Digital businesses are facing significant challenges due to AI-assisted fraud. As fraudsters utilize synthetic identities and generated documents, traditional verification methods are increasingly strained. Automated attacks enable organized crime groups to exploit vulnerabilities at an alarming rate, making Know Your Customer (KYC) checks a prime target. Volodymyr Todurov, CEO of fraud prevention company Frogo, reports that experienced fraudsters are employing AI techniques to impersonate genuine customers effectively.
KYC is currently the most vulnerable aspect of fraud prevention, with sophisticated technologies like real-time document generation and deepfake face-swapping complicating verification processes. While companies are under pressure to tighten their controls, they must also be wary of the potential repercussions. High levels of scrutiny can lead to false positives, rejecting legitimate transactions and frustrating valued customers.
"Operating with a 'guilty until proven innocent' mindset and relying on aggressive, automatic blocks can completely destroy the customer experience," Todurov notes. This concern raises a crucial issue: how can businesses balance fraud prevention with maintaining profitability while avoiding alienating their clientele?
To assess performance in anti-fraud measures, Todurov emphasizes viewing fraud prevention as a "revenue optimization engine". This involves three interconnected factors: direct loss prevention, operational efficiency, as well as customer retention and lifetime value. The first factor, direct loss prevention, gauges how much money is lost to fraud, such as through unauthorized withdrawals, and whether those figures are decreasing. However, essential operational resources also need consideration. If standard checks require constant manual oversight, companies might find it challenging to handle increasing customer volumes without continuously expanding their risk management teams.
"Without a nuanced evaluation model, you risk blocking your highest-revenue players," Todurov warns. In addition, an effective measure of success involves tracking how many monthly active users each fraud analyst can support, alongside the time required to complete investigations. Automating routine decisions could free specialists to focus on more complex fraud threats.
The experience of legitimate customers is the third factor to consider. Todurov advocates for implementing automatic withdrawals based on a presumed innocence, which ties smoother transactions to increased trust and long-term customer value. Delays and unnecessary verification processes can incur hidden costs, even if they do not appear on fraud reports.
It's critical to evaluate all these measures collectively. A system might efficiently flag fraudulent behavior while neglecting significant fraud elsewhere or decreasing losses through methods that also deter legitimate customers. A firm grasp of missed anomalies and the costs of intervention is paramount for financial success.
High-value customers exemplify the pitfalls of heavy-handed fraud controls. Their activities can significantly deviate from average user patterns: frequent travel may lead to sudden location changes, large deposits can create activity spikes, and the use of multiple payment cards introduces complexity. These signs can sometimes be indicative of fraud as well.
"Without a nuanced evaluation model, you risk blocking your highest-revenue players," Todurov reiterates. He asserts that unusual behavior should prompt informed assessments; a sudden change might call for intervention from support teams instead of an immediate block.
Such judgments necessitate specialists who are knowledgeable about their products and their consumers, allowing them to determine which behaviors warrant intervention. This expertise further delineates where AI can enhance decisions and where established rules are still effective.
"AI isn't a silver bullet," he emphasizes. "Its success depends on specialists who understand where machine learning provides value and where traditional logic still prevails."
The need for accurate information to guide decisions is crucial for specialists. Frogo suggests that data collection should begin at a user's initial visit, starting with the device used to access the platform, and evolving the risk assessment as user interactions progress.
"It all begins with device fingerprinting, where we analyze hardware and software parameters to verify legitimacy and identify bots, spoofed devices, or masked origins," Todurov states. Frogo offers a Device Fingerprinting tool that businesses can utilize for anti-fraud measures independent of their existing platforms, particularly benefiting those with elementary in-house rules but inadequate device recognition.
This approach adds context to changes in user behavior, helping analysts evaluate whether the activity is legitimate or if it needs further scrutiny.
"Anti-fraud tools should be viewed as core data engines," Todurov asserts. The tool checks over 300 client-side signals and produces identifiers that help maintain continuity within a single brand while recognizing devices across various brands.
Additional context, such as IP risk, VPN and proxy usage, browser specifics, screen resolution, and hardware details, is also provided. Other indicators include time zone discrepancies and remote desktop tool detection. When a user takes any action, such as registration or transaction, Frogo's integrated system checks these actions against the company's risk rules and can respond in under a second, explaining which risk triggers were activated.
The valuable insights generated by this data extend beyond threat detection. They can also assist businesses in identifying positive customer behaviors. "Anti-fraud tools should be viewed as core data engines," Todurov reiterates. He suggests that rather than solely focusing on negative behaviors, companies can establish triggers that highlight high-value customer actions.
Frogo’s alerting system sends risky behavior alerts to analysts, while positive behavior notifications are sent to marketing and VIP teams via webhooks or Telegram. This enables departments to react appropriately to similar underlying user behavior based on their specific duties.
Adopting this strategy in new markets requires constant adjustments, as customer behaviors, payment methods, and fraud tactics vary significantly. The goal remains clear: mitigate genuine threats, limit unnecessary work, and ensure that legitimate customer experiences are seamless as the business expands.
"The winners will combine a highly skilled fraud team with agile technology, viewing anti-fraud through a growth mindset," Todurov concludes.
