Long Read: who are you dealing with?

Contributing Editor Allan Foad writes: In my day, all customer contact for a lending proposition would be face to face, maybe backed up with a telephone call or two but not before a relationship was established. 

Even when a loan or lease agreement was credit scored the form would be completed in the office, probably by a member of staff with the customer in front of them. On rare occasions the customer might have been a con artist but would have been known to the bank or leasing company for some time. 

Today, the bulk of credit transactions will be completed online with no human interaction. In many cases, meeting up with a customer is physically impossible because banks have withdrawn from many high streets and asset finance businesses operate from towns like Basingstoke or Bradford, to name two at random, with customers from all over the country. The problem is compounded by the need for speed and a seamless decision-making process making things as painless as possible for the customer.

Ever since e-commerce started thirty odd years ago, there has been a struggle to confirm the identity of counterparties, and fraudsters have exploited that weakness. Today AI is an ever-present part of our lives and makes it almost impossible to be sure that your counterparty is a genuine customer.

In the 1990’s, the only identification required was full name and address, and maybe date of birth. Today those details are held on a plethora of databases, many of which have been hacked or fraudulently sold and are available on the dark web, easily obtained my anyone intent on committing identity fraud.

To redress the weakness of this approach the next step was to ask for personal information that was not publicly available and presumed you were dealing with a genuine customer. Somewhere in the dark recesses of a database or two it is recorded that my childhood cat was called Tim and I went to King’s Road Junior School. That is now accessible information if you know where to look and is no longer a reliable identifier. If you start a relationship with a fraudster those details will be fictitious from the outset but known to the fraudster.

Know your customer rules came in and required photo identity – passport or driving licence – to identify the person, and a utility bill or similar to prove their address. Today, this information is capable of being fabricated. 

The strongest form of identification is biometric, meaning fingerprints, eyeballs or facial recognition but these are far from practicable for HP agreements and they can be faked. There was a time when a finger had to be cut off to provide a fingerprint but that is no longer necessary. AI is capable of replicating all of these features.  Don’t ask me how. 

It is ten years since anyone has come up with a more sophisticated means of identifying a counterparty in a way that can beat the fraudsters who are now fully conversant with the capabilities of AI. In short, AI can soak up personal data widely available on any number of databases. It can create a credible persona of just about anyone who has a digital footprint. Deepfake technology can put a facsimile into a Microsoft Teams meeting using audio, video and image manipulation and it is impossible to spot.  

All of this, I find scary and so I am always on the defensive. I have come to distrust all emails and phone calls unless I can verify the sender or caller. Last week I had an email from Roger Hill asking me to contact him. Who is Roger Hill? There was a time when I might have responded – now Roger Hill is consigned to Junk. And I am afraid I have no idea on how to improve on the methods of identification that we have at present, but it is dangerous to fully rely on any of them and, seemingly more expert brains than mine are similarly blank. 

All that said, a proposal has been put forward for identifying fraudulent activity and for cutting it off before it causes too much damage. In truth I find this idea a bit scary as well and am not sure it would work in practice, but it pitches AI against AI.

It starts from the hypothesis that we all have a digital financial footprint that can be tracked by drawing information from every electronic payment we make across every app or payment system we use. From this a transactional pattern will emerge that only AI can discern which shows our regular behaviour. Any irregular behaviour would be red flagged and transmit an alarm to trigger an investigation. To a limited extent this is what organisations like Experian already do. This would alert consumers and providers of finance to the possibility of fraud.  

The analysis would also pick up the IP address or phone number used to make to a payment or submit a request for funding. It would identify the number of applications coming from the same sources and these could be in their thousands if not millions.

I can see how this could work to combat fraud, but it smacks of Big Brother, and I wonder if it would comply with the data protection rules. It would also require the co-operation of every provider of finance in the market to share their data and would certainly need regulatory approval.

 I would love to return to a world where we revived in person, face to face contact, but I realise the toothpaste left this tube long ago and it will not go back in. E-commerce is here to stay and we cannot live without it, but it makes businesses very vulnerable to AI generated fraud. Supposedly, the cost of fraud is factored into the pricing of a product, but the price to the consumer would come down (or profits go up) if the level of fraud was to be forced down rather that allowed to rise.

Although I hate to admit it, I think the only way to achieve this is to set good AI against bad AI!  

* This is a shortened and edited version of the original article which appeared in issue 220 of Leasing World magazine *

Comment on this article