Unifying digital experience in the fight against online fraud

Rapid­ly chang­ing cus­tomer expec­ta­tions have forced busi­ness­es to embrace digi­ti­sa­tion ini­tia­tives in recent years. Last year, for exam­ple, the ana­lyst firm IDC pre­dict­ed that organ­i­sa­tions will spend $2.3 tril­lion a year on dig­i­tal trans­for­ma­tion by 2023. If that wasn’t sig­nif­i­cant enough, ear­li­er this year research from Twilio con­clud­ed that the COVID-19 pan­dem­ic will accel­er­ate dig­i­tal trans­for­ma­tion efforts by over five years. Indeed, one of the core goals of dig­i­tal trans­for­ma­tion is to pro­vide a more per­son­alised cus­tomer expe­ri­ence – but are we still miss­ing the mark?

Though com­pa­nies are com­pelled to adapt to this rapid­ly evolv­ing dig­i­tal world in order to sur­vive, the shift to online plat­forms has also catal­ysed an explo­sion in fraud, as oppor­tunis­tic crim­i­nals seek to exploit vul­ner­a­bil­i­ties or weak­ness­es for their own gain. PwC’s Glob­al Eco­nom­ic Crime and Fraud Sur­vey 2020 found that near­ly half of organ­i­sa­tions have suf­fered at least one fraud, with an aver­age of six per com­pa­ny. Mean­while, one in five British con­sumers have fall­en vic­tim to nefar­i­ous fraud­u­lent activ­i­ty in the past 12 months, accord­ing to a study by Mar­qe­ta.

“Cus­tomers expect a per­son­alised expe­ri­ence akin to those they receive from the likes of Ama­zon and Google,” says Partha Sarathy, Glob­al Fraud Archi­tect at Shape Secu­ri­ty (now part of F5), which pro­tects the web and mobile apps of some of the world’s largest organ­i­sa­tions against fraud and abuse. “Then they come to login to their online bank, or a retail­er, and they’re not afford­ed the same lev­el of expe­ri­ence they’ve become accus­tomed to. That’s why organ­i­sa­tions are invest­ing heav­i­ly in dig­i­tal trans­for­ma­tion, the adop­tion of which has been expo­nen­tial­ly accel­er­at­ed by the pan­dem­ic”.

Are organisations ready?

The sim­ple answer is no, not real­ly; they’re still grap­pling with this accel­er­a­tion. Rather dis­heart­en­ing­ly, there has been an uptick in attacks on gov­ern­ment schemes, with fraud­sters unscrupu­lous­ly open­ing fake bank accounts to siphon funds from benev­o­lent ini­tia­tives drawn up to help com­bat the effects of the COVID human­i­tar­i­an cri­sis. They are using stolen cre­den­tials, which in turn come from data breach­es feed­ing into the age-old cycle of e‑Crime. Fraud­sters are tena­cious and mer­cu­r­ial, con­sis­tent­ly refin­ing their eva­sive tech­niques to sim­u­late real user behav­iour, allow­ing them to fly under the radar in high vol­umes of dig­i­tal traf­fic. It is becom­ing increas­ing­ly dif­fi­cult for organ­i­sa­tions to deter­min­is­ti­cal­ly iden­ti­fy them and mit­i­gate the affil­i­at­ed risk.

One of the biggest chal­lenges com­pa­nies face in achiev­ing their dig­i­tal trans­for­ma­tion ambi­tions is man­ag­ing the bal­ance between tack­ling fraud and dri­ving rev­enue growth, the lat­ter being deeply root­ed in the pro­vi­sion of a supe­ri­or cus­tomer expe­ri­ence. The issue has been ampli­fied by con­flict­ing objec­tives between dif­fer­ent depart­ments, often oper­at­ing in siloes. CISOs are pri­mar­i­ly tasked with pre­vent­ing data breach­es. Fraud depart­ments, mean­while, are respon­si­ble for reduc­ing fraud dol­lar loss­es. The strate­gies of both teams can add fric­tion to the cus­tomer jour­ney, and mar­keters are deeply cog­nizant of the impact this can have on con­ver­sion rates, cus­tomer sat­is­fac­tion and rev­enue.

These teams need to work more close­ly togeth­er to address both dig­i­tal fraud and busi­ness imper­a­tives to dri­ve rev­enue and growth. CISOs have an oppor­tu­ni­ty to spear­head this col­lab­o­ra­tion as they seek to be seen less as a cost cen­tre and more as busi­ness enablers, pos­i­tive­ly impact­ing both the top and bot­tom line. To do so, they need to bet­ter under­stand the user inter­ac­tions flow­ing across all dig­i­tal chan­nels and achieve a holis­tic view of the entire con­sumer jour­ney.

Cus­tomers don’t see CISOs or fraud depart­ments or mar­ket­ing teams – they inter­act with the organ­i­sa­tion as a whole, as a brand. Dig­i­tal is a uni­fy­ing expe­ri­ence for both the cus­tomer and organ­i­sa­tion. That uni­fi­ca­tion can only tru­ly be realised if the con­flict­ed exe­cu­tion of pri­or­i­ties between secu­ri­ty, fraud and mar­ket­ing depart­ments is elim­i­nat­ed.

“When cus­tomers log into a por­tal, they’re imme­di­ate­ly faced with fric­tion,” says Mr Sarathy. “On aver­age, 10 to 15 per cent of cus­tomers hard fail at login, which neg­a­tive­ly impacts con­ver­sion rates. Anoth­er 10 to 15 per cent expe­ri­ence some lev­els of fric­tion but are able to even­tu­al­ly com­plete their login attempt. This calls legit­i­ma­cy into ques­tion. Many organ­i­sa­tions do not have the capa­bil­i­ty to con­clu­sive­ly dif­fer­en­ti­ate between a legit­i­mate login request and one that stems from a fraud­u­lent source, adept­ly mas­querad­ing as a trust­ed end-user. Despite an imbal­anced ratio of fraud­sters to end-users typ­i­cal­ly inter­act­ing with their online plat­forms, many com­pa­nies remain com­pelled to impose increased lev­els of fric­tion such as CAPTCHA and MFA that ulti­mate­ly have a harm­ful impact on their bot­tom line.”

This means that around three in ten cus­tomers will face fric­tion at dif­fer­ent lev­els through­out their ses­sion. Com­pa­nies must be encour­aged to under­stand the intent of their users as they inter­act. A cross-func­tion­al con­ver­gent plat­form is cru­cial to enabling com­pa­nies to remove these kinds of fric­tion – increas­ing con­ver­sion rates and improv­ing the cus­tomer expe­ri­ence, while simul­ta­ne­ous­ly reduc­ing fraud.

“Com­pa­nies are buy­ing piece­meal solu­tions – one for dig­i­tal ID, one for authen­ti­ca­tion and one for mul­ti fac­tor – and then try­ing to solve these secu­ri­ty facets in siloes at the back-end, instead of hav­ing a solu­tion that speaks to the prob­lem as a whole. When every­thing is uni­fied in one solu­tion, you’re able to orches­trate every­thing at the enter­prise lev­el. This holis­tic orches­tra­tion pro­vides flex­i­bil­i­ty, vis­i­bil­i­ty and agili­ty to react to evolv­ing threats while man­ag­ing fraud loss­es and impact­ing rev­enue.”

As a cross-func­tion­al con­ver­gent plat­form, Shape Secu­ri­ty meets the needs of CISOs, dri­ves huge fraud loss sav­ings and helps improve busi­ness per­for­mance and cus­tomer expe­ri­ence. It’s a sin­gle plat­form address­ing both the top and bot­tom line, enabling organ­i­sa­tions to ful­ly realise their invest­ment across dig­i­tal trans­for­ma­tion, data and ana­lyt­ics, and eMar­ket­ing tools, whilst reduc­ing risk and grow­ing rev­enue.

Shape is one of the largest proces­sors of login traf­fic, block­ing over 1 bil­lion fraud­u­lent log-in attempts and oth­er trans­ac­tions every day, while ensur­ing that more than 200 mil­lion legit­i­mate human trans­ac­tions are kept safe.

“That stands tes­ta­ment to the pow­er of the net­work effect,” says Mr Sarathy. “Under­stand­ing how fraud­sters are oper­at­ing across a net­work is incred­i­bly impor­tant. Most fraud solu­tions offer this capa­bil­i­ty too but are con­fined to their exper­tise of the human aspect. Shape lever­ages AI and machine learn­ing to aug­ment its anti-fraud capa­bil­i­ties, fur­ther strength­en­ing its mar­ket-lead­ing data repos­i­to­ry in the unremit­ting fight against fraud. If the data qual­i­ty is inad­e­quate and/or incon­clu­sive, the effi­ca­cy of the solu­tion will be affect­ed.”

By remov­ing automa­tion as a first step, organ­i­sa­tions can strip out the noise to leave behind the ever­more sophis­ti­cat­ed lev­els of human-gen­er­at­ed fraud. When users show good char­ac­ter­is­tics and behav­iour, they should be legit­imised with­out super­flu­ous fric­tion and com­pa­nies should have the con­fi­dence in their sys­tems to extend user ses­sions where appro­pri­ate, lead­ing to increased con­ver­sion. The net­work effect enables organ­i­sa­tions to gain col­lec­tive insights into the char­ac­ter­is­ti­cal­ly nefar­i­ous sig­nals syn­ony­mous with fraud­u­lent activ­i­ty, and allows them to con­fi­dent­ly iden­ti­fy fraud before it takes place.

It is through the uni­fi­ca­tion of these pri­or­i­ties, teams and bud­gets that com­pa­nies will achieve the great­est impact on busi­ness per­for­mance, and simul­ta­ne­ous­ly stem the tide of fraud before its impacts become irre­versible.

For more infor­ma­tion down­load Shape Security’s lat­est whitepa­per: The New Busi­ness Imper­a­tive