Pub. 11 2021 Issue 1

21 PUB. 10 2020 ISSUE 4 its operating system, web browser, hardware properties, languages installed, etc. Each element makes the bad actor’s job more demanding since they either need to figure out how to fake everything or go out and buy a new device for each account that they open. Adding device fingerprinting capabilities can suddenly surface connections across accounts that may look wholly unrelated and otherwise completely normal, allowing you to ask some pointed questions about why they all appear to be connecting through the same device. The prior two categories of data add technical complexity to any effort to circumvent a bank’s controls. That complexity requires time and money, but it is still possible for more sophisticated bad actors to find their way through. w Behavioral signals are the final and perhaps most potent category of data to capture. Behavioral analytics tools have become more sophisticated in recent years as tech companies understand how their customers interact with their products. Knowing where the customer was tapping the screen was incredibly valuable for designers seeking to provide the best possible experience and advertisers who wanted to know the best placement for an ad. Conveniently for bank AML teams, those same signals are clear indicators of abnormal customer behavior. Considering bad actors’ perspectives once again, it is important to remember that they also have daily lives to live. They do not want to sit at a desk and manually manage every compromised account, so they design software bots to help them. A bot interacting with its platform will look very different from a real person from a tech-savvy bank perspective. Even if there are no bots in use, there is still a good chance that the account will show signs of abnormal behavior in terms of when customers interact with the product, how long they are in the product, and what aspects of the product were used. It is also likely that they will be checking in on all of their accounts simultaneously, so the bank may see spikes in activity across many accounts that don’t look to be related to one another. Where does this leave the bad actors? When faced with a bank that has invested in augmenting its technology stack with the ability to gather all of this additional data, they are likely to take their “business” elsewhere. w Matthew Van Buskirk is co-founder and co-CEO of Hummingbird.