Portals and Rails

April 23, 2012

Consumer protection: What to do when the consumer’s the threat?

How much for a cockroach in my take-out? What should the burger joint give me for gaining weight from eating their cheeseburgers? Consumers seeking a quick payday through frivolous lawsuits are old news in the food industry. What you may not know is that financial institutions must battle the same problem, as malicious actors twist consumer protection legislation for their own profit.

An American Banker article described how a federal court in Pennsylvania dismissed a lawsuit brought against a credit union claiming that one of their ATMs lacked a mandatory Electronic Funds Transfer Act (EFTA) sticker disclosing fees. This was just one in a string of lawsuits filed by the same plaintiffs. Some financial institutions have decided to settle instead of taking their chances in court. Some of the plaintiffs mentioned in the American Banker article have apparently decided to make a living by scoping out ATMs where stickers have fallen off or been removed, making transactions at these machines, and then filing suit against the unsuspecting operator.

This consumer behavior represents a type of second-order compliance risk. In addition to the formal consequences of noncompliance with regulation, financial institutions (FI) must also consider that some bad actors may attempt to undermine their compliance efforts. As a practical matter, FIs can manage this risk by validating EFTA compliance each time the ATM is serviced. As the machine is being refilled with cash and receipt paper, servicers should check for the disclosure sticker and have extras on hand in case it has been removed. The FI should maintain records of verification and/or replacement.

These lawsuits also raise larger questions. The other week I blogged about how the Federal Reserve has at times attempted to correct market failures in the payments industry. However, the unintended consequences of legislation discussed in this post demonstrate that government failure is also a risk. Government failure is any time that a government intervention to overcome a market failure results in a less efficient outcome than if no action had been taken. The case of these ATM vigilantes shows that legislation meant to protect the consumer can sometimes be used to justify wasteful lawsuits. In addition to determining if there is a legitimate market failure to correct, policymakers also need to consider the potential for government failure and unintended consequences of regulation before passage.

By Jennifer C. Windh, a senior payments risk analyst in the Retail Payments Risk Forum at the Atlanta Fed

April 23, 2012 in ATM fraud, banks and banking | Permalink

TrackBack

TrackBack URL for this entry:
http://www.typepad.com/services/trackback/6a01053688c61a970c0168ea9883db970c

Listed below are links to blogs that reference Consumer protection: What to do when the consumer’s the threat?:

Comments

September 27, 2010

Could the fight against ATM fraud use the help of biometrics?

Biometrics is defined as "the measurement and analysis of unique physical or behavioral characteristics especially as a means of verifying personal identity." There are several different identifiers that may be used in biometrics, including fingerprint and hand geometry, voice and vein recognition, as well as retina, iris, and facial scans. The concept of biometric technology as a customer authentication tool to protect the identity and accounts of individuals from fraud or theft is promising. However, relinquishing something as personal as a unique trait may leave some skeptical and others simply unnerved.

But can privacy concerns or consumer apprehension over the use of biometrics overcome the need to address the growing instances of ATM fraud?

Physical attacks on ATMs increase
According to Javelin Strategy & Research, in 2009, 10 percent of fraud victims in the United States experienced fraudulent ATM cash withdrawals. These schemes typically involve the use of a skimming device that may sit above the actual card reader and capture PIN entries. Other methods are more brazen and involve the physical act of pulling an ATM from the wall or floor and disassembling it elsewhere. Additional types of ATM attacks may involve data breaches, social engineering, and software vulnerabilities.

Successful adoption of biometric technology
Although the thought of biometric technology may conjure up images of George Orwell's 1984, for years now, several major Japanese banks have been using some form of biometric technology to combat ATM fraud. One example is the Bank of Tokyo-Mitsubishi, which uses palm vein-pattern biometrics for account and identity authentication. After inserting the card and entering a PIN, the user holds his or her hand over a sensor on the ATM for verification purposes. Because palm vein patterns are unique to each individual, others are not able to withdraw money using stolen cards. The palm vein information is stored in the card itself, which also keeps the biometric information hidden from bank employees.

In 2006, a new Japanese law made banks liable for fraudulent ATM withdrawals. Prior to the law's passage, banks did not impose withdrawal limits and did not protect against losses due to theft. As a result of the new law, today more than 90 percent of Japan's banks use some form of vein-pattern recognition.

Biometrics obstacles
A lack of standardization and the costs of implementation ring in at the top of the list when we consider why the financial services industry is apprehensive about integrating this technology. Also topping the list are privacy concerns and general consumer apprehension. But surprisingly, consumers have offered positive feedback when asked about the use of biometrics to combat fraud. In fact, when asked what they would choose, more consumers preferred using biometrics as an additional authentication tool over a one-time password device.

Enlarge

Will banks be willing to invest the time and money into technology that may or may not become an industry standard? Or are some banks waiting for other banks to serve as pioneers in the United States before they invest in biometric ATM machines?

Creating a chain of trust
U.S. consumers have historically shown reluctance to embrace new technologies until their reliability and trustworthiness have been vetted in the marketplace for a number of years. Part of building this trust will require building a track record of robustness with respect to both security and reliability. While concerns about biometrics may abound, these concerns can be addressed by educating the user and industry.

The concept of biometrics shows great potential for combating ATM fraud, but is it the panacea? Or is the key simply using technology more advanced than that employed by the bad guys, staying one step ahead of them rather than one step behind?

By Ana Cavazos-Wright, senior payments risk analyst in the Retail Payments Risk Forum at the Atlanta Fed

September 27, 2010 in ATM fraud, biometrics, fraud | Permalink

TrackBack

TrackBack URL for this entry:
http://www.typepad.com/services/trackback/6a01053688c61a970c0133f4a074cc970b

Listed below are links to blogs that reference Could the fight against ATM fraud use the help of biometrics?:

Comments