Scammers Now Trick You Into Approving the Payment Yourself

Strong security checks do not stop a scam if you are the one who approves the payment. Stephen Bowe, chief product officer at Paymentology, told PYMNTS that a bank can verify the right person is making a payment and still send money exactly where a criminal wants it to go.

What changed

Biometrics, chip and PIN cards and extra authentication steps have made stolen card details harder to use. Criminals adapted. Instead of breaking in, they now persuade real customers to approve payments, or they build identities that banks accept as genuine. In the first case, the customer supplies the approval. In the second, the deception starts before the bank knows who its customer is.

Fake identities and polished messages

Artificial intelligence helps with both. Bowe described false digital identities assembled from information gathered from several sources. Some stay unnoticed for long periods before criminals use them. Signing up remotely makes it harder to judge who is behind an application. Once a bank accepts a fake identity, later checks only confirm that same false identity.

Scam messages have improved too. "They're not full of spelling mistakes," Bowe said. "They're beautifully crafted emails." They work by playing on trust and emotion. A customer who believes the request is real can complete every security step, leaving the bank with an approved payment and a deceived account holder.

What banks can do

Bowe argued that banks should look beyond the moment money moves. Their ideas include:

• Monitor the entire customer relationship, not just single transactions.
• Use behavioral analytics that combine several sources of evidence.
• Show a simple recipient match check before money is sent.
• Use payment tokens, which are stand-ins for real card details, tied to one merchant, device or purchase.

The recipient check is called confirmation of payee. It tells you whether the person you meant to pay matches the account. A token limited to one purchase cannot be reused elsewhere if it is stolen.

Looking ahead

Bowe also pointed to payments made by software agents acting for customers. In his picture, your agent would check whether another agent can be trusted before a payment goes through. For you today, the lesson is simple. If a message pushes you to send money, check the recipient yourself, because your own approval will not protect you.