Actu
Financial companies unable to distinguish an attack from normal customer activity - expert comment
June 2016 by Ryan Wilk, director at behavioural biometrics firm, NuData Security
It’s getting harder for financial institutions to distinguish between fraudulent activity and the activity performed by their legitimate customers. According to latest research, nearly 38 percent of financial organisations find it very difficult to tell if a customer’s account activity is fraudulent or not.
Commenting on this, Ryan Wilk, VP at NuData Security said: “Early this month we read that 75% of shoppers will make online purchases by 2026 and are expecting retailers to sell more and more online. In this ecosystem moving more and more digital and with consumers demanding ease of online access, merchants and FI’s are increasingly pressured to provide a good experience for customers while protecting against more and more sophisticated hacks. The old tactics of protecting the perimeter simply don’t work very well when hackers can, and do, spoof a device or take over an account using valid PII, so easily stolen or bought on the dark web.
What is needed is a complete shift in the way we think of online security. A lot of organisations are scrambling to cobble together solutions from various vendors, building in-house solutions, tacking on “security show” type bells and whistles to make their consumers feel safer, but not actually making them safer. Customers have a right to feel nervous. There has been a 67% increase in the total number of data breaches since 2010. Password theft has increased by 300%. Everyday there is a new hack. The bottom line is that the hackers won’t go away and will continuously fight for the data they see as so valuable. Protecting your FI against motivated, sophisticated, and tech-savvy hackers isn’t easy.
So, let’s shift. The best way to take away an enemy’s power is to make them irrelevant. Imagine a world where the PII data hackers go after becomes irrelevant and worthless. Imagine a technology that can detect good users based on data points hackers can’t steal or mimic. Imagine a good user detector. Imagine a technology that can tell who is getting a present for Christmas and who is getting coal, because, that’s what we’re talking about here, only it’s not a fairy tale. Once we take this power back, the balance shifts in our favour and we can spot the baddies coming a mile away.
Just as FI’s base their organisational mission and vision around consumer trust, banking partners trust that we have the best good user detector around because we process 38 billion of behavioural events every year for them, offering a true consortium of behavioural truth in our rallying cry to stop the hackers. Rather than a mishmash of cobbled together solutions, with behaviour biometrics we can understand a user’s behaviour continuously over time, building layers of data points, and learn what a good user does, how they act, and how that behaviour compares to how they normally act/behave. Banks also know that fear of fraud, highly visible and annoying authentication controls, and false declines keep customers away. Behavioural biometrics removes the friction from the authentication process, enabling a good customer to have the good transaction they deserve.
We know that it can be a daunting shift. Thinking about security in terms of the customer’s experience is new and could seem radical, but seen from the perspective of understanding not just what they want (a great experience), but also how they behave, we can begin to grasp the potency of behavioural biometric technology. Perhaps the tough part of the shift is truly believing that it is possible to have in your security mix a tool that is truly a good user detector!”
