Instant-payment fraud drains customer accounts over a weekend
The prompt — read this to the room
It is Sunday morning at a regional bank with 600,000 retail customers. Fraud operations reports 1,400 instant payments in 18 hours from customer accounts to newly added payees, most just under the daily limit, about $3.1 million in total. Every payment passed one-time-passcode checks. Social media is filling with customers whose balances are zero, and the call-centre queue is 90 minutes. The digital banking team suspects SIM swaps or a phishing kit; nobody has confirmed either. Turning off instant payments to new payees stops the fraud, and it also stops legitimate rent and wage payments. Do you pull the switch?
Who to involve
Most important first.
- CISO / Head of security
- CFO / Finance
- SOC analyst
- Customer support
- IT operations
- Legal counsel
- Communications / PR
What it tests
- Decide on a payment-channel control (limits, holds, full stop) with explicit criteria and a named owner
- Identify the compromise path (phishing kit, SIM swap, malware or insider) from available telemetry
- Coordinate fund recovery with receiving banks and reporting to regulators and law enforcement
- Keep customers informed and protect vulnerable customers without revealing fraud controls
Outline of activities
- 1Fraud spike and the first numbers
- 2The kill-switch decision: limits, holds or full stop
- 3Finding the compromise path
- 4Fund recovery and the reimbursement position
- 5Customer communication and regulator contact
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…