PaymentsJournal

ISO 20022, a new global standard for electronic messaging between financial institutions, was initially created to give the financial industry a common platform for sending and receiving data about payments.

However, financial institutions should not look at ISO 20022 as merely a compliance burden to be met, but an opportunity to serve clients better and gain a competitive edge. The amount of data related to payments that will be transmitted under ISO 20022 standards is so robust that it gives banks the ability to know their clients better and create new products and services tailored to their needs.

The robust and granular data will also aid financial institutions in fighting fraud, allowing them to detect potentially fraudulent patterns in payments and stop them before they are completed.

To learn about the importance of ISO 20022 for financial institutions, what benefits it offers, and what it means for the future of payments going forward, PaymentsJournal sat with Andrew Foulds, Director of Global Clearing Solutions, Product Management, EMEA at Fiserv, and Steve Murphy, Director of Commercial and Enterprise Payments Service at Javelin Strategy & Research, for a podcast discussion on this topic.

This blog is the second of a two-part series covering that podcast. Part 1, which covered why the ISO 20022 standards were delayed and what financial institutions can expect around their implementation, can be found here.

Foulds observed that when it comes to ISO 20022, “The focus on compliance with these regulatory changes can make institutions lose sight of what the business benefits are. These messages contain a lot more data and richer data. That allows us to look at and examine this data and turn it into information, which can then be used to create new services for clients.”

Foulds added that banks can take the new data and “turn it into something useful and add to the services you are already providing now.”

For example, ISO 20022 data can be used to help business clients better manage liquidity and cash flow. ISO 20022 data can also be applied to supply chains to help solve supply chain network problems.

Murphy noted the vast potential for improving and streamlining B2B payments using ISO 20022. Nacha, the electronics payments association, reported that fewer than 20% of B2B payments are processed automatically. The group further noted that ISO 20022 data can greatly improve automation of B2B payments by automatically extracting and providing typical information found on invoices. Thus, businesses can issue a “request for payment” to a payor and receive the money automatically without the need for any human intervention.

“There is a big opportunity for revolutionizing B2B payments down the line [with ISO 20022 data] when banks learn how to use all that data,” said Murphy.

Benefits from ISO 20022 will likely be seen in consumer-related payments first said Foulds, though he agreed there are massive opportunities in the B2B space.

“A lot of the banks I talk to really understand the benefits and advantages [of using ISO 20022 data in B2B payments] but they say, ‘we’ve got to really get our house in order and understand it fully before rolling it out to our corporate clients,’” said Foulds.

As payments continue to become faster and more digital, the risk of fraud related to payments continues to increase, making detection crucial.

“Fraud is a big issue for our industry globally,” Foulds said. “Fraudsters are constantly evolving their methods and attacks to try and stay one step ahead.”

ISO 20022 does not have anything to do with fraud per se, but it will enable banks and payment providers to more easily detect and stop fraud due to the greater amount of information and detail around payments that it provides.

For example, Foulds noted that simply checking the name associated with a payment against the name that is on an invoice can reduce fake invoice fraud by 30%. ISO 20022 data will provide many more data points to use to check against potentially fraudulent payments.

“The more data we have, the more we can investigate transactions and make sure every payment is going where it is supposed to go,” he added. “There are plenty of opportunities for ISO 20022 there.”

Murphy noted that the increase in real-time payments makes it easier for fraudsters to get away with payments fraud before it can be detected. He added that digital payments fraud is also up since the pandemic, when many more people started making payments digitally.

“As payments become more electronic, there are more schemes being developed by fraudsters to take advantage of this,” Murphy said. “Banks need to be able to look at behavioral patterns and data and track this 24/7 and 365 days a year to detect and stop fraudulent payments.”

E-commerce merchants have had to deal with an onslaught of change recently — an acceleration of online shopping, disruptions due to COVID-19, inflation, and a possible recession — which has significantly impacted how online businesses should be operating to remain viable now.

The aforementioned events have given way to a few trends that online sellers must be ready to adopt. “Because of inflation, I see consumers looking for more bargains when they shop online,” said Ya Wen, SVP of Americas at Payoneer. “Since COVID conditions have improved, more shoppers are shopping … however, people are more cautious about their wallet. I predict that market players will do more and launch more tools and resources to provide better deals for consumers.”

Apart from focusing on budget-friendly offerings, merchants must be ready to optimize current strategies to draw in more customers. For merchants that have significant resources, the trends point to building an omnichannel strategy. Small and medium-sized businesses (SMBs), on the other hand, need to take a careful look at the cost of acquiring customers across different channels. These costs seem to be increasing and, therefore, merchants must rework their e-commerce tactics, focusing on their marketplace power, their traffic, and their economies of scale.

If the rising cost of customer acquisition isn’t enough, merchants must also contend with another possibility of supply chain disruption and take appropriate actions to minimize impact. Merchants can begin by looking at their supplier base and determining where they want to take action to offset this risk. China is a prime supplier for many businesses and recent news only emphasizes this need.

“We already know the latest news from Apple, as they are looking to move manufacturing from China for iPad and iPhone products,” said Wen. “What that means to the e-commerce seller is that they will start thinking about their supplier and their supply chain strategy overall and try to diversify their supply chain, looking more toward Southeast Asia, Latin America, even parts of Europe. This trend will continue and accelerate in 2023 and beyond.”

That said, Wen noted that as the Chinese government continues to ease its COVID-19 restrictions and reopens its borders, Chinese merchants are eager to expand their businesses on a global level. This expansion means more bargains, more selection, and more competition.

Another trend merchants should watch closely is the rise of the creator economy, which is also expected to accelerate this year. Creator platforms such as Instagram, TikTok, and Twitter are social commerce platforms where creators have amassed a significant following and are looking to monetize the traffic they have.

One event that cannot be ignored by merchants is the potential recession and its impact on e-commerce throughout this year. “One big trend I’m looking at is what the potential for recession means for e-commerce ,” said Daniel Keyes, Senior Research Analyst of Merchant Services at Javelin Strategy & Research . “I’m interested to see how the industry responds. The reflexes will be negative: demand goes down, online shopping goes down. We don’t really know how the modern e-commerce market will respond to a recession. When you add the supply chain issues, then you get into shipping problems, making e-commerce more complicated. If there is a recession, there are a lot of areas in e-commerce that will change.”

“I think it will definitely change the economics both on the consumer side and on the seller side, and frankly, the marketplace side,” said Wen. “The prospect of having a real recession will have a bigger impact on the e-commerce trend overall.”

In answer to the extreme challenges e-commerce merchants continue to face, some fintech players have stepped in to help.

“Payoneer really adds value and helps e-commerce sellers in a tough macro situation. Payoneer moves faster than traditional banks, something that SMBs have really been relying on. Payoneer offers products like working capital, [which is]  sometimes a lifeline for small and medium-sized sellers in a tough environment. We help them to build their selection by buying the important inventory and being competitive in spending on some of the online advertisements. We provide an end-to-end, money-in, money-out service. This is much nimbler and cheaper and faster in a time of real-time changes in the economy.”

These financial and payments-related products will continue to grow, fueling more innovation. As Wen explained, now Payoneer can help relieve their clients of tax issues and accounts receivable issues, just to name a few.

“There are plenty of problems that businesses could use help with,” agreed Keyes. “There’s always an opportunity to step in, especially during a recession.”

Despite many news outlets and thought leaders warning of a potential recession, there are important reasons to be positive this year.   “I think the competition in the e-commerce space will continue to heat up,” said Wen. “We’ll see more players coming into the space —spending billions of dollars trying to build that fulfillment capacity, build[ing] their local regional sales and marketing capacity to really drive seller recruitment, [and] offering a deeper selection and better pricing globally — so that competition will heat up further as China opens up. That’s great news for consumers.”

Wen emphasized the importance for small and medium-sized businesses to look beyond their own backyard and think globally, not just in terms of new customers, but also suppliers and partners. Demand is strong, both domestically and beyond our borders, and companies should consider partnering up with Payoneer to leverage their account receivables and supplier payment solutions to facilitate global growth.

ISO 20022 may be delayed in its global rollout, but that doesn’t mean banks can afford to put off or ignore upgrading their payments systems to meet this new messaging standard.

Broadly speaking, ISO 20022 is a global standard for electronic messaging between financial institutions and was initially created to give the financial industry a common platform for sending and receiving data about payments.

This new standard will provide much more granular and robust data about payments, which financial institutions can use to ultimately serve their clients better. Around 21 domains of business processes are specified in the ISO 20022 standard, along with the messaging and data necessary to support the different processes.

PaymentsJournal sat with Andrew Foulds, Director of Global Clearing Solutions, Product Management, EMEA at Fiserv, and Steve Murphy, Director of Commercial and Enterprise Payments Service at Javelin Strategy & Research to discuss the current state of ISO 20022 and what to expect. In Part 1, they chat about the importance of ISO 20022 for financial institutions, why it was delayed, and what banks can anticipate around this standard going forward.

ISO 20022 was meant to go live globally in November 2022 but got pushed back to March 2023. A big reason was the need for some market infrastructure platforms to iron out technical kinks. Notably, the European Central Bank (ECB) delayed the migration to its Target2 real-time gross settlement system, which would incorporate ISO 20022 standards, which in turn had a “domino effect,” explained Foulds.

“It caused other market infrastructure systems to delay their go-live dates,” added Foulds.

Swift, the global financial messaging network, also announced it will go live with ISO 20022 in March of 2023, but said that institutions will have until 2025 to adopt the new standard.

This may have lulled some financial institutions “into a false sense of security,” said Foulds, but it doesn’t mean that banks should be complacent in migrating to ISO 20022 standards.

“It’s something we are going to have to deal with as an industry,” he said.

Murphy added that U.S. institutions are not impervious to ISO 20022 standards, since the Federal Reserve will be adopting ISO 20022 standards for messages in its Fedwire Funds service, as well as The Clearing House for its CHIPS network.

The Clearing House noted that it “remains committed to the ISO 20022 message format to enhance the efficiency of payments processing, to allow participants and end user customers to glean value from enriched data content and structured message formats,” and added that approximately 95% of CHIPS payments have a cross-border component to them.

“There are global implications to this any way you look at it,” Murphy observed.

Murphy asked Foulds how banks should be preparing for this massive change and if they should rely on their payments service providers to help with the transition or use in-house resources.

Foulds responded that larger banks likely have the in-house resources to begin working on migrating to ISO 20022 standards, and they are generally being more proactive in getting it done as quickly and as comprehensively as possible since much of their business is done globally.

Smaller banks will likely have to rely more heavily on help from their payments providers and vendors, but no matter the size of the institution, Foulds warned that none should put off the work to move to the new messaging standard.

“Since Swift gave until 2025 [for its institutions to adopt the new standards], some smaller institutions may put this off,” he added. “Our recommendation is that you should engage with your service providers and have a strategy to deal with this.”

That’s because there is an “opportunity cost” associated with delaying migration to ISO 20022 messaging standards, Foulds said.

“The earlier you go about this, the better it is, we think,” he added. “Don’t think about this as a mandated, regulatory issue, but view it as a business opportunity. There are more robust, rich data points transported via ISO 20022 messages, and institutions can use that new data and turn that information into new services for their clients.”

By way of metaphor, Foulds compared previous data sent through payments messaging as “about the size of a baseball, or a cricket ball” while data sent via ISO 20022 messages would be akin to the size of a basketball.

“There is a vast difference in the amount of data,” he added.

Foulds said this means that institutions that do not incorporate ISO 20022 standards will be at a massive competitive disadvantage. For example, when the European Central Bank’s aforementioned Target2 system goes live in March, it will be a “big bang” approach rather than a phased approach.

“That means on Friday at the end of day they’ll retire the old system, and Monday morning the new will be in place. So if you’re not ready, you won’t be able to do business. It’s really more of an existential business issue than just a regulatory issue.”

The year 2023 is poised to see significant evolutions within the payments landscape. From the rapid rise of contactless payments in the past couple of years to the widespread adoption of embedded payments, consumers and merchants can agree that they want their payments to be seamless, frictionless, and fast.

Consumers have always taken part in payments in some shape, but the channels in which payments are taking place have changed. In the wake of COVID-19 lockdowns, the need for contactless payments arose, bringing security to top of mind for consumers and merchants alike.

With these changes come new demands, shifting the landscape of payments. Here is what those in the industry must look out for.

“From the payments landscape forward, I look at it from three different perspectives,” said Sukanya Madhavan, Vice President of Product Management and Engineering at CSG Forte. “From the consumer side, the end consumers want additional methods of payments, such as alternate methods of payment and embedded payments. The goal is making it seamless and simple for consumers to make a payment.

“From the merchant side, adding this to their regular business activities and making payments seamless to their consumers is something to consider, while keeping costs at bay and optimizing payment operations. As a payment solution provider, we need to keep tabs on the market to determine consumers’ needs and ensure we add all these capabilities, such as a QR code or open-banking BNPL (buy now, pay later).“

Merchants must learn to thrive in this increasingly demanding environment to stay competitive. Balancing in-demand offerings while keeping costs low and providing a seamless checkout experience is no small feat.

“Alternative payments are important in meeting consumer needs,” said Daniel Keyes, Senior Research Analyst of Merchant Services at Javelin Strategy & Research. “But they also introduce new complications such as crowding the checkout page. You can potentially overwhelm consumers with options, but you also want to provide them with the ability to pay the way they want to. Offering consumers with the payment options they want while avoiding a fragmented and frustrating checkout experience is a challenge that merchants and their providers will need to meet.”

“We need to have a balance,” Madhavan added. “‘Do you want too many payment methods appearing in your checkout?’ As a payment provider and as a merchant, [having] that flexibility in the offering so you can change it as needed, depending on the market or the specific customer that you’re looking for is critical.”

Luckily, merchants can easily pick and choose the payment options that best suit their business, saving time and money.

“It’s not a one-size-fits-all,” Keyes said. “A restaurant doesn’t need all the payment options that an apparel retailer needs and so on. The ability to choose and understand what is the right match for a merchant is important going forward.”

In the payments world, we have seen alternative payments options that have sprouted with abandon.

“The alternate-payment methods landscape has expanded in the past few years,” said Madhavan. “Although we’ve had digital wallets for a long time, Apple Pay and GPay adoption is accelerating. We have buy now, pay later, where customers can purchase items they wouldn’t have otherwise had they not had the option of paying for it in three or four or five installments.”

“From the merchant side, that’s a business or a sale that they wouldn’t have. There’s the concern of moving consumers toward additional debt. But it’s more of a calculated risk. We must ensure consumers are financially capable.

“We are also seeing an increased adoption in recurring payments, where people can set and forget it. People want seamless payments, and therefore we are seeing recurring payments grow.”

Younger consumers are more prone to be early adopters of such alternative payment methods as peer-to-peer (P2P) apps like Venmo and paying with a mobile wallet.

“Digital wallets really stand out to me as a cashless payment that is going to take off,” Keyes said. “Adoption has been on the way up. We’re seeing younger consumers rely on them more heavily. They’re making more purchases a week with a digital wallet than older generations, Gen Z in particular.

“I think digital wallets are really poised to become more of consumers’ go-to payment method, which is a big shift from what it’s been in the past years.”

On a personal note, Madhavan related a story about her teenage son’s inclination toward using Apple Pay on his phone instead of opening a bank account of his own.

Keyes added, “If you get a phone in your teenage years and you can get a debit card or a credit card loaded up onto Apple Pay, if that’s the first way you pay for something, why would you suddenly start using cards or other methods later? Those wallets are reaching consumers early and building up a relationship that could last for the rest of their lives.”

One of the biggest draws for embedded payments is just how easy they are to execute. The consumer does not have to search for a card or for cash. With just the push of a button, a purchase can take place, all on the same platform. What’s not to like about that? It’s a massive win for merchants and customers alike.

“We talked about how consumer behaviors have changed, how they demand instant payments,” Madhavan said. “Merchants must now offer all these capabilities in addition to their core business.  Embedded payments will make it easier for merchants and a seamless payment experience for the end consumer.

“Another benefit of embedded payments is additional reporting. We know companies spend a ton of time trying to go back and reconcile and make sure the books are right.”

“For merchants, embedded payments open so many doors and make things so much easier,” Keyes added. “For consumers, embedded payments make payments invisible. The average consumer does not want to think about payments and embedded payments. Consumers want a frictionless experience where they don’t even really know they’re paying. There’s not a lot of effort. That’s important for creating seamless, appealing checkout experiences and other shopping experiences. So, you know, I think embedded payments are certainly here to stay, and their importance is only going to grow.”

Payments providers will need to step up their offerings to serve the growing needs of their merchant customers, who are seeing growth not just in payments but also in alternative forms.

“I believe there is going to be a value sphere expansion,” Madhavan said. “At the core; capabilities and alternate methods of payment are expanding the value sphere. In terms of risk monitoring, fraud management, reporting and reconciliation, they will enhance consumer experience, ensuring merchants can continue to run their business while providing that better experience for the customer. That will be the focus, and we can expect several businesses to invest a lot of money in that area.”

Payments companies must also focus on the quality of their offerings, not just the quantity.

“Payments can be very fragmented,” Keyes said. “We’ve named a million different services that a company can offer: BNPL processing, acquiring digital wallets, [and more]. Payments companies that are trying to offer all these services in one have a real advantage if they can offer quality services. A merchant can get everything they need in one place. An SMB does not have the time to source out different vendors for all their payment needs. It would be much easier for them if it’s an all-in-one platform. Maybe it’s in a very-easy-to-use dashboard.”

Keyes continues, “I think we’re going to see a lot of companies continue to push to meet more if not all of merchants’ needs in order to deepen their relationship and to get more revenue out of the relationship as well. But I think the ability to make payments less fragmented for merchants will be key going forward.”

One thing is certain: More payment methods will mean that more must be done to ensure merchants and customers can enjoy quick, safe, and convenient payments. That is the future.

In a payments world that often is often focused on the new thing, reliable ACH payments—the province of the National Automated Clearing House Association (Nacha)—keep steadily growing, with billions of payments processed annually to the tune of trillions of dollars.

That doesn’t mean, however, that nothing is new in the ACH lane. On a recent PaymentsJournal podcast, Michael Herd, the Senior Vice President of ACH Network Administration at Nacha chatted with Brian Riley, Co-Director of Payments at Javelin Strategy & Research, about the highlights of the past year, what has been driving business for Nacha, developments to look forward to in 2023, and why Herd sees reason for optimism.

“It really is a far-reaching, industrial-strength payment system here in the U.S.,” said Herd.

The volume attests to Herd’s contention.

The ACH Network processed 30 billion payments in 2022, encompassing $76.7 trillion. Those numbers were up by 3% and 5.6% over what the network handled in 2021.

Herd said that volume was achieved despite “some headwinds.” He noted the absence of pandemic assistance payments, which flooded into taxpayers’ bank accounts in 2020 and 2021. There was also a slowdown in economic growth and in jobs.

Nonetheless, the numbers grew across the board for the ACH Network, with dollar growth of about 6% year over year. It all amounts to more than 120 million payments per business day, and over the course of the year, it’s approximately 89 payments per U.S. citizen.

But perhaps the best measurement of ACH payments’ enduring appeal and easy reliability is that the value of the payments processed by the ACH Network has increased by more than one trillion dollars every year for 10 consecutive years.

It’s an enviable steadiness, Riley noted.

“The volume continues to grow,” he said. “I don’t want to know about events that blow up. It’s nice and steady. It’s there, reliable.”

In March 2022, the per-payment limit on Same Day ACH transactions increased from $100,000 to $1 million. That boost brought new players into the fold and fueled remarkable year-over-year growth for the payment method.

“There was an immediate impact to that increase,” said Herd. “We were able to see a doubling of the dollars flowing through same-day ACH (from February, the month before the increase, to April).”

Again, the numbers tell the story of the growth: 697.5 million payments using same-day ACH that added up to $1.7 trillion in value, a more than 86% increase year over year.

What’s more, the boost in the per-payment limit expanded the use cases for Same Day ACH, drawing in such things as vendor payments, tax withholdings, merchant funding and settlements, and concentrations of cash. Further, business-to-business (B2B) payments across Same Day ACH are up 44% year over year, according to Herd.

The cap increase, Riley said, “was significant for the long-term reliability of that relationship.”

Herd backed that up with anecdotes from his dealings with users and would-be users of same-day ACH.

“It is the corporate user community that has been driving those increases over time,” he said. “They’re the ones that have really told us that this is something that they wanted and that it makes a difference to them. It enables them to use the capability that has been created.”

The ACH Network has continued to see shifts from the pre-pandemic business payments models, which in many cases clung to older forms like paper checks, to what became a necessity during the pandemic: paying employees, vendors, suppliers, and the like without putting a piece of paper in their hands.

That ended what Herd described as “inertia” among some businesses.

“When you don’t really have ways to send and receive checks with actual people doing the physical processing of those, that changes behavior very quickly,” he said. “So we saw some significant increases in business payments and especially B2B volume, and that continued in 2022 even though many businesses have either gone back or portions of the workforce have gone back.”

“Once you make that shift away from paper,” Riley quipped, “you’re not really going to go back.”

Herd pointed to three fronts where Nacha will be looking to refine how it does business:

Herd ended on a hopeful note, citing some of the reasons for optimism he has seen in the young year. Recession fears, swirling since last year, are easing a bit. Job gains for January (517,000 new jobs) were strong, and fortified statistics from November and December that were also encouraging.

“It’s good for payment systems,” he said. “It’s certainly good for the ACH direct deposit of payroll payments.”

And while acknowledging what Riley called “unpredictable things” such as inflation, Herd cast the steady reliability of ACH transactions in the wider light of Nacha’s ongoing mission to refine its processes and protect its customers.

“The world wants to move faster and faster and faster, and the ACH [Network] has been central to that conversation,” he said. “And we also have to be safer, safer, safer, and so we need to do that, too. So that’s kind of all in the mix of how to keep something running efficiently.”

In today’s digital age—when convenience, ease, and personalization are highly valued—consumers expect a variety of payment options, whether it’s buy-now, pay-later installment plans, cryptocurrency, or contactless payments. And they want those options not just in e-commerce but also within physical stores.

As a result, many companies are adopting an omnichannel payments strategy that gives consumers the option of paying the way they want.

In a recent PaymentsJournal podcast, Nitin Prabhu, Vice President of Merchant Experiences & Payment Solutions at PayPal, and Daniel Keyes, Senior Research Analyst of Merchant Services at Javelin Strategy & Research, discussed how retailers can bring their omnichannel strategy to life in order to reduce friction in the customer journey.

Although an omnichannel experience isn’t something new—retailers have long looked at being able to reach consumers on their own terms, regardless of the device they use—an omnichannel payments experience is a whole new territory for most.

“There are a lot of basic things retailers can do to improve this, such as reducing friction during the checkout process, as well as offering the right payment options,” Prabhu said.

Keyes noted that shopping at retail stores can be more taxing than online shopping, presenting more friction than is necessary. “Any process that can remove friction, and is very consistent and familiar, is ideal,” he said. “That way the customer is just getting what they want, without having to give payment much thought.”

Before the pandemic, small and medium-sized retailers worked with multiple vendors on dealing with fraud risks and catalog management. But they found that interoperability of vendor software was an issue and managing the vendor relationships was challenging. Today, many merchants are switching to a single vendor that can meet all their payments-related needs in an end-to-end experience.

For example, PayPal has developed a vertically integrated platform that includes services typically outside of its purview, including a service to return products. “PayPal recently acquired a company called Happy Returns,” Prabhu said. “They’ve done a fantastic job at creating a seamless returns process for merchants, especially in the small and mid-market segment who may not have the logistics or footprint across the U.S. to return products.”

Integrated platforms can also reduce headaches for consumers and even drive demand. A seamless returns process can drive business development.  

“It is shown that for most customers, if they’re able to return a product after trying it, the propensity to go and try that product or service is much higher,” Prabhu said.

Merchants need to find a custom solution to IT for their businesses, but this doesn’t mean they need to go after multiple vendors and maintain all those relationships. Increasingly, merchants are seeking a company that provides all of their payment functions in one place.  

Once merchants commit to a single payments ecosystem, they want it to handle everything. For example, in the hospitality sector, “a restaurant might expect the processor to have a shift management software, the ability to handle tips, but also delivery and other things,” Keyes said. “Providers are doing their best to meet that meet that challenge to maximize their relationships and maximize the revenue in the process.”

According to PayPal, having payment options that customers trust can increase sales. Its data indicates that 44% of consumers are more likely to trust merchants if they see their preferred payment option at checkout.

In fact, many consumers won’t make a purchase at all if their preferred method is not present. “Roughly 59% of PayPal consumers have actually told us that during checkout, if they don’t see PayPal as a payment option, they have decided not to purchase something,” Prabhu said. “People are very worried that if the purchase goes wrong, will their financial institution or payment provider have their back? How easy is it to get refund policies to fight chargebacks or disputes? Preference of payment options definitely drives trust with merchants.”

When consumers have to make complex payments, they often drop off. Thus, reducing friction becomes the first barrier to clear in driving sales.

“In a survey, we found that one in four customers drops off from a purchasing funnel if the process is too complex or there are too many steps,” Prabhu said. “That translates to approximately $236 billion in lost sales.”

Retailers should start by focusing on the basics. For example, smartphones aren’t the easiest devices to type on, so it’s important to have minimal forms. Providing one-click payment options is also helpful, as is storing customer information for future checkouts. And merchants still need to let customers check out as guests if they prefer.

Finally, retailers should avoid redirecting to different URLs within the payment process. Should consumers lose signal service, they would have to go back to the beginning of a long checkout flow. And that inconvenience is enough to drive them away.

One big change over the past few years has been the acceleration of e-commerce, particularly among older generations. There are no signs this will slow down in 2023.

What’s more, expect to see a greater diversity of payment options. “Credit and debit have historically dominated the payments in general,” Keyes said. “But other options—whether it’s a buy-now, pay-later solution or other types of digital wallets such as Venmo or Cash App—will gain increasing traction in 2023.”

The biggest change, however, will be the convergence of online and in-store shopping. “Customers don’t think about online or in-store separately,” Prabhu said. “They say, ‘Let me purchase this product online. I don’t want to wait for two-day shipping, so maybe I go to the nearest store and quickly pick it up, and try it on. And if I end up not liking it, I can return it in store or by mail.’ All these channels are merging. That is what is most exciting to me.”

Ransomware attacks are hitting financial institutions big and small, and show no signs of abating. When companies suffer ransomware attacks, they typically turn to their legal counsel or insurer for advice about how to choose a good ransomware negotiator. When small business, in particular, is hit, they often turn to their primary financial institution for ransomware-response guidance. That’s because they’re unsure of which negotiation service is the right fit. Ransomware negotiation is a niche industry, as it involves direct interaction with the criminals who wage ransomware attacks.  

In recent months, Javelin Strategy & Research’s Tracy Kitten, Director of Fraud and Security, and Alexander Franks, Fraud and Security analyst, conducted research into the industry around ransomware negotiation. They found that many financial institutions didn’t know much—or, in some cases, anything—about the ransomware negotiation companies they refer to their clients. Oftentimes, FIs just know negotiators by word of mouth from outside lawyers and insurance providers.

In a recent podcast, PaymentsJournal sat down with Kitten and Franks to discuss the main findings of their report. They provided an overview of what companies should look for when choosing a ransomware negotiation company and how companies in that specialty differ in the resources they offer.  

Kitten explained that Javelin’s research is really focused on the basics: Who are the players and what should customers ask of them? “So, it’s a very niche part of the ransomware mitigation landscape,” Kitten said. “But a very important one and one that we found really is kind of at the crux of ransomware mitigation.”

Financial institutions are indirectly impacted when ransomware attacks strike their commercial customers.  Franks noted that when a company looks for a ransomware mitigation specialist, it needs to ask about three main things: capacity, culture, and collaboration. Ransomware negotiation providers differ in those aspects, so asking about them can mean the difference between paying a ransom and avoiding a loss.

Ransomware negotiators also differ in what they are capable of doing—or willing to do—for clients. Franks suggested that prospective clients ask negotiators about helping with payments, helping with the handling of cryptocurrency, explaining how payments will work, providing legal support, and outlining the languages negotiators on staff are fluent in.

The language factor is essential. To get the best settlement, a negotiator needs to speak the language of the criminal. “Not only does it help the negotiators quickly determine the sophistication of the attackers, but it also helps the negotiators build a rapport with the attackers,” Kitten said. “They develop mutual respect. If you have negotiators that have native language speakers on staff, the likelihood that you’re going to lower your ransom is greater, and the likelihood that you’re going to be hit by the same ransomware gang in the future drops dramatically. And again, a lot of that is just because of the relationship building.”

It’s also important to inquire about how the ransomware negotiator collaborates with its clients. “This is essentially just the set of practices that describe how a victim organization is going to hear from their ransomware negotiator,” Franks said. “Are you bringing in the data protection officer or chief risk officer? Are you getting updates in real-time? Are you getting them daily? Who is providing public relations services? Who is handling all adherence to cyber insurance or legal requirements?”

If a company chooses a good ransomware negotiator, it may be able to avoid paying a ransom altogether.

“But we know that oftentimes, that’s not the case,” Kitten said. “You want to make sure the incentives are right for the negotiator. It is possible that, because it is such an opaque business, the negotiator could get a cut of the ransom. You at least want to make sure to get a ransomware negotiation provider that does not have an incentive to either get paid a high ransom or any ransom at all.”

If you’re hit with a ransomware attack once and end up paying a ransom, “you’re more likely to be hit by a ransomware attack again,” Kitten said. “And so having a really good negotiator is going to help reduce the chances or the likelihood that you’re hit again.”

Many companies that have been hit with a ransomware attack were already targeted by multiple attacks in the previous year.

“In 2021, 50% of the ransomware victims were attacked between two to five times, and nearly 75% of the victims were hit two to 10-plus times,” Kitten said. “Oftentimes, they’re getting in because an employee falls for some kind of phishing attack. It’s a network vulnerability that they exploit. So even if you have backups of data, you still need to address the network intrusion.”

The market for ransomware negotiation has long been a black box, with most parties seeking such services not knowing even the basics; so there’s lots of room for improvement. “There needs to be information sharing,” Kitten said. “All parties would benefit from sharing of techniques, standards, and the expectations of different ransomware gangs. It just doesn’t exist yet.”

Ethical standards will be increasingly important, too. “Sharing of ethical standards can really go a long way in handling this epidemic of ransomware and preventing the damage that it’s causing from spiraling out of control,” Kitten said. “Beyond that, I think that there are certain approaches, for example, pricing-model approaches, that would give us a lot of space to grow.”

Other innovations can involve the payment of negotiators. One classic model of compensation has been to give negotiators a cut of the difference between the ransom sought and what was ultimately paid. Kitten would like to see that revised.  “There’s an incentive for both the ransomware negotiators and the ransomers to give absurdly high ransoms at the outset, with the expectation they will be negotiated far down. And that puts the ransomers in an advantageous position,” she said. 

To learn more about the negotiations market and how to select a good ransomware negotiator, click here to view the full report.

With cybercrimes reaching unprecedented levels and impacting businesses in every industry, consumers are naturally wary of providing personal information online. Financial institutions continually rank among the most trusted organizations with which consumers do business, but FIs can quickly lose their coveted ground if their customers or members lose cyber-trust due to lack of privacy protections and transparency.

Javelin Strategy & Research’s “Cyber-Trust in Banking Scorecard,” which ranked 21 U.S. FIs on consumer privacy, cybersecurity empowerment, and cybersecurity education, finds that FIs that focus on focusing on privacy, empowerment and education for customers and members are the best situated to cultivate trustworthiness and long-term relationships.

What is cyber-trust and why is it important that financial institutions nurture this among their members and customers?

“The relationship between a consumer and the organization that they are doing repeated business with is contingent on trust,” said Suzanne Sando, senior analyst of Fraud & Security at Javelin. “You’re not going to go back and continue to do business with a company that you don’t feel takes you seriously or takes your privacy and your general livelihood seriously. Looking through the lens of financial institutions, they are arguably one of the most trusted organizations, which I think is why building and maintaining what we call cyber-trust is so important for FIs.”

“The impetus for this Cyber-Trust in Banking Scorecard was for us to get a feel for how much our financial institutions in the U.S. are focusing on empowering consumers from a cybersecurity perspective,” said Tracy Kitten, director of Fraud & Security at Javelin. “What’s interesting and ironic about it is that right after our report published, we saw so many institutions putting into motion some of the recommendations that we listed in the report.”

This comes as Congress continues to come down on FIs have responded positively, as they have made changes in the right direction.

The scorecard revealed how consumers’ trust in their FIs determines consumers’ willingness to surrender personal data. However, the FI must still handle consumers’ personal data responsibly.

“Consumers who trust their primary financial institution are more comfortable than those who don’t trust their FI with cybersecurity-relevant data being collected by their FI,” said Sando. “So, for a further example, of consumers who trust their FI, 62% are comfortable with their financial institution collecting PII (personally identifiable information) versus just 30% of consumers who don’t trust their FI. When that relevant data is being collected, if a consumer trusts their FI and they know what’s happening with that data, they’re OK with it.”

“The important takeaway here is that FIs can interpret this as a level of cyber-trust, but that doesn’t mean that they can just go crazy with collecting customer data,” Sando added. “Only things that are absolutely necessary for business should be collected. You don’t want to abuse that trust because consumers are going to react if they feel like their FI is overstepping their bounds. And that trust is destroyed in an instant when privacy expectations aren’t met. The main point here is that transparency matters.”

Cybersecurity has taken on many forms, including biometrics authentication, and consumers are willing to share physical and behavioral biometrics data to ensure stronger cybersecurity. They are not as closed-minded or fearful as FIs tend to think.

“If a consumer knows that tracking their behaviors and using biometric authentication is going to enhance security, they’re more than willing to share that information and have that information be used about themselves or about their physical being,” said Kitten. “And that’s just something that financial institutions historically have not been super transparent about.”

In fact, consumers are much more cyber-aware these days and are not scared off if FIs use the word “cybersecurity,” Kitten added.

“They want to be educated, they want to be talked to,” said Kitten. “We shouldn’t treat them like children who don’t understand anything about cybersecurity. I think it is one of the bigger takeaways.”

Knowledge about cybersecurity empowers consumers to make more informed decisions about protecting their security, forming a powerful alliance with their Fis against fraud.

“The more a consumer knows, the more they’re going to trust their FI because they have a better understanding of what is out there that’s threatening their privacy, it’s threatening their accounts, their own security,” said Sando. “And that’s why I think when we did the scorecard, that’s the strong foundation of having that protection for your accounts, for your identity, for the fact that you need to have the knowledge to better detect and report scams.”

The bottom line is that the education of consumers eradicates any fear involved in taking the necessary cybersecurity measures.

FIs have an enormous wealth of resources and educational materials at their disposal that are not being leveraged to their fullest potential; consequently, consumers remain in the dark about cybersecurity protection. This can potentially place the cybersecurity of both the FI and the consumer in jeopardy.

“It’s in a financial institution’s best interest to provide comprehensive educational materials from cybersecurity to fraud, scams,” Sando said. “When educational material is actually used by consumers, the vast majority say it’s useful, which is great. But the problem is, many FIs don’t have it organized in a way that is convenient for the consumer. If you look at FIs that use external search functions within their online website search, you’re pulling in a lot of results that maybe aren’t necessary. Relevancy and usefulness are incredibly important for a consumer to find real use from these educational materials.”

Presentation of materials in all formats is important in order to engage with all consumers. Audio and video content will be highly useful, as it is an easily consumable content. It takes more time and effort to sit down and read educational materials.

Kitten added that educational materials should be, “easy to find.”  

“If you have all of the educational materials buried deep into the website where no one can find them, they’re not doing anyone any good,” she said. “And we don’t want to have to download a lot of white papers and read them. When I’m working, I find it very easy just to put on a podcast in the background. I like to do the same thing with webinars. I can still check my email, but I’m also able to multitask and it’s just a more engaging way to interact and educate.”

Another highly engaging way to interact with consumers is by using gamification techniques.

“One of the other things that we looked at in the scorecard were interactive fraud and cyber assessments,” said Sando. “And only 14% of FIs were actually making use of gamification through an interactive assessment. They’re arguably one of the best ways to engage consumers because we are naturally curious about our own aptitude. Gamifying this education gives consumers a chance to benchmark their own fraud and security proficiencies. They can get a better sense of ‘where am I at? what do I need to do better?’ It’s not that cybersecurity is scary. It doesn’t have to be.”

Gamification uses both competition and rewards to enhance both learning and engagement.

Kitten added, “And also, it’s a little bit more fun, right? When you make it a game, if you make it a self-assessment, you’re posing questions that consumers might not even think about. They may not think about social media use or how often they’re changing their passwords. If they’re reusing passwords, do they use a password manager? All these things are questions that the FI could be posing in a self-assessment that would help.”

This will ensure that both the FI and the consumer can benefit from having extra layers of security.

FIs should also remember to speak to their consumers in a language that consumers comprehend. Industry jargon should not be used to communicate critical information to customers.

“When an FI has a privacy policy that’s comprehensive, it’s easy to understand, easy to read, in language that we can all take in and understand what’s going on, that is fostering a sense of trust because the consumer understands what is happening with their data, their privacy, and anything that goes along with it,” Sando said. “I think that transparency when it comes to data collection and marketing is also really important to establishing trust. When you disclose the data collection or your tracking practices, it leads to that sense of cyber-trust and -security among consumers because they feel like they have more of a sense of control over what’s going on with their data and that sense of autonomy right there, which leads to independence and a greater sense of satisfaction, which of course leads to cyber-trust.”

“Legalese has to go away, Kitten added. “These privacy policies have to be written in ways that the layperson will understand,” she said. “That’s one of the big things that some institutions are doing a better job than others, but all of them have room for improvement.”

So, what are the implications or consequences for FIs that fail to maintain cyber-trust among their customers?

“I think one last point here in terms of consumer privacy is just the implications of a breach of trust,” said Sando. “If a business is considered untrustworthy and betrays the trust of a consumer, the impact is not that substantial because the consumer probably didn’t have a lot of faith with them to begin with. They weren’t doing a ton of business with this, with this company anyway. But if an FI violates that cyber-trust, that impact of a breach of trust is so much more significant because the consumer had a greater level of trust to begin with. If you want to reduce the risk of attrition, reduce the risk of even just a consumer, maybe taking some of their services away from their FI and finding other sources for this business, you really have to focus on consumer privacy and fostering that sense of trust just within their own data and their own security.”

The key takeaway from this report is that FIs must do all they can to reveal to their customers their intentions for collecting their personal information. They must also continue to make cybersecurity education a priority by making it both relevant and accessible to all.

“Be transparent,” Sando said. “Transparency about everything from your privacy policy rights, to the data collection, to how you know you’re using targeted marketing, educational materials, security features that are accessible and easily found for all consumers. Everything has to be made aware to a consumer if you want to foster cyber-trust.”

“Institutions really need to lean into this role of being an educator,” said Kitten. “They’re trusted. They’re deemed to be much more secure than many other industries and businesses. So take advantage of that. Consumers are going to look to institutions for education, for support — take advantage of it and use it to just continually build on the trust that’s already there.”

“Prioritizing education, expanding your topic coverage, making use of all content formats. You want to maximize consumer engagement because anything that gives a consumer a better sense of independence and a better sense of control over their financial wellness as a whole is just going to lead to a greater long-lasting partnership.”

Direct Deposit has been a part of our banking system for more than two decades, and employers commonly use it to issue employees their wages directly into their bank accounts. Today, Direct Deposits can be used to pay taxes, bills, and other charges.

“Direct Deposit has been around for quite some time and it’s very well received throughout the United States,” said Debbie Barr, Senior Director of ACH Network Rules Process & Communication at Nacha. “Over 93% of American workers use Direct Deposit. We know the federal government uses Direct Deposit for tax refunds and EIP [economic impact payment] payments. But what we really wanted to know was to dig down deeper into one segment of the population: We decided to look at the millennials.”

Nacha, the payment system organization that manages the ACH (Automated Clearing House) Network, recently launched a campaign to encourage millennial workers to use Direct Deposit to receive their wages directly into their bank accounts. The survey consisted of 700 U.S. consumers ages 22–34. Half of the millennials surveyed were W-2 workers and the other half were gig workers. Here are the findings.

“What we found was that 97% of those surveyed have a bank or credit union account,” said Barr. “This means that they already have the tools they need to receive Direct Deposit. Eighty-three percent are already receiving their pay by Direct Deposit. Seventy-one percent said they primarily keep their money in their bank or credit union account. Almost all of them have deposit accounts. The vast majority have savings accounts. That’s a great thing as we think about Split Deposits. The top uses for Direct Deposits are salary, wages, receiving those tax refunds, and EIP payments.”

Barr believed receiving Direct Deposit creates a gateway to the many other benefits of using the ACH Network. “Receiving Direct Deposit creates this great foundation for using ACH for other things, like your bill payment,” she said. “The more you use ACH, you get this level of trust because you see the benefits of ACH, the reliability, the convenience.”

Barr continued, “With the trust level, we found that 80% of those who received their salary with Direct Deposit consider it highly trustworthy, giving it an 8, 9, or 10 out of a scale of 10. So that is exciting for us. It builds that foundation that moves them into using ACH for other things like Direct Payments. Seven out of 10 said they use Direct Payment for at least one bill each month. We were very happy to see those results.”

“I don’t think I’ve seen a paycheck in 25 years,” said Brian Riley, Co-head of Payments at Mercator Advisory Group. “It goes in, everything works, and it’s flawless. I had an issue with one of my kids — my daughter was filing her taxes [and] she checked off that she did not want to get an ACH on her tax refund but wanted a check. I said, ‘Do you realize that will add about five weeks until you actually get the funds?’”

Nacha’s reasons for targeting millennials as a group to potentially benefit from Direct Deposit are well-founded. These college graduates are entering the workforce, are earning salaries, and have a car payment.

“These are college graduates; they have annual salaries of at least $35,000 a year,” said Barr. “They all had either a student loan or a car payment. That really tightened up the group for us. With our W-2 employees, 88% are already using Direct Deposit. But less than half [47%] of gig workers are getting paid that way. We see a great opportunity there to educate that audience on the benefits of Direct Deposit. Some in our survey do both — they have their W-2 job and they also do some side work. With that group, we found that 92% of those were using Direct Deposit at least once a month to receive their pay.”

Barr continued, “With our gig employees, just over half [56%] are primarily storing their money in bank accounts. The rest are storing them in nonbank payment apps. So that’s a great opportunity to talk to them about the benefits of using Direct Deposit and having that bank account available for that.”

“This is basically a no-lose strategy,” said Riley. “It’s cheaper for the employer to do a DDA (daily demand deposit account or checking account) drop than it is to cut a check. That’s a significant channel. For the employee, it loads up that account quicker and [they do] not have to wait for funds to clear through a check deposit.”

Many benefits are tied to Direct Deposit payments. They are a fast, reliable, convenient, and environmentally friendly way to get paid. Nacha understands that as workers age, there will be a natural increase in ACH use as they begin to add utility payments, mortgage payments, and additional car payments. The time to educate millennials on the value of using Direct Deposit is now.

“We started our campaign looking at three different channels,” said Barr. “We have display ads that follow our targeted market audience throughout their internet [use]. We also have some native ads that, if they [millennials] are online and looking at articles, the native ads will be there, too. We also have 15-second videos where we picked three different types of gig workers. These are real gig workers that are doing their job, working hard, trying to get their pay. We have one that is in food delivery. We have one that is in rideshare, and one that is a dog walker. They are in our static ads and in our videos. Using Direct Deposit, their pay arrives when they expect it, and it’s there for them to use.”

“We really wanted to push this campaign out to help them understand like, ‘we know you guys are working hard and you deserve to get every dollar that you’re paid,’” Barr added. “And getting [paid] on the day you expect it. Making sure they understand all the benefits [that] go along with having Direct Deposit as your payment choice.”

Did Nacha receive any pushback from respondents about Direct Deposit? The study found that pushback stems more from a lack of education and awareness for this option than from an opposition to using this system.

“It’s really an education piece more than there being a holdback, so it’s helping people to make sure they understand the ease of signing up for Direct Deposit and the reliability that your pay will be there when you expect it to be,” said Barr. “And the security. There’s always a little concern when we do anything online that there might be some issues, but the ACH Network is a very secure way to make your payments.”

“It doesn’t cost anything,” said Riley.

To learn more about all the benefits that Direct Deposit has to offer, millennials can easily get more information on Nacha’s dedicated website.

“Visit our website, directdeposit.org/gigworkers,” said Barr. “There you will see a lot of great tools.”

Barr also invited financial institutions to get onboard, spreading the news about how Direct Deposits benefit both employers and employees.

“We want our financial institutions [involved] because they touch both sides of the transactions,” said Barr. “They have the employers as their corporate customers and making sure the employers understand that Direct Deposit is a great benefit to them to offer besides being a benefit to their employees. It’s more economical. It’s easy once it is set up. Making sure that the employers have the tools they need to get the Direct Deposit set up but also to educate their employers or their employees on the benefits of ACH.”

“Our financial institutions also have the employees as their customers,” Barr added. “We have the millennials with their bank accounts, and so making sure they understand the benefits of Direct Deposit. With that age group, they have the phone in their hand all the time. They have the bank app on their phone. Making sure they understand where in their bank app they can grab that routing number, the account number, the information they need to sign up for Direct Deposit, and know what it is. It’s probably on the app, but can they find it? Make it easy, clear, and call it out. The beauty of ACH is once you’re signed up, it’s set it and forget it.”

“Direct Deposit is something that is offered across the board. Any of your major payroll providers and the majority of the smaller, independent payroll providers know ACH, know Direct Deposit — it’s something they are able to offer,” said Barr. “It shouldn’t be something that you have to educate your payroll provider on.”

“As you start receiving ACH credits, you get that comfort level with ACH. You start doing some Direct Payments for this group [millennials] — it may be their student loans, their car payment that they set up as auto pay. As we age, we add more lifestyle payments such as utilities, mortgages, subscription services, donations — there’s so many opportunities for Direct Payment. As consumers age, they add more lifestyle payments and the more they add as Direct Payment, the easier it is. It’s such an easy way to handle your finances and manage your money.”

Check out directdeposit.org/gigworkers for tools and more information on the benefits of Direct Deposit.

Credit card tumbling (CCT) is a subset of credit card fraud in which a hacker has some, but not all, of a customer’s information and attempts to guess the rest. The word tumbling is a reference to the tumblers, or knobs, on an old-fashioned safe, which a robber would open by listening carefully to the moving tumblers to detect a click, an indication that a code number had been reached. Today’s hackers aren’t listening to moving tumblers until they hear that click, but they are leveraging partial credit numbers or expiration dates and continuing to guess the missing information until a purchase goes through. 

It’s no surprise that CCT is top of mind for merchants, who are continually looking to offer more security and prevent such fraud from accelerating.

In a recent PaymentsJournal podcast, Alok Kumar, chief information security officer, NCR Retail & Payments; and Brian Riley, head of credit and co-head of payments at Mercator Advisory Group, discussed the threat CCT poses and offered best practices for merchants who are tackling this issue.

Detecting CCT fraud is relatively simple. It shows up when a bill is disputed by a customer who’s unaware that information has been stolen. Preventing CCT fraud before it happens is more challenging, but can be done if the appropriate precautions are taken.

“The passive way is to sit there and wait for a bill to tell you of an attack,” Riley said. “The proactive way involves a process that pre-identifies where that risk is and allows you to catch things way before the problem turns into a real big problem.”

According to Kumar, the most important aspect of a proper information security control system is to prevent CCT fraud. “Today, with many of the vendors [out there], if I go to their website, they don’t ask for a CVV,” Kumar said. “The CVV is the card verification value, which is on the back of the card. That number is not saved in any database. So even if the hacker takes the credit card info online, they never have the CVV. That’s something we need to verify every time.”  

Velocity checking, also referred to as rate limiting, is another key factor to watch out for. “You need to check and see how many attempts at a payment you’re getting per minute from the same session,” Kumar said. “Sometimes people do up to 30 tries, and there’s no reason for someone to do that many per minute.”

Other security checks involve corroborating customer information. For example, it’s important to make sure the card number matches the address presented by the customer and that the IP address is legitimate. There are IP reputation lists published by different vendors—a merchant can subscribe to that service and verify that a customer is not coming from an IP that has already been blacklisted.

Companies can leverage these strategies in-house or outsource them. “There are a lot of third-party vendors that you can outsource the traffic to,” Kumar said. “Those companies have security services, where you can route your [customer] traffic through them. They also offer customizable solutions, blocking certain cards under custom rules, and only send the proper traffic to your website.”

Preventing CCT fraud also involves focusing on data storage. Merchants should make sure to have intrusion detection prevention services, such a firewall and antivirus file integrity monitoring. Databases should be encrypted, along with credit card information.

“When you’re sending credit card information to a processor for any reason, you should not leave any of the plain text of the credit card in any file, whether it’s a database or a flat file,” Kumar said. “Many people do manual processing at the end of the day. They sometimes leave log files on their computers with credit card text in them, which can be stolen.”

Another common mistake that can be easily avoided is the sending of sensitive log files to the trash folder. When malware gets into a computer, it looks in the trash folder first. People who handle credit card information daily can be trained to not leave sensitive files in the trash folder.

Overall, avoiding CCT fraud is possible with the right steps. Checking for a CVV, checking card submission frequency, and corroborating customer information are important to sniffing out fraudsters. Securing customer information via encryption and disposing of data properly are also important. Companies can implement much of this in-house or partner with organizations that specialize in these tasks. With the right plan, companies can improve their bottom line significantly by working to reduce fraud before it happens.