The PaymentsJournal Podcast

Reconciliation is an essential aspect of the accounting process that improves transparency, maximizes decision-making, and ensures regulatory compliance. However, many merchants and payments organizations still rely on inefficient processes that can result in errors, financial losses, or violations.

In a recent PaymentsJournal podcast, Nick Botha, Global Payments Sales Manager at Autorek, and Don Apgar, Director of Merchant Payments at Javelin Strategy & Research, discussed the importance of optimizing the payments reconciliation process and explored the influence of automation on its efficiency.

The reconciliation process is often fragmented among business divisions, which can lead to inaccurate reporting.   

“It should be viewed as an end-to-end process,” Botha said. “That includes financial controls, operational processes, payment flows, the whole of financial operations. Reconciliation has become integral to the success or failure of a middle and back office these days, and it must be a single, continuous process.”

Another pain point is the reliance on legacy-based processes or manual workarounds to process complex financial data. As a business scales, inefficient methods increase the potential for a costly reconciliation error.

“A function of paying money out is reconciling it,” Apgar said. “There’s been so much growth in the fintech space, and so many companies have stepped in that don’t realize how complex it is. They don’t understand the sheer number of data sources there are, the number of categories, and how many feed types to apply.”

The move to faster payments is likely to compound reconciliation challenges. As instant payments rails like FedNow and RTP gain traction, companies will be compelled to adopt reconciliation processes capable of operating in real-time environments.

Mastercard and Visa recently settled with merchants, agreeing to relax certain restrictions and reduce credit card interchange fees. The settlement is expected to save merchants $30 billion over the next three years.

“It’s a splashy headline,” Apgar said. “It boils down to a four-basis-point rate reduction for merchants, which is not much. The big news was the rules changes that allowed large enterprise merchants to negotiate their own interchange fee deals with large issuers. For example, Target could cut a deal with Chase for a lower interchange fee in exchange for ‘We Prefer Chase’ signage at the point of sale.”

The settlement also allows merchants to charge customers more to accept rewards cards that often have higher fees, such as airlines rewards cards.

“It will only be effective if merchant operations are improved,” Botha said. “A large, global merchant that’s still processing manually with spreadsheets and a team of 40 or 50 people, the new rules won’t have much of an impact because they aren’t efficient enough to take advantage of them. They’re using methods that are no longer fit for purpose.”

Though the settlement may provide short-term relief, many merchants and payments companies are operating on thin margins. If volume increases, they’re not prepared to scale accordingly and keep their margins secure.

In the interest of protecting consumers, regulators have established requirements stipulating that clients will receive 100% of their funds back in the event of liquidation by the payment services firm. In addition, the safeguarding regime ensures payment companies aren’t allowed to commingle their operational funds with their clients’ funds.

According to Botha, safeguarding extends beyond individual businesses. Partnerships are critical to the reconciliation process, necessitating collaboration with acquiring and technology partners that share the same values as your business.

Internal and external audits are another critical tool often overlooked by businesses. Regulators are intensifying scrutiny of merchant-bank relationships and payment ecosystems. With regulatory inquiries from the FTC, the CFPB, and the FDIC becoming more common, businesses should conduct self-audits to precisely assess their standing.

“For those companies that are still using legacy processes, creating even a basic report for regulators could be a nightmare,” Apgar said. “Automating the settlement function and having the data organized and accessible is crucial for accurate reporting. It’s not just about organizing your daily functions; it’s about preparing yourself for compliance inquiries so you can respond without manual intervention.”

Internal and external reconciliation are the biggest issues regulators have identified in organizations.

“It’s not just the manual processes,” Botha said. “There’s not enough control around these functions. Businesses must know what their workflows are, how they’re managed, and the tools used, simply to produce accurate reports. Many times, regulators aren’t just looking for data, they’re looking for insights into a company’s operations.”

Many reconciliation issues could be resolved by improving the communications between business segments.

“In today’s world, a data team might be handling day-to-day financial data,” Botha said. “You might have one team dedicated to reconciliation and month-end functions, and then a different team that’s handling stakeholder reporting. Even though there’s all these different business units, it’s one process. Companies must fold all those functions into a single source of truth.”

Every business has its own culture, but gaining an understanding of how competitors or similar organizations operate can provide valuable insights. Companies should also consider macroeconomic factors beyond their own geography, given the increasingly global payments economy.

When a business is fragmented, automation can do more harm than good because it’s based on inaccurate information. However, once a company has centralized its data, automation can have a substantial impact, especially as the company scales.

“Businesses spend so much money on customer acquisition and experience,” Botha said. “I would strongly suggest allocating an effective budget to your technology stack over the next few years. Funds rarely go to the back office, but that’s the piece that ensures you can scale as you acquire customers.”

Apgar added: “At some point you have to step back and build infrastructure. Often, if it’s not visible to the customer today then the money doesn’t get allocated toward it. But those processes will become visible to the customer when they don’t work.”

The post A Single Source of Truth: Automation’s Impact on Payments Reconciliation appeared first on PaymentsJournal.

The United States is a unique banking market, with more than 11,000 financial institutions and some of the most stringent regulations in the world. With the launch of FedNow last year, The Clearing House’s RTP network, and a new messaging standard in ISO 20022, U.S.real-time payments have finally arrived. There’s only one problem: The infrastructure here is not ready. 

In a recent PaymentsJournal podcast, Himanshu Pujara, Managing Director for Euronet Worldwide, and Elisa Tavilla, Director of Debit Payments at Javelin Strategy & Research, spoke about how instant payments are happening around the globe today, and how banks can develop payment platforms that take advantage of increased standardization and interoperability, as regulatory bodies push for a more interconnected financial ecosystem.

The state of global payments varies depending on where you look.

“We’ve connected to many RTP networks and have been processing instant payments for over a decade now,” Pujara said. “In India, the Unified Payments Interface has been a game-changer, enabling billions of transactions monthly with its simple, mobile-driven approach. Then there’s the EU’s SEPA Instant Credit Transfer, which streamlines cross-border payments efficiently within Europe. In Brazil, the Pix system has revolutionized the speed of payments, quickly becoming a mainstay in their financial ecosystem. We process millions of transactions every single month for our customers in the emerging markets, and in all of these markets real-time payments has become a dominant form of payment in the day to day lives of consumers.”

These global trends have not yet matured in the U.S. market. While the United States has had limited access to instant payments in the past, FedNow has sped up the timeline for banks to offer such payments to consumers and merchants. This gives banks the opportunity to enhance transaction efficiency, financial inclusion, and economic growth.  

Although there are different U.S. regulatory and market environments, the future points toward more collaborative efforts to harmonize regulations and technical standards, making it easier to transact instantly and across borders. Financial institutions have the opportunity to use the real-time payment rails to launch innovative use cases for customers such as insurance companies or payroll service providers.

Under the new rails, banking teams could offer a cash management solution or a liquidity management solution to make sure the merchants they support get their funds in real time. In other parts of the world, fintechs have taken the lead by converting their closed-loop stored-value wallet propositions and making them interoperable on the back of real-time payment systems. U.S. fintechs have the same opportunity. 

The challenges lie primarily with legacy applications and their architecture. How does a bank make sure it’s able to connect to these systems in the shortest possible timeframe, knowing there will be new services or functionalities launched by the Fed or TCH? And how do consumers recognize the benefits of adopting instant payments?

“We all know consumers in the U.S. are very card-centric,” Tavilla said. “They like using credit and debit cards and have been accustomed to their rewards and incentives, as well as the purchase protection that cards provide. It’s important for providers to offer comparable benefits to give consumers a reason to convert from card payments to other types of payments.”

U.S. consumers often expect inconveniences in their financial transactions, not realizing that an instant payment system could ease issues.  “Last week I unexpectedly had to go shop for a new car,” Tavilla said. “On Sunday, I picked out a car and negotiated the price. The dealer offered to put $3,000 on my credit card but asked for the balance by the day after tomorrow, which was a Tuesday.  I don’t keep tens of thousands of dollars in my checking account, so I had to transfer it from my savings account via ACH, from one financial institution to another.” 

Such transactions can take a few days to transfer and cost the consumer $30 or $40 each. Real-time payments and ISO messaging can help alleviate such pain points by automating and reducing the time and heightening the efficiency of the entire process.

“Elisa’s story is a classic example where the customer would want some sort of a payment rail, where the money can move on a real-time basis,” Pujara said. “She had an urgent requirement, but even on an ordinary basis, we’re all used to instant gratification. Whether it’s ordering a ride or shopping for goods, the real time element is there pretty much in every part of our lives, other than money movement.”

U.S. financial institutions have decisions to make as they move into instant payments. In addition to having connectivity to RTP systems, banks can build an orchestration layer on top to decide on the rules they want to put in. They have the flexibility to scale their processes based on cost, availability, or which network to route the transaction.

To navigate and capitalize on the evolving landscape of instant payments, organizations must be technologically adaptable, savvy with regulations, and customer-centric, ensuring they can meet the demands of a rapidly changing global payments environment. This means investing in payment technologies that can quickly conform to new standards and regulations. Cloud optimization is just one example of innovative technology that can enhance performance, security, and cost-efficiency.

The future points toward increased standardization and interoperability, as organizations and regulatory bodies push for a more interconnected financial ecosystem, enabling seamless transactions and enhanced user experiences globally. We’re likely to see more collaborative efforts to harmonize regulations and technical standards, making it easier to transact across borders. 

As those efforts come to fruition, Euronet offers an example of the flexibility available to U.S. banks. “We have a flexible deployment architecture depending on the size of the financial institution,” Pujara said. “We could provide a license that the bank can deploy in their own data center. For some of the smaller banks, we have a fully managed services offering with a hosted solution, which includes not just processing these transactions, and routing the transactions to instant payment schemes. It also includes services like reconciliation, settlement, unified dispute resolution, fraud, and risk monitoring.” 

The post Getting the U.S Banking Market Ready for Instant Payments appeared first on PaymentsJournal.

The end-of-the-year flurry of holiday shopping is a classic example of business seasonality. As fraud professionals have long observed, fraud activity also follows seasonal patterns, with seasonal upticks and slow-downs. The challenge has been reacting to seasonality with precision in real-time, instead of just recognizing them in the rear-view mirror. And new data shows that this seasonality doesn’t correlate to the business year as much as one might expect—fraudsters have a seasonal calendar all their own

In a recent PaymentsJournal podcast, NeuroID Head of Operational Strategy Nash Ali and Tracy Kitten, Director of Fraud & Security at Javelin Strategy & Research, discussed the seasonality of fraud. They analyzed the methods criminals use and offered solutions to keep businesses safe.

Fraud attempts are rising overall, up 57% from 2022 to 2023. Due to the holiday frenzy, December might seem like the logical peak of fraudulent activity.

“In fact, it’s January,” Ali said. “January has a 78% higher fraud attack rate than the average monthly rate. That includes a 59% increase in application fraud, where criminals falsify data or misrepresent themselves to business owners. There’s also an 85% increase in the hours businesses are under attack in January compared to the rest of the year.”

After a February slowdown, there’s a 44% higher fraud attack rate in March compared with the typical monthly average. A higher portion of March attacks consists of identity fraud, identity theft, or creating synthetic identities with bots and scripts. After another lull in April, fraud picks back up in May.

“We see 50% more application fraud in May compared to monthly averages,” Ali said. “A lot of that fraud is concentrated fraud attacks committed via fraud rings. After a slow summer, fraud rates pick back up in the fall, peaking again in October.”

Criminals are constantly looking for weaknesses, and seasonal fraud trends are no doubt spurred by company vulnerabilities. Business owners should also understand that there can be a delay between when their business is breached and when fraud actually occurs.

“Company information is likely being compromised during these high-usage months, like the holidays,” Kitten said. “Then we don’t start to see the fraud until several weeks to a couple of months later. When does a compromise happen and when does the actual fraud result?”

In the drive for year-end sales, companies often open themselves up to fraud attacks.  

“They’ve relaxed controls, they’ve let their guard down in order to attract more volume,” Ali said. “They also staff additional people to meet the additional volume. In January, businesses are scaling down their workforce and there are less eyes on fraud.”

The spike in March may also be attributed to the end-of-the-year rush. It takes time for data obtained from end-year breaches to circulate to the bad actors who exploit it.

“By March, it’s made its way through the trenches of the dark web and into the hands of fraudsters who will actually do something with it,” Ali said. “That’s why we see more identity theft, identity fraud in March.”  

Data breaches are increasing in frequency, to the point that it’s no longer shocking. That trend is likely to continue.

“Breaches don’t raise flags anymore,” Kitten said. “But there are still things companies and security teams should continually look for, including on the dark web. They must keep searching for indicators that a larger breach has occurred and company information has been compromised.”

The high-tech means criminals have at their disposal, especially since the advent of AI, increase the difficulty of preventing attacks. Cybercriminals have sophisticated ways of creating forged documents, like passports and driver’s licenses. Businesses that rely on document-based verification will likely see fraudulent documents that are difficult to detect, even with physical biometrics.

The May fraud spike is also a reaction to a time when businesses are vulnerable.

“The first quarter of the year tends to be a time when many companies release new products, new offerings,” Ali said. “In the financial services world, they release new loans. Fraudsters home in on that, which is why we see a resurgence of fraud in May. New products tend to have lower controls as they’re rushed to market, so in May criminals are looking to exploit that.”

Criminals often spend a lot of time conducting probing attacks. Criminals will explore perimeters, controls, and boundaries to measure a company’s effectiveness at identifying and preventing fraud.

“They’re testing companies to see what they can get away with,” Ali said. “Probing attacks are these short bursts of fraud activity, and most institutions don’t even react. If they do detect it, often they’ll ignore it because they’re looking for larger-scale fraud. When the real attack comes, they won’t realize it until it’s too late, because fraudsters found vulnerabilities through probing.”

The holidays are a common time for probing attacks, when thresholds are down and companies provide customer incentives and promotional products. That’s why it’s crucial for businesses to place a special emphasis on fraud prevention at the end of the year and install systems that will be attuned to detecting probing attacks.

New technology has made it increasingly difficult to detect fraud, because bots can be programmed to perform probing attacks. They can create new identities or attempt entry through permutations of personal data.

“It’s important to have tools that can detect whether an attack is an automated script or a human,” Ali said. “Businesses need proactive, real-time, technology-based solutions. You can’t rely on humans doing manual reviews. It’s not scalable, especially at the holidays. If you do install automated tools, however, they must be fine-tuned to lower false-positive rates.”

Often, businesses go too far and use outdated methods that end up placing undue friction on consumers.

“Enterprise fraud mitigation solutions have to equally evolve with fraud, if not be ahead of the game, especially since AI has been used in fraud attacks,” Ali said. “The best way to be prepared is not to rely on the same legacy fraud mitigation solutions to try to solve new fraud attack vectors. Behavioral analytics complements traditional fraud tools, and you can passively detect fraud.”

A combination of behavioral analytics, technology, and skilled oversight is the most potent defense. To that end, NeuroID offers an array of fraud detection and prevention solutions that harness the power of behavioral analytics.

“It has to be a multilayered approach,” Kitten said. “As things continue to evolve, the amount of friction on the customer is also a critical consideration. It’s increasingly important to do whatever can be done on the back end to authenticate and verify the authenticity of a user in a transaction. That’s where behavioral analytics come into play.”

The post Seasons of Fraud: How Fraud Patterns Shift Throughout the Year appeared first on PaymentsJournal.

Now that the Payment Card Industry Data Security Standard 4.0 has gone into effect, merchants have a year to conform to the 63 new or updated requirements. With many moving parts to the standard, some businesses may struggle to understand their compliance obligations. Simultaneously, they also don’t want to risk creating friction in the customer experience as they introduce the new security measures.

In a recent PaymentsJournal podcast, Sukanya Madhavan, Payments Chief Product and Technology Officer, at CSG Forte and Don Apgar, Director of Merchants Payment Practice for Javelin Strategy & Research, discussed the new rules. They examined the implications of the change and mapped out steps business owners can take to ease the shift to the new standard.

One of the main things to know about PCI compliance is that it’s an evergreen and ongoing process. The purpose of the compliance program is to build a safety net for consumers to make sure they’re protected against bad actors. It also streamlines merchants’ card payments operations.

“The program is designed to ensure that customers have peace of mind when they provide their data to us,” Madhavan said. “It should be considered a continuous improvement process, where businesses look for innovative ways to solve the evolving challenges.”

In response to ongoing data breaches, the PCI standard mandates that merchants conduct quarterly internal and external vulnerability scans. Due to the sophisticated technology involved, it’s critical to have an individual who is well-versed in the systems to review these scans.

If merchants need help, quality security assessors (QSAs) and payments processors can give guidance. Often, the issues turn out to be basic security vulnerabilities involving passwords, such as password sharing or passwords that aren’t strong enough. There is help, however, if the issue is more complex.

“Merchants should know they can reach out to their processors, and there is a whole network of support,” Madhavan said. “It’s a partnership between the processor and the merchant to ensure that they are jointly taking care of the consumers’ data. Some processors have gone so far as to create instructional webinars, and there’s even a hotline.”

Maintaining PCI compliance isn’t just about protecting customers. It’s also about safeguarding businesses. When there’s a substantial PCI violation or a significant data breach, it’s often newsworthy. But it’s not the kind of publicity businesses want.

“With the sheer volume of data and the high profile of many companies, it’s a reputational risk,” Madhavan said. “The consumer data that companies store is there to fuel business growth, and it’s a critical part of doing business. [The costs of switching brands] have decreased so much these days that you must ensure your customers trust you to take care of their data.”

“Many merchants view the PCI compliance requirement as a burden,” Apgar said. “They’re just looking to check a box. They don’t understand that this is a great opportunity for them to take a step back and review where data is being stored, what its uses are, and what rules govern it. PCI is not there to be burdensome to businesses. Keeping cardholder data secure should be viewed as a benefit.”

Merchants that take card payments can already start the switch to DSS 4.0, but there’s still a one-year period before all companies must be compliant. Although some of the new requirements are process enhancements, others are technology-driven. For example, multifactor authentication and passwords with a minimum of 12 characters are now required.

Depending on the business, that switch could take time and affect customers.

As Apgar noted, “Merchants are hesitant to implement some of these things because they don’t want their customer experience to have more friction than their competitors. But if they’re able to introduce new security capabilities, even if the authentication requirements may be more cumbersome, the benefits will offset the drawbacks.”

One of those benefits is added protection from fraud. The advent of newer technology, including generative artificial intelligence, brings a new set of challenges as well.

“It can be a lot for merchants to consume,” Madhavan said. “Should I focus on running my business? Should I focus more on the technology and the security side? It’s important for us as solution providers to make it easier for businesses to operate because they have all these other tasks to perform. We need to support them so they can focus on the core business.”

Security practices are continually evolving to combat new threats. That means companies should be prepared to evolve with those practices, even after they reach compliance with PCI DSS 4.0.

“There’s no magic bullet when it comes to the security side of it,” Madhavan said. “And it takes a village. It takes all of us working together to make sure that the systems are secure. If you don’t know what works for you, there are providers and approved QSAs who can help you. You can also take ownership by continuing to review security best practices and conducting vulnerability scans.”

Another key takeaway is that even though there’s a grace period, merchants should start to work on their gaps to comply with DSS 4.0 as soon as possible. A requirement for more secure passwords, for instance, works only if all of a company’s customers have updated their passwords.

“All these things have to be mapped out; otherwise, you risk a really poor customer experience,” Apgar said. “A year may sound like a long time, but when you start to map out the items that need to be completed and all the moving parts, it’s not so long, after all.”

Learn 3 quick tips to keep your payments data secure in CSG Forte’s white paper.

The post The Clock Is Ticking on PCI DSS 4.0 Compliance: Is Your Business Ready? appeared first on PaymentsJournal.

Though most people still refer to prepaid products as gift cards, that term has almost become a misnomer in today’s payments industry. Prepaid cards do so much more than carry gifts—not just for consumers but also for issuers. Savvy businesses use them to drive more consumer spending while increasing brand loyalty. 

To that end, Fiserv recently worked with Javelin Strategy & Research on a survey of more than 500 buyers in the incentives area to find out what’s driving their purposes. The survey provided a jumping-off point for a recent PaymentsJournal podcast with Tom Niedbalski, Vice President, Global Sales and Partnerships at Fiserv, and Jordan Hirschfield, Director of Prepaid Advisory Services with Javelin Strategy & Research.

The survey was conducted from the buyer’s perspective rather than that of the consumer. Javelin spoke with individuals who are buying incentives for purchasers of their brands, spanning a wide variety of companies, each with revenue of $20 million or more. Their responses provided an incisive look at what the benefits these buyers are seeking in an incentive. 

Javelin’s research has shown that loyalty programs and rebates are highly beneficial for building long-term relationships. This can have a significant impact on customer retention but can also improve the efficiency of onboarding new customers as well.  

“It’s expensive to acquire a new customer, but these incentives had a very material impact on lowering acquisition costs and subsequently on improving customer retention,” Hirschfield said. “With so many useful benefits of offering an incentive to a consumer, you can have a material impact on your bottom line.” 

Despite a reliance on physical gift cards, the shift to digital formats is going strong, consumers by and large prefer digital, and the research shows that the balance is continuing to shift that way.  On the buyer side, people are still purchasing incentives by going to physical stores and buying hundreds of gift cards. They don’t seem to realize they could be doing this through a relationship with a provider in an easier distribution model that can save on costs. 

On the consumer side as well, retail purchases remain popular. There’s an opportunity here to bring in a provider and transition those purchases to a digital distribution method. That can be easier for the buyer and can foster a positive ongoing relationship with consumers or employees. It tells the employee “we value you.” 

“Many buyers do not realize that there can be an economic benefit to buy through an aggregator, or through a brand’s website,” Niedbalski said. “In many cases, they will not only get a discount for that purchase but also build a strategic relationship with the brand, where there could be additional cobranded opportunities and synergies for the two companies to leverage.” 

According to the research, 40% of consumers will receive some sort of incentive this year. 

“When we look on the buyer side for the B2B side of the equation as opposed to the B2C side, that’s where the digital’s coming in,” Hirschfield said. “On the buyer side, 60% of purchases are digital, which makes sense, because around 70% of the recipients prefer that.” 

But the survey found that 39% of buyers are still giving out physical cards, even though 46% of them preferred digital. On the consumer side, the individual will control that relationship. 

Niedbalski noted that Fiserv is seeing use cases evolve because digital enables integration into various distribution vehicles. “Brands are now using this platform not only for loyalty but for rebates, for warranties, for specific product couponing, and for customer appeasement,” he said. “And of course you’ve got the foundation of a giftable program as well, where the card just remains a gift.”

Everything seems to be moving to a digital format, whether it’s credit cards, library cards, gift cards, or loyalty cards. Wallets, like George Costanza’s in the famous Seinfeld episode, have gotten too stretched to carry around those cards in a physical format. 

“But even our digital wallets are also starting to get overcrowded in some sense,” Niedbalski said. “With Google Wallet and Apple Wallet, we’re seeing a lot more brands invest in their own vaulting solutions. They’re creating branded apps to drive consumer engagement. The convergence of all their payments along with their loyalty programs into a branded wallet could prove to be a pivotal point for adoption of digital both at the consumer level as well as the merchant level.”

Since the pandemic, brands have reprioritized their consumer engagement model. Although they still want foot traffic in their stores, they’re seeing a lot more traffic outside of their stores, whether it’s via curbside drive-through, delivery, or online shopping. How do you maintain personal engagement with a consumer virtually? 

Many brands are dealing with this by bringing the in-store experience into a mobile environment. “They need to provide enough value within their app to keep the customer clicking that icon on their mobile phone,” Niedbalski said. “A lot of these use cases are being integrated in a way that makes it easy for brands to connect with their buyers and with their consumers.  Along the way, it’s driving convenience and value.”

A virtual card has another value over a physical card: It is easier to use, even in impromptu shopping situations. “I’ve got a stack of probably 20 to 30 gift cards sitting at home on my on my office desk,” Niedbalski said. “Some of those gift cards are 20 years old and still have value on them. I’ve never redeemed them because I’ve got too many cards. I can’t carry these around with me every day. With digital, you are able to access your gift cards on demand anywhere, anytime, which helps drive that redemption of those gift cards.”

In modern society, our phones are always with us, which means that our digital wallets are always with us. For many people, their phone is their wallet. “Last week I was traveling, and when I got to the airport, I realized I forgot my wallet at home,” Niedbalski said. “I had no credit cards, no driver’s license, and I’m already trying to figure out how to get through airport security without an ID. Luckily, I was able to pull up my driver’s license through the DMV app for California. I was able to pay for my hotel and my meals using my Apple wallet and the credit cards that I had stored in there. Airline tickets, hotel reservations, loyalty programs, everything I needed was there. I would panic more not having my phone than not having my wallet.”

The post The New Strategies Driving Digital Gift Cards appeared first on PaymentsJournal.

The banking industry infamously divides itself into silos to address different aspects of the business, which can be problematic for customers who think they are dealing with a single entity. This can be especially difficult during onboarding and security checks, when different silos at the bank ask repeatedly for credentials.

In a recent PaymentsJournal podcast, Sunil Madhu, founder and CEO of Instnt, a fraud loss indemnification that covers the entire customer lifecycle, and Jennifer Pitt, Senior Analyst of Fraud and Security at Javelin Strategy & Research, discussed the challenges of providing an easy, frictionless process for consumers while still safeguarding their privacy.

Retail banks have separate organizational units handling checking accounts, savings accounts, loans, and mortgages. Each of these silos has its own requirements for risk and compliance, comprising a half-dozen or more tools, that are used to vet individuals who are signing up for a particular product or service. Each has its own know-your-customer (KYC) protocols for compliance purposes.

The consequence of this is that anyone who signs up for a checking account has to go through a whole series of checks pertaining to KYC and other types of fraud. If that person comes back six weeks later and applies for a loan, they may have to provide the same information again, even though they have a relationship with the bank.

Obviously, different products have different types of risk, which is one of the reasons for these operational silos. But customers don’t care about that. They perceive themselves as working with a single bank, whether they’re dealing with a mortgage or a small-business loan or a checking account.

So there are advantages to connecting the silos with the technology that allows each line of business to have its own the independent risk and compliance management requirements. That can give the bank’s divisions the flexibility they need to maintain independent control while simplifying the user experience by giving customers a reusable, verifiable credential.

“We get a lot of reports that consumers are not happy with onboarding processes,” Pitt said. “They always say, ‘I thought I already gave you my information. Why do I keep having to give you this information?’ Having one place where that information is kept on the consumer’s device, and the consumer can dictate how they give that information. Not only can this help the consumer, but it can also save time for businesses as they onboard people.”

Businesses can frictionlessly sell multiple products and services without repeated signups that can leave customers frustrated. It’s time to rethink this kind of infrastructure so that it focuses on less friction for the user and easier onboarding experiences.

The past few years have seen new compliance standards, including verifiable credentials and decentralized ID, based on the notion of the blockchain. These two technologies combined have enabled businesses to issue reusable passes to customers who sign up.

“If I were to open up a checking account,” Madhu said, “I might get a pass back, which essentially is a tokenized identity document that helps to identify who I am. It also contains assurances from the verifying authority that issued the document, that the information has been vetted and verified. There’s also a KYC verification component to it.”

From a compliance perspective, the presenter of that pass has passed the necessary KYC checks and any other standard that needs to be met. The decentralized ID protocol helps prove the ownership of the document so the recipient can verify that the data belongs to the user. No one else could have stolen the pass or modified its contents.

These two technologies enable a user to get a comprehensive pass when a checking account is opened. When the user logs back into their checking account, they can present the pass again as the authentication token in lieu of a password. When they want to access other products or services, they don’t have to go through a whole other signup; they simply re-present the pass. As long as the level of assurance of the issued pass matches the requirement of the product or service the user is trying to access, they’ll get one-click access into the system.

“The new technology is as strong as multifactor authentication, but unlike other technologies like pass phrases and pass keys and multifactor authentication itself, it’s fully decentralized,” Madhu said. “There is no central point of attack for a hacker to compromise the database and steal the data and authenticating tokens. All of that risk goes away because the technology ensures that the credential is in possession of the end user, securely vaulted into their mobile devices with very mature mechanisms that essentially cancel a pass from a device that might have been lost or stolen.”

The technology is omnichannel, meaning that the person can be authenticated and vetted consistently whether calling into a call center or accessing the application through the web. If someone tries to use social engineering to get the call center to provide them with something like push notifications, the technology essentially thwarts all of those attack vectors.

Instnt has combined verifiable credentials and decentralized ID in a new product called Multipass.

“We provide a toolkit that basically allows the Multipass issuance and verification capabilities to be embedded in your application and provides secure mobile vault for any passes that have been issued to the user,” Madhu said. “All you need to do is load this toolkit into your application, and you have the full capabilities when the user is first registered and onboarded. At the end of the journey, the user will be asked if they wish to receive and store the pass.

“Behind the scenes, the system issues the pass with the data that was collected from the user that went through identity verification, fraud checks, KYC checks, and whatnot. Any additional information, such as the user’s bank account or other information the financial institution might need later on, can also be packaged up into the pass. The pass is then signed with two sets of keys, one that belongs to the user receiving the pass and the other issued from the business conducting the verification.”

The pass itself contains all the necessary information to non-repudiate the pass and verify that it’s not been altered.

“We essentially match the public record of the public keys of the key pairs that were used for the signature and the encryption of the data in the past,” Madhu said. “By virtue of the blockchain being immutable, you get the assurance that this pass was in fact issued to Sunil, for example, by Acme Bank or whomever issued it, and that all of the data in there was verified by Instnt. That assurance is intrinsically built in using the verifiable credentials document and the DID protocol.”

Financial institutions no longer have to store such data in their database, which removes the liability of being hacked. They’re protected from the possibility of consumer data being stolen. From users’ perspective, they’ve simply clicked a consent request saying, “Yes, I want to share the pass.” That’s the only friction they’ll have to face, but their privacy is maintained, and their data is safe.

“Privacy is a very important issue for consumers,” Pitt said. “We found that consumers will actually cancel their bank accounts if their privacy concerns are not met. Giving back control to the consumer about what can be done with their data, how their data can be used when it’s deleted, essentially, is a great thing.”

That type of comprehensive solution is possible only if banks break down those silos. Customers want to work with a single bank. Those banks should take care not to put obstacles in their way—and give them an incentive to seek another provider.

The post Reducing the Friction in Bank Customer Onboarding appeared first on PaymentsJournal.

As awareness of the dangers of identity theft grows, it’s important to highlight a particularly insidious threat: stealing children’s identities. Although children have very limited financial activity, this ironically makes them appealing targets for fraudsters.   

According to Javelin Strategy & Research, 1.7 million children had their personal information stolen in 2021-2022, resulting in nearly $1 billion in identity fraud loss. In a recent PaymentsJournal podcast, Tracy Kitten, Director of Fraud and Security at Javelin, explained what makes children so vulnerable to identity theft and what parents and guardians can do to protect them.

Obtaining a child’s personal information is alarmingly straightforward. When a criminal gets a child’s Social Security number, along with their physical mailing address and/or date of birth, that criminal possesses enough information to commit various forms of fraud, such as fraudulently opening bank accounts or applying for loans using the child’s information. 

The COVID-19 pandemic exacerbated risks to children’s identities. Government recovery programs, in particular, saw a fair amount of stimulus-related fraud. Additionally, the increase in online transactions revealed authentication gaps that were challenging to address. While strides have been made to close some of those gaps over the past year, vulnerabilities still exist. 

What’s tempting about using children’s identities is that they have no complicated background to deal with. “These kids don’t have bad credit,” Kitten said. “They don’t have any credit at all; so any type of account could be opened with a clean slate, maybe even a job application for someone who is here illegally.

What’s more, parents don’t readily detect this type of fraud. Since children aren’t applying for credit cards or mortgage loans, identity theft is not noticed until the child has reached maturity. 

For many of us, our Social Security numbers, along with our email addresses and passwords, are floating around the dark web. We’ve become more adept at handling breached information and are increasingly mindful about the information we share about ourselves online. However, all it takes is one slip—such as the exposure of your Social security number—to cause significant and long-term challenges.  

“We like to think that the government is this well-oiled machine that knows everything,” Kitten said. “The reality, however, is that our information is everywhere, and we don’t have good checks and balances in place to detect and determine  where it goes.

“You would hope that if someone were to steal my Social Security number, there would be a red flag raised somewhere, maybe at the Social Security Administration, to say, ‘Wait a minute, Tracy Kitten actually uses this Social Security number, but she doesn’t have this same date of birth, and she doesn’t have this same mailing address.’ But that’s not the case. That is why, oftentimes, you see identity theft that ultimately results in fraud taking place and going undetected for years and years.” 

This problem is worse for children, because they aren’t actively managing and monitoring their personal information regularly. When a child’s data is breached, there is no system in place to immediately notify parents. Frequently, parents and guardians only discover such identity compromises when applying for a student loan or when their child seeks first-time employment. Sometimes, the realization doesn’t occur until the child attempts to buy a car or rent an apartment.

“We strongly recommend that financial institutions step in to provide assistance, even though they aren’t necessarily going to be the entity that will resolve all of this,” Kitten said. “At the very least, financial institutions can step in and give guidance, and assist their customers and their members.”

Without such oversight from their financial institutions, parents and guardinas should take proactive steps to safeguard themselves and their children. Kitten recommends several steps :

Finally, it’s important to highlight the emotional toll identity theft takes on the entire family. Beyond the financial implications, the thought of your child’s information circulating among cybercriminals and scammers can be overwhelming. The gravity of these concerns should motivate parents and guardians to take proactive measures to protect their children’s identities.

“If they know enough about my child to open up all these accounts, what else could do?” Kitten asked. “Not only does it take an emotional toll; it wreaks havoc with us psychologically. Are we physically safe? Are our children physically safe?” 

The post A Silent Threat: Protecting Children From Identity Theft appeared first on PaymentsJournal.

Even though the number of checks written continues to decline, mail theft remains on the rise. Beyond the theft of checks directly from mailboxes, there have been instances of stolen mail trucks. The ease of modifying checks allows criminals to simply wash and modify the payee’s name. 

Q2’s positive pay system, used by roughly 550 banks across the country, is on track to stop more than $2.5 billion in fraud this year. In a recent PaymentsJournal podcast, Bruce Dragoo, Manager, Solutions Consultant for Q2, and John Byl, SVP Product Development at Mercantile Bank of Michigan—a Q2 customer—discussed how to get people on board to combat check fraud with Albert Bodine, Director, Commercial and Enterprise Payments for Javelin Strategy & Research.

In 2022, around $720 million of fraud was identified and stopped by Q2’s positive pay system. Last year, that number doubled to $1.4 billion.

“It seems like it’s wider-reaching at this point and coming downstream to smaller businesses,” Byl said. “It had been historically viewed as a large corporate need, but it’s indiscriminate at this point—and it’s affecting everybody.”

A third of commercial payments globally are still made by check, which presents a huge opportunity for criminals. But only 30% of eligible businesses use positive pay, which matches the details on a check to the details on file with the bank to ensure its validity. Some related solutions cover just checks, and others cover ACH transactions, but they don’t address the gamut of everything a business may need.

“In some cases, having a great technology provider that can provide not only check but ACH positive pay, along with full reconcilement capabilities, can be a barrier to some of these institutions signing up for a full breadth of what they need,” Dragoo said. “It’s about being either reactive or proactive in regards to the financial institution selling positive pay. At some financial institutions what I’ll hear is that the only time that they sell positive pay to a customer is when they’ve had check fraud on their account and they’re reacting to the situation.”

Talking to customers before they open a checking account can be critical. If they are a small business or a corporate client, financial institutions can say, “We have a great solution for you that can help identify and stop check fraud before it even happens.”

The best value proposition for positive pay is stemming or eliminating the flow of funds out the door to fraud.

“We’ve gone through the evolution of being reactive and only bringing up positive pay when we’ve had check fraud or a customer’s asking about it,” Byl said. “What we’ve realized with this whole process is that many customers are not aware of what positive pay is, or why they might need or want it. We need to create awareness for our customers and help them understand how they go about implementing something along these lines.

“I’ve worked for institutions where we haven’t had a great solution in place, one that hasn’t been very user-friendly to work with. Thankfully, we have a solution today that is user-friendly and adaptive to our customers, so we can remove those barriers to entry for them and make it as an easier process as possible.”

Some financial institutions are limited in how they can build out new revenue streams. Many of their resources go into supporting legacy systems. Having organization partners enables FIs to bolster the security of the products and services they offer.

“While 30% of the institutions we’ve surveyed are not charging for positive pay, of those customers that use it, 47% of them said they would pay for positive pay,” Dragoo said. “They understand the value of the solution itself in helping to stop any type of fraud that may be coming through their checking account. Several of our financial institutions actually have turned their treasury management team into a revenue generator just by selling positive pay at a nominal fee of $30 to $50 an account.”

Customers respond best to thinking of positive pay as a form of insurance against fraud. Q2’s approach has been not to nickel-and-dime their customers for each little tick mark that happens as part of the positive pay process but rather casting at it as a holistic product that can protect customers.

“It’s easy to build revenue models for positive pay, taking into account the mitigation of the fraud losses,” Bodine said. “Even if you’re partnering with somebody from the outside, it’s pretty easy to cover those transactional costs by eliminating those fraud dollars that are going out the door.”

Financial institutions can’t assume their customer base knows or understands what positive pay is and how it can protect them. Q2 has identified some essential items that financial institutions can use to increase the adoption of a good positive pay solution. Rolling out a solution that has check and ACH positive pay in it—and has great pay-name match reporting self-service for the customer—is a good first step.

Secondly, financial institutions should sell positive pay proactively by talking to customers at account opening. They should educate them on check fraud and what it looks like. Although some consumers may not have encountered fraud yet, they will understand the risks, especially when they hear a broader value proposition.

“Part of what where our successes come from has just been in helping our staff understand who our customers are and what sorts of fraud scenarios we’re seeing taking place in the market area,” Byl said. “We make it more real to people—this isn’t something that’s happening on one of the coasts. It’s happening around the corner where a mail truck has been robbed. Or these people dropped stuff in their mailbox and put the flag up and just walked away and didn’t realize people would have the audacity to just take that stuff out of there.”

Partnering with a dedicated provider is vital. “One of the strongest recommendations that we’re making at Javelin in the commercial enterprise practice area is that legacy bank structures are not really set up to do well moving forward,” Bodine said.

Q2 is looking at enhancing its pay-name match to make it even better. The company is also looking at embedding AI technology into the solution to help not only FI customers but also frontline bank staffers to sell positive pay to existing customers and prospects.

“As a Q2 customer, the biggest thing is having a partner who is willing to listen to you and engage in the conversation,” Byl said. “They listen to the feedback of their customers and make their product better. That’s been huge to know not just what’s happening in your neck of the woods, but how other FIs that they work with are implementing their best practices. Having that collective learning going on makes such a huge difference.”

Said Dragoo: “You’re the one that’s bringing us the ideas and bringing us what is happening in the market that we may not be seeing. We appreciate that partnership so that we can develop leading technology and make sure that we can help identify and stop fraud in the future.”

The post Positive Pay: An Underused Tool for Fighting Check Fraud appeared first on PaymentsJournal.

The evolution of digital card management has given financial institutions new opportunities to cultivate enduring customer relationships. By making consumers’ lives more convenient and complimenting physical cards, so consumers have the options that work for their lives at a particular time, issuers can foster ease of use and brand loyalty, leading to decades-long relationships.  

In a recent PaymentsJournal podcast, Wesley Suter, Senior Director of Product Solutions at Fiserv, spoke with Elisa Tavilla, Director of Debit Advisory Services for Javelin Strategy & Research, about the future of digital cards. They discussed what strategies can make cardholders develop loyalty to their issuer—or lead them to end the relationship.

Digital card management addresses two issues: Making it easier to do business with a financial institution and making consumers’ lives more convenient. The goal is to ensure that customers are more willing to use your card over a competing card in their wallet.

To understand where we are today, it helps to take a step back. During the COVID-19 era, many merchants amplified their touchless point-of-sale capabilities, and thus digital wallets such as Apple Pay and Google Pay became even more attractive.

“COVID accelerated consumers’ preferences toward the digital channel,” Tavilla said. “Our Javelin research has shown that consumers are using both credit and debit cards in digital and mobile wallets. And the expectations that consumers have, whether it’s in commerce or in online mobile banking, have trended more toward digital capabilities.”

In this digital environment, cardholders can handle most service issues more easily than calling into a call center or discussing their card relationship by going into an in-person branch.

Consider how information is more readily available with a tap of a finger: When you use Uber or Lyft, you can track the precise location of a vehicle. And when you order packages online, you can track every movement of the shipment—from the order confirmation to when the packages leave the warehouse to when they arrive on your doorstep—solely through your phone.

“I don’t necessarily walk out of the out of the house or out of the room with my wallet, but I always have my phone on me,” Suter said. “As we can drive more of that phone experience into the digital banking platforms that many financial institutions leverage, that’s going to create the adoption and loyalty that many issuers are looking for.”

Said Tavilla: “Just a few days ago, I left my house without my wallet, and it was an hour or two later that I realized I didn’t have it. If I had left my phone, I’d have realized that in two seconds. But I had my credit card and debit card loaded into a digital wallet, so I was able to make it through the rest of my evening without needing my physical wallet. I find that to be very convenient and a positive customer experience, and I’m sure I’m not the only customer who feels that way.”

When it comes to digital card management, banks do not differentiate themselves based on the ability to activate a card or set a PIN. The focus should be on acquiring new relationships or leveraging newly onboarded customers for cross-selling opportunities at a later stage in the relationship.

“CardHub, the digital card management solution from Fiserv, handles all the other stuff while our issuers are really focused on that acquisition of new relationships,” Suter said. “We’re focused on deploying CardHub in a manner that makes it easy and convenient for a consumer but also drives that necessary relationship into all of those subscriptions, recurring payments, card-on-file merchants.”

“Let’s say Elisa opens up a Hulu account and puts her preferred payment to that relationship,” he said. “The likelihood for her to swap that out with a competing card is very, very low. How do we generate more of that type of card-on-file connectivity in relationships so that our card issuers are winning that default card position? That leads to customer loyalty and bringing the ideal customer experience through their entire journey.”

If FIs can get to a position where they can educate cardholders that a digital card is more secure and a more convenient checkout experience, they’re going to attract Apple Pay and Google Pay wallet experiences as a default.

Another factor involves the proprietary apps that every merchant built after the pandemic. How do you drive those interconnected relationships with in-app payment experiences? If FIs provide solutions to those with their own card portfolios, they’re going to win in the long term across debit and credit payments.

If consumers lose their physical card, they can call and ask for a replacement that could be sent traditionally through the mail. But it’s not instant. With digital issuance, FIs can replace that card and have it in the customer’s phone or hand in minutes. That ensures a continuous, seamless experience that allows the customer to keep using the card as top of wallet. That’s important because lag time could cause customers to use a different mode of payment.

The most sensitive chapters in the relationship between a cardholder and the card issuer are those disruption events when the customer has to replace the card or get a new PIN. That’s a vulnerable position for the consumer because if a replacement card isn’t received quickly, they’re likely to move on to a different form of payment—perhaps a competitive card in their wallet.

“If I’m a debit card holder, I’m doing 25 transactions on average per month,” Suter said. “So you do not want to miss that gap where there is a disruption.”

The post FIs Are Building Long-Lasting Relationships Through Digital Card Programs appeared first on PaymentsJournal.

As fraud related to artificial intelligence (AI) becomes increasingly sophisticated and accessible, many legacy lines of defense are no longer able to effectively protect financial institutions and their customers. Financial institutions need to take a more proactive approach to fraud. By collecting and analyzing real-time data and using AI to identify patterns, FIs can quickly detect suspicious activity and clamp down on fraud.

Karen Postma, Senior Vice President of Risk Solutions at PSCU/Co-op Solutions, has long been a leader in detecting and deterring financial fraud. In a recent PaymentsJournal podcast, she sat down with Jennifer Pitt, Senior Analyst in Javelin Strategy & Research’s Fraud and Security practice, to discuss the nature of the latest attacks against credit unions and their members as well as the scourge of first-party fraud.  

Consumers have learned that if an email doesn’t sound quite right or contains suspicious punctuation or misspellings, then it may not be legitimate. However, fraudsters are now leveraging generative AI like ChatGPT to create content that more effectively looks like a normal email than a phishing email.

“We can no longer tell consumers to look for those basic things like spelling errors, grammar errors,” Pitt said. “We need to be better at giving more generic advice to consumers about emails. If you’re not intending to get this email, if you don’t know the sender, don’t answer it. Instead, contact the company directly yourself.”

Another way non-technical individuals use AI is with a tool called WormGPT, which effectively writes code or malware with fraudulent intent.

“I don’t have a technical background, but I could leverage these tools to create malware that I could embed in a phishing email or in other content to put keyloggers on a consumer’s computer or other device,” Postma said. “That’s probably one of the most unnerving components of AI utilization by cybercriminals.”

AI is also targeting employees at large companies. Several recent data breaches that Postma has seen have been phishing campaigns targeted at high-level employees whose credentials have been compromised, which can lead to an entire company being compromised.

AI is being leveraged to trick identity verification and circumvent know-your-customer (KYC) protocols via deepfakes using voice, photo and video. Criminals are also using AI to get around multifactor authentication.

“These scams are looking for anything from passwords to financial payment to one-time passwords to absolutely anything that they can get their hands on,” Postma said. “As soon as fraudsters have convinced the consumer that they are their financial institution, those multifactors become very compromised.”

Postma’s team at PSCU/Co-op Solutions has been talking to credit unions about adding a fourth layer to multifactor authentication: the data aspect. This data becomes a validation for the transaction, and that verification at the end offers a red flag that there might be a scam happening.

This is not data that you would typically get in an authorization component; rather, it would be data obtained through online banking, through the contact center, or through various components that will confirm if the IP address is one the consumer has used before, if the consumer has used the device before and/or if the inquiry is coming from overseas or within the geographical location that would be expected for the consumer.

“These likely aren’t variables that most contact centers would have a hard-and-fast yes or no on,” Postma said. “But they would be a red flag that will allow an extra layer of validation or an extra layer of protection for that member.”

Being able to leverage data on the fly, in real time, will be imperative for all financial providers. Leveraging different technologies to be able to use the IP addresses, geolocation, different alerts, and consumer alerts in real time to detect those scams will be crucial.

Another development will be leveraging the technology for KYC and detection techniques. The financial professional can interact with a live likeness to see if it is a real person or a deepfake.

Many consumers are leery of enabling data geolocation because of privacy concerns. Credit unions should educate their members on how they will use that data to help overcome that barrier, while protecting their assets and data.

“Most people want to know why something’s being done,” Postma said. “When consumers are onboarding, you need to tell them not only that this is the data we need, but this is why we need it, and this is what we’re going to do with your data. Some of those privacy issues center on data that we’re collecting for third-party reasons, data that we would like to have. If it’s not a need to have, then allow the consumers to opt out. That will really build consumer trust with financial institutions and credit unions.”

Since the pandemic, the credit union industry has seen a huge influx of what is known as first-party fraud, which entails members either knowingly or unknowingly reporting legitimate transactions as fraud. In the post-COVID-19 environment, a great number of transactions shifted from card present (CP) to card not present (CNP) as consumers deal with merchant aggregators, billing nuances and instances in which they did not receive their merchandise. With all those factors, it’s easy to understand why there’s an increase in fraudulent claims.

Anywhere from 30% to 70% of initially reported fraud is first-party fraud. This volume of first-party fraud is adjusting the scoring models—which is, in turn, changing how institutions address fraudulent claims and processes. The other component of first-party fraud is that credit union members are owners of the credit union. If the institution takes that loss, there is a financial impact on members.

“What financial institutions have to do is balance the upfront experience with verification on the back end,” Postma said. “If you have valid proof and you can do a little investigation as to the fact that that member was engaged in that transaction, you have the ability to make them liable for it.”

Balancing the needs of member service and fighting fraud is essential. Every interaction or every member contact, whether lasting a minute or an hour, is basically an interview. It’s an opportunity to make a good impression, build trust, and get information from the consumer.

“There are things that you can listen for, like tone changes or hesitation as if they’re talking to somebody else,” Postma said. “There are definitely red flags that investigators can learn to identify if the caller is an attacker. If they are not, trust but verify.”

Financial institutions sometimes think that education is the easy, non-technical part of the equation. “Part of what we need to improve on as a whole in the financial industry realm is being intentional with everything we do, being proactive instead of reactive,” Pitt said. “We’ve been behind the fraud curve because we’re not doing targeted education. We’re not intentional about what we want the consumer to achieve and the outcome that we want to get.”

“Everyone—from your contact center agents to your frontline staff to your back office—needs to be educated on what scams look like, what first-party fraud looks like, and all the different types of technology we use to fight these things,” Postma said. “It isn’t just a small handful of people that fight fraud. It is truly in every channel.”

The post Fighting Financial Fraud When the Bad Guys Are Armed With AI appeared first on PaymentsJournal.