Transcript: Trust in the Fight Against Fraud and Scams

00:00 Dave: Hello and welcome to episode three of the Australian Payments Plus Point of View podcast, in which we examine the theme of trust from all angles. Today, we'll be examining the crucial topic of trust in the fight against fraud and scams. I'm your host, Dave Ellett, Chief Commercial Officer at AP+ and joining me today is Ben Young and Katrina Stuart. Ben is Head of Fraud Prevention at Westpac, and his team researches and operates Westpac's key fraud prevention processes for the circa 25 million transactions processed every day by the bank. Ben has been intimately involved in Westpac's fraud processes since 2007, and has worked in various data-led risk processes since 1997. 

Katrina works for AP+ as Executive Sponsor for the Industries Programme, work focusing on modernising Australia's payments and migrating payments to the MPP. Prior to the formation of Australian Payments Plus, Katrina was Head of Engagement at MPP Australia, working with financial institutions and FinTechs to grow volumes and services on the MPP. Ben, Katrina, welcome to the AP+ Point of View.

01:14 Ben: Thanks for having us.

01:15 Dave: Firstly, Ben, if we look at the data, Australians have lost more than $2.7 billion to scams in 2023. Aside from financial loss, what are the other costs of scams to those impacted and how does this impact trust?

01:31 Ben: Yeah, look, it's a big number. It's a very scary number. I think in addition to the financial impact, there is an impact on trust. So I feel like trust in the digital world is pretty rock bottom right now. I know that sounds a bit negative. But look, and it sort of should be, you've got things like telephony mistrust. Frankly, I don't take calls from numbers I don't know anymore.

And I miss personal calls. I miss work calls because of it. So I pay a price for that. And there's just an economic impact of that. So, I think there's definitely a reduction in trust. There's also just more friction that has to be brought in. And you can see there's restrictions these days, more restrictions than there was, and things like on crypto, large payments, and real time, generally, the notion of just meeting a random person in the street to buy a secondhand car, which is one of the big use cases.  And I'll just give you the keys, you give me the money, like that is still somewhat challenging to achieve because of the risk of the scams that sit out there.

02:22 Dave: Yeah. I mean, as you say, 2.7 billion is a huge number. But actually, when you look at that year on year, it's a 13% decline based on the numbers published by the ICCC. Does this suggest that we're doing a better job as an industry to prevent scams? How are you thinking about that?

02:38 Ben: It is. I'm not sure how much of an impact it is having on... I think people are more aware of scams, and I think banks are better at stopping scams, but the evolution of scams is so rapid that sometimes you're just treading water on some aspects of it. At the moment, it feels like we're winning, definitely a decrease, and in fact we're measuring an even larger decrease than that. Cryptocurrency restrictions are a big part of that improvement. 

But yeah, I think the general awareness of people in the population about scams, the idea of sending money to Nigeria because you've won the lottery there. Most people laugh at that these days and not too many people fall for scams like that. Unfortunately, scams are just way more sophisticated than that these days. But people are just coming along on that journey about keeping pace with what more things you need to be careful about.

03:23 Katrina: And I think to that point, Ben, I think as you mentioned earlier, customers are changing their behavior in terms of to try and avoid scams and protect themselves. So people don't react to those technical issues, they don't react to the emails and they're becoming a lot more circumspect when some of these requests come through. But it is a kind of constant evolution in terms of we see scams just move to a different type of scam. And I think, you know, particularly as the technology evolves and we start to see fake scams and other activity occur, how do we protect ourselves against that?

03:50 Dave: Yeah, I mean, I think that's my observation from a consumer perspective. Awareness is definitely much better, but we always feel like we're behind. And I think that's the thing. We don't know what we don't know. And so you don't know how big the next scam case will be. And I think that's something as an industry, we're obviously trying to work again. So and just on that point, you know, scams is clearly an Australia-wide issue and it feels much more like it's a Team Australia approach to dealing with this. 

So what are some of the things, Ben, that the major banks doing and particularly Westpac and how are you kind of getting together to combat scams and fraud?

04:21 Ben: There is lots of collaborative work that banks do together, but even on their own, banks are doing a lot around things like confirmation of pay, biometrics, there's a lot of inbound monitoring these days as well. You've probably seen a lot of banks are working on trying to find better, safer communication channels between us and our customers, and frankly, just increasing the size of the teams whose job it is to prevent this because it's just the nature of the problem, and probably delaying a few more payments along the way, hopefully judiciously, but all of those things are part of the scam prevention processes.

04:54 Katrina: And I think one of Australia's kind of success stories has been how, as a market, we brought together different players in the ecosystem and acknowledging the role that each of those need to play in helping to prevent scams as well. So, the involvement of the telecommunication carriers, for example, and others, I think has been one of the success stories for the Australian market that, you know, certainly we hear from other markets, they're looking to Australia as an example of how collectively to come together to combat scams.

05:20 Dave: Yeah, I mean, it really is a global issue, right? Australia has been impacted, but if you look to other markets, it kind of just moves around to the kind of where the sort of worst sort of protections are from a consumer perspective. There's been recent research in the new national polling from Essential Research, which reveals nine out of 10 Australians believe that scams are becoming more sophisticated and that anyone and everyone can become a victim. 

More than 75% believe that if the law forced banks to reimburse, it would be a good incentive for banks to improve their technology to prevent scams. Obviously, there's been moves in the UK to make this happen and make banks liable for some of those customer losses. So, I guess the question there is, should we be thinking about something like that in Australia?

06:04 Ben: Look, I think just a couple of things on that. One is, just to be clear, just from definitional stuff, fraud is when someone breaks into your account and sort of steals your money, essentially. A scam is when you willingly give away your money after being lied to. So sometimes in phrases like keeping our money safe can be a little bit unclear as to which of those two things you're talking about. So, I think surveys, the wording is everything, so I'd need to see specific language about what questions were asked. 

Certainly, the experiences we've had is that most people think that you do need some level of consumer contribution to decisions that they've made with investments. That's not to say banks don't play a huge role, they do, as well as telecommunications, social media, and all those other platforms. But there are circumstances where banks will intervene on payments, will alert on payments, and have conversations, and customers are very, very adamant.

06:50 And there is a legal obligation to follow customers' obligations. There's also a lot of scams occur in ways that banks cannot detect. And it's difficult for banks to say, tell me about your girlfriend, how long have you known this woman for, is she living with you? These are questions people do not expect to get from their banks, and I think that's reasonable. And there are scams where that's the level of intervention in someone's life you need to try to achieve to fight it.

So it's very difficult for banks to hold responsibility for all of those things. But there are places where we can play, where we can add real value. And we do try to do that. And we're trying to do more of that all the time. Just on the UK thing, there's probably a couple of points about the UK reimbursement model that get glossed over a little bit. The UK reimbursement model is not the sort of universal reimburser.

07:31 The UK model has to be a domestic payment. For example, the Nigerian lottery example I gave before, that's not covered by the UK model, nor are payments to crypto, nor is it for businesses and so forth. So in Australia, where banks do reimburse scam victims, where there's been a contribution, those are not omissions in the Australian reimbursement world. You would get reimbursed for an international payment just as readily as you would for a domestic payment. There's just a slightly different emphasis about customer contribution.

07:58 Katrina: And I think it's also interesting to see how the UK is also evolving their framework as well. So actually moving to making both the sending financial institution and the receiving one kind of jointly liable as well, because what they found is actually it needs to be the right balance and you need to incentivize all of the participants in the ecosystem to do what they can to help prevent scams.

08:18 Dave: There's a liability framework, but as we were discussing earlier, there's also, to your point Ben, there's the consumer awareness piece and trying to actually stop the prevention of the scam in the first place. And I know Westpac and you personally have kind of been doing a lot of videos around that. I'm just interested, how have you found that and how has that resonated with the consumers?

08:35 Ben: Look, it's an interesting part of my role these days. I mean, education awareness is a big part of it. There are some scams that are easier to educate on than others. Things like the "Hey, Mom" scam or we were just chatting earlier about the random text messages that we all get every day about road tolls and grocery store points and things. Education on those can be very, very powerful. If someone's – or if they're unaware of it, you can convert someone.

We use this phrase convert someone out of it if someone's got a text message that they think is from their son or daughter by the "Hey, Mom" scam. If you point this out to them, the fog can be lifted very quickly whereas romance scams and investment scams, that is harder because this thing could have gone on for many, many months and even family members can't talk you out of it. But, education awareness plays a role in all of those things. Definitely a lot of that education happens in the moment, in the moment of the payment.

09:25 But, proactive education on some of those more universal ones can be good. You can send it out to as many people as care to engage with it. I don't know how many people want to watch videos from their bank, but we try to make them as engaging as we can and as universal as we can. There's scams about buying shipping containers, which we probably won't do a video about because it's such a rare purchase and that applies to such a small proportion of people. But investment scams, remote access scams, hey mom scams, these sorts of things I think are worthy of sort of more broadcast style proactive education.

09:58 Katrina: And I think certainly, I think we've noticed in the media as well over the last sort of year or two, there's been much more talk about scams and I think people are more willing to come forward and talk about their experiences, which really benefits everybody to really kind of understand some of that and learn from that, which helps customers to then protect themselves.

10:14 Ben: The customer stories of scams, I mean, some people are quite embarrassed about scams, but like you say, they're really powerful. If you can have it as a real example of what I fell for or nearly fell for, it can be so much more powerful than just the generic, this is what tends to happen. We still do it, but customer stories are, as you say, so much more powerful.

10:29 Dave: Yeah, I mean, some really, really bad stories as well of people losing all their life savings and you spent all your life doing that and then you lose it all. And at that question, I think, you know, we talked about 2.7 billion, it's a huge number, but that's only the reported scams. Imagine how big that number really is because I'm sure there's people who are quite embarrassed to kind of, you know, offer up kind of the impact to them. 

So, I do think we as an industry need to keep focusing on that and hopefully get more people reporting so we really truly understand the extent of it. So, a question for both of you, the Albanese government is soon planning to introduce some scam legislation into Parliament. which will set a very high bar for banks and companies to prevent scams. What can we expect? And are there any learnings from other markets?

11:10 Katrina: I think we're still waiting to see the detail of what those likely laws will be. I think certainly the government is signalling that more needs to be done. I think collectively everybody recognises that fraud and scams is such an issue that requires ongoing attention and focus.

And I don't think we'll ever be in a place where we can say we're done and dusted as it relates to that. It is a kind of constant battle that we all need to continue to fight. There has been some talk about liability and potentially does that kind of shift to the financial institutions, potentially will there be non-compliance fines and other things that come into effect? But I think we're still waiting to see the actual detail of that legislation that's being proposed in terms of what that's going to mean for banks and the ecosystem.

11:52 Ben: Yeah, I'm a bit nervous to make predictions, but yes, I feel like confirmation of payee is pretty much we know that that's on the radar and everyone's working really fast on that, which is great. I'm sure there will be obligations around sort of credible monitoring, which again, a lot of institutions do, but I think across the broader ecosystem, you have to have sort of proactive, credible monitoring. 

And I know that's a bit of a, can be a spectrum, but there's obviously a lot of big emphasis on that. I think, frankly, from the conversations I have worldwide, I think the Albanese government will be the heroes of regulators worldwide if they can find a regime that does allow all the participating parts of the ecosystem to have to step up to that table in terms of obligations and or some type of reimbursement. And I think, as alluded to on the UK side, I think some greater emphasis on the receiving bank is very likely to become part of that.

12:39 Katrina: I think what's interesting about what has been talked about is the recognition by the government that it does need to be all of ecosystem. It's not just a responsibility of the banks to kind of protect customers, but the role that others can play in that as well, and that they need to take some of that responsibility.

12:53 Dave: And there's clearly a lot of coordination going on, as you said, Ben, in Australia, and we've talked a bit about the UK example, but is there any other countries that you kind of coordinate with to kind of learn from as it relates to frauds and scam?

13:04 Ben: Working in the fraud department of a bank is kind of fun in that regard. You've got a lot of friends all around the world. You can go to any fraud shop. 

13:10 Dave: They want to take your call. 

13:11 Ben: Well, they will, and it's a place where you're not that competitive. We're obviously proud of what we do, but you know you have a shared enemy and you have a shared goal. And so it's really wonderful that you can collaborate specifically on intelligence and so forth, but just stylistically and understand what's happening. So yeah, we talk to banks all around the world. 

I talk to UK banks very frequently. I think the English-speaking world just has some unique problems that even, you know, very modern wealthy democracies like, you know, Denmark don't have to worry about as much. I mean, Denmark still has a scam problem, but the fact that they don't speak the language that a lot of the scammers know this works well in. So, we definitely see some unique scam trends that frankly get migrated to us from the UK, but apply very well in any of the Western English-speaking worlds.

13:58 Dave: So, question for you Katrina, obviously real-time payments here at AP+ is a big thing and it's great for efficiency, but it can make it hard to stop fraudulent transactions. There's new prospective regulation in the UK which will enable banks and other payment providers to delay payments by up to four days. How should Australia be thinking about this issue? And should we be looking at something similar?

14:19 Katrina: I mean, I think there are a lot of benefits of real-time payments and customers have come to expect that when they do make a payment, the funds are gonna go through in real time and be made available on their account. I think there is a recognition that friction in certain circumstances does need to occur in the payment flow. 

I think the question is, where is it most appropriate to happen? Is it actually before that payment gets submitted to be processed? Is it actions that can be taken by the banks to verify with the customer that indeed they wanna make that payment? And I think to what Ben was talking about earlier in terms of can you convert them at that point as well to prevent them from making some of those payments rather than do we have a kind of arbitrary delay in the payments in terms of the funds going through? 

15:04 Because I think it's also important to acknowledge that there are many cases when actually being able to send a payment in real time has huge benefit when it's the government sending out a disaster relief payment to a citizen in the time of need or somebody wanting to get access to their salary that they've earned so that they can basically pay for an unexpected cost that's incurred because their house is flooded, for example. And I think it's really about where is it appropriate to have that friction? And we do allow for, if there is concern over a payment that it is basically being able to be treated separately and looked at and analysed further to understand, do we think that fraud or scams are occurring?

15:44 Dave: Particularly from a consumer perspective, I think most consumers would be happy with a bit of friction in that transaction flows, particularly if there's a lot of money they're paying. I just think about as a consumer, if I was paying for a holiday that's $10,000, even if that took like 20 minutes for the payment to go through, I think that'd be something I'd be happy to do if it was protecting me and my money.

16:04 Ben: Yeah, I totally agree. I feel like the delays in themselves don't give you a lot of extra scam uplift unless you're doing something with that time. If you're talking to the customer, providing education, just delays for the sake of delays don't actually help us control scam. We've played around a lot with delays.

You get this a lot. People go, why don't we just delay all large payments for like four days or something. Most of our victims for scams don't discover it for 30 days. For investment scams, it's closer to 60 days. Delaying it for three or four hours...

16:30 Dave: Four days isn't going to make a difference.

16:32 Ben: Yeah. Unless you're doing something with that time. In fact, the reason they notice it is because they couldn't get the money out. So if you haven't put the money in, they wouldn't have noticed that they couldn't get it out. So yeah, don't get me wrong. We use delays. Delays are very important and they're a big part of the armory, but it has to be judicious delays and you have to be doing something with that time. And you can't do that if you delay every single payment because whatever you're doing will then produce some sort of very blanket approach.

16:51 Katrina: And I think the question is, are there more effective strategies and actions that can be taken before the payment actually gets made that will be more effective to help. So, validating with the customer, step up verification and other practices that the banks can adopt. I think as well as customers, particularly if they're being scammed into making a payment quickly, taking time to think about that as well in terms of why do I need to make that payment.

17:18 Ben: Absolutely. I think it's worth saying that there are banks that don't have real-time payments that don't subscribe to MPP. They still have a scam problem. It's not like they're immune from scams. So it does require you to have a good real-time fraud system to allow you to just pull out the needle in a haystack. But doing it through a fraud system that delays some payments is the way to go.

17:35 Dave: Yes, Ben, in November last year, the major Australian banks signed up to the ScamSafe Accord. Can you tell us a bit about how that's impacted the work you do at Westpac?

17:45 Ben: The Accord is actually really quite powerful, you know, six key obligations on banks. For a bank like Westpac, we're sort of largely compliant with most of it already, but even we have some work to do. The two big ones for me are really about the biometric, collecting a biometric for digitally onboarded customers and confirmation to payee, obviously both of those things are big pieces of work. We've asked customers to provide us, you know, selfies for many years. 

But, you know, the ABA scams are covered. We're rolling this out for everyone, which is a big uplift and I think is actually good progress for the industry. And confirmation of payee, while some banks like Westpac have had a version of this in place behind the scenes and overtly for a long time. Confirmation of payee just brings everyone up to that same standard and it will be both those things are quite meaningful and powerful improvements in scam management.

18:29 Katrina: I mean certainly from our perspective at AP+, developing an industry-wide solution for confirmation of payee we see as being a kind of critical way that we can help protect customers and businesses and others from scams and that's why we've announced that we're working to develop that solution that will start to roll out in 2025. 

But I think also looking at more broadly how can that capability be extended to not just say for you know payments that I'm making as a customer, but also how can it be extended to you know business payments or government payments as well and actually start to build in some of that protection for all payment types that we see here in Australia. 

19:05 And certainly what we know from in our experience with PayID is that when I actually can validate the person that I'm paying is the right one, not only will it help for things like you know payment misdirection scams, but also mistaken payments as well when I've actually you know inadvertently put in the wrong details and I'm about to pay the wrong person, but I don't have visibility to that at the moment when I'm using a BSPN account number to make a payment.

19:27 Dave: So, maybe you could expand a little bit on that, Katrina, as you said we've recently announced the confirmation of payee solution. I know it's been in the UK for I think five years they've had that solution and just recently it's gone over two billion verifications so it's obviously being used a lot. Talk a little bit maybe a bit more about the problem it's solving and kind of where we're up to in that kind of build phase.

19:47 Katrina: So, I think as an industry we recognise that having confirmation of payee was an important part of the kind of collective arsenal that we have to help protect customers and we do have PayID, you know, one of the challenges there has been that it requires customers to opt in and register a PayID link that to their bank account. 

With the confirmation of payee service what we are looking to do is provide that confirmation that I'm paying the right person on all payments that I'm making and give an indication to customers if there's a name match or do the account details not match before they make a payment. 

20:21 So, we see it as being a really kind of important capability, but also doing it industry wide and actually involving all of our participating organisations in the development of that capability so that even smaller institutions, you know, like our building society and credit union partners can participate in that as well. And also looking to see how do we extend that capability for all accounts within the Australian market as well so that we actually have an industry wide solution because as we know fraud and scams will just migrate to where the weakest links are and where the vulnerabilities are in the system.

20:52 Dave: Ben, how do you think about that? Obviously, as you said, Westpac's had its own sort of version of confirmation pay, kind of how do you think about the industry role and Westpac's view of that?

21:01 Ben: Yeah. Look, I think that notion I mentioned earlier about just digital trust in the modern world, I think this is a really good step towards making sure we're playing our part in that when people say, the money went to who you said you wanted it to go to. The name hasn't historically been validated, but that point of confusion has caused a lot of pain for customers. I've heard complaints, people say, why do you collect the name if you don't validate it? 

That's a fair question. Obviously, your bank statements would look very bland if they just had BSB and account numbers on them. To a certain degree, names have been collected for labeling of who you thought you were paying. To validate that name, obviously, your sending bank doesn't have records of the other bank's customers.

21:41 It was obviously, if you think about it, it would have been difficult for your bank to do it. It would have to have been done on the receiving party. The receiving party, I can tell you that most payments, the name is wrong. Most people don't have the exact strict legal name. If you rejected every payment where it wasn't exactly letter for letter, word for word what the name was, the economy would grind to a halt.

There will always need to be some level of flex about how close a match it needs to be. But I think saying that you give us this BSB, this account, and this name, and the payment will go to that exact thing, or you'll be very clear that it's not a name match, just helps really rebuild that element of trust. It's not the end all be all of scams. It's not like scams will go to zero. Clearly scams are not zero in the UK, but it's a big way of just improving that level of trust. It just cuts out one version of the way that these scams can be pulled off.

22:28 Katrina: I think just knowing that is the name an exact match, or is it a partial match, or actually no match at all, really helps customers to think about whether they want to proceed with that payment. I think it's just another kind of check in that process that's going to be important in helping to protect customers.

22:46 Dave: I mean, as you say, as you come back to the theme of trust, there are things like the confirmation of pay solution where we're giving the industry and therefore consumers more insights into who they're paying. I just think that helps build trust. And I think that's an example. And hopefully there'll be other ones that the industry kind of develops in the future. So, as we look to the future, what other things could or should we be thinking about as we think about combating fraud and scams?

23:10 Katrina: I think certainly as our different strategies evolve, we'll start to see the role of data become much more important in terms of how we think about preventing fraud and scams and how additional data variables can feed into kind of the bank's fraud decisioning and capabilities. 

So, if we can incorporate not just what is the name match on an account, but also information related to that account in terms of the kind of transaction history that we've seen or how recently was that account opened, that smarter decisions can be made.

23:43 And certainly, I think we're seeing from other markets as well, everybody seems to be looking at the role that data will play in helping to combat fraud and scams, and I think that's going to become increasingly important.

23:53 Ben: Yeah, totally agree. I mean, our fraud shop is full of mathematicians. It's a very data-heavy business. It's what we do. It's how you find that needle in the haystack within your own data, but there is also organized structural sharing of data between organizations, not just on a payment, but also on fraud rails. I think clearly the offenders are going to move into the future and absorb all the new technology and data they can, and things like AI just open up a whole array of toolbox of new things that they can use. 

So, we need to be doing that too in terms of just using the data for scam fighting. I also think the trusted communication channels will be a big part of that for us. You might have seen the Westpac, we've made an announcement around finding a way to make sure that when we call a customer, it's unequivocal that this is definitely us, and we know it's definitely you.

24:36 Those sorts of ways help to smooth the conversation and drive huge efficiency for our customers and for us, but make it far more likely that they can avoid scams and impersonations.

24:45 Dave: So that's things like verifying in the app as you're making a call and stuff like that.

24:49 Ben: Yeah, that's right. And doing things like replacing SMSs with pushes and stuff like that. So communication channels that are more trusted by the customer.

24:56 Dave: Yeah, so it's not just like the new scam comes up, we're trying to work to fix that. It's actually preventative stuff to protect against existing scams and future scams as well. So both of those. One last question for both of you. So what does trust mean to you personally?

25:09 Ben: Well, I think what we just talked about is a good example of it. I think there are some concepts out there, like one of the other issues that's very topical for us in scam management at the moment around telecommunications is things like alpha tags and spoofing of phone numbers. That's been around since mobile phones were sort of invented, but it wasn't largely a problem. It wasn't exploited to any great degree, but that's because text messages cost 10 cents to send them. 

It doesn't cost that anymore. Telephony is essentially free now, so suddenly alpha tag spoofing has become now a major problem and a major scam vector, and so we need a solution to that problem. Things like aliasing concepts, in a digital world where you're not physically face-to-face with some of these people, the idea of aliases you have to treat very, very carefully. For pay IDs and so forth, we're very careful about the pay ID has to be a fair alias.

25:57 The idea that you can make a phone call come from one number, but make it appear that it's come from a completely different number, those things are not helpful in the modern digital world where you're trying to rebuild trust. Some of those concepts are really important about just transparency of telecommunications or payments. More difficult in social media, because we've obviously got this world where we've gone from trusted fact-checking broadcast media to platforms that don't moderate content nearly to the same degree. 

That is a tougher nut to crack, and that's why there's justifiably sort of fairly low trust of a lot of the content that you see there, but it is how a lot of people get their information.

26:34 Dave: Yeah. A lot of the scams are coming from social media, aren't they?

26:36 Ben: Absolutely. Yeah, absolutely, they are. We see lots of false advertisements for individual products, but also like investment scams particularly, and a large number of people get their information and news and advertising from those platforms.

26:49 Katrina: I mean, certainly for me, it's about having the confidence and kind of assurance about how I kind of conduct my life in what is increasingly a digital world, when you don't actually have the luxury of being sort of face to face with someone and knowing that, you know, who you're interacting with is the person you think it is. And knowing that I have confidence to be able to conduct daily transactions in a digital world.

27:13 Dave: Ben, Katrina, thank you very much for joining me on the journey through the world of trust in relation to fraud and scams. I know our listeners will gain valuable insights into the latest thinking and developments from your perspective. So thanks very much.

27:25 Ben: My pleasure.

27:26 Katrina: Thanks, Dave.

27:30 Dave: Thank you for listening to the AP+ Point of View podcast. Be sure to share it with your colleagues. For more information and the latest news and views from Australian Payments Plus, visit www.auspayplus.com.au and follow us on LinkedIn.