Knock knock..your bank says hi!

In this post, I'd hoped that banks would implement actionable SMS alerts such that, say, a cardholder receiving a transaction alert can reply with a simple "STOP" message to block a fraudulent transaction. I'm keen on knowing whether you've come across any banks, especially in India, that have implemented such 2-way SMS Alerts.

In Indian context, the two way communication combining pull type and push type alerts come under the realm of SMS banking. Because of security vulnerabilities the operations that are currently exposed by majority of the banks are limited primarily to enquiry services (balance, last few transactions, etc.) and payments through IMPS.

One of the leading private bank offers a provision to provide SMS request in case they find any discrepency in the details provided in the latest alert. Since most of the alerts being used are post-ante, the transaction itself might not be stopped but can be mitigated. Going forward, banks can look at infusing predictive analytics / advanced rule engines into real time transactions to flag off alert on a potential suspicious transaction and prevent them from becoming a fraudulent transaction.

I am aware of many banks - some in India and many overseas - who have been using predictive analytics of the type you have described to prevent a fraudulent transaction from happening in the first place. In fact, I have known this happening well before SMS Alerts, which are relatively a more recent development. As I understand, the problem with predictive analytics based fraud prevention is the high level of false-positives they introduce and the resultant adverse impact on revenue and customer satisfaction. Therefore, many banks have decided to supplement / substitute fraud prevention with SMS Alerts, where the customer is in fuller control. 2-way alerts make them actionable, which was the context of my previous comment.

In my previous comment, I was not indicating that the Predictive analytics has to be a substitute to action bases alerts. Rather, I was suggesting that it could complement the alerts system by acting as a filtering layer feeding into the alert management system. In other words, the customer will be intimated only upon actual fraud scenarios and fewer false positives (thanks to analytics layer) instead of bank crying wolf for every other transaction. Also the modern predictive analytic techniques usually deploy learning algorithms - so accuracy would only increase with time.

It was I who said in my previous comment that predictive analytics based fraud prevention is getting at least partially replaced by SMS Alerts! The way I understand SMS Alerts, they are meant to cry wolf over every transaction and leave it to the cardholder to decide which transaction is fraudulent and respond immediately via 2-way Alert and which transaction is genuine and do nothing about it. I agree that it becomes painful for the cardholder to receive so many cry wolf alerts but that can't be helped since predictive analytics, despite being used for at least 5 years in my knowledge, has not reached a level of maturity where it is free of false-positives. Having seen their susceptibility to false-positives in actual practice, I don't share your optimism that they will get more accurate with time. Especially since card authorization - at least for CP transactions - is a realtime process that can't tolerate the processing delay likely to be caused by a more exhaustive algorithm. 

I think there is some disconnect here. It has always been you who had been suggesting that predictive analytics are getting replaced by SMS alerts. I am trying to clarify that I dont subcscribe to that POV. In my opinion, for the system to be effective these should work in tandem as per the model i had indicated in my previous comment. The significance of the alert is lost if it is sent for every transaction which many customers would choose to unsubscribe.

There are many recent developments in the field of predictive analytics to identify profile of suspicious transactions though they might not have yet been deployed in live scenario. In any case the time lag will be less than if you have to wait for a customer to respond. Are you suggesting every transaction should have a lag time waiting for customer to respond before going through? If so, assuming that no response for a short slice time can be deemed as approval is not realistic. Customers cant be given a TAT of seconds to verify such transactions - they might not be checking each SMS as and when it gets delivered to them.

I got SMS alerts not because I subscribed to them but because the regulator mandated them. When the alerts sent by one of my banks ticked me off - cf. BANK1 in this post - I wanted to unsubscribe to them but the bank told me I couldn't do so since they were mandated by the regulator.

No, I'm not saying that the transaction should wait for the cardholder to respond to SMS alerts. In fact, such alerts can be generated only after the transaction gets authorized. I'm only saying that, at their current maturity level, predictive analytics create too many false-positives to be effective, so banks are replacing them by SMS alerts to give more control to cardholders. If, as you say, predictive analytics have gotten better, I look forward to seeing some case studies of live deployments before changing my mind.

Banks usually have a category of alerts which is common for all their customers (regulatory or as per bank policy) and leave the rest for the customers to subscribe to. But customers can opt out of any alert from the bank, if they wish to. I havent come across any regulation that mandates banks to send alerts for transactions and i find the example you had quoted a bit out of context for the current discussion on alerts related to transactions. So can people not open a bank account without providing their mobile number or email ID?

Even if some strange regulation requires this, it can easily be circumvented by customers - in many cases banks allow flexibility to the customer to define the threshold limits (some might choose million dollars, others could choose 1000 dollars) that would trigger the alert. So customers who dont want to be disturbed for transaction updates can easily choose an artificially high amount as their limit.