Digital security and fraud

Digital credit is subject – in a way that conventional lending is not – to the full range of security and fraud issues that affect the cybersphere. These continue to increase as smartphone and digital credit use grow. They include:

• Transaction (repayment) failure when the network is slow or down.
• Weakness and breaches of mobile app security
• Frauds by third parties such as unauthorized charges and misuse of client data.
• SIM swap fraud.
• Social engineering scams, e.g., phishing or spoofing (fake SMS or websites that mimic legit lenders’ sites to harvest personal data); smishing or vishing (phishing via text or voice call); and QR code or mobile app frauds that promise easy access to digital loans.
• Authorized push payment scams, i.e., when a fraudster tricks a consumer into sending money to a criminally controlled account, for example, to pay a loan application or processing fee.
• Identity frauds, where a criminal gains control of a consumer’s phone number or identity data through: SIM swaps; biometric identity frauds where a fraudster breaches data storage to obtain copies of a consumer’s biometric data (e.g., fingerprints, photos); or synthetic identity frauds where new identities are created by blending elements from different persons. Fraudsters can then obtain new digital loans, renew them, or increase their amount.¹

Recommendation: Regulators can combat cyber risks with tools including rules on customer due diligence, data protection and security standards applied to providers, institutional governance (e.g., risk management) standards, and penalties related to financial fraud and malpractice. Market monitoring can help financial authorities to detect significant risks or occurrences of digital credit-related fraud that can inform further development of regulations. It is also vital to secure the active cooperation of other authorities with jurisdiction over frauds – criminal investigators and prosecutors as well as data and ICT regulatory bodies.

The difficulty of holding fraudsters to account makes it critically important for authorities to collaborate in setting up mechanisms to mitigate the effects on consumers and to encourage digital lenders and other firms in the digital sphere to invest in fraud prevention. It should be a priority for financial regulatory and other cooperating agencies to stay up to date on digital loan-related fraud and other cybersecurity developments, strengthen staff training and recruitment, increase information exchange, and leverage initiatives (e.g., ICT authorities’ SIM registration and authentication).

Ensuring some recompense to fraud victims is important in building consumer trust. One component of this is framing rules to allocate legal and financial responsibility among digital lenders, third parties and customers for consumer losses due to fraud. These provisions typically appear in clauses that apply broadly to fraud, consumer protection, consumer finance, and electronic payments – the latter because digital credit-related frauds are perpetrated via electronic payment systems and the associated communications networks. Another aspect of fraud mitigation is to create a funding vehicle for victim compensation – a heavy lift for most resource-constrained countries.