By Aman Mishra, Senior Research Associate – The Dialogue
In today’s digital age, financial fraud poses a significant threat to individuals and organisations worldwide. Despite the widespread adoption of one-time password (OTP) mechanisms, fraudsters continue to exploit unsuspecting victims and vulnerabilities in traditional authentication methods. Fraudsters have adopted several methods for exploiting OTPs to perpetrate financial fraud. These methods include social engineering tactics, phishing attacks, and SIM-swapping attacks, amongst others.
The Indian government has taken several steps to combat financial fraud; these include strengthening the Know Your Customer (KYC) norms, enhancing the security of the OTPs, and setting up a Digital India Trust Agency (DIGITA) to verify and maintain a public register of legitimate digital lending apps. Further, the Ministry of Home Affairs (MHA) has established the Indian Cyber Crime Coordination Centre (I4C) to coordinate efforts against cyber-crimes nationwide.
Regarding enhancing the security of OTPs, the MHA is currently testing a solution that will enable banks to track a customer’s registered address and geolocation securely. It aims to ensure that OTPs are delivered to the correct location, reducing the risk of phishing attacks or fraudsters intercepting OTPs. Furthermore, in relation to strengthening the KYC norms, the Finance Ministry is pushing for stricter KYC norms and enhanced due diligence when onboarding merchants and Business Correspondents by banks and financial institutions to check financial frauds and enhance data security in the financial system.
While the Indian government’s efforts are steps in the right direction, the ever-evolving nature of cyber threats necessitates adopting more advanced technological solutions. Recently, the Reserve Bank of India (RBI) stated that with the advancement of technology, alternative authentication mechanisms have emerged to the OTP mechanism. Furthermore, the RBI suggested that it will propose a principle-based “framework for authentication of digital payment transactions”.
Technological Solutions in Fraud Mitigation
Implementing advanced technologies like Artificial Intelligence (AI) and Machine Learning (ML) as an alternative or addition to the existing OTP framework through technological solutions will play a pivotal role in mitigating financial fraud. Enhancing OTP security may help advance technological solutions existing in the market. These advanced solutions consist of multi-factor authentication systems combining identity proofing with one-time passwords sent to users’ devices, providing an additional secure layer for high-risk transactions requiring no additional hardware apart from the user’s existing phone or personal computer.
AI has emerged as a powerful tool in fraud detection, leveraging ML algorithms to analyse vast amounts of data and identify suspicious patterns or anomalies indicative of fraudulent behaviour.
Behavioural biometrics solutions also exist that can effectively combat fraud by analysing users’ unique patterns when interacting with devices and applications. These solutions verify users by studying individual habits like keystroke dynamics, swipe motions, mouse movements, and cognitive traits. These behavioural biometrics leverage ML to isolate anomalies deviating from a user’s typical behaviour, flagging potential fraud attempts.
Through monitoring multiple aspects of digital interactions, these technological solutions can isolate automation signals such as the behaviour of the mouse, the phone movement (Is the phone being held in a landscape or portrait position), the touchscreen behaviour (How is the touchscreen used?), the keyboard behaviour (Were any keyboard shortcuts taken?). This is done to ensure users are genuinely who they claim to be. Furthermore, incorporating a real-time risk-based transaction scoring based on digital identity intelligence will assist in assessing transaction risks dynamically & taking appropriate fraud prevention action.
Moreover, technological solutions enable organisations to deploy advanced authentication methods such as biometrics, tokenization, and behavioural analytics, providing multi-layered security against fraud. Biometric authentication, for example, relies on unique biological traits such as fingerprints, iris scans, or facial recognition to verify user identity, offering a more secure mechanism. Furthermore, push notifications present another effective tool, delivering real-time transaction details to the user’s device and soliciting confirmation for authentication requests. Additionally, authenticator apps require the user to receive the password from another application on its smartphone. However, the drawback with authenticator apps is the requirement of a smartphone.
Balancing security with user experience and privacy remains a challenge. Hence, the major focus of these technological solutions should be to enhance security without disrupting customer experience and privacy. Strategies must prioritise seamless authentication processes while ensuring robust protection against fraud. Continuous innovation and collaboration are key to staying one step ahead of cybercriminals and safeguarding financial systems for users globally.
Way Forward
The future of fraud mitigation lies in continuous innovation and collaboration. Financial institutions must prioritise developing and implementing advanced technologies to stay ahead of evolving threats. Constant refinement of authentication processes, leveraging emerging technologies like AI and machine learning, is essential for effectively combating fraud. Furthermore, the government should actively explore and adopt such advanced technological solutions and develop a regulatory framework encouraging innovation while ensuring data privacy and security.
Moreover, fostering a culture of cybersecurity awareness among users and stakeholders is crucial. By embracing a proactive approach and investing in robust security measures, the financial industry can mitigate risks and ensure the integrity of digital payment transactions in the years to come.
