As an educator and consultant in Jack Henry's Financial Crimes Division, I engage a considerable number of customer questions related to our AML and fraud detection products. A question that has become more common recently is, "When reporting P2P fraud, how can I be more confident that I am accurately designating it as 1st party fraud, 3rd party fraud, or scam?"
Accuracy in P2P payment fraud reporting is important. The lines of differentiation between 1st party/3rd party fraud and scams can sometimes be subtle and nuanced, and some financial institutions have expressed the need for a clearer method of interpretation. The following information hopefully provides some helpful instructional scaffolding.
Let's start by defining the three P2P payment fraud types:
First-Party Fraud - An authorized payment conducted with the intent of directly deceiving the financial institution.
Third-Party Fraud - An unauthorized payment resulting from the unapproved use of customer information.
Scam - An authorized payment resulting from the customer being deceived or manipulated.
When evaluating P2P fraud, the first thing to discover is whether the payment was authorized or unauthorized. This is one of the primary differences between the fraud categories.
If the payment was unauthorized, I could eliminate 1st party or scam, as unauthorized payments are always classified as 3rd party fraud. For example, consider account takeovers. The victim suddenly realizes that money is missing from their account and has no idea how it happened. The victim might not even use faster payments, but in reviewing their account, they notice that an unrecognized email address was added to their online profile so no notification of payment was sent to them.
If the payment was authorized, this is always classified as 1st party fraud or a scam. This can sometimes be difficult to discern because, with 1st party fraud, the alleged victim is trying to deceive the financial institution. For example, the fraud claimant enables a cohort to move funds from their account and then claims that they were scammed or that an unauthorized transaction has occurred. Once the reimbursement is received from the financial institution, the customer asks their partner in crime for the initial funds, doubling their money. Then the claimant’s cohort presumably gets a reward for assisting with the scheme. Another example is that the accountholder buys a TV and then tells the FI the transaction is fraud.
It can be difficult to prove that the fraud claimant is perpetrating a scam against the financial institution, which is what makes it 1st party fraud. Until this is confirmed, the fraud typically must be classified at face value as 3rd party fraud or scam.
Scams always involve authorized payments resulting from deception and/or manipulation of the customer. There is a wide array of scam types, but the key to understanding scams is that the payment was authorized, but the victim was deceived about who they were dealing with and deceived about the nature of service or item for the payment they made. For example, a consumer receives a phone call or a text message claiming to be from their financial institution. Because the contact expresses urgency and often includes personal information only a financial institution representative should know, the customer cooperates by moving their funds to an alleged “safe account” a.k.a. fraudster’s mule or drop account.
Social engineering schemes can sometimes introduce subtleties, but there are simple tactics for thinking them through. For example, the victim receives an urgent call from their bank. The representative states that they need to ensure that the customer's personal information was not compromised in a recent data breach. To verify that the account was not impacted, the victim is asked to sign in using a link sent to their cell phone. The victim complies and the representative indicates that the account is fine. The victim later discovers that $500 is missing from their account.
Is this 3rd party fraud or a scam? It looks a lot like a scam, but it was actually 3rd party fraud. In this case, the victim was manipulated, but they did not authorize any payment.
In summary, make the following evaluations during your fraud intake:
- Does the claim involve an unauthorized payment? If yes, this is 3rd party fraud.
- Does the claim involve an authorized payment? If yes, this Is 1st party fraud or a scam.
- If the authorized payment involves a customer being deceived, this is a scam.
- If the payment involves an attempt to deceive the customer into account information but the fraudster initiates the payment, it is 1st party fraud.
A noteworthy mistake often made during fraud reporting is worth mentioning, customer dissatisfaction or business disputes. One example, the customer purchased a service from a listed business. The service was performed, but the customer is not happy with it and reports that they were scammed. But they were not scammed, and no fraud has occurred. They are just experiencing buyer's remorse or paying for a service that did not meet their expectations.
A great way to help improve your accuracy in reporting is to develop an intake questionnaire that contains questions designed to help specify the kind of fraud being described.
Here are some examples of intake questions we have seen:
- Do you know the person or vendor you made the payment to?
- How was the payment conducted?
- How did you come across this vendor/recipient?
- What are the items or services that were supposed to be exchanged for the payment?
- Do you have any documentation (emails, receipts, etc) to support this claim?
The point of your intake questions should be to a) establish whether the payment was authorized or unauthorized and b) determine the nature of authorized payments. This can go a long way toward making some initial evaluations about which category the fraud falls into, and whether it even qualifies as fraud or scam at all.
With P2P services being newer to many financial institutions, it can take some time and experience to establish an intuitive sense of which category your P2P fraud claims fall into. But most financial institutions find that with a little extra attention, their ability to promptly and accurately categorize their fraud develops relatively quickly. Always keep in mind that accuracy in reporting has a direct benefit to you and your customers. You are also playing a meaningful role in exposing and frustrating P2P payment fraud across the entire network.
Are you prepared to combat rising financial crimes and fraud rates in the real-time digital world? Learn more. Or visit us at jackhenry.com for more resources about reducing risk.
.svg)
