Fraudsters no longer need to reinvent their tactics from scratch. With artificial intelligence and increasingly sophisticated access to consumer data, they can test new approaches quickly, learn what works, and adapt before financial institutions have time to catch up.
That speed is forcing banks and other financial institutions to rethink how they authenticate customers. One approach gaining traction is ownership authentication, a process that looks beyond whether an application’s information matches a particular account. During a PaymentsJournal Podcast, John Gordon, CEO of ValidiFi, and Suzanne Sando, Lead Analyst of Fraud Management at Javelin Strategy & Research, explored how this approach can help financial institutions connect seemingly minor signals, identify emerging risks, and stay ahead of the adaptive fraud schemes.
A New Generation of Fraud
Artificial intelligence has made it possible for criminals to create new schemes and fraudulent identities in a matter of minutes. AI has fueled the rise of several types of scams, including account takeovers and bank impersonation. Some fraudsters use AI to submit account applications across multiple institutions, while others use it to gather information about existing customers, allowing them to mimic typical behavior and evade detection.
One way financial institutions are responding to those evolving threats is through ownership authentication. Rather than focusing solely on a new account or one that appears to be involved in fraud, this approach seeks to understand the consumer across their broader financial relationships. It incorporates factors such as ownership, payment history, account stability, and behavioral changes that can reveal emerging risk.
Verified accounts generally outperform better than the broader population in terms of fraud outcomes, but those results can improve further when institutions add an additional layer of authentication. Simply verifying that account details match the person opening the account is no longer enough.
“Just because an account is open and valid and it belongs to a particular consumer, there are still aspects that drive different decisions for the financial services provider based on fraud and risk connotations,” said Gordon. “If an account is open, valid and belongs to the applicant, if that applicant has an email address that’s less than 30 days old, the increase in risk is skyrocketing.”
Taking the Holistic View
It’s no longer enough to examine a single aspect of a consumer’s identity or behavior. Matching personally identifiable information (PII) to an account at a single point in time doesn’t provide a complete picture. Financial institutions increasingly need to take a holistic view of the consumer and assess whether the information provided remains consistent over time.
“Taken individually, you may miss the signals of a brand new email address or phone number—all these things that maybe don’t seem that that risky on the surface,” said Sando. “When you put them all together, it becomes a serious risk factor for this particular consumer. Fraudsters are bypassing a lot of checks that they normally wouldn’t have in the past because they have AI enabling them.”
Fraudsters, for example, may begin an account takeover with seemingly innocuous changes, such as updating a marital status or utility information. On their own, these changes may not raise an alarm.
Over time, however, those changes can be combined with a new credit card, a new debit card, and a utility bill to make the activity appear legitimate. Individually, each signal may seem insignificant. Together, they can reveal a much stronger pattern of potential fraud—one that can be missed when institutions examine each signal in isolation.
Facing Up to First-Party Fraud
Ownership authentication can also play a role in addressing fraud associated with buy now, pay later plans. As these options have become a prominent part of the consumer economy, they have made it easier for people to spread payments over time for purchases they may not be able to afford upfront.
For some consumers, even extended payment schedules can become difficult to manage. And as a result, first-party fraud may become a more deliberate strategy for consumers who are unable or unwilling to repay what they owe.
“All of those consumers are providing bank account and routing numbers at application, and we have the ability to access all of that data,” said Gordon. “When you look at that information together, you can see the status of the most recent transactions tied to those accounts. Is there a history of stop payments, frozen accounts, or other first-party fraud indicators? By evaluating those factors collectively, you give yourself much greater protection.”
“For those of us a certain age, that brings back a lot of connotations from 2008 where the consumer pressures were increasing and increasing,” he said. “And as a result, saying they felt like their best option was bankruptcy.”
Convenience as a Risk
Consumers often care less about who provides a financial service than whether the experience is convenient. But that emphasis on convenience can create risk, particularly when providers are reluctant to introduce anything that could add friction to a transaction.
As research has shown, many consumers will abandon a payment process when they encounter unwanted friction. But merchants and payment processors are increasingly learning that friction doesn’t have to be all-or-nothing. It can be targeted and managed based on the level of risk.
For example, if an applicant attempts to open a bank account using information associated with more than four Social Security numbers, that should trigger additional scrutiny. Similarly, if an applicant uses a relatively new or undeliverable email address, the institution may require a higher level of authentication.
Consumers may be frustrated by these additional steps, but they are also becoming aware that friction is sometimes necessary to protect their accounts and financial information. The challenge is finding the right balance between a seamless experience and appropriate security.
“We’re actually finding now that 50% of consumers are prioritizing the security of their PII that they’ve entered into that application,” said Sando. “If they don’t find that to be secure, they’re going to drop out of that process and you’re going to have abandonment issues.”
Key Takeaways
Ownership authentication falls under the broader category of “smarter friction.” It means understanding the customer experience, centering the end user, and providing safeguards that consumers can understand and recognize as necessary.
Most importantly, it recognizes that every account applicant is different.
“There is no one-size-fits-all,” said Gordon. “You’ve got to have the ability to tailor solutions to the application. How well-known is that consumer to you? That should drive a lot of the defense that you stand up.”
“You validate what’s happening on that end. You marry that with the risk that you could potentially be facing. And that’s where you get that smarter friction.”
Read ValidiFI’s latest intelligence report
