Where is the fraud going next? I like this question and I was asked to opine on it last week at the Featurespace User Conference. My answer is that fraud will continue to focus on Customers, it will seek out system Changes, it will probe and attempt to bypass new Controls, and it will be channeled to weaker F.I.s by what Competitors are doing. Here is the rundown on eleven probable paths:
Customers - will continue to be victimized by Scams until the Scam Kill Chain is vastly improved
Customers - banks will see a shift to First Party Fraud as IDV controls and Doc V controls continue to improve
Customers - will be victimized by AI driven voice/video presentation attacks (e.g., Deepfake version of BEC)
Change - fraudsters will always attack new products and access channels, they are also adept at finding weaknesses in system / platform upgrades
Controls - trust but verify your black box vendor controls (they all have gaps); accept that anything that has become ubiquitous is under attack (e.g., SMS OTP); any control suffering from tech debt will eventually be uncovered and exploited (e.g., Check Fraud Controls); any control that has some element of manual fallback processing is ripe for exploitation (e.g., PW reset); and any control that spans two or more channels is subject to exploitable race conditions.
Competitors - be mindful of the security and product enhancements that your competitors are making as they might be shifting the fraud to you (e.g., Branch IDV for non-customer check cashing, account linkage controls for API P2P connections).
I'm sure that there are lots of other places that fraud is going next. Feel free to add to this list. Thanks!