A bank can authenticate the person making a payment and still send money exactly where a criminal wants it to go.
“It doesn’t matter how sophisticated your authentication protocol is, if it’s actually me [the legitimate customer] who’s trying to initiate the payment,” Stephen Bowe, chief product officer at Paymentology, told PYMNTS.
The exposure has grown as criminals adapt to protections designed to stop unauthorized transactions. Biometrics, chip and PIN cards and additional authentication have made stolen credentials harder to exploit. Fraudsters have responded by persuading legitimate customers to approve payments and by constructing identities that financial institutions accept as genuine.
In the first case, the customer supplies the authorization. In the second, the deception begins before the institution establishes who its customer is.
Artificial intelligence assists both approaches. Bowe described false digital identities assembled from information drawn from multiple sources, with some remaining undetected for extended periods before criminals put them to use. Remote onboarding adds to the difficulty of assessing the person behind the application.
“It makes it easier to impersonate genuine customers,” he said.
Once an institution accepts a fabricated identity, subsequent authentication relies on credentials attached to that identity. Successful verification carries forward the original deception.
Social engineering reaches genuine account holders through a different route. AI helps criminals write personalized, persuasive messages without the obvious errors that once gave recipients reason to hesitate.
“They’re not full of spelling mistakes,” Bowe said. “They’re beautifully crafted emails.”
Their effectiveness rests on exploiting trust and emotion. A customer who believes the request has a legitimate purpose can complete the security steps themselves, leaving the issuer with an authenticated payment and a deceived account holder.
Checking Trust Throughout the Relationship
Bowe argued that issuers need to extend their scrutiny beyond the moment money moves. Know your customer checks remain a foundation, but their usefulness depends on whether the identity presented at onboarding deserves that trust.
He called for monitoring “the entire customer relationship rather than the individual transaction.”
Behavioral analytics would contribute to issuers’ assessment, combining several sources of evidence about the participants and their activity. Bowe described AI as a means for issuers to evaluate sophisticated fraud attempts, alongside its use by criminals.
Customer interfaces also have a role. Bowe cited confirmation of payee as an example of complicated infrastructure producing a simple, understandable result when someone enters recipient details. The customer gets information about whether the intended recipient matches the account before sending money.
Agent-led payments would introduce another point at which participants need to establish trust. Bowe envisaged customers giving credentials to their own agents, which would then evaluate third-party agents before proceeding with a payment.
“My agent will interact with a third-party agent and establish if this is something that can be trusted, and then the payment can flow through from there,” he said.
Tokenization would constrain the credentials used in those exchanges.
“Tokenization replaces the credential with an alternative, and that can be use case specific,” Bowe said.
He described restrictions tying tokens to merchants, devices or individual transactions. Those limits reduce where a compromised token can be used, with a transaction-specific token preventing reuse beyond its intended payment.
For issuers preparing for agents to transact, Bowe’s proposed approach combines scrutiny of the participants with restrictions on what the payment credential permits.
Watch the full interview with Stephen Bowe to learn more about:
- Why successful authentication can accompany a fraudulent payment.
- How behavioral analytics support checks after account opening.
- Where agents could verify counterparties before releasing a payment.
