Navigating Evolving Threats in the Digital Banking Age

This year promises to be a pivotal year in the ever-evolving landscape of fraud threats, marked by significant advancements in technology and changes to the UK regulatory landscape. A continued shift toward an AI-assisted, tech-dependent society promises widening opportunities and capabilities, but brings with it the evolution of more sophisticated fraud attacks. Here, we consider what will be the most prominent threats for businesses to address, in 2024.

1. Fraudsters to target unaware money mules
Money mules – the arbiters of the fraud networks – have always been a significant risk for banking institutions, concealed in amongst the millions of genuine customer accounts. We’re already seeing regulation influencing institutions’ fraud strategies, placing significant focus on recipient banks to identify and exit mule accounts at an early stage as possible.

With the introduction of new PSR rules in October 2024 mandating shared liability for scam reimbursements, mules become an even bigger problem for banks. Recruitment of unwitting mules, such as the victims of romance or investment scams, should be a major concern throughout the established banking network and something they must factor into their money mule strategies going forward. Mid-tier banks should expect more attention from fraudsters as they move to exploiting banks with weaker monitoring and prevention capabilities. Gangs will likely move from bank to bank, testing to see what they can perform undetected with small-to-medium sized financial institutions, such as digital challenger banks and some building societies being at greatest risk.

2. First Party Fraud & False Claims
Another consequence of the new reimbursement model may be an increased volume of first-party fraud where genuine customers attempt to deceive their bank with false fraud claims. As economic conditions continue to put pressure on average families’ budgets, the temptation to take advantage of mandated reimbursement rules to make ends meet may be too much for some. Of even greater concern is how organised criminal gangs may respond, industrialising the process with sophisticated tactics to encourage or coerce individuals to make claims en masse.

It remains to be seen whether banks will treat second- and third-time scam claimants with a more sceptical eye. After all, mandatory reimbursement presents a sizeable fraud impact to budgetary lines. Banks may even decide to exit vulnerable customers, even those who are unwillingly contributing to mule activity. The consequences of this de-banking could be profound for those affected – exacerbating financial hardship through long-term exclusion from mainstream financial services and lines of credit.

3. Increase in Card Not Present fraud and Other Channels
Should the inevitable crack down on money mule networks have the desired effect, we may well see fraudsters switching to other channels to perpetrate attacks, with the CNP channel being a prime target. In 2023, we saw a proliferation of fraudster tactics through phishing, social media platforms and marketplaces to capture card details, subsequently engineering victims into revealing their OTP or using mobile app push notifications to authorise illicit card transactions. As other streams of revenue are closed to fraudsters, inevitably they will expand this already successful route even
further.

In response, banks must enhance controls and utilise shared network intelligence, such as through the LexisNexis Digital Identity Network UK banking consortium. Another possibility is that fraudsters look to move funds outside the banking system or beyond the jurisdiction of the UK regulation, to
reduce the risk of detection, resulting in an increase of transactions to crypto currency exchanges and international payments.

4. Increase in Generative AI to Perpetrate Fraud
The rise of generative AI heralds a new era fraught with challenges for financial institutions. Deepfake technology, now widely accessible, can mimic facial expressions, gestures and voices to create the illusion that you are engaging with a genuine individual. Its use in fraud has notably escalated in recent years across a number of applications.

First-party fraud – already accounting for around a third of UK fraud – will likely increase with the help of generative AI. Faked identity documents can be more easily created and video or motion-based authentication procedures circumvented with realistic likenesses. Deep fakes can play a key role here, impersonating a victim to authenticate or instruct a transaction on their behalf. CEO frauds – now on the rise – use this exact approach, recreating a high-ranking executive’s face or voice to coerce company employees into transferring funds.

Generative AI tools are helping fraudsters produce ever-more convincing phishing content too, and with greater ease. Replicating web pages and customer communications is quick and simple, enabling mass-production of phishing content in any language with few mistakes. Combined with
AI’s ability to perform large-scale web scraping to obtain personal and employment information, we’re now witnessing fraud on an industrial scale.

Integration of generative AI into social media platforms is a double-edged sword, offering both innovative experiences and increased susceptibility to fraudulent activities. In 2024, expect generative AI to contribute significantly to the proliferation of increasingly sophisticated and convincing social media scams, including payment fraud, investment scams and the more insidious romance scams ¹. Of equal concern is AI's capability to create realistic virtual profiles and chatbots used to convince victims to part with their money or personal information on a massive scale.

It’s widely accepted that most scams originate on the big tech platforms, well away from the banking environment. Time will tell whether Government initiatives, such as the Online Fraud Charter ² (2023), will follow-through on their promise to hold these platforms to account and begin to stem the flow of fraud into the financial services sector. An increased focus on social media’s role in facilitating and originating UK fraud and scams can only benefit everyone, through better protection of all online users.

James Rushe, Engagement Manager

¹ Financial firms must boost protections against AI scams, UK regulator to warn | Artificial intelligence (AI) | The Guardian
² Online Fraud Charter - GOV.UK (www.gov.uk)

-ENDS-