individuals as easily and quickly as if it were cash.

“Criminals are drawn to P2P platforms because the funds settle quickly and setting up transfers is as simple as providing the consumer with an email address or phone number to send the payment to.”

Javelin research in 2022 found that of the consumers who experienced unauthorized access to their bank account, 23% said the fraudster broke into their P2P account. Furthermore, 29% of consumers who suffered a financial loss were robbed directly from their P2P account.

“Anything that’s new in payments often doesn’t have the same controls, the same regulations, the same kind of understanding of the risk,” Thomas said. “What we end up seeing is the fraudsters take advantage of it and you don’t have the proper controls and tools in place to mitigate.”

Financial institutions can’t detect fraud in every transaction—whether it’s a genuine one or whether the institution is manipulated to authorize a transaction. The key to mitigating fraud is prevention, and one of the most important tactics to help prevent fraud is to be educated and stay abreast of the latest fraud tactics.

Consumers should also rely on their financial institutions to send regular email newsletters, social media posts—anything that provides useful information to keep customers informed about the latest scams and fraud tactics so they can avoid becoming the next victim. Ultimately, consumers and financial institutions have a responsibility to stay informed.

“You have to trust who’s on the other side of that payment, and it requires a little bit of due diligence,” Thomas said. “You need to investigate. If you get a text or an email and there’s a link, don’t trust it. Look it up. Go directly to the website.

“They’re so sophisticated now that they will attack you where they know you. Because emails and addresses and things are so readily available, these bad guys realize, ‘Oh, you have an Amazon account, you have a PayPal account, you have these different types of services. I’m going to send you an email or a link that looks just like that solution that you leverage.’”

When in doubt, consumers should always reach out to the financial institution directly to verify these messages and requests for information.

“You can’t overestimate the value of providing somebody with even a little bit of knowledge. It goes a long way,” Libby said. “And for consumers, I think if they don’t know that a particular scam or a particular fraud type exists, then they don’t know to look out for it in the first place, let alone what tell-tale signs there might be.”

Artificial intelligence is proving to be a game-changing tool in helping FIs combat fraud tactics. Some of the ways they’re using AI is via anomaly detection systems. AI can evaluate an extensive amount of data, including user behavior and transactions. It can also identify any anomalies or other suspicious patterns that could indicate an attack, which enables early detection.

Implementing stronger identity and verification—a process that verifies that the person or the organization involved in a transaction is legitimate—is also crucial. It verifies different forms of documentation, including biometric identification and database checks.

“The sheer number and variety of parameters that financial institutions are able to test these days, not just individual parameters themselves, but also how they kind of interact and how they might influence or inform one another,” Libby said. “That goes a long way to engaging in identity authentication and verification protocols and keeping criminals out while still allowing users the near frictionless experiences that they’re hoping for and growing used to.”

It’s easy to play the blame game when financial institutions and consumers are under duress from unceasing fraud attacks.

However, the best strategy is for both parties to take more responsibility. Consumers need to be hyper-vigilant and aware of what fraud is out there to avoid being tricked into making fraudulent payments. Meanwhile, financial institutions must continually look for ways to safeguard their customers with the latest fraud protection solutions, including AI-powered tools.

“It starts with awareness,” Thomas said. “It starts with understanding the risks that are out there, how it’s evolving, how the ecosystem is evolving, and then understanding that as the ecosystem evolves.”

With consumers’ growing demand for instant payments, convenience, and immediacy, instant issuance just makes sense. Providing a personalized, on-demand, active debit and credit card that promotes top-of-wallet use as well as boosts security—instead of making consumers wait for their card to arrive in the mail—can be a game-changer. By offering this service, financial institutions are doing more to potentially help solidify a long-term relationship with their customers.

In a recent PaymentsJournal podcast, Rob Dixon, VP of Digital and Business Development at CPI, and Brian Riley, Director of Credit and Co-Head of Payments at Javelin Strategy & Research, discuss what instant issuance is, why financial institutions should offer it, and why offering more sustainable options for customers is a forward-looking, strategic move.

Instant issuance programs can help financial institutions gain a competitive edge, giving their customers instant access to their card of choice, thereby reducing incidences of lost cards and promoting increased spending. But what is instant issuance?

Dixon explains:

“Instant issuance really is the ability for a cardholder to walk into a branch or another facility and walk out with a fully capable card, being able to transact anywhere that the cardholder wants to.”

And it’s not just any run-of-the-mill card that these FIs are offering via instant issuance. Dixon said that many of the current instant issuance programs provide EMV or dual interface contactless cards, as well as a multitude of substrates (recycled plastic cards, traditional PVC, and some wood cards).

But as Riley points out, having an instant issuance program is more than just getting a card on demand.

“That card really reinforces the brand,” Riley said. “Getting into instant issuance is important because you’re really at the height of the relationship.

“This is your core contact with the customer, whether they’re opening an account of one sort or another. Having the ability to get that (card) right away really keeps the momentum of that relationship going.”

When FIs eliminate the lag time between issuance and the  customer’s receipt and activation of their card, the customer is more likely to use the card sooner and more often. Consumers certainly appreciate this service, and it could influence a customer’s decision to bank with the FI in the first place.

“Instant issuance enables higher activation and utilization of that card for the cardholder,” Dixon said. “The cardholder is going to use that card more often, not only in the short term but in the long term. It’s also more likely that that card becomes top-of-wallet when it’s issued through an instant issuance program because that cardholder is transacting immediately.

“The higher activation utilization within the portfolio of cards is a significant benefit to the financial institution and could result in higher interchange revenue, as well as cost savings within the card program because you don’t have to mail the card.”

For FIs, it’s all about satisfying the immediate demands for customers to access their funds. Limiting or delaying that can cost FIs loyalty and trust.

On the issue of activation, Riley said, “You’re in that moment of truth where the customer wants the card, and if you can’t give it to them at the point that they want it, they’re going to use an alternative.”

“That could push that card back down deeply in the wallet,” he added. “So getting that (card) activated early is important—to start that muscle memory of the account being used for the transaction.”

With the tsunami of change and competition facing financial institutions amid a rapidly changing digital payments landscape, FIs must keep their finger on the pulse of consumer preferences to ensure they stay in the game. Where FIs leave gaps in customer demand, a fintech company is ready to scoop up market share with innovative solutions.

“It’s important that financial institutions support all channels of customer preference in all ways they can,” Dixon said. “It’s important not only to leverage instant issuance for some of the non-traditional issuance checkpoints like call centers but also that we start to support customer preferences and the instant issuance channel around digital as well and ensuring that card is top-of-wallet both in the physical wallet as well as the digital wallet, too.”

Consumers are increasingly concerned about the impact on the environment and are demanding more sustainable products from their financial institutions.  This movement can be seen more prominently in Europe, especially in the United Kingdom. Financial Institutions should think about following suite as normally it’s only a matter of time before it’s adopted in the U.S.

“I think it’s important, as we move forward, to look at recycled products as the world continues to have sustainability initiatives emerge,” Dixon said. “As customers continue to look for sustainable options, it’s going to be important that you evaluate your options and your instant issuance program.

You have to support things like recycled plastic or recycled ocean-bound plastic types of cards or other eco-friendly options.”

Although some financial institutions are still debating whether to adopt an instant issuance program due to costs and the move toward mobile banking, it is still a highly sought-after program among customers. The selling point is that customers have a fast, convenient, and safe way to continue their daily transactions. FIs should consider the competitive advantage that could come with instant issuance.

Financial institutions are increasingly navigating a sea of scams and fraud. With the evolution of emerging technologies, new avenues for attack have opened, leaving banks, credit unions, and their accountholders more vulnerable.

As peer-to-peer (P2P) payments become an expectation, the risks for banks and credit unions edge higher. The real-time nature of P2P payments and the “relationship” between the scammer and the victim, makes it exceedingly difficult for banks to detect and mitigate P2P scams.

In a recent PaymentsJournal podcast, Kannan Srinivasan, Vice President of Risk Management at Fiserv, and Brian Riley, Director of Credit and Co-Head of Payments at Javelin Strategy & Research, explored the key differences between scams and fraud, the prevalence of P2P scams versus other types of scams, and the best approach for financial institutions to implementing P2P payments.

Incidences of scams and fraud have gained traction in recent years, and it’s easy to use these terms interchangeably to describe any type of financial wrongdoing by criminals. But there’s a distinction. The proper classification of these types of fraud can aid in developing the countermeasures to address them.

Fraud can be divided into three types: first-party, second-party, and third-party.

“First-party fraud is when the crime is committed by the owner of the account,” Riley said. “It might be a bad return, it might be a claim of non-service on a merchant, something along that line. And then you have second-party fraud, where fraud is committed by another person and there’s a relationship that the owner of the account has with the other person. It might be allowing them to use the card or something along that line.”

“But third-party fraud is really one of the most common when it comes to payments, and that’s when there’s another party that’s unrelated to the account using it in one form or another,” he said.

Within third-party fraud is a deeper classification where the act can be readily identified as a fraud or a scam. An act of fraud normally involves the illicit use of another person’s information, such as in identify theft and credit card fraud.

With scams, the focus is on deceiving victims into giving up their money or their personal information, which can occur in P2P payments like those driven by romance scams and phishing emails.

“If somebody gained access to your bank account and made a payment without your permission, that’s typically considered unauthorized,” Srinivasan said. “It’s an unauthorized activity. Think about it as credentials compromised, username and password are stolen. You clicked on a phishing link and provided your login or bank account information.

“Those are all considered fraud or unauthorized activity, versus if you were knowingly involved in a transaction,” he said. “Somebody may have pretended to be a bank, but you were involved in a transaction, and you authorized a transaction. This is typically defined as scam.”

Recent news reports about a marked escalation in P2P scams don’t tell the whole story. Although incidences have increased, they are far less than the total amount of fraud losses.

“According to new data from FTC, total fraud losses reported in 2022 was $8.8 billion, compared to P2P and money transfers, (which) were about $1.7 billion,” Srinivasan said. “In general, P2P fraud has much lower exposure for our financial institutions compared to other products, such as check fraud or card fraud losses.”

Srinivasan noted that the sensationalism and attention aimed at P2P payments fraud can be traced to their relative newness in the payments space and the real-time nature of the transactions.

Financial institutions and other organizations are not the only ones leveraging the latest technology. Scammers are also using these tools to evolve and stay a step ahead, lurking behind seemingly trustworthy brands.

Some of the most nefarious tactics to deceive unsuspecting customers include deepfakes, where scammers create fake videos and audio of bank employees via artificial intelligence, deceiving customers by leaving a voicemail or recording phone calls in which bank account information is requested.

Generative AI is also being leveraged for highly customized phishing emails, posing yet another potential threat for financial institutions.

With AI technology, bad guys can launch automated bot attacks at scale,” Srinivasan said. “We see a large number of new-account-opening fraud, where fraudsters might be creating mule accounts to collect funds, so they create tons of spoofed emails specifically targeted to a geography.”

Increasingly prevalent are faked emails, texts, and invoices, all with the aim to deceive customers into making payments and giving up other sensitive information.

And with the explosion of e-commerce, this has become yet another expansive playground for scammers to take part in. “We’re in a world now where electronic commerce is growing 20% yearly in the U.S.,” Riley said. “You’re getting further away from that point-of-sale, somebody who has to go to a store and tender it. You have more of the anonymous nature of the internet.”

“So many things can happen in a very short period of time,” he said. “When you stack on top of the fact that things are going faster, it becomes a much tighter playing field. It’s encouraging when you talk about the Zelle numbers on fraud going down, but just recognize that it’s an ongoing base job and people will be fighting fraud for the rest of time.”

According to the Bank Policy Institute, Zelle continues to be the safest P2P network. Three times as many disputed transactions were made to PayPal as to Zelle, and for CashApp, there were six times as many.

Zelle requires customers to already have a bank account, fulfilling the know-your-customer (KYC) requirements. Any incidences of fraud are reported back to the Zelle Network so other banks can make use of this critical information.

P2P payments, and specifically Zelle, have solidified as a must-have for financial institutions. Customers demand it, and therefore it is table stakes, not just a nice-to-have offering.

“You look at how real-time payments have grown and faster payments and every other channel that’s going against that market, there’s a demand for it,” Riley said.

“Even on the credit side, some of the contraction that was built into the process is starting to wane,” he said. “But when it comes to addressing real live funds and real live accounts, people want that money moved quickly, that’s for sure.”

With the flurry of new stories of disputed transactions, losses reported by customers, and now liability shifting over to financial institutions, banks and credit unions feel apprehensive about including these types of payments. But there is more to be gained than lost. Financial institutions stand to attract more customers, boost brand loyalty, and create new revenue streams. And they don’t have to navigate this area alone. It’s about forming a strategic partnership with experts in this space.

“One of the things which we recommend is leveraging the expertise of a reliable partner,” Srinivasan said. “Fiserv reduces the work burden for the financial institution significantly in terms of not just operational human expenses but also technology costs.

“Fiserv has the risk management protocols and strategy in place to help mitigate various kinds of scams and fraud,” he said. “Based on fraud and scams, we also design the user interface to interact and alert consumers on the transaction. Our consumers are the last line of defense so Safety messages and communication with your consumer on the app or email and text, is an important factor, too.”

The evidence clearly suggests consumers are safer with Zelle vs. alternate payments. With Zelle, financial and other risk management controls come into play, which in most circumstances are more robust compared to controls from alternate payment providers.

Overall Zelle Network fraud has dropped by over 35% year over year and financial institutions are continuing to bring fraud down to protect consumers. Real-time payments including P2P payments will continue to see increased adoption. With adequate preparation and strategy financial institutions are in great shape to delight consumers—safely and securely.

Interest in learning more? Contact [email protected].

Payment processing is much more seamless now than it was even a few years ago. The pandemic accelerated the pace of digitizing payments, and peer-to-peer payment networks continue to grow in popularity. But this has also meant that consumers and banks have faced a growing number of innovative payments scams. 

 In a recent PaymentsJournal podcast, Sudhir Jha, Executive Vice President and Head of Brighterion, a Mastercard company, and Tracy Kitten, Director of Fraud and Security at Javelin Strategy & Research, discussed how generative AI is changing the payments fraud landscape and what we should expect in  the year ahead

Social media has changed many things about payments, starting with the fact that they can now be facilitated directly from an app like Facebook. That has opened up new avenues that institutions need to keep a careful eye on. On top of this, consumers have become more comfortable with leaving information in the open on various social apps. Many financial institutions have been facing more challenges when it comes to intervening or detecting fraudulent or suspicious activity through these channels. 

Social media adds several new wrinkles to fighting fraud. “If you go to a restaurant and post your food before you eat, that gives a fraudster a ton of information about you to make their fraud attempts much more believable and effective,” Jha said. “The potential criminal not only knows the location, then they know which business you interacted with, and even what you ate.”

With all this information, a fraudster can easily create a believable approach to the customer: “You ate at my restaurant yesterday and you paid X dollars, but that was incorrect. To get your refund, click on this link.” That link can be part of a phishing attempt. By collecting all that personal information, the criminal can even become friendly with the target and create a bond that sets up a later scam.

While scams have always been around, AI makes such approaches more scalable. It used to be much harder for bad actors to collect enough information to personalize attacks. Now all of that can be automated using AI. To counter these attempts, businesses need to embrace sophisticated solutions. Checking a few touchpoints and asking a couple of questions will not be enough to fight the scams of today.

“We’ve talked a lot about regulation and halting advancements in AI, which sounds wonderful in theory,” Kitten said. “But in practicality it’s not really a logical step because regardless of what we do as an industry, cybercriminals aren’t going to halt. They’re going to continue to use AI to advance their techniques and their tactics.”

Consumers in many markets have become more lenient about privacy in recent years, because they trust the government to protect their data. “We find year over year that consumers are willing to share more personal data about themselves, specifically in the U.S., if they think it will fight fraud,” Jha said. Businesses can use technology to better understand their customers’ shopping habits, biometrics information, and even personal details as a way to enhance cybersecurity. 

 It all goes back to the fact that fraudsters have been able to amass a wealth of consumer data they can collect from the internet. To combat this, AI has become an important tool for institutions faced with fighting payments fraud. “AI technology can help you piece together a story and create a persona of the consumer,” Jha said. “And you can be a lot more prepared for what the customer’s next step is.” 

Generative AI has the promise of allowing institutions to know enough about their customers that they can predict that next step. The challenge for banks is to secure the transaction without adding so much friction that the customer doesn’t enjoy the experience. 

According to Jha, the key is layered security. Behavioral biometrics can indicate the typing cadence of the consumer logging into the account through an online banking transaction or the cadence they use on the keypad when they’re logging in on a mobile device. Those behaviors are difficult for a cybercriminal to mimic. Banks can use some of those back-end behavioral biometrics in tandem with device identification and the amount of the transaction to detect fraud. 

Twenty years ago, when e-commerce was just coming into its own, most institutions were resigned to losing 1% to 2% to fraud. Now if institutions don’t get below 0.1% in fraud losses, they think that they’re not doing the right thing. As an industry, ecommerce is more well-versed in fraud than ever before. But evolving fraud threats require innovative approaches and collaboration across the industry.

“In almost any payment transaction, there are at least five or six parties involved, and they have their own view of the transaction,” Jha said. “For a credit card transaction, you have a bank that issues the credit card, a merchant where you’re transacting. There are acquirers who basically collect all these merchant signals into one place. Payment processors and card networks come into the picture as well. Each of these entities has a limited picture of the transaction and the cardholder profile. None of them have all the information. For example, a merchant doesn’t know what a given cardholder has done in other merchants’ operations.” Close collaboration across all parties of the payment transaction is key to securing it.

Collaboration and communication within organizations is vital as well. Silos have to be broken down to foster the sharing of tools and information, as long as the proper privacy concerns are accounted for. 

“We have seen a lot of fragmentation within the organization because of the rapid advancement of the different payment technologies, as well as the different fraud vectors,” Jha said. “When I talk to different banks, I hear that they have all these different channels: a card payment type, ATM withdrawals, account transfers. These have evolved at different times, and therefore they have different solutions, different stacks, even different vendors. Now you add different fraud types to that and the solution landscape quickly becomes unmanageable.” 

“We’ll take another step forward in 2024 towards making our payment ecosystem safer and better,” Jha said. “It is going to require a cultural change within financial institutions as well as retailers from the top down. The C-suite has to understand that this is a customer service issue—unless you take steps to protect them, you’re going to lose customers.” 

Validating account information is key to ensuring ACH payments continue to be safe and reliable.

In a recent PaymentsJournal podcast, Rob Unger, Associate Managing Director of ACH Network Development at Nacha, spoke with Elisa Tavilla, Director of Debit Payments at Javelin Strategy & Research, about payment innovations to help safeguard banks and consumers. They discussed how Phixius by Nacha helps financial institutions and fintechs verify bank information to mitigate risk, reduce costs and meet compliance requirements.

As ACH payments grow in volume it is important to ensure these payments are accurate and safeguarded as well. As the bad actors come up with more sophisticated scams, it’s important for participants to stay ahead of these new risks to ensure optimal security for payments. 

“Collaboration is the key,” said Unger. “By working together and sharing information, the entire industry could not only reduce risk but also create new risk mitigation tools to enhance security.”

“There is no standard way of validating accounts in the U.S.,” said Tavilla. “We have some folks using micro deposits, screen scraping and several other methods, which creates a clunky customer experience. Having something that’s more standard and consistent would make for an easier and more convenient way to pay.”

Created and operated by Nacha, Phixius uses standardized APIs so customers can validate accounts with validation sources. Phixius is a peer-to-peer network where participants can exchange and verify payment-related information quickly and securely.

Specifically, Phixius participants can verify routing and account numbers, as well as any associated names on the account, and will soon be able to evaluate the related ACH return history before executing payments. The goal is to simplify the spider web of connections that organizations must maintain.

“If you want to increase coverage, you have to go to multiple options and multiple providers, which entails multiple contracts, different API standards, and different API gateways,” said Unger. “We’re looking to simplify that friction and be that connective tissue.”

Phixius has successfully validated information for more than 4 million accounts since its debut in March 2021. Its first use case involved helping organizations comply with Nacha’s WEB Debit Account Validation Rule. Whenever a biller or other payment originator sees the authorization for an account number for the first time, the rule requires that entity to validate that the account has been opened. 

While participants are welcome to share information, Phixius does not require connected banks and fintechs to provide information to access the Phixius services. However, a new, optional API will soon facilitate the sharing of information related to ACH returns, giving the entire community further insight into potential fraud or suspicious activity. 

As organizations assess their need to validate accounts, the waterfall approach can be very valuable. “Phixius very much fits into that,” said Unger. “You can ping Phixius and get responses from multiple sources. But if it’s a very high-risk payment, you may need to consider other tactics to de-risk that payment.”

Direct customers of Phixius are credentialed service providers, fintechs and banks providing services downstream, as well as their customers, businesses and consumers trying to be compliant with the Nacha web validation rule or that have other use cases around risk mitigation. 

“These capabilities would also be helpful with the newer debit payment methods and technology that continued to evolve,” said Tavilla. “The account validation piece and a frictionless experience would be key in increasing adoption for these newer payment methods and achieving scale.”

As a one-stop shop, Phixius is particularly valuable for many smaller financial institutions that rely on third-party service providers because they might not have the in-house resources to conduct their own risk mitigation. Phixius’ partnership with Aliaswire is designed to serve businesses with smaller account verification needs. 

“Every ACH originator has a wealth of information in the ACH return file,” said Unger. 

“Every day as you send your payments out, you get returns that may include one of 70-some reasons why payments can’t be posted. That’s very valuable information. Our community said, ‘I’d like to be able to share that information.’ When an originator experiences some kind of fraud, they’ll certainly contact their bank and maybe law enforcement. But meanwhile, the community doesn’t know about this, and fraudsters are not just attacking one entity. That’s what this new API is designed to address.” 

The Consumer Financial Protection Bureau (CFPB) proposed a rule in October that requires non-depository and depository entities to release certain types of data related to customer accounts and transactions to consumers and third parties.

As a result, larger financial institutions will need to adhere to the compliance regulations earlier than their smaller counterparts. Initially, community banks and credit unions lacking digital interfaces will be exempted. Advocates of this regulation argue that it will provide consumers with more control over their financial information, enabling them to make more informed financial decisions. Overall, this initiative is expected to foster competition within the financial services sector.

Kevin Hughes, Director of Aggregation Solutions at Fiserv, and Matthew Gaughan, Analyst of Emerging Payments at Javelin Strategy & Research, delved into this proposed rule during a recent PaymentsJournal podcast. They discussed some of the highlights of the CFPB proposed 1033 update and its impact on banks and credit unions.

Known as the Required Rulemaking on Personal Financial Data Rights, the CFPB proposed 1033 update enables consumers to access and download their financial transaction data and other information from credit unions and banks.

With their consent, consumers can share their data with authorized third-party apps and services. In this data exchange, organizations are required to disclose the methods by which they collect, use, and share consumer data. The most important elements of this suggested rule revolve around ensuring security and establishing standardization.

“A part of this proposed rule is that banks and credit unions will have more visibility into what their customers are doing and who they’re sharing data with,” Hughes said. “It’s about being able to control the scope of data for aggregators in this community.”

According to Gaughan, the CFPB is providing standardization, which is needed. “These rule changes will bring consistency to the industry and make it easier for banks across the board to utilize some of these different data solutions and not rely on some of those less secure options like screen scraping,” he said.

Consumers today have distinct preferences for payment and financial applications, favoring those that offer convenience and ease of use. Consumers are also increasingly gravitating toward financial institutions that align with their preferences.

Banks face a new challenge as customers reach out to customer service centers seeking to link their bank accounts with specific applications. Unfortunately, many banks lack the necessary partnerships to facilitate such integrations. Consequently, consumers may switch from smaller banks to larger ones capable of accommodating their preferences. The proposed rule aims to address this issue and maintain these crucial consumer relationships.

“The new regulation is going to give banks and credit unions more tools to get insight on servicing their customers better while they can comply,” Hughes said. “The original 1033 update, which talked about data availability and that the data belongs to the consumer, that needs to be made available for sharing. Some banks have historically really balked at that because of the security issues.”

The update, Hughes said, eliminates any security issues and gives banks and credit unions a nice runway to be able to provide that flexibility to consumers.

“One big impact is adopting some of these financial data exchange (FDX)-compliant API technology standards, which allows for an interoperable framework upon which a growing universe of different products and services can exist,” Gaughan said.

“This is especially important for some of the smaller banks, which have less resources available to them to provide some of these emerging products and services. What this allows them to do is to provide those open-banking APIs that are more common at the larger banks.”

As larger financial institutions prepare for the proposed update, some have opted to build their proprietary infrastructure to accommodate the new requirements. This includes building secure APIs to enable customers and third-party apps to access financial data in a standardized manner. It can also involve implementing privacy frameworks to ensure data privacy regulations are met, or the FI could upgrade its current data management systems to integrate with the new API structure.

But these options may not be viable for most institutions, as they would require a massive overhaul of current legacy systems and involve a substantial investment of time and money.

“We’ve seen a lot of the larger institutions develop their own infrastructure that’s not typically scalable to smaller institutions,” Hughes said. “They obviously have the option if they want to develop and maintain a direct data access agreement with a third party.

“Most organizations of various sizes would put that option aside just because of the cost that it involves. But where we’re seeing the market emerging, and we’re seeing this at Fiserv, we’re seeing it through other providers, is the ability to offer a platform within the banking system that gives the banks the ability to adopt and plug into a framework rather than developing their own framework.”

Data aggregators will also play a key role, serving as trustworthy middlemen and providing a secure way for consumers to authorize the release of their financial data with third-party apps. The aggregators and financial services providers can then use this consumer data to develop financial tools and services that can be customized to customers’ needs.

Smaller banks will be able to benefit from this data to solidify their customer relationships and boost their competitiveness.

“Smaller banks are going to be able to benefit from some of those different value-added services that these financial data aggregators are building out,” Gaughan said. “Things like loan decisioning or fraud mitigation tools that could be crucial to helping them provide good services to their customers. It also helps ensure the acceptance of some more of their traditional products as well.”

The CFPB has suggested a four-year period for full compliance. This timeline is structured on a tiered system, taking into account the size of financial institutions and their asset sizes.

“The challenge with those four years for the smallest of institutions is that it isn’t that long of a time period because of the planning that needs to be involved,” Hughes said. “One year certainly is a very short time frame for a lot of institutions. What’s really going to be important here is that organizations not necessarily wait until their tier is up in terms of a deadline but that they start the planning process now.”

That’s happening. Regulators are sending inquiries to financial institutions to request compliance plans.

The first step, according to Gaughan, is that FIs take stock of what they currently have and put forth a plan of action to determine how the implementation will look.

“Banks across the board must unpack what resources they have available to them, both technological expertise and financial—and understand how they would go about implementing some of these changes,” he said. “For community banks and credit unions, if they don’t have a digital interface, they might be exempt from the rule. Once that’s finalized, we will know more about that.

“What’s most important is just understanding what it is that your bank needs.”