What Does a Customer Experience When You Handle Fraud the Right Way?

PositiveCX.jpg

By: Tim Prugar

This morning, tens of millions of Americans woke up and experienced the same, sinking feeling:

Was my information exposed in the Equifax Breach? Am I at risk for being a victim of fraud?

As a business, your customers are frightened right now. They're worried about their accounts, and their identities, and the lives that they have worked hard to build for themselves and their families. What they want more than anything is the peace of mind that if something goes wrong, it can and will be taken care of in a timely fashion.

I know that feeling well - last month I was the victim of credit card fraud. The feelings above were real, and they were intense. However, my bank was able to transform a very scary experience into a positive one by making it easy to have my problem addressed and fixed. The fundamental tension in fraud prevention is between Customer Experience and Security. However, as you'll see here, those two can very easily work hand-in-hand to protect the customer while ensuring loyalty. 

My story, originally posted over at CustomerThink, is as follows:

Speed

I had just become the victim of credit card fraud.

While sitting at my desk, I received an email alert from my bank — one of the largest in the United States — that my credit card had just been used in Iowa. Of course, I wasn’t in Iowa. And I hadn’t used my credit card in nearly three weeks.

Upon looking, to me, it was an amount that clearly showed someone was testing the card to see if it would go through — often the first step in a fraudster’s bag of tricks.

My bank prompted me to confirm the purchase — “Was this your purchase, or is something wrong?” it read. They had started on the right foot, and with 15% of banking customers who experience fraud closing all accounts with that provider, the bank knew the next steps were just as critical to keeping my business.

I clicked “something is wrong” and my card was immediately frozen. I called the support number listed in the email, was quickly authenticated by the bank, and in less than five minutes, my card was closed, the fraudulent transactions reversed, and a new card was on its way.

Efficiency

Chances are, you or someone you know has or will be a victim of credit card fraud. According to the consumer financial protection bureau, more than 10% of the US will fall victim at some point in their lifetime; indeed, the United States accounts for 47% of the world’s credit card fraud cases.

To combat this, companies are always improving their security. For example, the advent of EMV, the smart chip on your card, has led to a decline in total losses in recent years, as it has become more difficult for some fraud acquisition techniques like card skimming.

So where do high-tech fraudsters turn when they’re thwarted? The weakest link, of course. And today that is the call center. The place where customers are earned and lost.

In 2016, call-center fraud rose more than 110%. Financial institutions authenticating primarily through ANI — automatic number identification — were startlingly vulnerable to attacks carried out by phone spoofing, which remains a heavily relied upon technique for fraudsters.

Shoring up this vulnerability is a fine line for financial institutions to walk.

Too little security and perpetrators of fraud can easily game the system. Too much security, and you’re putting an already aggravated customer through the ringer.

The worst thing a bank can do is handle this poorly: bouncing someone between multiple agents, poorly thought out knowledge based authentication question that either the person may not know the answer to, or a fraudster may be able to figure out through social media, long hold times, etc.

You need a system that does this, and does it quickly, so a customer can get on with their day as quickly and efficiently as possible.

Positivity

Ironically, having my credit card stolen ended up being a pleasant experience, because now I’ve got a great story to tell — a firsthand account of how a powerful authentication system can transform the customer experience in fraud cases.

How a company handles fraud and makes the customer feel is important; a company has the same responsibility as when they’re trying to convince a customer to buy. If someone has a terrible experience dealing with the counter-fraud measures of their banking institution — that can derail the entire relationship.

Speed is a factor in situations like this, and with a solid authentication system in place, my bank and I can operate with trust and peace of mind that I am who I say and solve the problem at the speed I desire as the victim. I want to get a person on the phone as quickly as possible.

When a company can authenticate a caller quickly, they chop off the clunky knowledge based process at the beginning of the call and it allows them to green light calls like mine.

The primary benefits are twofold: identifying fraudulent calls and beginning the procedures on dealing with such calls, or authenticating the call quickly before any further damage is done by a perpetrator of fraud.

Who knows what the damage of an additional 5, 10 or even 30 minutes means in terms of fraud — but we can stop the damage before it gets that far.

When companies use efficient technology to put the customer experience first while simultaneously demonstrating a commitment to strong security measures, everyone comes out ahead.

Even though my account was compromised, even though there was fraud — I walked away with a positive feeling about the company, because of the efficiency of how my case was handled.

With brand loyalty harder than ever to win, and fraudsters continuing to evolve the way they commit attacks, smart organizations will do well to bake fraud prevention into their CX.

 

Tim Prugar is the VP of Operations at Next Caller. He can be reached at tim@nextcaller.com.

Will Biometrics Change the Way Your Business Accepts Payments?

By: Tim Prugar

Yes. Yes they will. But Payments will also change the way that Biometrics are leveraged for security. 

Technology has widened the chasm between small businesses and behemoth competitors like Amazon and Alibaba. This becomes most clear in the payments space, where smaller merchants struggle to process the volume and speed of transactions with the technological innovation that larger firms can afford. Small Business Trends took a look at the role biometrics plays in payments, and had an interesting takeaway:

Biometrics is not a Binary

Well, shouldn't be a binary anyway. Biometric identifiers don't get scored as "Correct" or "Incorrect" like knowledge-based identifiers do (Either "Appetite for Destruction" is your favorite album or it isn't!). Instead, authentication solutions look for the probability of a match based on a number of traits or signifiers - once that probability crosses a certain threshold, it's deemed a "match." 

The most effective biometric systems increase the probability that a biometric identifier is deemed a match by marrying that fingerprint or iris or what-have-you to other data signals. As the article points out, fingerprint biometrics can have their efficacy increased when paired with data signals like geolocation or Device ID. Similarly, Jack Ma made Alipay more secure by marrying the "Selfiepay" concept with smiling or nodding as a movement captcha. 

But what about Voice Biometrics?

Voice biometrics are an effective solution for authenticating callers and detecting fraud. Without additional data points, however, Voice Biometrics fails to meet its full potential. 

Here's what Voice Bio can leverage to get even smarter:

Dynamic Blacklists - If a call is coming from a known fraudulent number, a suspicious international number range, or a compromised account- why treat it as a basic customer call? Leverage this information, much of which can be accessed via API in near-real-time, to flag calls before they even reach you Biometric Authentication. 

Spoof - According to Next Caller's research, 94% of all fraudulent attacks on the call center leverage ANI spoofing as one of the methods to gain access.  Smart call centers use information about whether a call is spoofed to "green light" a call for an agent or flag that call for further scrutiny. 

Geolocation - Where should your caller be? If they're somewhere else - that's a solid indicator to at least take a second look at a call. 

Again, all of the above information is available in near-real-time, much faster than a Voice Biometric Authenticator can perform an analysis. 

The next major wave of Biometric Security won't be the implementation of the solutions, but the marrying of data that makes those solutions smarter. 

 

Tim Prugar is the Director of Customer Success at Next Caller. He can be reached at tim@nextcaller.com

What You Can Expect After the Verizon Breach

By: Tim Prugar

Yesterday, ZDNet broke the story that a data breach at Verizon resulted in the exposure of the names, phone numbers, and PINs for over 14 million Verizon customers. The data was accessed in June after it was discovered to be improperly stored on a server maintained by Nice Systems, an Israel-based company. 

The scope of the damage has yet to be established, but here are some safe bets on what you will see in the wake of this breach:

Explosion of Call Center Fraud at Verizon

Obtaining customer names, phone numbers, and PINs is pretty much the Holy Grail for fraudsters. Having this information allows fraudsters to order new handsets, obtain additional personal information for a secondary attack, set up call forwarding, or engage in number porting. Attacks using this information will almost always center around spoofing, and will most likely look something like this:

1) Fraudster researches the individual who owns the account they wish to breach online or through social media to figure out the answers to Knowledge-Based Authentication Questions.

2) Fraudster spoofs the number of the account they're attacking in order to present a matching ANI to the IVR system or the live agent.

3) Fraudster gives the name they've obtained from the breach to the agent when they reach a live person.

4) Fraudster gives the PIN they obtained through the breach. If there are any Knowledge-Based Authentication questions, Fraudster answers them easily based on their prior research. They're in. The Account Takeover is complete. 

 

Exploitation of Two-Factor Authentication (2FA)

Fraudsters will attack the Verizon Call Center directly - but for most fraudsters this will be the first step in a two-step plan. 

Many banks leverage 2FA to ensure the security of the accounts. 2FA largely relies on mobile devices, leveraging callbacks or SMS messaging to ensure the security of the customer. 

As Fraudsters set up call forwarding or port numbers during their primary attack on the Verizon Call Center, they will have the ability to intercept this 2FA from financial institutions. By successfully navigating this authentication process, fraudsters can attempt to execute wire transfers, open lines of credit, order replacement credit cards, or any amount of nefarious behavior. Expect fraudsters to leverage spoofing once again to present as the compromised customer to the financial institution to execute this plan. 

 

Increased Attacks on ISPs

We predicted in this post that ISPs would encounter "Hacktivism" and retaliatory breaches in the wake of the Net Neutrality debate. There isn't evidence yet that this breach is a direct result of internet unrest, but ISPs would be wise to batten down the hatches on their cyber and telephony channels. 

 

Tim Prugar is the Director of Customer Success at Next Caller. He can be reached at tim@nextcaller.com.

 

 

Merchants Stand To Lose HOW MUCH to CNP Fraud?

 

By: Tim Prugar

           Regular readers of this blog should be no stranger to Next Caller’s stance that the EMV migration has had a significant impact on Card-not-Present (CNP) Fraud in the retail and financial services spaces. The call center channel and eCommerce are the most vulnerable due to the volume of transactions and vulnerability to social engineering. We always knew that the threat was a potentially catastrophic one, but the amount of money at stake may be even greater than anyone realized.

            A recent report by Javelin estimates that $71 billion will be lost to CNP Fraud over the course of the next five years. With those staggering numbers in play, it’s even more alarming that so many merchants still insist that the costs of combatting fraud are too high to justify. This is false: the majority of real-time fraud solutions are less expensive and less labor intensive than salaried Analysts who perform manual reviews of instances after the fact. Javelin also indicates that in the eCommerce space, address fraud in the form of freight forwarding and Synthetic ID fraud are of particular threat to the industry.

            So, in the face of this oncoming tsunami of fraud, what is a merchant or financial institution to do?

 

Prioritize Real-Time

The reason for the growth in CNP Fraud is twofold: one, the difficulty of traditional Card-Present Fraud post EMV migration, and two, the enormous volume of transactions fraudsters can pump through CNP channels. Merchants and Financial Institutions simply do not have the time and resources to hand-review the massive amount of fraud that is coming and will continue to come their way. Visionary organizations will prioritize real-time, first-stage fraud detection systems over second-stage review solutions.

 

Leverage Geographic Intelligence

Businesses know where their fraud is taking place. Why not view those regions with a greater degree of skepticism? Setting up business rules to trigger automated, real-time reviews of orders going to suspicious locations is a must for dynamic fraud teams. According to Javelin, Fraud chargeback rates in Brazil jumped from .5% of all transactions to 3.5% - with a jump from 1.25% to 2.75% reported during the same period in Mexico. Wouldn’t it make sense to pay a touch more attention to orders going to those locales?

 

Verify Everything

With Synthetic ID fraud on the rise, it serves as the perfect compliment to CNP Fraud. It’s not enough anymore to verify that a phone number and/or a postal address are valid. Fraudsters are providing valid information in invalid combinations to circumvent detection systems. Fraud teams, particularly in eCommerce, should not only be validating each order line, but should be verifying that the information has been seen together before – an offering that Next Caller provides.  

 

Tim Prugar is the Director of Customer Success at Next Caller. He can be reached at tim@nextcaller.com.

Speed Read: How to Hack Biometrics

Hot off the presses, two quick articles to start your week. Both on the subject of hacking biometrics, voice or otherwise. 

  • The Register breaks down how scientists are trying to identify and stop the methods that hackers and fraudsters circumvent voice biometric authentication systems. SPOILER ALERT: spoof plays a major role. 

 

  • A lively debate focusing on the "hackability" of biometrics. It looks like the question isn't if biometrics can be hacked, but how easy it is to do. 

 

Click to learn more about Next Caller's unique approach to real-time caller authentication and fraud prevention.

Social Security: Social Media Phishing Attacks Are on the Rise, Here’s How You Can Protect Yourself

While phishing, or the practice of sending emails or making phone calls purporting to be from legitimate companies in an effort to get victims to reveal personal information is nothing new, fraudsters are increasingly turning to new channels to target victims. One such channel is social media.

Recently, a social media attacked carried out by Russian hackers was able to infiltrate the computer of a Pentagon official. And it didn’t take much for the hackers to find their way in; a simple link attached to a Twitter post advertising a vacation package was enough. Once the linked was clicked, the official’s computer was infected.

In November 2015, the State Department revealed that its 7,000 of its employees took the first step toward being compromised by clicking on a link that appeared in their social media feeds.

According to one report, social media phishing attacks increased 500% from beginning of 2016 to end of 2016. While that’s a scary statistic, the success rate of these types of attacks may be even more frightening.

Research published by the cybersecurity firm ZeroFOX found that 66% of spear phishing messages sent through social media sites were opened by their intended victims.

The reason for the increase in attacks on social media is rather simple. These attacks are targeting channels where users usually have a high-degree of trust. When you share something to your social network, or see a post from someone else, it’s unlikely that you screen the content for fraud potential.

With the number of attacks on the rise, and the vulnerability that social media channels presents making headlines, corporations and government agencies around the world are starting to realize the importance of educating and training staff on the dangers of social media fraud.

However, these attacks aren’t relegated to big organizations. Anyone who uses social media should be aware of the potential threats as well as the steps they can take to make it less likely that they will be hooked in a social media phishing attack.


To help, we’ve put together the following infographic:

Should ISPs Prepare for "Hacktivism" in the Wake of Net Neutrality Vote?

     The internet erupted in a collective fury last week as the FCC voted to rollback net neutrality regulations. From the internet commons of Reddit to the New York Times Editorial Page, observers noted with concern, anxiety, or full-blown rage that the policy shift was a threat to the concept of a free and open internet. The popular wrath was directed at two main sources: FCC Chairman Ajit Pai and massive Internet Service Providers (ISPs) who potentially stand to gain from the deregulation. With ISPs squarely in the sights of the internet’s vengeful wrath, the rise of “hacktivism” should give ISPs significant pause about the security threats this policy change can bring to their organizations.

 

What is Hacktivism?

            A blend of hacking and activism, hacktivists leverage security breaches or other cyber attacks to advance a political or social cause. Rather than looking for money, Hacktivists are seeking to combat perceived injustices. Examples include an attack on the state of Michigan’s website in the wake of the Flint Water Crisis, the hacking of DNC Emails, and even the data breach at Ashley Madison.

 

Why Should Net Neutrality Make ISPs “Productively Paranoid”?

            First and foremost, there’s already been an alleged hacktivist attack as a result of the net neutrality vote. The FCC itself has claimed that it suffered multiple distributed denial-of-service (DDoS) attacks that they believe had the goal of shutting down the public commenting system in advance of the net neutrality vote. These tactics are becoming increasingly common as an expression of internet outrage, and ISPs don’t need to look much further than headlines to see the anger that these policy changes have caused:

Comcast and Verizon’s Sneaky Push to Kill Net Neutrality is Just Embarrassing

Comcast and other ISPs celebrate imminent death of net neutrality rules

Verizon Apparently Thinks You’re Stupid 

FCC Buried By Fake and Hate-Filled Comments on Net Neutrality

            To sum…many people are very unhappy.

 

 What Can You Do To Protect Yourself From Hacktivist Attacks?

            The most important thing to recognize is that attackers focus on vulnerabilities and weaknesses. Any plan to shore up security must identify and secure frequently-overlooked channels.

1.     The Phone

Whether it’s PBX, VOIP-based UC systems, or a consumer-facing call center, the phone channel is a prime target for bad actors. ISPs should be certain that PBX/UC systems have secure passwords and that systems are in place to detect suspected breaches. A hacked PBX can run up hundreds of thousands of dollars in long-distance calls in a single weekend, and would be a perfect way for hacktivists to make ISPs feel financial pain for the net neutrality shifts.

ISPs who operate consumer-facing call centers should employ technology that can detect instances of call spoofing or robodialing in real-time. Executing a Telephony Denial-of-Service (TDos) attack by flooding a call center with robocalls is an effective way to completely shut down a call center, like what happened at the Minnesota insurance exchange. ISPs want to be sure to have strong anti-spoofing technology in place to prevent account takeover protect their customers’ personal data in the event of an attack.

2.     Phishing Attacks

The human being is always the weakest link in the fraud chain. From Snapchat to the World Anti-Doping Agency to GoogleDocs, significant cyber threats can be facilitated by an employee clicking on a link or downloading and opening a file they shouldn’t. It is essential that ISPs exhibit a heightened sense of internal security, and ensure that all employees have received recent training on phishing attacks, social engineering practices, and basic email safety.

3.     Third Party Vendors

With the rise of interconnectivity and the Internet of Things, it’s no longer enough to worry about your own security protocols and practices – you must also be rock-solid certain as to the security credentials of your third party vendors. An air conditioning vendor contributed to Target’s data breach, and Lady Gaga’s album was leaked after a collaborator was hacked. How are you being certain that your vendor partners aren’t accidentally putting your business at risk?

3 Lessons Contact Center Leaders Can Learn From WannaCry

By: Tim Prugar

     The transnational WannaCry Ransomware Attack exploded across the internet early Friday Morning on May 12th, and it’s aftershocks are still being felt early this week as some machines in Asian Markets are being booted up for the first time after the weekend. For the curious, Nicole Perlroth over at the New York times provides an outstanding overview of the background events leading up to this cyber attack, but the basic facts are relatively simple. A hacker or team of hackers identified a vulnerability in the Server Message Block (SMB) Protcol in Microsoft Software, and put together a ransomware attack that spreads through a system’s file-sharing capabilities. The attack would immediately encrypt all of the system’s files, demanding a Bitcoin payment for the de-encryption and safe release of the pertinent documents. The attack, like many, was unleashed via a simple phishing ploy – an unsuspecting victim downloaded and opened a file they shouldn’t have that contained the malicious software. The rest was a nightmare for the cybersecurity community.

     While the WannaCry threat can reasonably be classified as “cyber terrorism”, and patches to protect machines from being infected have already been issued, Information Security Officers should use this incident as an opportunity to pull lessons about protecting all channels from attacks from bad actors. What can fraud experts, CISOs, and Call Center Leaders learn from the WannaCry attacks?

 

1. The Human is the Weakest Link In the Fraud Chain

The methods through which WannaCry spread and replicated may have been automated, but the door for access was opened by a human being. Basic social engineering is at the heart of many of these phishing, SMSishing, and vishing scams, and the phone is one of the most lucrative channels for manipulating a human being to a desired end. CISOs and Call Center Leaders should be investing heavily in training agents to identify and recognize common social engineering methods and tricks, and should consider exploring technologies that are able to identify calls real-time that have been spoofed or otherwise manipulated. There is a high correlation between ANI Spoofing and phone fraud attempts, so more information allows agents to “trust but verify” with more complete data.

 

2. The Cost of Attacks Go Beyond Money

     The big story of the WannaCry attacks isn’t the absolute value of the money extorted (some reports have it at less than $60,000), but the “collateral damage” losses of disruption to services, man hours lost, and even potential health implications. The WannaCry ransomware didn’t just infect computers in a vacuum – it infected computers at Universities, the British National Health System, train stations in Germany, and multi-national corporations based out of France and China. Similarly, when fraud teams do cold “dollars and cents” cost benefit analyses of fraud solutions for the Contact Center, they often look only at their absolute number of fraud losses, and compare that to the cost of the solution. CISOs and Contact Center Leaders should look at the problem holistically: How much time are we losing due to caller authentication? Can we quantify the damage being done to our brand due to fraud and data breaches? Are fraudsters leveraging information stolen at the contact center level to make larger, more costly fraud attacks elsewhere?

 

3. Hackers and Fraudsters Are Very, Very Good At Exploiting Vulnerabilities

     Some hackers and fraudsters are organized criminal enterprises; others are impish troublemakers. Either way, these people are experts at identifying weaknesses in security systems and exploiting them for their own gain. Just as the architects of the WannaCry attack masked their malicious software to get a foot in the door, so too do those looking to commit account takeover or identity theft through the Contact Center mask their phone number to minimize the likelihood of detection. By using ANI Spoofing, fraudsters look to mimic the phone number of an existing customer to bypass ANI-matching authentication procedures, or look to mimic a completely random phone number to hide their own identity. Either way, these fraudsters are leveraging spoof as the main method for their attacks, and any technologies that can detect these spoofing attempts real-time provide an added layer of much-needed security at the Contact Center level.

 

     So what can CISOs and Contact Center Leaders do in the wake of the WannaCry attack to ensure that all channels are adequately defended from bad actors?

     Security Leaders would be wise to conduct a thorough audit of Contact Center authentication and security protocols to ensure that vulnerabilities and weaknesses in the call flow are identified, isolated, and addressed in a timely fashion. Tools such as blacklists, voice biometrics, and anti-spoof technology are all strong safeguards to keep bad actors out, but they are used best in tandem as a layered solution to provide the highest possible level of Contact Center security.

 

Tim Prugar is Next Caller's Director of Customer Success. He can be reached at tim@nextcaller.com.

Top Call Center And Telecom Trends For 2016

Authored by: Sheldon Smith is a Senior Product Manager at XO Communications (XO.com). XO is a telecommunication services provider that specializes in nationwide unified communications and cloud services.  Sheldon has an extensive background in UC and he has over 15 years of experience in the technology industry. His position involves overall product ownership of Hosted PBX, SIP, VoIP and Conferencing.

Overview

Research and Markets, a market research store, states the global contact center market is on track for a compound annual growth rate of 9.26 percent over the next four years, as companies look to outsource communication services and improve the customer experience. However, growth isn’t just happening over the long term. With 2015 almost over, it’s worth taking a look at what next year may bring for the call center and telecoms market: Here are five top trends for 2016:

Improved Mobility

Most telecom providers have built-in support for mobile devices and in some cases, wearable technology — but according to research firm Gartner, 2016 will usher in a new type of mobility powered by the “device mesh.” Put simply, this mesh extends beyond “traditional” consumer devices to also include home electronics, automotive digital systems and environmental tools. For telecom companies, this means increasing demand from users to support any device, anywhere, anytime.

The Ambient Experience

Gartner also predicts the rise of “ambient user experience” over the next year. Enabled by the device mesh, the idea here is to create a customer experience that “seamlessly flows across a shifting set of devices and interaction channels blending physical, virtual and electronic environment.” This is a sea change: Consumers are trending away from devices as discrete channels but instead view them as part of a unified whole. For call centers, the means a rise in the number of callers who expect agents with full access to historical records along with any online, mobile or previous phone conversations.

Stepped-Up Security

Breaches are now an expected outcome for many companies regardless of size or industry. The same applies to telecom providers: Personal data stored by your organization is a hot-ticket item for determined hackers. In 2016, expect to see a rise in the number of security startups and VoIP providers that offer native encryption for all communication data — in transit and at rest. Improved controls for local admins are also on-tap: C-suites and security pros alike want to know what is happening on their network, why and how they can put a stop to it, as needed.

Power to the People

According to global online community Customer Think, one big change coming to call centers of the future is the ability for customers to help themselves with minimal assistance from an agent. While CT takes the long view and says 2020 is the year to watch for this kind of transition, the tech market of 2016 should lay critical groundwork. For example, improved interactive voice response (IVR) systems will make it possible for customers to “self-serve” most of their issues, in turn putting more pressure on front-line call center staff to become subject matter experts. Over the next year, expect the view of agents to shift from one of “first contact” to “final option” — knowledge and skills must improve to match demand.

Bandwidth for Big Data

If telecom providers want to stay competitive through 2016, they’ll need to do better with big data. It’s no longer enough to simply store this steady stream of information — consumers expect their provider to offer real insight when it comes to buying habits and predicted needs. Handling the big data deluge means providers need to shore up available bandwidth and make sure they’re ready to manage the transition from steady flow to rushing river as data demands. According to business news publication Trade Arabia, companies in the Middle East — the world’s second-largest mobile phone market — faces the challenge of dealing with a tech-savvy consumer base that effectively jumped over landline adoption to embrace Internet-connected devices. The result? Massive amounts of data to analyze and insights to glean, and the chance to get a leg up on North American providers that don’t dive headlong into big data.

Ready for 2016? The future holds better mobility, improved user experience and security backed by a tech-savvy populace with big data focus.