Customer Attitudes to Security: The Perception and Reality Gap

SYStephen Yap

So while third-party frauds such as account takeovers, people stealing other people's identities, fraudsters essentially logging in and pretending to be genuine customers. While that is and will continue to be a major part of fraud, what is very much on the up is first-party fraud.

So that is fraud that is either knowingly or unknowingly committed by genuine customers who essentially are victims of scams. They've been scammed. And often times they don't even know that they've been scammed and so they are engaging in behaviours which ultimately are counterproductive not only to their providers but to themselves and they don't even know it. They actually think they're doing the right thing.

And so that's a very different strategic challenge, if you like, compared with third-party fraud. It's not necessarily about securing the front door or authentication. It's much more about identifying scams and protecting customers almost from themselves.

SYStephen Yap

The second broad category of insights that emerged from this research this year was the difference between age groups in terms of two things, broadly attitudes to fraud, but both in terms of their awareness of fraud attempts. So younger people tend to be more aware or tend to report more frequent attempts at fraud.

Or be aware more often of fraud attempts, and that might be because they're more online, they are users of a wider range of media and so fraud is perhaps more visible to them.

MSMatt Smallman

So is it worth jumping to the slide on that, Stephen?

SYStephen Yap

Yeah, why don't we do that? Young people are more likely to say they've experienced an unauthorised access attempt.

And this is the survey that I mentioned of a thousand people across the UK and I've cut the data by age groups. And as with any analysis like this, it's a generalisation. There will always be exceptions, but broadly you can see a trend. You can see in the green bars, the percentage of people saying, 'No, I haven't. To my knowledge, nobody's tried to gain unauthorised access to any of my accounts.' And you can see among people aged 55 plus, that's 65 per cent. And among people aged 18 to 34 it's almost a half of that, which is 37 per cent. So people aged 18 to 34 are significantly more likely to say, yes, I have experienced an unauthorised access attempt.

So that's one of the, if you like, demographic differences. But I think we've got a slide, haven't we, Matt, that illustrates the other demographic difference. Younger people tend to use fewer passwords. So the question here is, which of the following best describes your approach to passwords?

Do you use the same three or fewer for all of your accounts? Do you use the same three to six for all of your accounts? Or do you use different passwords for every account? And what you can see here is that 31 per cent of people aged 18 to 34 say they use the same 3 or fewer passwords for all of their accounts.

Compared with people aged 55 plus, 16 per cent who say they use 3 or fewer passwords for all of my accounts. Generally speaking, more mature people tend to have a wider portfolio or repertoire of passwords, and younger people tend to have fewer passwords, which very clearly suggests that younger people have a lower tolerance for friction in the authentication experience.

And I've seen this in other areas outside of authentication. Generally speaking, as a rule of thumb, younger people tend to have a lower tolerance for friction in their digital experiences. So they are more likely to want to trade off some security or more likely to be willing to take risks in exchange

for less friction, despite the fact that they are, at the same time, more likely to be aware of potential fraud attempts.

MSMatt Smallman

I just find this fascinating, yeah, that at the same time, they are the biggest victim or they perceive themselves to be the biggest victim, but they knowingly take less measures themselves.

And I know there's some other research that I've seen that suggests that particularly in that demographic, there's a certain kind of abdication of responsibility or a kind of helplessness that they feel that regardless of what other steps they took, they wouldn't necessarily be able to do anything to mitigate it.

So it's that security is a cost of doing business and they'd rather have the convenience of fewer passwords.

SYStephen Yap

Yeah, I think one of the things I have learned is that seamless experiences are absolutely everything. And that friction in the experience, even a little bit of friction, will attract, if you like, avoidance attempts.

Yeah. Particularly digitally savvy people, which, again, the generalisation that younger people tend to be comparatively digital savvy. They'll find ways to get around friction, and if necessary, they'll just switch provider. If they think that they're getting too much friction from the experience of a provider, they'll just find another provider that is a more frictionless experience.

And so I think the challenge is getting the balance right between security and friction, knowing particularly that younger customers have a very low appetite for friction.

And just something I want to add here, Matt, is I think there is a common perception that the customers that are most vulnerable to fraud tend to be older customers, tend to be ones who are less digitally savvy. If you like, there is this trope that older customers are easier to scam. That may or may not be true. But one thing that I didn't know before this latest piece of research, and I really only learned through conducting this research is that equally young customers are extremely exposed.

Partly because as we've just discussed, they have a lower appetite for friction and, if you like, a greater risk appetite. So they tend to be more on the, I'll take risks with my security side of the balance, if you like. But also because, frankly, the younger people, as a general rule, tend to spend more time online.

And a lot of the scams, a lot of the first-party fraud attempts are now. We've seen the rise of crypto scams, for example, money mule scams targeting highly digitally savvy people. And yes, while perhaps younger people might have less money in the bank and for that reason might not be as attractive to fraudsters, at the same time, a lot of these digital scams are these sort of get-rich-quick type scams.

So if you will just help me move this money from one place to another, you can earn a lot of money very quickly. And that's particularly attractive if you're a young person with not a lot of money in the bank. So I think we need to revisit our trope, because there is a lot of evidence that younger people, even super savvy young people, are also very vulnerable to particularly first-party digital scams.

So that was the point of demographics.

SYStephen Yap

I'll just close off my third point in terms of the themes from this year's research. And it's fair to say this is a good general rule of thumb with any survey research is that you shouldn't take anything that you see from a survey at face value.

And unfortunately there's an awful lot of misinterpretation of surveys by people who are taking survey results at face value, whether it's a political poll or whether it's any kind of survey, including a fraud survey, you need to try to read between the lines.

And certainly you should never choose your authentication methods based on what a consumer tells you is their preferred authentication method. What was really interesting is we did ask consumers what their preferred authentication methods were. And there's a big piece here around familiarity. I'll just explain how this works.

What do these numbers mean? We offered a choice of eight different authentication methods. And just to be clear, we're talking about telephone authentication here. When you're calling into a contact centre and you have to prove your identity, you can choose many of these authentication methods and which one would you say are most convenient for you.

The way the question was asked was you have 100 points to distribute across all of these eight methods and please allocate more points to the method that you find most convenient. I could go into a long sidetrack around why we ask the question in this way, but it's the best way to ask the question, trust me.

So basically the more points, the more convenient consumers consider the authentication method, and as you can see here, the highest score, 20.8 out of 100, was allocated to SMS OTPs. And if you compare that with some of the much less highly rated authentication methods, we can see Automatic Voice Recognition is on the other side at 6.4. Automatic Phone Number Recognition, which... You can make a case to say that either voice biometrics or automatic phone number recognition is actually a lot more convenient than OTPs. It's a lot more frictionless than OTPs. You don't have to do anything compared with OTPs. And yet OTPs are considered much more convenient by consumers.

That to me suggests that familiarity plays a huge role in driving consumer perceptions and preference in terms of authentication methods that because we're so used to OTPs now, we don't even think about them. We can do them with our system one brains turned on. We don't actually require conscious effort to execute an OTP.

And if we just go back to the previous slide, Matt, I just wanna share a supporting point here. So the question here was, please rate each type of provider according to the experience that you have with authentication and the green bars represent, in a dark green, very good, and light green, quite good.

And it's banks that top the list in terms of consumer perception. So the most positive experience, according to consumers, is with banks. And it's actually quite far ahead, as you can see here in terms of experience ratings. And you've got travel companies on the other side of the equation with the least positive rating, comparatively.

So what's going on here? Is it that banks are just much better in terms of delivering great, seamless, frictionless authentication experiences? Perhaps. I think that's probably true to a certain extent. I also think that familiarity is playing a role here because think about how often you interact with your bank versus how often you interact with an airline or an insurance company.

Because we're familiar, most of us, not all of us, but most of us will now be using self-serve methods to interact with our bank; we might even be using an app. So just like OTPs, we've got used to it because we do it, and we do it so often. And once the familiarity is there, then the positivity starts to follow.

So is it that banks are objectively doing a better job of verification, perhaps? Is it that actually we think that banks are doing a better job just because we interact with our banks more often and we're just more familiar with their methods? I think that's also a factor. I believe familiarity is a thing and that also when any provider tries to introduce any new type of experience or method, there's going to be a period of time when there's going to be a certain amount of resistance from consumers because of the lack of familiarity.

I think about when ATMs, I'm old enough to remember when ATMs were new and a lot of people were really sceptical about the security of ATMs. Obviously, now no one ever gives a second thought to the security of ATMs. We know that fraud exists on ATMs, but ATMs are just taken for granted now. It's just really interesting to unpack that and understand what goes on to drive these perceptions and the importance of familiarity in creating positive perception.

MSMatt Smallman

These two charts are the ones that fascinate me the most, because I think if we came up with some objective measures for both security and convenience, we'd choose stuff like time, cognitive effort and chance of a bad guy guessing or being let through the process, and we could objectively measure each of those methods and come up with a score functionally based on science and observation, but it's so far away from what customers really perceive to be going on.

And that's why, for me, this customer perception of the security process is almost as important as the reality of its execution. Now, the reality of its execution will have an impact on actual fraud or loss or risk, but the perception of whether it's consistent with what people are expecting or consistent with what they demand has a huge impact on satisfaction and engagement with the process.

And SMS OTP is just this classic... I used to think about how we have trained customers over the years to equate friction with security to the extent that you could probably replace the 48 per cent and the 26 per cent with time in seconds to complete authentication on this process.

And you would see that chart because the organisations at the bottom of this chart probably have the shortest authentication processes because they're the lowest value at risk, et cetera, et cetera. It's just fascinating this disconnect and therefore how important it will be for implementers of new technology and improved technologies to think about this as they communicate and they educate consumers. It's a huge disconnect between consumer perception and the reality. And that is where we are. So we have to deal with it. So it's fascinating. And thank you so much for the contribution to the discussion on it as well.

SYStephen Yap

And just to add to that, Matt, I couldn't agree more.

SYStephen Yap

And I think the perception of some friction contributing to one's comfort level. If it's too easy, if it's completely automated, I don't have to do anything, how secure can it really be?

Perhaps a little bit of security theatre can help to drive perceptions of efficacy, perhaps. But as you said, perception is everything, and it's all about how, particularly when we are introducing new methods, how do we educate? How do we communicate to consumers? And it's not just about the customer's own satisfaction.

It's also about customers talking to other customers. And we know that reputation is a key driver here because it drives word of mouth. If people have a good experience with authentication, if people have a bad experience with authentication, then people will talk about it to other people. So it's not just affecting the customer's own perception, it's affecting potential other customers' perception through word of mouth.

There was a prominent television campaign going on from KitKat, which is all built around painful friction within authentication.

It was all built around how many passwords you had to remember and obviously the creative idea was life is hard, life is difficult, life is painful and you need to take a break, therefore have a KitKat. But I just thought that was a really interesting example of how it's now entered the mainstream consciousness.

It's an example of how authentication is not just a niche topic that fraud enthusiasts and authentication and security enthusiasts love to talk about. It's a mainstream topic that drives mainstream debate.

SYStephen Yap

The friction is the only thing that the customer can see and experience.

So it's the only measure they really have of what's going on. So in service design, we talk a lot about what's called the line of customer visibility, which is, the stuff above the line is the stuff they can see about the process, the communications, the things we say to them and stuff below the line, almost like the swan on the river.

It's really ugly underneath the water, but you don't want to show that to the customer because it gives them a negative impression and so security is one of those things where, by its very nature, you don't want to show very much to the customer, because it's also observable by bad actors as well. So the only thing they can observe is friction in their own efforts. So it's almost natural when you think about it for them to correlate that with the effectiveness of the process.

Now we as professionals know that's not necessarily true, but it's so easy to forget when we're chasing the latest technology that gives us zero seconds of handle time to authenticate people to really high confidence levels.

It's so easy to forget that. And it does remind me of a story back probably decades ago now that was in an online banking service: I think someone did buy an oil rig or transferred the money for an oil rig in a corporate structure using a smart card authentication, getting perfectly happy with that, but the transaction to pay their kid's birthday money was something they wanted to do by phone and speak to a human about, and that they felt there should be a bit more security about it than there actually was, even though we used biometrics and all sorts of things in the background to make sure they really were who they claimed to be. That friction just makes it feel secure.

Security theatre was a term you used before, which was coined by Bruce Schneier just after 9/11 to describe some of those security things in air travel.

And I've long been anti security theatre, and I'm certainly anti it in terms of the way in which we use pins and passwords, which have no security value, but are almost pure theatre or farce, as I'd prefer to call them. But I think when we're designing less friction for the experiences, we do definitely need to think about that aspect of it.

And yeah, this survey just is a classic and I won't forget it for bringing that point home. Thank you, Stephen, again.

SYStephen Yap

I think the distinction between above and below the line is super relevant. And it's made me think of, it's not exactly above and below the line, but it's a slightly different idea, where, as more and more fraud is first-party fraud,

it becomes not just about securing the front door and building a big moat. And then once you're in the castle, you can do anything you want. It's about actually, you still got to have a moat, you still got to have a locked front door, but you've increasingly, as first-party fraud committed unwittingly by genuine customers proliferates, it's identifying fraud once people are in the front door and that's where analytics and increasingly AI is actually starting to play a role. So using those analytics to identify unusual behavioural patterns, red flagging when people are on a path that deviates from, if you like, their normal happy path.

And then it goes back from below the line to above the line where you've got to bring it in front of the customer. Now we're familiar with really simple, I think predominantly we're still doing quite simple implementations of that. Most of us, I would say, are familiar with the experience when you're trying to make a bank transfer using your

favourite bank app or online banking interface. Do you really want to make this transfer? And all the questions that you get asked. And I think speaking for myself, I'm always at the point where I'm now in system one. I just know exactly, I don't even read the questions. I just know exactly what to take to get me as quickly as possible to the transfer.

But as those analytics become much more intelligent, we can start to really identify those exceptional behaviours and then escalate it and flag it. And then identify the most appropriate intervention when we think there might be something suspicious going on that isn't just following a really generic tree, but is actually tailored to an individual customer's specific profile and behaviour.

And that's interesting. Also, I think interventions are going to be interesting, particularly when the customer is actually unwitting. This is something that came up in the research.

SYStephen Yap

There is, if you like, a pressure and a contradiction on the contact centre advisor on the front line whose main job is to deliver a great experience to the customer.

If we're now asking them to call out the customer as well, who may unwittingly, not to their own knowledge, they might be thinking they're doing a genuine thing, but we actually think they might be committing fraud. Who actually is the person? What is the right intervention and right communication to the customer?

When that happens, should it be escalated to, should it go back to the fraud team, for example, what is the right language, how do you communicate sensitively and sympathetically to a customer who actually doesn't know that they're actually committing fraud.

Oh yeah.

It is a really challenging area. And I think there's one other we'll come back to in a second, which is the mutual authentication and trust side, but I think when we're talking about the front door security clearly, and we see some states, certainly in financial services, I think is now at the point where the reason fraudsters are going to these first-party type attacks or going to the customer and getting them to initiate the transaction is because the security has reached a point where that is the easiest path. Lowest effort, greatest reward is currently from targeting consumers.

And the stopgap solution of are you sure this payment is genuine and you're sending it to the right place is only that, it's a stopgap. The first time you make that transaction, you might read it. The next time it's just click, click. Oh, it's gone. Good. But I also have real issues with

putting responsibilities on frontline contact centre agents, call centre agents to make that determination, because it reminds me of just going all the way back to where we were with authentication, maybe a decade ago, where like the customer got the password correct and they answered the demographic correct, characters correct.

But when we listened to it three months later, when the fraud was discovered, it was very obvious that the customer, the caller was not genuine and the agent really should have noticed it and done something about it.

And I think that's a really unfair load to put on the agents. Like, inevitably, organisations do that as stopgaps because it's quickest to put the responsibility on somebody like that who's flexible than it is to design systems and processes that overcome it.

But I think you're absolutely right. It's the analytics. It's the out-of-character transactions that we need to identify and have means of intervening in appropriate ways, and maybe that is the call centre agent, but we can't put responsibility on them to detect the incident.

We have to have tools and analytics that identify it and then prompt the intervention that they're trained for.

Maybe I can respond to both those points in order. What I'm hearing actually is something slightly different, which is that because fraudsters are becoming so adept at social engineering, and you're absolutely right to say that the fact is in many situations today, the customer is the weakest link, so rather than try to hack the authentication platforms, let's hack the consumer because it's just easier to do it that way. And because fraudsters are so adept at social engineering, it's much easier to get an OTP by social engineering the customer than it is to try to brute force an OTP.

So ironically, it is that also that shift to first-party fraud that is undermining the efficacy of traditional authentication methods. And for that reason, many organisations are basically moving away from OTPs, because they're just no use at securing because it's so easy to get the customer to tell you the OTP.

So a lot of banks, for example, or financial institutions in general, trying to move towards apps for authentication, which is an environment they can control much more than relying on OTP. So that was the first point.

SYStephen Yap

And the second point around the front line. Yeah, I really hope there aren't any contact centres today who are holding their front lines accountable, because, as you say, that is just a weak supplement to actually designing properly secure systems.

And let's face it, people on the front line have enough to think about. If you're working in the contact centre on the front line, you're probably dealing with, if you're lucky, you've got five systems and screens. If you're unlucky, you left 20. It's not unknown for contact centre advisors.

They've got scripts to think about. They've got quality measures that they've got to worry about. Chances are the customer's irate talking to them, which is a function of the general environment in which we're operating, but also the predominance of self-serve. Because what's happened in the last few years when self-serve has really become much more commonplace is a whole new class of demand coming into the contact centre where, increasingly, customers are being delivered to the contact centre lines in a state of agitation because they tried to self-serve and they failed. We've all had that experience. We all know how frustrating it is when you try to self-serve your query and you fail and you're forced to dial in as a result.

And you're already, your patience is wearing thin by the time you get there.

And then you had to queue to get there.

You had to queue to get there. So on top of all of that, which the frontline has to deal with, then holding the frontline accountable, I think, is nonsense. And the technology exists today, in different states of readiness, but the technology exists today to be able to, as you said, Matt, to flag exceptions and to at minimum provide intelligence to the frontline to say this might be somebody who you need to escalate.

So we should absolutely not be holding the frontline fully responsible for identifying potentially fraudulent behaviour because they've got enough to think about.

Yeah, I know, I completely agree, but it's an inevitable knee-jerk reaction in some of these situations. Just moving on slightly to a related topic.

The weak spot is the customer, but again, we've trained the customer to not be that security conscious. What we call mutual authentication, the act of asserting back to the customer that I am a representative of the organisation I claim to be a representative of.

So many customers don't really think about that when they're contacted. And that is challenging for both fraud teams who are trying to carry out those interventions, but it also opens a door for fraud via the customer. And I think one area we've not really focused on as an industry really is that mutual authentication.

How do we assert back? I saw last week, or maybe it was the week before actually, Monzo Bank doing a really good example out there. They've got a new feature in their app: 'We are on a call with you' or 'We're not on a call with you.' So you can literally go to your app and if someone says they're calling from Monzo, you go to the app and it says, yes, we're on a call with you.

And if it doesn't say that, then you know you need to hang up and call their security team. So I think there's still a lot of work to be done in that mutual authentication space. But again, we haven't trained customers particularly well.

SYStephen Yap

The question that came in was for me in the familiarity space, just interested in your insight.

So obviously a lot of people in our audience group are interested in some of these modern security technologies like voice biometrics and phone-based authentication. How do we get people to improve people's perception of both the security and convenience that they deliver?

What would you suggest?

That's a great question. Let me start by making another point, which isn't directly addressing the question, but I think, as the predominance of first-party fraud continues to rise, I think it's raising questions about biometrics, because obviously biometrics doesn't protect against first-party fraud, it only protects against account takeovers.

Yep. And ID theft. So that's again where you need to supplement, if you like, the locks on the front door with the right measures when people are in the castle using the analytics that we've discussed. How do you educate? For me, education is inclusive of not just the right methods that you use for authentication, but increasingly, as we've talked about in the current fraud environment, ensuring that people are vigilant against potential scams.

And it does seem to me there is more mainstream coverage of this. Maybe it's just because I've been doing this research, I'm more attuned to the topic than I used to be, but it does seem that I notice it more perhaps in the mainstream media, which is a good thing, but I think it's really important to use the right channels in the right language for the audience and going back to the demographic differences that we talked about.

If you're trying to educate a younger customer, whether it's around authentication and protecting themselves or whether it's about educating them against scams that they might be vulnerable to. You've got to use the right channel and use the channels that the fraudsters use. So if the fraudsters are on social media, use social media, use the right language, use the right spokespeople.

The sorts of language and channels and spokespeople that you might use to target someone aged 60 plus is not necessarily the same as you might target someone in their 20s. As with anything, the right language, the right medium is really extremely important. And I think there is ultimately no substitute for just making people use it.

If you like. I know that's not perhaps the most strategic answer but if you put something out there, there's always going to be resistance because people don't like change and there's always resistance to the new, but if you stick with it over time, people get used to it.

That's just a fact and that's something that I've learned to realise is with authentication. You have to obviously put something together, you have to try to get the balance right as we talk about between not too much friction but ensuring that there's protection within there. But once you decide what the balance is, once you get it out there and it's shown to be effective in terms of protection, then over time people will get used to it.

I guess the question is, once you get it out there, if you're seeing that you're losing customers, if you're seeing that it's driving lots of negative word of mouth, then perhaps you need to make some tweaks or some changes there. But rather than do huge amounts of testing up front or sandboxing, do in-market testing. Do it on the fly. Do it in market. Go live with something and iterate it on the fly.

There are some constraints legally around doing some of those things, but I think you're absolutely right. You just have to get it out there and in front of people and then let them touch, feel and experience it themselves.

I think that definitely is something though, to the observability points. There's always a balance between different levels of education, like how much do you tell people about what's actually happening underneath the scenes versus let them trust you. And we've seen very different levels of trust inferred to different types of organisations.

The classic quote I always remember is you own half my house and all my money's with you, so why wouldn't I trust you to make the right choice about security for a bank? Versus a telco who is charging me exorbitant fees and all the rest of it. So different levels of trust flow into how people perceive those services as well, which I think is a point that needs to be borne in mind, but yeah, interesting. Good thoughts.

If I could just add Matt, actually, I think this is a point of view that I'm still cogitating on. Consumers tend to be savvier than we give them credit for, and consumers understand providers doing things for their own protection, but often, I use the example again of the questions when you try to do anything with online banking. Are you sure? Are you sure? Are you sure?

Once you've done that for the tenth time, which only takes two weeks for most people, you've got used to it and you don't even pay attention to those questions anymore. You just know exactly what options to pick. So the value of those questions I think very quickly diminishes and yet the friction is still there.

And then it creates a certain amount of, if you like, cynicism on behalf of the consumer. Now, I'm not saying dispense with the front door locks entirely, but I think if we can ultimately create an entry experience or authentication experience that is as frictionless as possible but dial up our ability to identify fraud in the moment as it might be happening, that might be the better way to address the challenge.

Rather than making it incredibly difficult to get in, make it as easy as possible to get in, but make sure that your ability to address the fraud in the moment is as strong as it can be.

I did send you a copy of the book, yeah? That was the best advert I heard in a long time, but yes.

I've been reading it.

Maybe it's in there in my head.

Awesome. There was one, we're just coming up on time and unless there are any other questions, one I'm going to try and, it's a difficult and potentially controversial one as well.

SYStephen Yap

The debate we've been having is about these two parties, yeah, an organisation that has some assets that need protecting and a consumer or user of those services needs to access them and the potential for a third party bad actor to be involved.

But what we see with a lot of certainly these first-party type attacks is that there are other enablers of this whether that be intentionally or unintentionally or just ignorantly, whether that be social media networks, whether that be telcos and mobile carriers that are, by absence of action, enabling this fraud to take place and potentially the trust that people have in those organisations is coincidentally inferred onto people who messaged them from a platform or whose adverts are seen on the platforms or who, which call who, which arrives on the device.

I dunno, was there any insight from consumers or from call centre leaders about the role of these enablers?

It's not a topic that we've explored yet. It might be one for a future iteration of the research.

One that I'd need to think about, if I could offer you, in the absence of insights or data, I'll try to offer you an opinion, and this is very much an off-the-cuff hot take, and my opinion might change next time you ask me this, after I've thought about it some more.

As somebody who believes that, generally speaking, the likes of social networks need a lot more regulation and a lot more oversight than they currently do. I do not in any way buy the traditional argument that they're just dumb pipes, not at all, right?

They are profiting from at the same time as causing an untold amount of harm in many different ways. I'm not sure whether that, having just said that, necessarily applies. I think, ultimately, if the regulations aren't there, you can't blame the social networks or the telcos for doing what they need to do to maximise shareholder value.

It's up to the regulators and the people who have the power to make a difference, to bring in the regulations, to mitigate against harm.

Now, I think it's a really valid point as I take my 20,000-foot view of the last decade or so of security and fraud prevention, you can see

in financial services in the UK, the US, North America and Europe, the burden of work being like, the harm is to the consumer, but actually the consumer isn't in a position to do much about it. And it's the organisation, the enterprises that need to take more responsibility for that. And they've gradually shifted over time, direct financial responsibility to those losses. And we see that in the UK with APP, the push payment frauds now squarely coming down on the industry side of responsibility, even though there isn't. As you say, they're authenticated. They're authorised by genuine customers.

It's only when it moves in that way that we actually see the analytical action, the investment, the incentive to do anything because 40 million consumers are not going to spend time, effort and money figuring out what's an exceptional payment or an out of character transaction. It has to be centralised in some way.

So I think it is a role for regulation to find out what that right balance is. But there is a point where there are no more levers to pull.

So if we want to reduce the harm to consumers, then some other levers need to get pulled, I guess is where my head goes on that.

And it's different, isn't it? And it's not all the same. Can we hold a telco accountable for a fraudulent SMS, a phishing SMS? I would argue that is a dumb pipe scenario and the telco has no control.

It's an SMS. Yeah. How can you expect the to have any control over the content of SMS? It's a very different situation when it is a social network that accepts a paid campaign for what we've all seen them. Yeah. On our favourite social networks paid campaign for what is obviously fraudulent content.

What is obviously, inviting, unwitting, a complex area of people. And the social network is promoting that, and they're receiving money for it, and they're promoting that, through algorithms. That's a very different scenario, where I do think there is a lot of accountability.

So it depends.

SYStephen Yap

No, it is a complex area. I'm sure we'll come back to it as well. Stephen, thank you so much for joining us this afternoon. Again, thank you for your contribution with this research. It is, for all of us who spend our days and lives thinking about security. We're so close to the subject that we just miss the bigger picture that the users of the process and technology we design are humans. They have a natural set of biases and tendencies, and actually their perception of the services that we're delivering is almost as important as the objective functionality of them.

We'll include a link to the CCMA's website and how to download that in the email we send out afterwards, and I do encourage you; we've only just shown a snippet of the findings that the team came up with, so please download that and have a look at the detail.

I just want to thank everyone else who's joined us this afternoon. Thank you so much again for everything in 2023, and we will see you sometime in 2024 with the next edition of the Modern Security Community.

So thanks very much for joining us, everyone, and have a great afternoon.