While bank account takeover represents more than half of all fraud cases for customers in India, there is a concerning bump in mule accounts used in these frauds, according to a report.
BioCatch, a leader in digital fraud detection powered by behavioural biometric intelligence, released findings from its report '2024 Digital Banking Fraud Trends in India'. It says, "Accounting for 55% of all fraud in India, third-party account takeover fraud still represents a bigger slice of the fraud pie than the social engineering scams BioCatch sees exploding elsewhere on the planet."
The report says banking mules is a massively under-reported plague. It notes a concerning bump in mule accounts in India, in line with what BioCatch data shows as a growing global threat. "Every device found to participate in mule activity in India logged into an average of 35 accounts each," it added.
BioCatch found nine out of every 10 mule accounts went undetected at one partner bank in the country.
"The prevalence of mule accounts potentially represents the most under-the-radar trend in the entire fraud space," says Tom Peacock, director of global fraud intelligence at BioCatch. "The mule accounts banks succeed in identifying almost certainly represent just the tip of the iceberg. Indian financial institutions must employ more robust security measures to both detect and then shut down these sprawling mule networks."
Referring to the Reserve Bank of India (RBI)'s recommendation to financial institutions to abandon text-based one-time-passcodes as a method of secure authentication, Charanjeet S Bhatia, counter-fraud expert and former head of group fraud risk and investigations at First Abudhabi Bank, says, "The existing one-time passcode (OTP)-based authentication does not protect customers against new-age frauds, including customer-initiated fraudulent transactions. With the right technology and implementations, banks can do a lot more than what they are currently doing to protect customers."
BioCatch's report underscores the urgency with which Indian banks must bolster their fraud defences.
"The fraud threats we see in India are a mix of both common threats seen globally and unique threats we find only in this region," says Richard Booth, BioCatch's APAC vice president of sales. "All around the world, we are seeing explosive growth in mule activity, fraud attacks, and scams that grow more sophisticated by the day. To combat this onslaught of fraud and financial crime, BioCatch continues to believe that banking and financial institutions need as much intelligence on the criminals, their tactics, and their fraud arsenals as possible. Our India report provides much-needed intel and hopefully spurs these banks to rapidly adopt advanced defences to stay ahead of a ceaselessly innovating group of fraudsters and criminals operating domestically and around the globe."
Here are the key findings from BioCatch's report...
• Account takeover attacks still dominate: Accounting for 55% of all fraud in India, third-party account takeover fraud still represents a bigger slice of the fraud pie than the social engineering scams BioCatch sees exploding elsewhere on the planet.
• Mules a massively underreported plague: Every device found to participate in mule activity in India logged into an average of 35 accounts each.
• Fraudsters likely accessing Indian mule accounts from outside the country: While 86% of the first session of documented mule account activity came from within India, after a month that number fell to just 20% - and 16% of those sessions used a VPN.
• BioCatch customers saw more mule activity (14% of the total) in Bhubaneswar than anywhere else in the country: Lucknow and Navi Mumbai accounted for 3.4% of recorded mule activity, two cities in West Bengal - Bhagabatipur and Gobindapur - 1.7% and 2.6% respectively, Mumbai 2.2%, Bengaluru 1.8%, and Cuttack 1.6%.
