Opening Keynote Speech on “Time for an even more coherent response to Fraud” at Fraud and Financial Crime Asia Summit 2024
Speeches
21 May 2024
Opening Keynote Speech on “Time for an even more coherent response to Fraud” at Fraud and Financial Crime Asia Summit 2024
Carmen Chu, Executive Director (Banking Supervision), Hong Kong Monetary Authority
- Good morning everyone. It’s my pleasure to address the Fraud and Financial Crime Asia 2024 and my thanks to Regulation Asia for this opportunity again to exchange views and engage with stakeholders in the ecosystem.
- If I ask this group how many have had a personal experience of fraud, I am guessing the numbers may be quite low based on the industry you are working in and the demographics of the group. However, if I rephrased that to ask you how many knew somebody else – a family member or close friend - who had been a victim of fraud, then I dare say the numbers would shoot up.
- Whatever we want to call it: fraud, deception, scam, con, cheat etc., the fact is fraud in all its various guises, and more often than not perpetrated as cybercrime, is impacting the daily lives of millions of individuals and businesses globally.
- Scams are cheap, easy to set up and can be upscaled on an almost industrial basis, with the scammers operating anonymously online and at arms-length from victims, opening and operating bank accounts remotely to launder funds through networks of mule accounts.
- The techniques used by fraudsters are getting more sophisticated, and despite our best efforts at raising public awareness and the all-too-often warnings, individuals remain highly vulnerable in our global digital economy. In fact, as we speak, thousands of frauds may be taking place, achieving in minutes and hours what took months in “old-fashioned” cold calling boiler rooms.
- So let us be clear in our intent. Tackling fraud in all its guises remains one of our most important global and regional priorities since fraudsters always try to find the weakest link. Our efforts to claw back losses, including asset recovery, are not yet where they should be, and therefore confidence in the digital delivery of financial services could be threatened; indeed we are already seeing examples of people going “offline” to protect oneself.
- You might ask whether we are moving backwards? No, but one may argue that we are not going forward fast enough either.
- So an important question for all of us to consider today is how best to harness the benefits of technological banking advancements while mitigating digital fraud risks with appropriate safeguards – and I include in this broad term – increasing customer awareness, enhancing banks’ cybersecurity arrangements, the ability to detect and respond in real time, supported by forward-looking supervisory and regulatory measures.
- There is also considerable debate, and action in some jurisdictions, regarding reforms to legal frameworks and sharing responsibilities for compensation. This debate is most welcome, but one further question: will placing exclusive responsibilities on financial institutions for compensating victims fully solve the problem?
- Globally and regionally, there is also considerable traction to bring enabling sectors to the table as part of an ecosystem approach, such as social media platforms, telecoms etc. – this of course is vital, everyone in the system from victim, telco, social media platform, as well as financial institution, needs to be incentivised to address this issue collectively.
- And how can these efforts form part of a broader and more coherent response to fraud across the region?
- I should mention the positive developments contributing to a collaborative ecosystem response to fraud: multi-disciplinary risk assessment and management, information sharing partnerships as well as tactical interventions in the region including Hong Kong, are helping to enhance resilience and response of the whole system against evolving threats from digital fraud.
- The surge in digital fraud over recent years, fuelled by the growing popularity of online shopping and e-commerce, have prompted an enhanced understanding across a number of risk disciplines at financial institutions, regulators as well as law enforcement agencies. Digital fraud involves technology, operational, money laundering and reputation risks, and while these risks are manageable at the moment, large-scale or high-profile cases could affect customer confidence in financial services, and thus potential financial stability implications. In response, all relevant stakeholders are joining up for a coordinated approach for prevention, detection and disruption of fraud as well as confiscation and recovery of crime proceeds.
- A good example is the launch of a suspicious proxy ID alert mechanism by all retail banks in Hong Kong last November, leveraging the value of high-risk alerts based on a match with the Scameter database of the Police to promptly warn customers where a faster payment transaction is potentially scam-related. Our analysis of how these alerts are used suggests they are effective in preventing a large volume of high risk transactions, although there is still work to do in terms of public awareness of the mechanism, and in cases where payments are proceeded with regardless of the alert, what further actions or analysis may be appropriate on the part of the bank. We are now working further with banks and law enforcement agencies to enhance these efforts, the next step being the introduction of additional fraud alerts for internet banking and intra-bank transactions, which will be launched very soon in the coming weeks.
- Secondly, information sharing has been enhanced to tackle fraud and related mule accounts through expanding public-private partnership, including for example co-locating bank staff alongside Police officers as part of the Anti-Deception Alliance established in Hong Kong last November. I am aware other similar initiatives exist in other regional centres. Meanwhile, bank-to-bank information sharing has also demonstrated its value through pilots or practical experiences, and so we are seeing legislative and regulatory support globally and regionally for more banks and more information, from corporates to personal, sharing for the purpose of crime prevention and detection.
- The list goes on. From operational and technology risk perspectives, preventive measures were taken to increase friction against fraudsters’ unauthorised transactions, while enhancing the ability of banks and customers to detect suspicious activities and empowering customers with more controls over their e-banking and credit card accounts. For example, there has been a sharp drop in unauthorised card-binding activities, from over 60 complaint cases in Q1 2023 to nil after banks have promptly implemented additional authentication for binding payment cards with contactless mobile payment services.
- The common theme in all these initiatives is the ecosystem approach, which recognises that this issue will not be solved or fixed by any single agency. Bring more parties to the table and increase the tool box.
- BCBS’s work on digital fraud as well as sharing of the latest modus operandi and anti-malware controls, for example, have enabled a swift and collective response to the emerging threat. At the same time, FATF’s recent focus on cyber enabled fraud is also very welcome, as is the President’s initiative on asset recovery. These all help. But what comes next? A standard on information sharing? A regional anti-scam centre? And how will the international groupings showcase what works under an ecosystem approach?
- There is no doubt in my mind that as part of the move towards effectiveness and outcome-focused work, the understanding of the lifecycle of a financial crime, and being able to take action mitigating the various stages and opportunities for intervention, is a critical component to success.
- To do so, within banks and supervisors, collaboration is growing across different risk disciplines including anti-money laundering, cybersecurity, operational resilience, and mitigating potential implications to financial stability. Public-public, public-private and private-private partnerships across financial regulators, law enforcement agencies, banks, telcos and other relevant stakeholders can deliver real changes if we equip and empower them to do so, mindful of the need for safeguards around data sharing. For instance, fraudsters extensively utilise social media platforms to disseminate phishing messages, significantly accelerating the spread of digital fraud. Closer collaboration with Fintech and Regtech communities, and the innovative use of traditional and non-traditional data, are key to any measure of success.
- The HK experience is that where meaningful coordination takes place, in established frameworks across the public and private sectors, alongside bilateral and multilateral collaboration, we are better able to deliver the results we aspire to helping prevent and detect more fraud, and thus protecting banks and their customers from financial losses and often emotional harms so caused.
- The creation of such frameworks across the region cannot wait, we are being judged against public expectations around all aspects of the fight against fraud – legislation, regulation, measurement of success – how far do we achieve effective outcomes leveraging on data, technology and collaboration?
- It’s time for an even more coherent response to Fraud regionally and globally. On that note, I look forward to a fruitful discussion today. Thank you.
