Profile

Location

London

Member since

2009

Writes about

Security Payments Regulation & Compliance Sibos Retail banking

David's blog archive

2013 (5) 2010 (10) 2009 (4)

David Divitt

Senior Fraud Product Manager at VocaLink

Message Posts: 19 Comments: 14

Blogs

What's the link between the price of electronics and fraud?

11 Nov 2013

We all know that fraud has been rising pretty steadily in some form or another over the past decade despite efforts to stem it. We have been able to control areas in which fraud was prevalent by implementing technologies and processes to make it much more difficult for fraudsters to accomplish their crime, but in general, that tends to simply shif...

Lifecycle of a fraud

28 Oct 2013

Card fraud is a massive problem around the world, costing banks and consumers time and money. Even when we seem to be making headway the criminals find another way in, which is why we see stats such as those from the UK earlier this year, which showed that fraud losses on UK issued cards climbed 14 per cent last year to hit £388 million, the first...

Bayesian v Neural Networks

22 Oct 2013

Payment fraud evolves constantly, changing and adapting to the systems, networks and infrastructure. Criminals are always on the lookout for a weak link in the payment cycle to exploit, altering their behaviour to extract maximum value from their fraud activities. Responding to this ever-changing landscape is the responsibility of everyone involved...

What's really behind the Courier Scam?

19 Aug 2013

The recent article talking about the “Courier Scam” published in The Guardian is an interesting read for those of us in the industry, and an important one for both consumers and banks to pay attention to. While the police’s explanation of the scam seems plausible, I actually think the scam may have been even more sophisticated. The police figured t...

See all David's blogs

David is Commenting on

Banking Trojan hijacks out-of-band SMS security - Trusteer

I think saying "if you could only do one" can be a dangerous game and is probably not beneficial since I really do believe in a layered approach. With regards to giving a weight to the various options (event monitoring, multi-factor auth and transaction auth) I think event monitoring should probably comprise about 50% of your total solution (budget/efforts/etc) and the others spread evenly at 25% each. If you implement a multi-factor auth solution to authenticate logons, then you should be definitely using the same system to authenticate payments or other key account activity as well, to maximise its value.

12 Oct 2011 Reply Read article

Banking Trojan hijacks out-of-band SMS security - Trusteer

Fraudsters are always looking for new ways to steal money, and this is an example of how they are working across different platforms to breach security. However, I think it is wrong to say that this necessarily enables them to 'fly under the radar of fraud detection systems'. True - many financial institutions use out-of-band authentication - but it is rarely used in isolation. The strongest fraud detection always comes back to one key premise - knowing your customer: knowing what transactions they do, who they send money to, what amounts they spend, where they log on to their online banking site from, when they typically do transactions etc. Banks have got, at their fingertips, everything they need to build up a detailed picture of normal behaviour for their customers and any transaction that falls outside of that, even if it has apparently been authenticated by a mobile phone, should still be treated as suspicious. Of course, it is important to educate customers about threats, and ensure they know not to open suspicious messages or links - but the right security system needs to assume all these things will happen anyway, but the customer is still protected.

07 Oct 2011 Reply Read article

UK financial services industry loses £3.6bn a year to fraud - NFA

Unfortunately, I'm not surprised by these figures. Fraud, of all types, is a serious problem across all areas of society, and I completely agree with the NFA that everyone has to play their part to help beat the criminals. For their part, banks in the UK and around the world make significant investments in their fraud prevention tools and people, using many different techniques to try to identify any suspicious activity and stop fraud as soon as they can. But it isn't enough to leave the problem to the government, police or banks, every single person must also take fraud seriously and try to protect themselves and their money. This can be as simple as not throwing sensitive personal information in the bin, checking bank statements regularly and flagging anything suspicious, or protecting your PIN when withdrawing cash or using a card to pay in a shop or restaurant. It would be naïve to think we will ever be able to eliminate fraud completely, but there's no reason why we can't all work together to reduce it significantly.

27 Jan 2011 Reply Read article

E-crime gang dumps phishing for Zeus - APWG

This news is very concerning, although it probably isn't surprising. What this means is that we are likely to see a sharp rise in the more sophisticated, and harder to detect forms of internet banking fraud such as man-in-the-browser, which may signal the beginning of a new wave of internet banking fraud globally. Banks need to ensure they are monitoring customer behaviour and profiling their typical activity. The highest risk patterns such as transfers to a new beneficiary need to be risk ranked and checked using alternative methods of communication such as an SMS message to a mobile phone - even by those banks that employ multi factor authentication as part of the login process.

21 Oct 2010 Reply Read article