I have already commented on “secret questions” as the root of all evil when considering tools to reduce identity theft and minimize fraud losses. No, I’m not quite ready to jump off that soapbox….not just yet, not when we’re deep into the season of holiday deals, steals and fraud. The answers to secret questions are easily guessed, easily researched, or easily forgotten. Is this the kind of security you want standing between your account and a fraudster during the busiest shopping time of the year?
There is plenty of research demonstrating that fraud rates spike during the holiday season. There is also plenty of research to demonstrate that fraudsters perpetrate account takeover by changing the pin, address, or e-mail address of an account – activities that could be considered risky behavior in decisioning strategies. So, what is the best approach to identity theft red flags and fraud account management? A risk based authentication approach, of course!
Knowledge Based Authentication (KBA) provides strong authentication and can be a part of a multifactor authentication environment without a negative impact on the consumer experience, if the purpose is explained to the consumer. Let’s say a fraudster is trying to change the pin or e-mail address of an account. When one of these risky behaviors is initiated, a Knowledge Based Authentication session begins. To help minimize fraud, the action is prevented if the KBA session is failed. Using this same logic, it is possible to apply a risk based authentication approach to overall account management at many points of the lifecycle:
• Account funding
• Account information change (pin, e-mail, address, etc.)
• Transfers or wires
• Requests for line/limit increase
• Payments
• Unusual account activity
• Authentication before engaging with a fraud alert representative
Depending on the risk management strategy, additional methods may be combined with KBA; such as IVR or out-of-band authentication, and follow-up contact via e-mail, telephone or postal mail. Of course, all of this ties in with what we would consider to be a comprehensive Red Flag Rules program.
Risk based authentication, as part of a fraud account management strategy, is one of the best ways we know to ensure that customers aren’t left singing, “On the first day of Christmas, the fraudster stole from me…”
