- Key insight: A lack of national regulations creates challenges for bank authentication.
- What's at stake: The growth of real-time payments further stresses risk management.
- Expert quote: "In the absence of regulation and it being mandated, there will be inconsistencies." —Capgamini's Oliver Hanmer.
Instant payments create an additional layer of customer authentication challenges for banks.
Processing Content
Unlike with cards, there's no single, centralized way to confirm an account is open, active and owned by the person or business getting paid. And, unlike the United Kingdom or European Union, the U.S. has no all-encompassing regulations requiring banks to employ strict verification.
"Depending on which of the country's banks and credit unions sit on either end of a transaction, verification today can still mean a microdeposit that takes a day or two to land, a manual name-match a bank employee runs by phone or email, or no real check at all beyond what the payment file happens to carry," Ximena Aleman, co-founder and co-chief executive of fintech infrastructure company Prometeo, told American Banker.
Here's what banks need to know about verification trends:
Verification tools are improving, but not all banks are up to speed
More tools are being created for banks to verify accounts in real-time, and they're getting more sophisticated, Aleman told American Banker. A greater number of banks, however, have to adopt them. Some financial institutions rely on data that's not real-time to help verify accounts, which leaves them open to fraud and other issues, even accidental ones. You miss a number in a bank account, and the money ends up in someone else's bank account, Aleman said.
Fraud is much faster with real-time rails, so it's more important to pre-validate the bank account before sending the money. Because, generally, you won't be able to do a charge-back or reverse the transaction, she added.
Rules are slowly changing
The lack of regulatory uniformity in the U.S. makes the situation difficult for banks because everyone is not on the same page. "In the absence of regulation and it being mandated, there will be inconsistencies," Oliver Hanmer, managing director of the U.K. financial crime compliance advisory practice at Capgemini, told American Banker.
The U.K.'s confirmation-of-payee rules have been in place since 2020, and they're effective, Hanmer said. The EU, meanwhile, adopted a similar verification scheme last October, with implementation dates scheduled this week for Payment Service Providers operating in the Eurozone and in 2027 for providers in EU member states.
In the U.S., however, such rules are voluntary, and market operators are starting to act on their own. The Fed offers a Payee Name Verification service, and since April, early adopters on FedNow can pull network data on a receiving account before they send, according to a spokesperson for ACI Worldwide.
Also, two Nacha rule changes took effect this year that apply directly to businesses that collect payments by ACH or eCheck. Since June 19, every non-consumer ACH originator has to run risk-based fraud monitoring on the entries it originates, regardless of how much volume it does. And since March 20, consumer e-commerce debits for goods have to carry the company entry description "PURCHASE."
States are also stepping in. Georgia enacted a law, for instance, that allows banks to delay a transaction for suspected financial exploitation of a customer 65 or older while they investigate. On an instant rail, that hold only works before the payment is sent, the ACI spokesperson said.
Dynamic risk profiling is gaining steam
Beyond basic verification, banks are increasingly turning to dynamic risk profiling of customers before a payment goes through. Multiple vendors have products to help banks with dynamic risk profiling, including Fenergo, Quantexa, and Feedzai.
Dynamic risk profiling uses AI, machine learning, and behavioral analytics to detect anomalies in real time rather than banks' traditional use of static, point-in-time assessments. Is it the first payment? Is it unusually large against the pattern? Is the customer suddenly moving large amounts of money? Using technology, banks can slow down payments where there's a concern, Hanmer told American Banker. However, for greater effectiveness, more banks need to use the available technology to help detect fraud.
Verification is the beginning, not the end of fraud protection
While it would be ideal for more banks to get on the verification bandwagon, effective fraud control is more complicated. "It's one piece of information, but it's not the be-all and end-all in fraud strategies," said Marc Trepanier, director of analytics and optimization for fraud and financial crime at ACI Worldwide.
For instance, a recent survey by the Federal Reserve found that mule (money laundering) account detection is still largely manual, with many financial institutions discovering issues only after experiencing losses or external alerts. The survey of more than 400 institutions found that 71% of institutions rely on manual review, and less than half use automation, which can lead to delayed identification. A notable 53% of respondents said they learned about mule activity from another financial institution, and 49% said they discovered it after losses occurred.
Finding the right balance
For banks, it's a matter of finding the right balance between friction customers experience and the need to keep payments and their money safe. "It's about how you introduce additional layers of financial crime control, and therefore potentially slow down the payments process, but still maximize the customer experience," Hanmer told American Banker.
That trade-off is an increasing challenge as fraudsters become more sophisticated amid instant payments. The firms that strike the balance well will have a competitive advantage, he said.
In the U.K., for instance, Revolut, Monzo and Starling Bank have taken a more progressive approach to financial crime, embedding it within the customer experience, Hanmer said. Even so, these banks, and others, are still playing catch-up, with regulators actively involved in ensuring appropriate fraud controls.