As digital scams surge, who’s responsible?

Hey there, everybody, it's Mikayla. To close out the year, we're bringing you something a little different. Back at the beginning of the month, I was in London for the FT's Global Banking Summit. While I was there, I hosted a discussion on consumer protection in the digital age. From fishing attempts to the emotional manipulation of romance scams, the so-called social engineering tactics that scammers are using are becoming increasingly sophisticated. And all of that is raising serious liability questions. So who should be doing more? The banks, the regulators, social media companies. For this panel, I had a group of four great guests from around the industry. You'll be hearing from Carolina Garcis, she's the global head of financial crime risk at City. You'll also hear from the founder and CEO of Open Banking Excellence, Helen Child. Also my colleague, Elliot Smither, who's a production manager and chief sub-editor at the FT. And finally, Ethan Salatio, who's a director at KPMG, leading on fraud transformation. So now we're going to play an abridged version of that conversation for you right here. Enjoy! The pace at which fraudsters are developing new ways to scam people is evolving extremely fast. I should say that I've mentioned to several people that I'm moderating this panel today, and pretty much every person I've mentioned this to says, "Oh, I know someone who got scammed recently." So Elliot, you and I were talking about this before, and I'm wondering if you might be able to tell us just one anecdote that you heard recently about a situation like this just to kind of set the scene. Yeah, of course, I was actually hosting a panel at the wealth management summit the other day, another FT life event. And there was a panel, actually, I think the next panel, the next host, Martin Arnold, was host here. But there was this guy who was a former cyber criminal, turned kind of, you know, government advisor now in the host. And he showed this video that was posted on the dark web, and it was a live, deep fake video of, there was this lady who was talking to what she thought was a retired Asian dentist. But in real time, you could see behind this dentist was a West African criminal gang. And he was talking, and it was going live in real time through the voice of this Asian guy, and this lady was completely fooled by it, apparently she lost about 150 grand. And the scary thing was, this wasn't just an example of it. This was an ad on the dark web for criminal gangers to go and purchase a monthly subscription to this software. So the point is now that this stuff is out there. In the past, you had to be a digital wizard or a tech guru to do it. Now you can just buy off the shelf and run it from your phone. So I think the scams, maybe the same, they've always been romance scams or, you know, fishing scams or whatever. But the tech advances have been staggering, which mean that, you know, suddenly anyone can get involved. I don't think the penalties are that great. So, you know, it's just getting scarier and scarier. Well, so that kind of brings me to my first real question here, which is, so the surge in scams, fishing attacks, digital fraud, it's raising serious liability questions. So, should banks, regulators, fintechs, should they be doing more to protect consumers? Ethan, if you want to start us off? Yeah, absolutely. Well, I think, you know, just an acknowledgement that fraud represents 40% of all crime in the UK. So it's huge. And as early as the security referenced, we're seeing these emerging schemes where fraud is being purchased as a service. And these organised criminal groups are really organising themselves like business models, which is really quite frightening with an entire hierarchy and structure. And it's going to take us as a financial services industry to actually act like a network to bring down that criminal network activity. So that's, you know, my first key point. I think in terms of what more can be done there is obviously always more we can do. But a lot of good work is being done. And I think we just need to pause and reflect on that as well. And we've got the introduction of the payment service regulators mandatory investment scheme, which is now making no banks reimburse victims of fraud on a 50/50 liability basis from the sending and receiving bank. We've got the introduction of new pieces of legislation to hold organisations more to account. And we've got an increasing awareness where the financial services system are working with Scams Alliance. It was BBC Safe Scams Week last week and, you know, we saw programmes in terms of protecting Britain, rip off Britain, so a lot has been done. But I think for me, it's about lodging the ecosystem in its entirety and actually working from an end to end perspective, 70% of these Scams originate online. So it's not just incumbent on the financial services industry, but we need to also try and tackle fraud at source where it stems from and actually tackle it there so that it's not always, you know, at the end of the life cycle and of course, you know, where the force does cash out in the financial services. Yeah. So, in short, the answer is yes, should be done. Should be done. Yeah. Always more to be done. I'm in agreement with what Ethan is saying, because first and foremost, a fraud prevention and detection is not a point in time strategy, it's a continuum. We need to keep improving and as banks, we are doing that. I appreciate the perspective from the UK, however, fraud is borderless and I welcome your input on reflection on the ecosystem and how we need to tackle it from the end to end perspective. We banks only look at one part of the puzzle, right? And I do believe that we are focusing on the regulated segment, the one that possesses transparency and already has a cadence and certain control infrastructure, but SCAMs stemming from social engineering are in the trillions. And if I'm not mistaken, chain analysis issues, an estimate of 10 billion for SCAM, crypto SCAM invoices, right, that runs to the 10 billion in 24 alone. What's happening is that all of these transactions and the genesis, the starting point of fraud is happening away from that regulated ecosystem and that's where we also need to be looking into. I think that digital literacy is not where it should be, right? And there are many players that need to become more aware and more active in this space. There are payment systems outside of that regulation and there are market and industry participants outside that segment. And I think that those numbers corroborate that statement, so the ecosystem as a whole. Yeah. Well, Helen, I mean, what role do you think banks, regulators, fintechs, play in tackling SCAMs and what needs to change to improve that? Well, I think we're all unequivocally, it's a yes, it's a yes, to your question. Yes. To answer that, I'd go about to Caroline's point about it being an ecosystem play. So I've been involved in open banking since the get-go, since we launched it in the UK and the UK was the first to launch it. And I would like us to be the first in the world to put some systemic risk management in place and lead the world in that systemic risk management. So to answer your question, what does that mean? For the banks? Well, if you look at it as concentric circles, you've got the bank in the center of it, the regulated entity, then around that, you've got in the UK circa 300 regulated open banking entities. And then beyond that, it's unregulated and it's the Wild West. It really, really is. So the regulated entities will connect to an entity that aren't regulated and they will collect to other entities. So you get third, fourth and eighth degrees. Now everybody will come back to the bank. So it's creating an unsustainable liability model for the banks because right out there at the Wild West, you have a problem, you trust your bank, you're going to come right back through that ecosystem to your bank. Now that isn't encouraging the bank to invest more and more into the ecosystem for the xecosystem to grow. I'm not saying they're not investing, but to continue to invest at a sustainable rate. The cost of compliance for those fintechs, the regulated fintechs, is growing and growing and growing. And yet, once you get beyond those regulated borders, the ecosystem, we're not monitoring the health of the ecosystem. So there isn't an accreditation process in place. It's like an abtor. You book your holiday, you go for an abtor accredited supplier, a travel agent. There isn't an accreditation program. There isn't any real-time risk monitoring and there isn't any insurance-backed warranty. There's no underwriting. There's no insurance to the banks and the fintechs to underwrite that model. So what two years ago, I started working with a treasury and we got something in the Mountain House speech, which I'm really, really proud of, which is why I'm announcing it now. And I wanted to shift the dial in the industry that I'd help create. And I wanted to do that by making the liability more sustainable for the banks, first and foremost, because they will invest more into it and giving the fintechs more protection to encourage more innovation. And I'm now working or advising, OBE is a global advisory company on open banking, open finance, advising a company called Invalor. And we're working across the pond, so in their states and in Canada and in the UK with the banks across all the regulators to introduce exactly what this systemic governance, if you will, controls in the marketplace, that will help us to continue to grow. Because if just one more point on this, if you look at it, I'm normally on stage saying open banking, open finance, go over the hill, the growth director is like this. Of course it is. The flip side of that, as we all know in this industry, is risk. So we need to have an adult conversation in open banking, open finance, about managing the risk. And that's what we're doing. We're stepping up as regulators as fast as do. So yes, there's a problem, but we are coming to the market with some solutions. Does that answer your question? Yes. So keeping that in mind, I mean, what are some of the challenges that you see in getting the industry to, it sounds like collaboration, more collaboration and better is needed. What are the challenges to that and to getting the industry to invest more in more proactive fraud prevention measures, that sort of thing? Can I just say something? The reality is that fraudsters these days are also investing the time to build trust, to scum people. So there are other players out there, hidden, also earning the trust of the consumer, so that they can trick them. So that responsibility, that obligation is no longer sitting just with banks. To answer your question as to the challenges that we are seeing, I want to respond from a global bank perspective. Again, the UK has made tremendous efforts, and I think it is leading in the industry in its efforts to tackle and prevent fraud, but we operate in an international environment. And some of the challenges that we are seeing, together with the evolving nature of fraud and the use of technology, is also the rapid change of regulation. And with those changes, we also see a lot of a symmetry. When you finish implementing a regulation that is obviously challenging costly and trying to reconcile how you will play out a VCB, your international customers, then you have the next trend, right? Then the other thing that we are seeing in fraud is that the vast majority are happening through authorized mechanisms, so the client is authorizing that. So your detection infrastructure needs to change and needs to adapt to that trend. At the same time, when you assess what you are seeing in these new typologies, you realize that you are playing with a typical data, right? In former times, you just look at who the client is, moving from A to B, from B to C, right? But now you need to take into account other data factors like geolocations, IP addresses, telephone numbers, email addresses, looking at networks, looking at timing and certain patterns of behavioural patterns, and that all is creating a more complex environment. So our traditional investigators, there were specialists in a particular crime, they need to be more of generalists, think crime generalists. And another important point, and I think that Helen alluded to these briefly, they need to balance security and customer experience. We often have this challenge in that we don't want to introduce friction to the system. We are now faced with the challenge of processing transactions instantaneously, so they have to be good, cheap, transparent and secure, right? And just one other challenge that I will put out there, and again, we've been referring to it already, is the fact that transactions are now initiated through different platforms, locations, mobile phones, and all of that together is what we need to contend with. Do we want to? Do we have two years? We have no choice, but we need to put all of that together and make progress. Yeah. I mean, thinking about it that way, I mean, what role should regulators play in all of this? You mentioned that the UK has been getting more involved, but maybe thinking on this from a more global scale, Elliot, what are your thoughts? I think straight away, you need to have banks that have 24/7 fraud monitoring. I think that's something that maybe not all have, but I think you need to be put in place that that is expected. And I think a lot of problems I've heard happen at the onboarding or just after that process. I think you need to have like a multi-layer's of defense. It's not any more just biometric data or particular documents. There should be different levels that you have to go through to kind of side it out. And I'm sure we'll get onto it, but I think there's an awful lot of AI out there that can be used as to help fight this. The criminals are certainly using it. So I think perhaps regulators can sort of point people in the direction of how this could best be used, what's safe to use, and how you can work together. And I think mainly getting people to collaborate because you've got banks, you've got fintechs, you've got tech companies. And they don't necessarily want to put one to pull in the same direction, I think. The banks are involved certainly at one stage. And regulators are getting banks, you know, certainly in the UK to pay up, I think, cover H5,000 pounds worth of, you know, that's on the banks. But this stuff originates on social media, so I think there's a lot of it does. So I think that has to be a way to kind of get everyone singing from the same sheet. I think at some point banks have been seen as the gatekeepers of the payments system. I would like to see social media and marketplaces also play a role in gatekeeping. All engineering, as I said at the very beginning, has become the entry point for fraud and market places, the conduit or the vector that facilitates the selling of fraudulent products. And I think we have to accept the fact that today there is not just hacking of systems, they are hacking people. And I think they have a responsibility to also monitor that. I do believe their algorithms are very clever. And I think whenever I see all the things that pop up in my feeds, because I also use that and my 80-year-old mother is also being victim of the algorithm, they're very clever. And they know what I like and surely they figure out that I'm a dog lover. I get all of those feeds that I'm also interested in regulations. It's a weird combination of things that I've seen in my feed, but I think that they could be equally clever to look at what's being posted in there, fraud as a service, that we were referring to earlier. That's something that their algorithm can also look into, right? And that 24/7 detection capability, I see no reason why it could not be implemented there. It is about recognizing that the movement of funds is not exclusive anymore to just regulated financial institutions. You have these rewards or tips or stars or rubies or whatever. That has become a similar model and infrastructure to a payment service provider. It's a payment intermediary and we need to start recognizing that. All it today, they look like a bank account, but we are not calling that. We continue to focus on regulating institutions, what about regulating the activity. And if we took that approach, I think that there is a lot that can be done in here. Sorry, I get a lot of cases. Yeah. I get animated. Well, we've touched on this a little bit, but just to dig it more into AI and how that's playing a role in this discussion here, AI is advancing rapidly. Scammers are becoming more sophisticated and how they use it to scam people. So Carolina, how are you thinking about this at City? Well, AI is the poison, but it's also the antidote, isn't it? We fight AI with AI, right? We're just all in that race to find the new toy, the new technology, the new capability, how to identify those deep fakes, how to recognize the pattern that the client uses to move their mouths, to instruct their transactions, how they use their mobile phone. But at the same time, I know that there is somebody else watching on the other side how we improve with that. So I think to the point made earlier by Elliott and Hellett about this collaboration, I do think that that also needs to be 24/7, right? We need to be at the other side of the telephone of an email and see ourselves as united in these efforts to try to improve things, share those typologies that we are seeing and learn from them and try to be faster. But I think that 20 years down the line we will still be here talking about the new typologies and the new methods and new technology that we could use to detect scams, but yeah, it's the machine against the machine, Helen, what do you think? The AI one is a fascinating one, but I asked the guys at Invalor that are building their trust platform, what they're doing in AI, because I wanted AI, I wanted to learn because it's moving so quickly, so it's a great opportunity to learn. And they started to talk to you about trust and governance, and that seemed to get it onto home territory from you, so I know about trust and about governance, and I said, okay, tell me more, let me, and I'm going to just read from my notes, because I'm not an AI expert. They said that everything they do at Invalor is grounded in evidence and that every AI output references live data. And the second point that they told me, which I found really reassuring, is this human in the loop concept. And I wondered if we shouldn't all be talking more about human in the loop, because that would seem to me to build more trust into what we all need to do, the, not the poison part, but the antidote part, I think it's a great, and I use that internally now. But I think if we talked more about the human in the loop, that would help to accelerate good use of AI. I mean, we talked about what does that mean exactly, human in law. Okay, let me read my next one, because I'm not an AI expert. A normalist and critical decisions, automatically escalated for human review, okay? And this that Invalor's Trust and Governance is built by some former ex-Google guys and some very senior execs in the industry. And what they've said is that you need a human in the loop, IE, you know, AI first, but then get humans to monitor and to review it. And then also that there is a way of AI marking its own homework as well. And that's an integral part of trust and governance. But then what they also said was that it goes back to some, we all know in this room, it's also a data segregation and good data management principle. So I think AI sort of goes across all of our business. And we know a lot of this stuff anyway. We know about trust and governance models. We know about data aggregation. We know about, you know, forizing it back in the day, you know, you'd have four people looking at every document before you send that transfer back in the days of Apex. And that's, you know, Apex 1340, that dates me. You know, so we know a lot of this. It's just, I think, bringing those good principles into practice now with the advantages that AI can bring, wouldn't you agree? Yeah, I mean, I cover a lot of wealth management in my job, wealth management, private banking. And that you're talking about the human in the loop. That's always traditionally, particularly the high net worth end. It's been a people business, a relationship business, and they've always talked about that. But you go to the wealth management summits now, you talk to the private banks, they're all getting increasingly involved in AI and increasingly involved in this stuff because they're trying to move further down the wealth trend, either get the next generation, get their business, or get the mass affluent business and you simply have to use AI and stuff like that for that. But they'll all be talking about how the way you can target that and serve those people with that sort of relationship in mind is, again, getting to know your customers, but maybe through a digital lens, like they can program it. So they get to know how these people invest and move money and that flags will be raised immediately if they start doing stuff out of character. So that is definitely a way that if you, but obviously it's only as good as the data that's being put in at the right hand side. But there's no doubt that AI has to be a part of the solution because you can't do this at scale and you can't do it at speed and 24 hours without it. And to your part about regulation, our regulator, the FCA has asked the industry to step up. Well, if you look at an open data economy, which is where we're going, that by default is open across many, many regulated environments. So we have about 150 regulators. You cannot get a piece of regulation that monitors and policies all of that. So we need to, as an industry, step up and bring some solutions to the market rather than waiting for the regulators who will never, ever be ahead of the game in this market. They couldn't, to the point she were making, they can certainly advise and signposts into what that practice looks like, but we really do need the industry to step up, step up. Ethan, I wanted to ask you, so you were working across many businesses. What are you seeing that is working in the AI space? Yeah, we're seeing, well, I mean, it's AI versus AI as we've heard. And a lot of this is about real time detection and there's a lot of technology vendors at the event today. It's about real time speed of application. We're seeing machine learning deployed in a lot of our banking systems to, to Elliot's point to take patterns and then the AI sort of overlaying that to give the context to make decisions quickly off the back of those patterns that are, you know, anonymous against sort of the what's expected from that particular user. So it is an exciting space. We're also seeing in certain areas of the world where we've got trust framework starting where the tech vendors are actually sharing kind of consortium-based data and risk signals back with the financial services sector to actually do better and calibrate and fine-tune those rules and overlay those behavioral analytics, which is so important. It's no longer the case that I need to know your name and dress and know who you are because there's so much rich data in actually the way that you interact with the devices, whether you're left-handed, you're right-handed, you know, your swipe patterns of speed at which you go through applications and payment journeys. So that behavioral analytics layer is just so crucial and that's where a lot of the focus is. But I think that the point that we should also make, which is a hot topic at the moment, is the use of a Genti KI, which is essentially an AI agent, which is increasingly being deployed to improve efficiency. And as we talked about, you know, a number of times about fraud as a service, fraud as a business model, you know, the fraudsters are using co-pilot and efficiency tools to do things quickly and to fraud their victims at pace. And we need to equally, you know, use those efficiency gains ourselves to, you know, summarize cases for an agent or an operator, you know, to actually use to investigate, to actually bring data in from disparate systems into one central place so it's orchestrated and it's easier to make decisions in our sector. So, yeah, this is an exciting time for AI and generally. Yeah. And just to, you know, focus a little bit more on the individual, because when a person is scammed out of money, it can be a very traumatic event. Should banks be responsible for helping that person? I mean, obviously the person wants their money back, but is there even more that banks should be doing? What do you think? Well, I think, you know, I'm really glad you asked this question, Michaela, because we often focus on the financial impact of fraud, but we often forget that there's a huge psychological impact as well on these victims. And that, you know, is a case of, you know, the blame, the shame, the anxiety that is carried forward and it's long lasting actually outside of the financial loss experience. In some of my client work, I've had the pleasure of working with Eileen Charlotte, who's one of the victims of the Tinder Swindler documentary, I don't know if any of you have seen that, but she was defrauded to the tune of 150,000 over a long duration by her fraudster. And there was a huge amount of emotional manipulation involved in that fraud and the way it transpired. And I think it's incumbent on the ecosystems to think about ways to support people emotionally through that journey. In Eileen's words, she said her bank could have intervened more quickly, and some of the care and support in helping her get a refund and reclaim some of her loss, it could have been better. And we all think some good practice along a number of clients I work with, they've got breaking the spell teams in call centres, which actually intercept the fraud live and actually help to coach the victim to see whether they're actually a victim of fraud and trying to get them to see through the mystery that they're under by their fraudster. So we all think some good stuff like that happen, but always more can be done. And I think it's about, you know, education and awareness, making sure that it's signposted for victims, you know, where they can gain additional supports. And obviously that whole ecosystem approach that Carly and I referenced earlier, thinking about not just the financial services industry, but more broadly. One of the big things the banks could do, because ultimately the liability model is unsustainable for them, is going back to this accreditation process, knowing who you are dealing with as we grow and we have a far more open ecosystem to have an accreditation process, I just think it's common sense. You wouldn't book a holiday without knowing, because we've been through all that trauma in the holiday industry. So, you know, as we expand as rapidly as we are expanding, there are some tools really, you know, that we can start monitoring the ecosystem far better. A lot of the ecosystem, outside of those unregulated boundaries, you know, to your point entirely, is unregulated, is unmonetored. And, you know, there are some good actors, but there's also some, you know, bad actors and, you know, it's a bit of a wild west out there. So I think everybody needs to step up to the mark, yeah. And, you know, in terms of consumer protection more generally as well, you know, I think it's important, you mentioned social engineering earlier, you know, that's where fraudsters are doing their research before they target a victim and actually the banking sector can do the same. Flip that on its head. Actually, investigate, you know, how to communicate well with particular victims and look at the data, you know, look at the cohort's segmentation of your customer base. Make sure the messaging is tailored to those specific audiences. So we know students are more, you know, a potential victim of money muleing activity and elderly people, perhaps more on the investment scams side of the spectrum. So actually, personalising those messages using AI to help you personalise those communications can really help sort of help the anti here. I was just at one point because the customers are also corporates, small medium or large ones, but it doesn't really matter how big they may be. Some of them are still lacking on their data security, which is usually, it's also a common starting point for a fraud. And I think that there is a lot that can be done in terms of educating both corporates and individuals about that basic security, simple things, very good to dangeable terms, how you control your data, how to keep it safe, changing passwords and just basic things of that source. But I also think that if we think of the individual victim, right, of these social engineering scams, if we were showing how these scams work, you know, they have fantastic podcasts that bring these to life. And it often makes you think, will I have fallen victim of these type of scams? And you're thinking, if somebody had said this and if they had presented this and the way they operate it, they build that trust, they give you results. And when the bank asks you, are you sure you know this person? Is this a person that you know and trust? Think before you send your money. And they'll say, yes, of course, I've been chatting to this individual for 10 months. The answer to that binary question is yes, but they don't really think a key thing here as well. I think you mentioned earlier that 40% now, I think in the UK, if crime is now this kind of financial stuff, but there's also evidence that the vast majority goes unreported. So it could be way, way higher than that. And I think the only way to really combat that is to encourage everyone to report everything. And there might be reasons not to, it could be embarrassment, it might be small amounts. You surely can't build up a robust defense unless you really know what you're dealing with. So I think you have to make it easier. And as you say, educate people and encourage them to report every little thing. And yeah, I think that's the way to fight it. Yeah. All right. Well, I think on that note, we can wrap up. I want to thank my panelists again for joining me in this discussion. And thanks to the audience for listening. Really appreciate it. Thank you. We'll be back next week with my colleague, Martin Wolf's thoughts on what to expect for the economy in 2026. See you then.