--- title: "Network Authentication and Fraud Prevention 101" url: "https://symnexconsulting.com/video/network-authentication-fraud-prevention-101" date: "2023-03-09" author: "Matt Smallman, Chris Wade" category: "Accelerate Delivery" description: "An educational session on using signalling data from the telephone network for Authentication and Fraud Prevention, with Chris Wade of Smartnumbers." video: "https://stream.mux.com/DHMXLiWNetzCiuJUepIxgHrvvt0001oB013jZIjWx449gQ.m3u8" --- # Network Authentication and Fraud Prevention 101 _An educational session on using signalling data from the telephone network for Authentication and Fraud Prevention, with Chris Wade of Smartnumbers._ Network Authentication and Fraud Prevention use signalling data from a phone call either to confirm that the call originated from a device known to be in possession of the customer (authentication) or to detect when the call has originated from a device, location or network indicative of suspicious behaviour (detection). Matt Smallman provided an educational session with real-life examples provided by Chris Wade. - What is Network Authentication and Fraud Prevention? - How can it prevent fraud? - How can it improve customer experience? - How can it improve efficiency? Matt's presentation was followed by a question-and-answer session with Chris Wade from Smartnumbers. ## Chapters - 1:32 Introduction - 2:21 Convenience and security trade-off - Why do we need a more modern approach? - 5:14 The differences between Traditional, Transitional and Modern security methods - 8:46 Where does the data for Network Authentication and Fraud Prevention come from? - 11:22 What can analysis of network data tell us? - 12:40 How can we use this analysis for Authentication? - 14:43 What does a Network Authentication business process look like? - 16:04 What should you consider before implementing Network Authentication? - 18:14 Why is Fraud Prevention important for all call centres? - 20:55 How can we use the analysis of network data for Fraud Prevention? - 22:08 How does call scoring work, and what does it mean? - 23:21 What should you consider before implementing Network Fraud Prevention? - 26:32 Network Authentication and Fraud Prevention Summary - 28:25 Introducing Chris Wade - 30:16 Question: What are the origins of this technology? - 31:09 Question: What impact has this technology had on your customers? - 32:10 Question: What surprised you about your early implementations? - 33:31 Question: What have you learnt from your customers? - 34:21 Discussion: Challenges of using Caller ID or ANI for Authentication - 38:22 Discussion: Risks to organisations outside financial services - 40:14 Question: How do you see this technology evolving? ## Transcript [00:00:00] **Matt Smallman:** Good afternoon and thank you very much for joining this afternoon's Modern Security Community session. I'm Matt Smallman. I'm the author of the book Unlock Your Call Centre, and my work is helping organisations improve the usability, efficiency, and security of their call centre Identification, Authentication, and Fraud Prevention processes. [00:00:16] But that's a bit of a mouthful. So, put a bit more simply, I do everything I possibly can to help people eliminate those time-consuming, frustrating, and often pointless security processes wherever I find them, which is what led to the formation of this community and today's session. [00:00:38] Whilst I think my client's results speak for themselves, there are only so many hours in a day. So I wrote the book Unlock Your Call Centre to provide a framework for others hoping to improve their organisation's security processes. [00:00:49] And recognising it takes a village to raise a child, founded this community to allow practitioners to share their experiences, to identify best practice and promote the application of modern security in a safe environment where you can be sure that other participants are your peers. I'll come onto what the term modern security means a little later in my presentation. [00:01:09] What I'm really hoping to do is to spin this flywheel: engage people who want to or are making the change, provide them with the information and support they need to make that change, which enables them to ultimately deliver it, have impact on their organisations and customers, which in turn provides the stories, information, and support that others need to make their change in their organisation. ### Introduction [00:01:32] Today we are going be talking about Network Authentication and Fraud Prevention. And over the next 20 minutes or so, I want to provide a primer on this technology and how you might apply it to your contact centre. I'm incredibly excited about the potential impact of this technology on customer authentication experiences far beyond the traditional financial services organisations that I have worked with and traditionally purchased this kind of advanced technology, and we'll look at more of that, why that's important, in a minute. I'm also gonna provide a bit of context on Modern Security, having a look at the background for this technology, and then spend some time in those Fraud and Fraud prevention use cases afterwards. [00:02:11] I'll be joined by Chris Wade from Smart Numbers, one of the pioneers in this field, who'll be able to answer mine and your questions on the realities of this. ### Convenience and security trade-off - Why do we need a more modern approach? [00:02:21] **Matt Smallman:** So how do we even get here? First off, and this is what this chart is supposed to illustrate, I think we all intuitively recognise that there's a trade-off between security and convenience. [00:02:32] As this background hopefully illustrates, the most perfectly secure system is almost certainly completely unusable, and the most convenient security is probably no security at all. So we can draw a trade-off that looks a bit like. Now, nearly every organisation requires some security, but particularly when we're serving customers remotely, we want that security to be reasonably convenient. [00:02:55] And when we started operating call centres, we took what was at hand, knowledge about our customers, and we implemented what's known as knowledge-based authentication: questions like date of birth and mother's maiden name. And they probably appear about here on this chart. Now, unfortunately, this presents a few challenges. [00:03:12] Some organisations have higher security requirements and they've implemented additional methods, generally accepting some form of trade-off, less convenience for more security, for those transactions that need them. We can think of things like PINs and passwords maybe here, and things like SMS one-time passcodes and hardware authenticators here. More secure, but less usable, I think we'll all agree. [00:03:37] Unfortunately, this relationship presents a few challenges. First off, from an organisation's perspective, it's difficult to move these dots to optimise for your customers' and organisation's real needs. How do you make a password a bit more secure or a bit easier to use if that's what customers are asking for, or your organisation needs to stop fraud? But more importantly, from an external perspective, [00:04:01] they're not really fixed at all. Our customer's perception of convenience and usability is increasingly driven by their experiences in other verticals and modalities. The fourth, eighth, and 12th letter of my password was never that convenient, but didn't seem to be a problem a decade ago when I couldn't unlock my phone with just my face. [00:04:20] But now I perceive it to be significantly harder that my bank makes me go through this effort. And fraudsters didn't stay idle either. They exploit the same technologies our organisations use to become more efficient and scale their operations accordingly, sending millions of texts and emails every day to trick customers into handing over these precious pieces of knowledge. [00:04:43] Ultimately, I believe these security methods trend to zero. They're neither usable nor secure in the long run. [00:04:49] What we need is a new relationship, a modern relationship, one that provides higher levels of convenience at any given level of security, and, importantly, gives organisations the ability and flexibility to choose exactly where on the curve they want to operate in order to meet their unique needs. [00:05:06] And I call this Modern Security. Before we get onto that, just to recap a little bit, and the different terminology I might use. ### The differences between Traditional, Transitional and Modern security methods [00:05:14] **Matt Smallman:** When I talk about traditional security, I'm usually talking about knowledge-based authentication, the kind we're all used to: my mother's maiden name, my social security number, my date of birth, information that, when we first started to operate call centres, was reasonably secure, mostly through its obscurity. Very few people knew it. [00:05:32] Then it was hard to find out; that now has. Everyone is providing service remotely. Everyone wants to know my mother's maiden name and date of birth, and you could probably go and figure both of them out right now from Facebook or LinkedIn. Account-based questions, similarly, when we only dealt with one or two organisations, were never that easy to remember, but at least they were few and far between, but now have become increasingly hard, and increasingly easy for fraudsters to obtain information relating to. [00:06:01] Some organisations, of course, recognise this and traded usability for security, and that's what I call transitional security. First off, they start with PINs and passwords, maybe SMS one-time passcodes or even hardware authenticators, and they did provide significantly more security [00:06:19] for a time, but as fraudster techniques and technologies evolve, their real security value has declined, and when compared to advanced methods, their usability is significantly lower. [00:06:31] Now, I need a password for everything, so most people, myself included, use the same or handful of ones for nearly every service I interact with and will gladly hand it out or add it to any new service I might subscribe to. [00:06:44] And organisation still can't make it more secure. It's deterministic. I need a whole new scheme if I want more security, with all the cost, complexity and disruption that entails. More recently, more organisations have started using SMS, and fraudsters have followed them down that route. [00:06:59] So if a fraudster can't intercept it, the volume that I'm asked to use on a daily basis means that the chances of some, or at least a few, customers handing out that information to fraudsters when they call is quite high. [00:07:11] And don't even get me started on hardware authenticators, the ultimate usability-for-security trade-off. I have a drawer full of them right here, but I never have them on me when I need them. [00:07:23] Which leads us on to Modern Security, and the Modern Security methods that we talk about are Voice Biometrics, Network Authentication and Fraud Prevention, which we'll cover in far more depth today, and Behavioural Analytics. ### Modern Security Method Properties [00:07:36] **Matt Smallman:** Now, all of these methods have some important properties that can be used to provide a significant and sustainable improvement in security and usability over those traditional and transitional methods. First off, they're passive. They require little or no customer interaction, significantly improving usability and hence adoption by both customers and agents. [00:07:57] They're probabilistic. They largely express their results in terms of confidence that the subject is who they claim to be, allowing organisations to establish an appropriate risk appetite for any given transaction. [00:08:08] They're dual purpose: they can be used for both authentication and fraud prevention purposes. So whilst an organisation may prefer, and I certainly prefer, authentication over fraud prevention every time, they can also be used separately, or in addition, for those callers where it's appropriate, for fraud prevention. And they're continuous: they're usable at different stages of an interaction, they can sometimes increase their confidence over time, and they provide organisations with a capability of providing strength through depth. [00:08:37] So let's take a little bit more look at Network Authentication and how that fits into this Modern Security approach. ### Where does the data for Network Authentication and Fraud Prevention come from? [00:08:46] **Matt Smallman:** To start off with, I want to look at how a call actually gets from your customer to your call centre. When your customer picks up the phone to call your organisation for service, they dial a number on their device, and that obviously goes to nearest cell tower, which is connected to the operator's backhaul network, which at some point, or many, will connect to a national carrier, which will eventually deliver it to your enterprise's telco, which will ultimately deliver it to your switch or to your internal network. [00:09:14] Now, whilst there is obviously the voice stream that your IVR and agent interact with, there is also a significant amount of associated data that allows the network to route the call and, importantly from their perspective, make sure that everyone gets paid for their part of it. [00:09:27] First off, no cell operator wants to allow somebody else's devices onto their network without the right authentication and hence link to a bill. So the cell tower makes sure that the device that's connecting to it is cryptographically proven to be the one that it's claiming to be, both the device and the SIM inside it. [00:09:45] The mobile network wants to find the most efficient route to the network, to the national carrier, who wants to make sure that the mobile network gets billed for the work it's doing and the service it's providing. And then they want to find the most efficient route to the telco, to the enterprise telco, who wants to make sure it's delivering and charging the customer correctly for the service. [00:10:04] And because this isn't one-way communication, a single message, each node in this network needs to know what happened before it and what happens after it so that the route can be maintained. Now, in most cases, all the data you see from this is the caller ID or ANI that's provided to your switch by the carrier. [00:10:21] And this is one of the real problems with this approach, because that data that you see is just relayed from the originating party through every other ones with very little validation or checking. It's not part of the routing that's critical for the voice stream or the carriers getting paid. So what Network Authentication and Fraud Prevention does is look behind those numbers, is to look at what's happening underneath in the network to assess the likelihood that the call is originating from where it claims to originate from, and to identify any other behaviour that might be considered anomalous or indicative of fraud. [00:10:56] Now, of course, this is a massive oversimplification of what is an incredibly complex network that's evolved over probably close to a century of international telecoms. But it's sufficient for our purposes right now. And as we delve into Network Authentication in more detail, it may be appropriate to go and look at some of the detail underneath this in a little bit more. Suffice it to say, though, this will work for today's purpose. ### What can analysis of network data tell us? [00:11:22] **Matt Smallman:** When we think about Network Authentication and Fraud Prevention, I like to think about the analysis it does in two buckets. The first off is what I call Provenance. That's about right here, right now: what can I tell about this particular call and this caller? [00:11:36] Analysis of the data enables me to understand whether the caller originated from where it claims to originate from, whether it was spoofed or not. I can check whether I know this caller, either as a fraudster as a customer, and I can combine it with other sources of data, such as mobile number or network intelligence, to give me some insight as to who this customer might actually be, where they're located, or even, in some jurisdictions, who they uniquely might be. [00:12:01] And the second bucket is behavioural. Observing this caller over time, what can we understand? Have you seen this caller before? How often do they call, and at what frequency? And what is that indicative of? Which accounts or customers does this caller claim to be associated with? And, similarly, what does that tell us about their legitimacy of their behaviour? [00:12:21] And all of this data gets combined together to inform an authentication or fraud detection decision appropriate for your organisation. So we're gonna look in a little bit more detail at both of those use cases and how this data might actually get used. The first, and I think the most simple, is authentication. ### How can we use this analysis for Authentication? [00:12:40] **Matt Smallman:** Whilst many organisations conflate these processes, ID and V, data privacy, security, I think it's important to make a distinction between Identification and Authentication. Identification is the process of establishing which customer in your systems this caller is claiming to be. And Authentication is about being sufficiently certain that they are who they claim to be to carry out the service they request. [00:13:03] In the case of Network Authentication, the Identification step is most often carried out using the caller ID or the ANI. Now, whilst everyone in the network gets to access this data, they have privileged access to this, and we only get to see this data as the end user if the subscriber allows us to access it and they don't withhold it. [00:13:23] Historically, this was always a challenge, to understand where these calls were originating from, but in a recent snapshot we did with Smart Numbers, we're able to identify that more than 97% of callers to UK organisations disclose their number on calling. The second challenge, then, is having got the number, I need to figure out which of the unique customers in my system of record it relates to. [00:13:46] Now, there may be many people in my household, there may be many people phoning from a single corporate exchange, but fortunately we also discovered that 76% of customers called using a mobile number. And we increasingly know that customers view their mobile number as a number for life and that they are increasingly prepared to use that for service provision rather than any home or fixed-line phone. In many cases, many younger generations have no fixed-line phones at all, and they're entirely dependent on their mobile, the number for which they intend to keep for posterity. And this simplifies the problems immensely. [00:14:21] Now, I can personally attest to the challenges of managing customer data, but I think just having this one mobile number allows very, very easy searches and is usually of higher quality than some of the legacy numbers we might have captured for people's home phones and the like, mostly because if it's not, it can't be used for purposes like text messaging. ### What does a Network Authentication business process look like? [00:14:43] **Matt Smallman:** The final key, then, is that network Authentication analysis solution itself needs to confirm that the number being claimed in those ANI and CLI fields that we receive from the carrier, which, remember, are not validated, that we can't really trust, is originating from the number that it claims to do, and that there are no other anomalies associated with their call. [00:15:03] And in this case, we should consider the caller authenticated as a customer for most purposes. [00:15:09] Importantly, and I think the critical power of this technology is that that can happen pretty much instantaneously, and certainly quicker than it's gonna take you to thank the caller for calling you today, or to ask them what they're calling about, or to tell them about their options in your menu system. Which means the call is authenticated right at the start and, subject to knowing what it is they want to do, we can route them into some of the amazing self-service features and capabilities that are available. [00:15:34] I always find it amazing to look at the sheer volume and capability that exists with natural language understanding and speech-driven systems today to have that real conversational discussion with customers. But, importantly, we can't really do anything for those customers until we're certain that they are who they claim to be. And that really is the powerful feature of Network Authentication and why I think it's gonna be so impactful for so many organisations as they invest in these self-service technologies. ### What should you consider before implementing Network Authentication? [00:16:04] **Matt Smallman:** Before we move on to fraud prevention, I do want to add a few slight caveats. We are clearly dependent on the possession of the device, which leads to two risks. [00:16:12] The first, that a related party could access it, either innocently or maliciously, and be incorrectly authenticated as the customer. This is an age-old problem, the husband-wife problem. And whether it needs mitigation really depends on the type of service you are providing. My wife knows all of my passwords, could access all of my services, and I don't really have a problem with that, and neither is there a lot of risk to those service providers. [00:16:36] The second, perhaps more concerningly, is that the physical theft of the device, or its electronic signature through the SIM, could allow an imposter to authenticate as the customer. And again, the impact of this risk depends on the nature of your business, whether it's worth the fraudster to do that, and whether you have the protections against identifying whether the device itself has been changed. [00:16:56] My expectation with both of these is that this kind of low-risk interactions, common in nearly every industry, don't require any stronger authentication, but that's clearly something that organisations need to decide for themselves. If you think mother's maiden name and date of birth is secure, then I guarantee you this is more secure. [00:17:18] In some cases, however, it may be appropriate for organisations to implement some additional step-up authentication, either because the risk of all their transactions or the risk of a certain number of transactions is more significant. [00:17:29] And that leads me to this diagram here on the left, taken from Unlock Your Call Centre: the sweet spot for Network Authentication. And where it really provides us value is in the huge number of low-risk, low-frequency interactions that every service organisation has to deal with, day in, day out. [00:17:46] Yes, there are more frequently calling customers who may be appropriate to enrol in Voice Biometrics solutions because the risk of the interaction or because the length of the relationship makes that worthwhile, and because the risk of imposters or related parties authenticating. But in many cases that's overkill, and the complexity associated with it really prevents those organisations from delivering better authentication experiences. ### Why is Fraud Prevention important for all call centres? [00:18:14] **Matt Smallman:** So, moving on and looking at the other use case, Fraud Prevention. [00:18:18] Before we look at how we use network data in this, I think it's important to remind ourselves the role the contact centre can play in fraud. Here's our typical fraud cycle, and I think the contact centre play different roles here. [00:18:33] If we look right at the start, we can see this acquisition phase. Now, many times fraudsters have obtained some information relating to a customer and they need more information in order to properly compromise that customer, whether that be with you or with a third party, their bank or another service provider. And our IVRs are ripe for that, because often we just recognise an incoming number. [00:18:56] You can enter an account number, and our behaviour will be different if we recognise it versus if we don't recognise it. And that's an easy opportunity for fraudsters to figure out which data is valid and which data is not valid. If they have obtained PINs or passwords from the dark web, to test those to see if they provide access to the account or not, in an unattended situation, and one in which we have very little data and unlikely to detect very well. So that's the impact in the acquisition phase. [00:19:23] In the reconnaissance phase, if I'm trying to understand a customer and their behaviour better, maybe to gain additional data or to escalate the privileges in a channel, the reconnaissance phase, again, in IVRs allows us to understand what the customer's balance might be, the date of payments they're making, what the bank those payments originate from, the cell provider they might be using. All of which helps the fraudster build a picture of this user, which allows them to be compromised either through the phone channel with you, through your online or mobile channels, or to take that data to a third party and compromise them in that location. [00:20:00] And this often leads to our iceberg analogy. In many companies I speak to, there is little or no fraud in the telephony channel because there is just very few transactions that have enough material risk for it to be worth people's while to do it. So very little is identified or detected in that channel because it doesn't appear to happen. [00:20:21] But actually those channels are being used to get the information that enables your customers to be exploited in either your other channels or with other service providers. So the iceberg analogy is really important here, and this is one of the unique properties of Network Authentication, that [00:20:38] almost instant decisioning allows us to make decisions about how we treat calls and what services we do or do not provide to them, and, after the fact, to understand the impact and the relationship between different customers and potentially different customers who've been compromised. ### How can we use the analysis of network data for Fraud Prevention? [00:20:55] **Matt Smallman:** So it's important to just go back and just look at those two buckets of analysis that we can provide and how those might apply to the fraud prevention scenario. [00:21:03] So we have the provenance, the stuff we can tell right here, right now. Spoofing of itself may not be indicative of fraudulent activity, but spoofing from some networks and some sources is more indicative than others. Some fraudsters may be known to us and some fraudster may be known to other providers. If we can see underneath the number, we can tie together even those callers who haven't disclosed their number to us, such that we can see that they are the same known bad actor and either prevent service or do something about it, which we'll come to in a second. [00:21:36] That's different. That kind of deterministic category is slightly different from our more behavioural analysis of the type of activity that is likely to be fraudulent. Have we seen this customer before? Is this number generally associated with this account? How frequently is this number, whether disclosed or undisclosed to us, seem to be calling us? [00:21:54] How many and which accounts does it appear to be related to? Now, this, again, is a gross oversimplification of some of the amazing work done by the data scientists under the hood of this technology, but it gives you an indication of the sort of thing that happens, and ### How does call scoring work, and what does it mean? [00:22:08] **Matt Smallman:** The general output of that is some form of score. And what we would generally expect, and coloured green for this specific reason, is that 90 or more per cent of our calls are going be categorised as low risk. They almost certainly are coming from the number they claim to be, and there are no anomalous behaviour associated with it indicative of fraud. [00:22:29] A proportion, mostly for behavioural reasons, will be assessed to have some greater risk. And the degree of risk within that is variable, and the actions you take within that are variable. And a smaller, and often infinitesimally small in terms of percentage points, maybe even less, 0.1 rather than 1% here, are deemed to be very high risk, almost certainly fraudulent activity, either because they originate from somebody we know, from a call or source or point origination we know to be fraudulent, or because other parties have told us about the fraudulent activity, or it's just really, really obvious in this interaction. [00:23:06] We then need to determine what to do with that score. And this is, I think, which leads on to the considerations, and these will vary immensely between industry and situation and company and even country. ### What should you consider before implementing Network Fraud Prevention? [00:23:21] **Matt Smallman:** A few things just to consider, and I'm not gonna go into too much more depth here, but the first off is about watch lists. [00:23:27] How do we build, maintain, and sustain a watch list of known bad actors? Do bad actors really recycle their numbers, or do they keep coming back to us? And, importantly there, I think one of the really valuable things that the organisations are starting to do is to share between each other. And hopefully Chris will talk a bit more about that later. [00:23:46] Just because somebody's in our watch list almost certainly means that they're likely to target other people later. Those devices are likely to be used against other organisations, and by sharing that information, we can be far more effective at identifying and preventing fraud, which leads on to the next thing. [00:24:03] What do we actually do when we get that score? I think the immediate reaction is you stop it dead. But if you refuse and deny service to that call, but that's really telling the fraudster everything they need to know about our methods and means, and will invariably result in them picking up another device and using that to carry out a similar attack. [00:24:22] It doesn't really stop them, and it doesn't really protect any of the customers or accounts that they're attempting to compromise. Most often we see, and recommend, is that this behaviour is observed and that the accounts that are compromised are protected in some other way, whether that be by restricting the activity they can do, by changing credentials, by informing the customer themselves. But again, something you need to consider when implementing this technology. [00:24:48] Another is: is this information itself sufficiently powerful to actually act on, or does it need to be combined with other data sources to make it effective? And again, in some organisations we see that's the case, like, they see so many spurious calls for quite legitimate reasons that they can't act on them unless there's some other indicator of fraudulent activity. [00:25:13] So, again, those scores can be ingested inside other fraud prevention and detection systems. Which leads on to how much effort do you really put into investigating those calls? And we see two types of work take place in this space. We see an immediate amount of work that needs to take place in order to allow transactions or to unlock accounts that may have been locked as a result of identifying fraudulent activity. [00:25:37] And then we see a longer-term investigative effort where potentially fraud is being reported to us, and by looking back over the data, over time, we can see that this number or this caller was associated with that fraud. And it's also associated with a number of other customers and accounts, which may not yet have either identified or even been defrauded, and we can then do something to protect it. So the investigative model, operating model, needs some consideration. [00:26:04] And then finally, I say use model a few too many times, possibly, but sitting underneath most of these things, and I'm sure Chris will talk about it later, we've evolved from a rules-based model into a machine learning, artificial intelligence, and those models always need data. They need data to train them, to tell them how to operate, tell them what a fraudster looks like and what a genuine caller looks like, so that they can be more effective the next time they're asked to make a decision. ### Network Authentication and Fraud Prevention Summary [00:26:32] **Matt Smallman:** Just to recap before we move on to the questions, then: Network Authentication and Fraud Prevention is an incredibly potent set of technologies that will enable far quicker authentication and far more effective fraud prevention decisions for organisations. [00:26:47] In the case of authentication, it really is dependent on good-quality data. Like, if you don't have the mobile numbers for your customers, then it's gonna be hard to identify them. We can be very sure that the number is coming from that mobile number, but if we can't link that with a customer, then it can be challenging. But the powerful impact is really that instantaneous decision that enables self-service of the kind that we really want to deliver to customers, that prevents them needing to speak to agents. [00:27:14] We are really on the cusp of some amazing breakthroughs in natural language understanding and artificial intelligence that allow us to deliver conversational experiences to customers like never before, as good as, if not better than, some of the conversations they might have with our agents. And the opportunity to both save cost and deliver better experiences is significant, but it hinges on Identification and Authentication. [00:27:39] Finally, then, you must also evaluate the related party risk. This is not right for every situation, but I would argue that in many it is the perfect form of authentication. [00:27:51] And on the fraud prevention side, it's a very powerful and effective tool for identifying this hidden fraudulent activity. It does, however, produce a probabilistic score, and that needs to be connected somehow to some form of activity. [00:28:04] The biggest consideration really is about whether that should be a standalone solution or combined with other mechanisms as part of an overall protection against Fraud. [00:28:13] So, with that, I'd like to thank you for listening to my short part and jump right over to our discussion with Chris, who is waiting on the line for us now. Hi, Chris. [00:28:24] ### Introducing Chris Wade [00:28:24] **Matt Smallman:** So, could you just give us a quick introduction to yourself? Tell us a little bit about yourself before we get started. [00:28:30] **Chris Wade:** Yeah, so I've worked at Smart Numbers for past four years. [00:28:35] I joined when Smart Numbers Protect was very much in the early stages. And as the product has matured and our customer base has grown, now, like I say, I look after the risk model that powers Smart Numbers Protect. So that means I spend a lot of time with our machine learning and data science teams internally, but also still very much on the front line with our customers, speaking to them nearly every day, helping with their fraud prevention and Authentication challenges. [00:29:02] **Matt Smallman:** That's awesome. So just, how did you find yourself in this area? They'd start off with, it's like it's new thing, isn't it? [00:29:08] **Chris Wade:** Well, so I'd worked at fintechs and in financial services long before joining Smart Numbers. So I was never really too far away from it. And then when you get a chance to help fix something that is very, very broken, you've really gotta take it. [00:29:23] So on one side you are stopping fraud, which, we know, rips apart people's lives. And on the other side you've got authenticating yourself over the phone, which everyone knows is, like you say, terrible. I mean, when I explain to people what I do and what Smart Numbers does, as soon as I say, "Oh, you know when you phone your bank," you see this red mist come down, that so many people have had so many bad experiences, and they just really stick with you. [00:29:51] **Matt Smallman:** That's all you need to talk to my mother-in-law. That's literally the conversation every time I walk through the door. It's like, "What are you doing about this?" Now, [00:29:58] I was gonna ask you what excites you about your job, but it's clear that that's the bit that excites you about your job. So I think it's worth just going on to our questions. [00:30:06] Then, obviously calls have been flying around phone networks for a long time, so why now? Why hasn't this been done for years? ### Question: What are the origins of this technology? [00:30:16] **Chris Wade:** So, Smart Numbers is a tech company, but our heritage has always been as a telecoms company. So for a long time, our core products was focused around call deliverability and operational resilience, making sure calls always get delivered, which is still a core part of Protect. [00:30:32] But as we were running the telephony for big banks, obviously they're experiencing fraud on some of these calls. Now, we're an Ofcom-regulated network provider, which means we got access to that carrier-level data that customers can't see. And you talked about a few slides ago, so customers were coming to us with requests to ask what could we see on those calls. [00:30:53] For example, a withheld call. And after this happened enough times, we really took that as a signal that this is a real problem out there for organisations that need solving, and it's very clearly not being solved by any of the other network operators. [00:31:08] **Matt Smallman:** That ### Question: What impact has this technology had on your customers? [00:31:09] **Matt Smallman:** That's how I came across you guys as well. So it is really interesting. Would you mind just telling us some of those first customers? What kind of impact have you had there? [00:31:19] **Chris Wade:** Well, the impact was nearly immediate. So in one pilot we ran, in the first month, we were able to link hundreds of what looks like, to them, completely unrelated calls. [00:31:30] We were able to link them all to one fraudster who committed half a million pounds' worth of fraud. In other organisations, we've pulled out very clear patterns of that IVR reconnaissance he talked about earlier, and we could link that to fraud that the banks had no idea had even touched the telephony channel, which, like I say, showed them the scale of the fraud happening and how much bigger telephony fraud is than they thought, like you mentioned. [00:31:54] And we also saw, through the Smart Numbers consortium, that the same fraudsters attack multiple banks. They don't have brand loyalty. And getting organisations collaborating to stop fraud is such a powerful tool, getting everyone working together. ### Question: What surprised you about your early implementations? [00:32:10] **Matt Smallman:** I mean, unfortunately, I've been on both sides of this problem. So I'm a little bit of a cynic, and I would say, I mean, it can't all have been plain sailing. What didn't go quite as you expected? [00:32:24] **Chris Wade:** So, in the early days, we had a rules-based system. It was very, very heavy based on certain rules that were either true or false. And one thing fraudsters are very, very good at is spotting rules and working around them. [00:32:38] So if you put in a rule that you have to wait 48 hours after adding a payee, then frauds will wait 49 hours and then just commit the fraud anyway. So we learnt about the adaptability of fraudsters, and maybe we underestimated them to begin with. [00:32:51] And the other thing with those black-and-white rules: it's not that clear-cut. Call frequency on its own doesn't necessarily mean that something is fraud. There are genuine reasons to call a bank multiple times, and those are genuine customers doing that. You shouldn't highlight them as fraud. I think those are big drivers of why we invested so heavily in our machine learning and in the consortium, because that's where we're seeing the best results. [00:33:16] **Matt Smallman:** And you see those as more powerful signal to the noise of everything that might otherwise happen in a call centre. [00:33:24] **Chris Wade:** Yeah, exactly. Spotting those patterns that you can do with machine learning models is a very, very good predictor of fraud. ### Question: What have you learnt from your customers? [00:33:31] **Matt Smallman:** So to what extent is feedback important in that process? How do you get feedback? [00:33:37] **Chris Wade:** So, broad patterns are quite consistent. We've seen, across our customers, fraudsters are doing similar things generally, but every bank, every organisation will have their own unique pattern. [00:33:55] So some banks might have a more international customer base, some might have different opening hours or different shift patterns. And getting that feedback to train specific or tuned models for a customer does really, really help spot those patterns and really separate the genuine customers from the fraudsters and make sure the right calls get looked at. ### Discussion: Challenges of using Caller ID or ANI for Authentication [00:34:21] **Matt Smallman:** That's fascinating. I guess just, we got double people on the call today, so I would encourage you, if you have any questions, to drop them into the chat or to the Q&A session, and we'll put Chris under pressure. I've just got a few more. [00:34:34] Like, I've seen first-hand, and people have told me about, the enormous benefits from the fraud prevention story. I guess when I look at this stuff, what I'm most excited about is, and I've spent most of my career working in large financial services, and actually I think we do quite a good job now of Authentication and creating as effortless experiences as, well, may not agree, as effortless experiences as we can do. [00:35:02] Or certainly, if we haven't done to date, like, we are doing it now, and customers will be experiencing it over the next few years. What I find most frustrating is everyone else. Yeah, it's the utilities, it's the telcos, it's the insurance providers. It's every other organisation I have to interact with, albeit less frequently, and maybe they don't have my money, but I think that's where the opportunity is. [00:35:28] So what's to stop them today just using, like, the caller ID that they're already getting in order to identify and authenticate their callers? [00:35:37] **Chris Wade:** I've seen CLI matching used. I mean, obviously banks use it, but I've seen it used everywhere from there to even estate agents. So people are aware of it, but even the average person on the street now knows how easy it is to spoof a phone number. [00:35:53] And if an organisation's got nothing in place to detect or stop it, then they're putting themselves at risk and they're putting their customers at risk. Now, as a network provider, we've got access to that carrier-level information, and we've got ways of knowing if the number is spoofed or not. [00:36:08] But as you pointed out, that's not the only way numbers can be compromised. Fraudsters or bad actors can take control of the number through things like SIM swaps and fraudulent ports. [00:36:20] **Matt Smallman:** I think that's a really interesting point, because today this data is not used for that purpose. It is not necessarily attacked in the way in which it could easily be attacked and compromised were it to be used for this purpose. [00:36:34] So I think, like, any organisation could start just trusting the CLI it's getting today and consider the customer authenticated and provide them with the information or service they want. But pretty quickly fraudsters are gonna figure that out and adapt and start to exploit that mechanism. [00:36:50] And I think that's where the risk is. It doesn't have longevity. But I think what you are talking about, being able to validate the number hasn't been spoofed, that it really does belong and has originated from the device that's claimed to originate from, really gives this mechanism some longevity and allows for those low-risk, low-frequency interactions, for all those organisations that deal with millions, billions of those every day, to authenticate their callers. [00:37:14] I think you just mentioned it, just an issue there that I think comes up quite a bit is the SIM swap risk. Like, so we talked about possession being important here. I talked about the theft of the device. I think it's always important in this to remember that the phone number is not actually the customer's property or the caller's property; it's property of the network. [00:37:34] And I'd just be interested to hear about what you consider to be the risks when people being able to swap their SIM over. [00:37:42] **Chris Wade:** Yeah, I mean, when we talk about people falling victims to scams, generally there's a lot of pressure nowadays being put on organisations further up the chain, like social media companies, for example. [00:37:53] Now, in that same vein, we are working with carriers to help them put in place protections against SIM swap and even their own vulnerabilities. We know with banks that fraudsters know every detail of their internal processes, and it's the same for telcos. It's the same for utility companies. Any organisation that has valuable customer data, fraudsters will find ways to get hold of that data, and it's on the organisation to stop that. ### Discussion: Risks to organisations outside financial services [00:38:22] **Matt Smallman:** I think that's a really important point. I think, when I talk to companies about this, it certainly, again, outside financial services, where the financial risk associated with the call is a lot lower, I think people just underestimate the reputational risk associated with it. [00:38:37] Like, if I can go to company, utility A, in order to get the security material and data that's needed to compromise them in bank B, then I'm just as liable. And if the public finds out about that, then actually the reputational impact on my brand could be far more significant than any financial loss I might get from somebody sending me an incorrect meter reading, for example. [00:39:01] So I think it's a really important and well-made point. So, Jason's asked: how often do fraudsters show up as a withheld or block number, versus simply change the number they're using over time? [00:39:14] **Chris Wade:** So that's quite an interesting one. When we speak to organisations, they think that once a fraudster is rumbled and their number is added to that watch list, [00:39:26] the organisations used to think that the fraudster would ditch that number immediately. And what we'd see, and we'd saw evidence of this behaviour, is the fraudsters would simply withhold their number and just carry on as before. So they may change their number now and again, and sometimes we can see them cycling through different SIM cards on the same device, and we can link them together from the device. [00:39:52] But often, if there's no protection against callers from a withheld number, there's no way of detecting if it's a known fraud or just somebody who is withholding their phone number for a genuine reason, then the fraudsters won't change their number, because they don't need to. They'll just go the path of least resistance, which can be withholding their number as soon as they're rumbled. ### Question: How do you see this technology evolving? [00:40:14] **Matt Smallman:** No, I think it's a really, really good point. I'm just gonna ask you one more question. Where do you see this stuff going? How do you see it evolving? What was it like to look forward? [00:40:24] **Chris Wade:** Oh, that's a question. [00:40:27] **Matt Smallman:** Sorry, it wasn't on the list I sent you, so it's a bit unfair that [00:40:30] **Chris Wade:** Yeah, that's possibly the one I would like most prep for. I think I really see it going very omnichannel. So the line between calling and going through the apps on your phone or on the website, I think those lines are gonna blur more and more. So linking everything from the telephone calls you make to the chat interactions you might have on the website or through an app, [00:41:01] I think there's gonna be more of a consistent thread in Identification and tracking through those. So, and that will help build up a better profile of who a customer is and also, conversely, who a fraudster is, and those kinds of behaviour. [00:41:17] **Matt Smallman:** Yeah, I think that's certainly the behavioural analytics bucket we have in modern security, is, I think, you've got like an in-session behaviour, like, and that's a lot of what network authentication's about, is about like what they're doing right now in this session. [00:41:31] But then when you bring that out and look across all of their sessions and all of the interactions that our customer has, and the degree of variation those are from the mean or from expected patterns, I do think that's where the big opportunities for certainly fraud prevention are. I do worry about whether, at some point, [00:41:49] like, Authentication becomes too behind the curtain and cryptic for customers and users to feel that they're actually secure in their interaction. Like, if we do too much of this stuff magically for them, how secure do they really feel in that interaction? But I think that's probably a topic for another day.