Everything old is new again Jonathan Williams Principal Consultant

The world of payments and fraud is changing … New technology New providers Customer preferences Increasing threats Regulation and Legislation

Contactless fraud loss rates in the UK are not increasing Loss £m Spend £b Rate 2014 0.15 2.32 0.0066% 2015 2.8 7.75 0.0361% 2016 6.9 25.2 0.0274% 2017 14 52.4 0.0267%

“Never has there been so much change in payments” Payments Industry Legislation Payment Services Directive 2 Strong Customer Authentication Open Banking Regulation PSR: Payment Strategy Forum New Payments Architecture Request to Pay CMA Remedy

Old techniques are coming back, or never went away Payment fraud Invoice/supplier fraud CEO/Director fraud account takeover Direct Debit fraud misuse of facility subscription double indemnity Identity fraud Authorised Push Payment fraud Account takeover Collections fraud account takeover double indemnity Identity fraud

Payment fraud is all about hacking, right?

Authorised push payment fraud Unauthorised push payment fraud is what? Authorised by the a valid customer PSPs are acting on their customer’s instructions Consumers and businesses cannot confirm whom they are paying Faster Payments facilitates mule accounts. Change of account details Condé Nast lost $8million to one scammer related to one e- mail in November 2010 “UK Councils lose £7m” 2011 “Friday fraud” – solicitors CEO/Director fraud Invoice fraud Builders Private schools …

The end to end fraud supply chain Customer IP Application fraud Account takeover fraud Transaction fraud IP IP IP Business IP Money mule network Suppliers Consumer

… but what about direct debit ?

Securing bank account payments DebitShield help banks and businesses secure consumer and business bank accounts from fraud and financial crime by hiding and protecting payment data

… and identity?

Payments Strategy Forum has made some progress Progress to date Strategy Working Groups Oct 2016 Report Jul 2016 End of consultation Nov 2016 Design & Implementation Working Groups Jan 2017 Payments System Consultation Report Jul 2017 End of Consultation Sep 2017

CMA Open Banking and PSD2

Regulation vs Legislation: CMA Remedy vs Open Banking London Competition and Markets Authority Remedy Consumer/SME current accounts at 9 (big) banks Open Banking Limited Regulatory requirement Single API Customer checks TPP in FCA list Shared credentials Brussels European Commission Payment accounts at all EU banks and payment institutions Multiple groups (e.g. Berlin Group) National law (EU Directive) Multiple APIs Bank checks TPP certificate Unshared credentials? ©Mk2Consulting 2017

The way we pay is changing … and impacts financial crime prevention and detection The weaknesses which always existed, still exist More authentication: identity is a weak link Instant Payments: chasing the money is hard Open Banking: new providers with little experience Data compromises undermine data-related validation New architecture: new systems, more data, decentralised

Giving our clients the best advice and insight www.mk2consulting.co.uk

About Mk2 Consulting Mk2 Consulting can help you plan and deliver Identity Management Fraud Prevention Payments Current key topics include: PSD2, GDPR, 4MLD, eIDAS We work with industry bodies Payment Strategy Forum Euro Banking Association Vendorcom We’re available for: Education and training Auditing and assessments Strategy and product review Article and copy writing Speaking and moderating and specific project work Mk2 Consulting is affiliated with: Association of Risk and Fraud Advisors (www.airfa.net) MLROs.com

What is a payment? “the transfer of money from one individual or business to another” Bank of England, 2012 “the action or process of paying someone or something or of being paid” Oxford Dictionaries “something given as a reward or in recompense for something done” Oxford Dictionaries “compensation, discharge or performance of an obligation, or reimbursement, by giving over something that is of satisfactory value to its recipient, such as money” BusinessDictionary.com “the partial or complete discharge of an obligation by its settlement in the form of the transfer of funds, assets, or services equal to the monetary value of part or all of the debtor's obligation” investorwords.com

What is a payment? Purpose Transfer of Value Payment Cost of payments is about processing the associated data: Cashing up at the end of the day Reconciling cheque payments Applying payments in suspense accounts Approving electronic credits and card payments