Insights

Combatting Financial Fraud: Insights and Solutions from the Telecom Sector

Aug 14, 2024

Fraudsters have increasingly sophisticated methods for targeting the consumers of banks and financial institutions. One such tactic involves calling into the main phone numbers of banks, often during off-peak hours, to learn and replicate the Interactive Voice Response (IVR) systems. These criminals meticulously map out the IVR flow, noting every prompt and option, so they can recreate an almost identical system. By mimicking these systems, they can trick users into believing they are interacting with their bank when they call back a phone number provided in a text message (smashing scam) or voicemail (vishing scam). The scammer impersonates the bank so convincingly that they can gather sensitive information from the user, such as account numbers, PINs and passwords. This deception not only compromises customer security but also erodes trust in the institution, leading to potentially significant financial and reputational damage. 

Moreover, these fraudsters frequently spoof numbers to determine if the IVR system changes based on phone number validation. If the system adjusts its responses according to the caller's number, the fraudster can confirm that the number belongs to a genuine banking customer. This information then enables them to launch highly targeted attacks. 

Scammers use smishing (text message scams) by sending messages like, "This is Your Bank. We see a $534 charge on your account. Was this you? Reply yes/no." If the recipient engages, they are quickly targeted by a vishing scam (phone call) where the scammer impersonates the bank's main number to steal personal information. 

Given this threat, it's critical for both service providers and financial institutions to take proactive measures: 

• Monitor Unusual Activity: Investigate calls to main banking numbers that occur during unusual hours. Ensure your fraud management system (FRS) has rules in place to detect and flag such anomalies. 
   
• Detect Number Spoofing: Be vigilant for patterns of number spoofing and initiate investigations promptly. For example, if an incoming phone number is identified as a Do Not Originate number, it is a clear indication of a fraudulent call. Databases such as RealNumber DNO offers access to over 6 billion phone numbers identified as a number that should never originate a call. 
   
• Validate Customer Information: Regularly check your customer database for phone numbers that have been disconnected. This ensures that you do not unintentionally provide potentially sensitive information to someone who is not your customer. Services like RealAgent can query the Federal Communications Commission (FCC)’s Reassigned Numbers Database on behalf of the business to verify that your customer phone number records are up to date. 

Vigilance, proactive monitoring, and robust validation processes are key to safeguarding the integrity of financial institutions and maintaining customer trust. By implementing these measures and collaborating with telecom service providers and solution providers, financial institutions can better protect themselves and their customers from nefarious activities.