Mastercard cyber chief on using AI in the fight against fraud

The fight against fraud has always been a messy busi­ness, but it’s espe­cial­ly gris­ly in the dig­i­tal age. To keep ahead of the cyber­crim­i­nals, invest­ment in tech­nol­o­gy – par­tic­u­lar­ly arti­fi­cial intel­li­gence – is para­mount, says Ajay Bhal­la, pres­i­dent of cyber and intel­li­gence solu­tions at Mas­ter­card.  

Since the open­ing sal­vo of the coro­n­avirus cri­sis, cyber­crim­i­nals have launched increas­ing­ly sophis­ti­cat­ed attacks across a mul­ti­tude of chan­nels, tak­ing advan­tage of height­ened emo­tions and poor online secu­ri­ty.

Some £1.26 bil­lion was lost to finan­cial fraud in the UK in 2020, accord­ing to UK Finance, a trade asso­ci­a­tion, while there was a 43% year-on-year explo­sion in inter­net bank­ing fraud loss­es. The bank­ing indus­try man­aged to stop some £1.6 bil­lion of fraud over the course of the year, equiv­a­lent to £6.73 in every £10 of attempt­ed fraud.

If you don’t test things to break them, you can be sure their vul­ner­a­bil­i­ties will be dis­cov­ered down the line

The land­scape has rapid­ly evolved over the past year, says Bhal­la, due to fac­tors like the rapid growth of online shop­ping and the emer­gence of dig­i­tal solu­tions in the bank­ing sec­tor and beyond. These changes have bro­ken down the bar­ri­ers to inno­va­tion, dri­ving an unprece­dent­ed pace of change in the way we pay, bank and shop, says the exec­u­tive, who’s respon­si­ble for deploy­ing inno­v­a­tive tech­nol­o­gy to ensure the safe­ty and secu­ri­ty of 90 bil­lion trans­ac­tions every year. 

“Against that back­drop, cyber­crime is a $5.2 tril­lion annu­al prob­lem that must be met head-on. Stand­ing still will mean effec­tive­ly going back­wards, as fraud­sters are increas­ing­ly per­sis­tent, agile and well-fund­ed.”

AI: the new electricity

It isn’t just the grow­ing num­ber of trans­ac­tions that attracts crim­i­nal atten­tion, but the diver­si­ty of oppor­tu­ni­ty, accord­ing to Lon­don-based Bhal­la, who has held var­i­ous roles at Mas­ter­card around the world since 1993. 

“As the Inter­net of Things becomes ever more per­va­sive, so the size of the attack sur­face grows,” he says, not­ing that there will be 50 bil­lion con­nect­ed devices by 2025. 

Against this back­drop, AI will be essen­tial to tack­le cyber threats. 

“AI is fun­da­men­tal to our work in areas such as iden­ti­ty and ecom­merce, and we think of it as the new elec­tric­i­ty, pow­er­ing our soci­ety and dri­ving for­ward progress,” says the 55-year-old.

Mas­ter­card has pio­neered the use of AI in bank­ing through its world­wide net­work of R&D labs and AI inno­va­tion cen­tres, and its AI-pow­ered solu­tions have saved more than $30bn being lost to fraud over the past two years. 

In 2020, it opened an Intel­li­gence and Cyber Cen­tre in Van­cou­ver, aimed at accel­er­at­ing inno­va­tion in AI and IoT. The com­pa­ny filed at least 40 AI-relat­ed patent appli­ca­tions last year; it has devel­oped the biggest cyber risk assess­ment capa­bil­i­ty on the plan­et, accord­ing to Bhal­la. 

“We are con­stant­ly test­ing, adapt­ing and improv­ing algo­rithms to solve real-world chal­lenges.”

Turn­ing to exam­ples of the company’s work, Bhal­la says Mas­ter­card has built an abil­i­ty to trace and alert on finan­cial crime across its net­work, a world first. He also points to the recent­ly launched Enhanced Con­tact­less, or ECOS, which lever­ages state-of-the-art secu­ri­ty and pri­va­cy tech­nol­o­gy to make con­tact­less pay­ments resis­tant to attacks from quan­tum com­put­ers, using next-gen­er­a­tion algo­rithms and cryp­tog­ra­phy. 

“With ECOS, con­tact­less pay­ments still hap­pen in less than half a sec­ond, but they are three mil­lion times hard­er to break.”

Building security through biometrics

Such inno­va­tions are trans­form­ing cus­tomers’ inter­ac­tions with finan­cial ser­vices providers. For exam­ple, Mas­ter­card has com­bined AI-pow­ered tech­nolo­gies with phys­i­cal bio­met­rics – like face, fin­ger­print and palm – to iden­ti­fy legit­i­mate account hold­ers. These tech­nolo­gies recog­nise behav­iour­al traits, like the way in which cus­tomers hold their phone or how fast they type, actions that can’t be repli­cat­ed by fraud­sters. 

“We see a future where bio­met­rics don’t just authen­ti­cate a pay­ment; they are the pay­ment, with con­sumers sim­ply wav­ing to pay.”

Excit­ed by devel­op­ments in this area, Bhal­la says Mas­ter­card recent­ly detect­ed an attack that involved hun­dreds of devices attempt­ing to log in from a phone that had report­ed itself as lying flat on its back. “Giv­en the speed at which the cre­den­tials were typed, we knew it was unlike­ly it could be done with the phone flat on a sur­face,” Bhal­la says. “In this way, a sophis­ti­cat­ed attack that looked oth­er­wise legit­i­mate was detect­ed before any fraud loss­es could occur.”

Cyber­crime is a $5.2 tril­lion annu­al prob­lem that must be met head-on. Stand­ing still will mean effec­tive­ly going back­wards, as fraud­sters are increas­ing­ly per­sis­tent, agile and well-fund­ed

Mas­ter­card might boast an impres­sive list of suc­cess­ful fraud-fight­ing solu­tions, but wrong turns are vital for the jour­ney, Bhal­la admits. “If you don’t test things to break them, you can be sure their vul­ner­a­bil­i­ties will be dis­cov­ered down the line,” he says. “At Mas­ter­card, trust in and reliance on our ser­vices is far too impor­tant to take that risk, so rig­or­ous­ly test­ing solu­tions before they get any­where near the end user is our stan­dard oper­at­ing pro­ce­dure.”

Trust is a must

A keen row­er and golfer, Bhal­la vol­un­teers as an exec­u­tive-in-res­i­dence at the Uni­ver­si­ty of Oxford’s Saïd Busi­ness School. He has a bachelor’s degree in com­merce from Del­hi Uni­ver­si­ty and a master’s degree in man­age­ment from the Uni­ver­si­ty of Mum­bai. 

Even with his expe­ri­ence and tech knowl­edge, Bhal­la insists that Mas­ter­card and oth­ers with­in the indus­try must go back to basics and focus on cus­tomer expe­ri­ence. The company’s lead­er­ship in stan­dards has been core to earn­ing and retain­ing the trust of its cus­tomers, he notes. 

The tech­nol­o­gy may be evolv­ing quick­ly, but one core prin­ci­ple remains, says Bhal­la.

“Our busi­ness is based on trust, which is hard-won and eas­i­ly lost.”

The cor­rect oper­at­ing process­es and stan­dards must be in place from the out­set so that both cus­tomers and busi­ness­es can have con­fi­dence in the tech­nol­o­gy and trust that it will be use­ful, safe and secure. 

“What has changed is the sharp focus now placed on devel­op­ing lead­ing-edge solu­tions that pre­vent fraud and man­age its impact, which is not sur­pris­ing giv­en that the aver­age cost of a sin­gle data breach has now grown to $3.86 mil­lion,” Bhal­la says.

Pro­vid­ing a blue­print for busi­ness lead­ers, Bhal­la strong­ly believes that “inno­va­tion must be good for peo­ple … and address their needs at the fun­da­men­tal design stage of the sys­tems and solu­tions we cre­ate.”

“We see a future where bio­met­rics don’t just authen­ti­cate a pay­ment; they are the pay­ment, with con­sumers sim­ply wav­ing to pay

Bhal­la is using tech to fight fraud and dri­ve finan­cial inclu­sion, with Mas­ter­card aim­ing  to con­nect 1 bil­lion peo­ple glob­al­ly to the dig­i­tal econ­o­my by 2025. His ambi­tions are wider still, with much of his work focused on “pro­tect­ing the world we have”. 

Mind­ful that cli­mate change is high on the agen­da, espe­cial­ly for younger gen­er­a­tions, Mas­ter­card has launched a raft of pro­grammes in the area, includ­ing this year’s Sus­tain­able Card Badge, which looks to iden­ti­fy cards made more sus­tain­ably from recy­clable, recy­cled, bio-sourced, chlo­rine-free, degrad­able or ocean plas­tics.

Much like fight­ing fraud, glob­al warm­ing is reach­ing a cru­cial stage. Thanks to the efforts of indus­try lead­ers like Bhal­la, the world stands a bet­ter chance of ulti­mate tri­umph on both fronts.

---