# How behavioural biometrics can help financial organisations tackle complex ATO
Author:  Pal Sinha, Barnali 
Author URL: https://financedigest.com/author/pal-sinha-barnali
Published: 2021-09-14
Category: FINANCE
Category URL: https://financedigest.com/category/finance
Meta Title: Advanced ATO Techniques: The Growing Threat of Account
Meta Description: Discover the growing risks of ATO and deepfake technology, and how financial organisations can stay ahead of cybercriminals with new innovative technologies.
URL: https://financedigest.com/how-behavioural-biometrics-can-help-financial-organisations-tackle-complex-atohtml

![undefined](https://prod.superblogcdn.com/site_cuid_cm5qst7v3003gwirgwqtxn8i8/images/close-up-of-a-financial-report-with-the-silhouettes-of-business-people-in-the-backgrou-sbi-300726171-1736837893229-compressed.jpg)

![](https://prod.superblogcdn.com/site_cuid_cm5qst7v3003gwirgwqtxn8i8/images/richard-da-silva-450x450-1736837893222-compressed.jpg)

_By **Richard da Silva,** VP EMEA at Revelock_

Account takeover (ATO) occurs when a cyber-criminal poses as a genuine customer, for example by using stolen credentials, or hijacks them mid-session in order to make unauthorised transactions. There is a vast and growing range of techniques and technologies bad actors can leverage to take over the accounts of legitimate users in order to steal funds.

What’s more, advances in technology have led to a rise in new, more complex forms of ATO that an increasingly sophisticated and technically-experienced generation of fraudsters are taking advantage of – leading to an ever more lucrative fraud landscape for the cybercriminals, and consequently an endless game of cat-and-mouse for fraud [prevention](https://www.financedigest.com/payroll-fraud-and-how-to-prevent-it.html "Payroll fraud and how to prevent it") teams that are often left overwhelmed with fraud alerts. In order to get one step ahead of cybercriminals, and both ensure account security for and maintain trust with legitimate customers, [financial organisations need to look at leveraging new and innovative technologies](https://www.financedigest.com/how-financial-services-companies-can-successfully-utilise-low-code-and-no-code-technologies.html "How financial services companies can successfully utilise low-code and no-code technologies") themselves to guarantee they can authenticate users and establish without doubt that they are who they say they are.

**ATO techniques are becoming increasingly complex**

[Technologies are emerging that allow cybercriminals to impersonate other people](https://www.financedigest.com/the-start-up-using-technology-to-help-the-20-million-people-in-britain-with-money-worries.html "The start-up using technology to help the 20 million people in Britain with money worries") to a startling degree of accuracy and believability. For example, MyHeritage has recently launched[‘Deep Nostalgia’](https://www.myheritage.com/deep-nostalgia) which uses AI-powered software to reanimate photos – giving families the chance to see their old relatives ‘come back to life’. This includes animating photos to do and [say things that the real person](https://www.financedigest.com/professionals-in-the-finance-sector-say-they-want-their-personal-data-edited-or-deleted-when-gdpr-comes-in.html "Professionals in the finance sector say they want their personal data edited or deleted when GDPR comes in") themselves **never actually did or said**.

And it’s not just a person’s appearance that can be stolen – there now exists [technology that can perfectly](https://www.financedigest.com/psd2-open-banking-the-perfect-marriage-of-technology-and-regulation.html "PSD2 & Open Banking: The perfect marriage of technology and regulation") clone an individual’s voice too. Again, this was created with good intentions:[VocaliD](https://vocalid.ai/)’s AI-powered technology was set up as an extension to the founder’s clinical work – aiming to give a voice to patients who otherwise could not talk, for example due to surgery.

These innovations, however, relate to the worrying rise of ‘deepfakes’, which have garnered recent [media attention due to the associated risk of political and social](https://www.financedigest.com/ai-and-social-media-are-revolutionizing-personal-finance-in-2023.html "AI and Social Media Are Revolutionizing Personal Finance in 2023") manipulation.[A prominent example](https://www.theguardian.com/technology/2020/jan/13/what-are-deepfakes-and-how-can-you-spot-them) of a deepfake in the wild is one that appears to show Mark Zuckerberg apparently celebrating his “total control of billions of people’s stolen data”.

It’s clear to see why the development of [technology that allows a person’s image](https://www.financedigest.com/ai-created-images-lose-u-s-copyrights-in-test-for-new-technology.html "AI-created images lose U.S. copyrights in test for new technology") and voice to be perfectly replicated is readily exploited by bad actors looking to perpetrate complex ATO. It provides a path to convincingly pose as either legitimate customers when faced with a bank’s security, or as a spokesperson from the customer’s [bank during attempted phishing attacks](https://www.financedigest.com/attacking-banking-and-fintech-fraud-head-on-through-ai-infused-strategies.html "Attacking Banking and Fintech Fraud Head-On Through AI-Infused Strategies ").

When fraudsters can look and sound exactly like a genuine customer and, in a post-breach world, have access to millions of sets of legitimate account details, how will [financial organisations](https://www.financedigest.com/can-financial-services-organisations-harness-data-and-bi-to-catch-up-in-the-digitalisation-race.html "Can financial services organisations harness data and BI to catch up in the digitalisation race?  ") be able to tell the difference between friend and foe?

**What does this mean for** [fraud prevention?](https://www.financedigest.com/fintechs-want-fraud-prevention-taught-in-schools-as-britain-becomes-a-passwordless-society.html "Fintechs want fraud prevention taught in schools as Britain becomes a passwordless society")

The increasing sophistication of technologies bad actors are using to perpetrate [online fraud are causing problems with various methods of authentication and fraud prevention currently being deployed by financial](https://www.financedigest.com/5-steps-to-strengthening-your-online-financial-security.html "5 Steps to Strengthening Your Online Financial Security") institutions. For example, the startling accuracy of present-day deepfakes [demonstrates that solutions founded in physical biometrics](https://www.financedigest.com/demonstrating-contactless-card-payment-with-biometrics-by-fingerprints.html "Demonstrating contactless card payment with Biometrics by Fingerprints") – such as facial recognition software – are no longer secure in isolation.

What’s more, modern complex ATO techniques can also undermine the effectiveness of fraud [prevention tactics such as multi-factor authentication](https://www.financedigest.com/how-strong-customer-authentication-can-prevent-cart-abandonment.html "How Strong Customer Authentication can Prevent Cart Abandonment"), including the hijacking of One Time Passcodes (OTPs). For example, SIM swap fraud – where bad actors [manage to switch an innocent person’s mobile](https://www.financedigest.com/managing-mobility-in-the-enterprise-must-have-consideration.html "Managing mobility in the enterprise must have consideration") number onto a new device in their possession – has seen a huge uptick in popularity among threat actors in recent months. To achieve SIM swapping, cybercriminals simply [need to convince the mobile provider in question that they are a legitimate customer](https://www.financedigest.com/why-empathy-needs-to-sit-at-the-heart-of-bbls-and-cbils-customer-service.html "Why empathy needs to sit at the heart of BBLS and CBILS customer service") – which is now easier than ever with advanced voice-cloning and deepfake technology. Once they’ve re-routed a customer’s number to their own phone, the criminal will receive the OTP in their stead and so bypass the extra factor of authentication set up to stop them.

**Use technological innovation for good**

Fortunately, just as advances in technology have led to more types of complex ATO, they have also led to [innovations in fraud](https://www.financedigest.com/2021-predictions-less-fraud-shifting-consumer-behaviour-and-accelerating-pace-of-innovation.html "2021 predictions: less fraud, shifting consumer behaviour and accelerating pace of innovation") prevention solutions. The foremost of these is the analysis of users’ [behavioural biometrics](https://www.financedigest.com/id-finance-transforms-customer-authentication-with-behavioural-biometrics.html "ID Finance transforms customer authentication with behavioural biometrics").Whereas physical biometrics can be replicated and leveraged in impersonation attacks, behavioural biometrics are unique to each and [every user](https://www.financedigest.com/rabobank-to-monitor-the-real-time-experience-of-every-customer-and-user-for-all-services.html "Rabobank to monitor the real-time experience of every customer and user for all services") – a bit like a digital fingerprint.

[Financial organisations can analyse thousands of parameters related to a user’s online interactions, such as typing speed, touchscreen pressure and more, in order to create unique ‘BionicIDs’ for each user that **cannot be replicated.** In short, an approach to online fraud prevention founded in behavioural biometrics focuses on asking each user the fundamental question: “Are you really **you?” And in an age when both fraudsters and the technology they use are becoming increasingly intelligent, financial institutions’**](https://www.financedigest.com/the-future-of-financial-institutions-in-2023.html "The Future of Financial Institutions in 2023") best defence is to know their customers inside and out.

**Automation is technological key to effective fraud prevention**

[Considering the scale and sophistication of modern fraud attacks](https://www.financedigest.com/over-half-of-organisations-would-consider-using-cryptocurrencies-for-business-transactions-though-8-in-10-acknowledge-the-increased-risk-of-associated-ddos-attacks.html "Over half of organisations would consider using cryptocurrencies for business transactions, though 8 in 10 acknowledge the increased risk of associated DDoS attacks"), alongside the ever-advancing nature of technology, it is no surprise that traditional prevention methods can no longer keep up – a human-powered approach alone is simply not enough.

Behavioural biometrics analytics is innovative in that it can be layered with other authentication methods, as well as deployed alongside [artificial intelligence](https://www.financedigest.com/types-of-artificial-intelligence.html "artificial intelligence") and machine learning technology. This combination of behavioural biometric analysis with advanced AI means a solution will become more and more accurate to each user, causing a [financial institution’s](https://www.financedigest.com/what-the-future-holds-for-financial-institutions-in-2023.html "What the Future Holds For Financial Institutions in 2023") fraud prevention strategy to become increasingly effective over time.

Financial organisations should also look to the enterprise cybersecurity industry for inspiration; it is striding ahead in terms of automating [fraud detection](https://www.financedigest.com/the-clues-to-detecting-fraud-are-hidden-in-relationships.html "THE CLUES TO DETECTING FRAUD ARE HIDDEN IN RELATIONSHIPS") and response capabilities to block attempted attacks. In particular, what was once a manual alert system has now become a fully **automated** process, which moreover spreads across an enterprise’s **entire** technology stack through a **single** Extended [Detection and Response](https://www.financedigest.com/endpoint-detection-and-response-market-is-projected-to-expand-at-a-cagr-of-21-from-2020-to-2030-tmr.html "Endpoint Detection and Response Market Is Projected To Expand At A CAGR of 21% from 2020 To 2030 | TMR") (XDR) platform. The introduction of automation means potential threats can be responded to in [real time](https://www.financedigest.com/its-time-for-real-time-accountancy.html "It’s time for real time accountancy "), blocking fraud before it can occur, while fraud analysts are freed up to focus on complex and higher-level threats such as intricate networks of mule accounts that could already be hiding in a bank’s system.

In the age of increasingly sophisticated attack vectors such as deepfakes, an approach to fraud prevention founded in behavioural biometrics can comprehensively establish that each legitimate [customer is who they say they are and are not being impersonated or manipulated throughout their entire online](https://www.financedigest.com/online-marketplaces-embracing-embedded-finance-to-benefit-both-customers-and-vendors.html "Online marketplaces: embracing embedded finance to benefit both customers and vendors     ") journey.


---
This blog is powered by Superblog. Visit https://superblog.ai to know more.
---