Complete the form to unlock this article and enjoy unlimited free access to all PYMNTS content — no additional logins required.

A bank can authenticate the person making a payment and still send money exactly where a criminal wants it to go.

“It doesn’t matter how sophisticated your authentication protocol is, if it’s actually me [the legitimate customer] who’s trying to initiate the payment,” Stephen Bowe, chief product officer at Paymentology, told PYMNTS.

The exposure has grown as criminals adapt to protections designed to stop unauthorized transactions. Biometrics, chip and PIN cards and additional authentication have made stolen credentials harder to exploit. Fraudsters have responded by persuading legitimate customers to approve payments and by constructing identities that financial institutions accept as genuine.

In the first case, the customer supplies the authorization. In the second, the deception begins before the institution establishes who its customer is.

Artificial intelligence assists both approaches. Bowe described false digital identities assembled from information drawn from multiple sources, with some remaining undetected for extended periods before criminals put them to use. Remote onboarding adds to the difficulty of assessing the person behind the application.

Once an institution accepts a fabricated identity, subsequent authentication relies on credentials attached to that identity. Successful verification carries forward the original deception.

Social engineering reaches genuine account holders through a different route. AI helps criminals write personalized, persuasive messages without the obvious errors that once gave recipients reason to hesitate.

“They’re not full of spelling mistakes,” Bowe said.

Source link