Banks act as a single anti-fraud

The largest banks of the Russian Federation want to join forces with the Central Bank in order to develop a common anti-fraud monitoring system for the entire market. It will track information about suspicious transactions online and transmit it to all participants. Sberbank and VTB believe that the system can become a real measure to combat social engineering. But the project will be effective only if all players are required to participate in it, which can be costly and technically difficult for small banks, experts warn.

At the Cybersecurity in Finance forum in Yekaterinburg, Sberbank and VTB made a proposal to develop a common system for the entire market to combat fraudsters who steal citizens’ funds using social engineering. “It is necessary to create a single resource for all banks that would automatically track suspicious calls and transactions online and warn banks about them,” explained Stanislav Kuznetsov, deputy chairman of the board of Sberbank. what we can do is to warn colleagues.”

As Mr. Kuznetsov explained to Kommersant, banks will be able to see the suspicious activity of a fraudster “literally at the moment when he is only talking to the victim on the phone.”

“This may be a system into which the necessary data is entered so that online ML models work out and block emerging suspicions with even greater accuracy,” said Vadim Kulik, Deputy Chairman of the Board of VTB. The head of the Central Bank, Elvira Nabiullina, suggested that the system could be created within FinCERT. She clarified that this would not be information confirmed by the Bank of Russia, but information about suspicious transactions exchanged between banks.

Experts agree that combining many different anti-fraud systems can be an effective measure. According to the chief expert of Kaspersky Lab Sergey Golovanov, if the bank transfers money to an account that was marked as fraudulent, the funds will be returned to the victim by a financial institution that had information about potential risks, but carried out the operation. As a result, the number of fraudulent transactions will potentially decrease, and the share of returns will increase, he believes.

However, Dmitry Kuznetsov, director of methodology and standardization at Positive Technologies, warns that the system can only be really effective if it covers both the sending bank and the receiving bank.

At the same time, a Kommersant source in the payment market emphasizes that it can be very technically difficult to implement such a project. “Exchanging data between Sberbank and VTB is a fairly easy task, and it can give a good effect, but only to the clients of these two banks. Building a system that includes many participants at once will raise the question of who this association will be around, ”says the interlocutor of Kommersant. FinCERT, in his opinion, does not have sufficient experience in the exchange of information in real time, nor resources. “In the end, everything will come down to the fact that Sberbank, as the owner of the largest database, will say that there is no need to reinvent the wheel, join my antifraud, and start downloading data from other banks,” the Kommersant source said.

Information security specialists have no doubts that “in the end, the system will become mandatory for all banks, although its introduction will be costly.” Fedor Muzalevsky, director of the RTM Group technical department, clarifies: at the forum it was said that all large projects and systems would first be tested on large banks, and then the expertise would be transferred to small market participants, and just by the forces of large financial organizations. Probably, the expert believes, the creation of the system will cost millions of rubles. Muzalevsky is sure that joining it will be made mandatory, and the Central Bank “made it clear that it is not interested in the expenses of banks.”

Maxim Builov, Yulia Poslavskaya