Financial fraud is big business for cybercriminals, with the Federal Trade Commission (FTC) estimating that $5.8 billion was lost to scams in 2021, a 70% increase from 2020.  

To fight the threat and help maintain compliance, several banks have turned to bots and robotic process automation (RPA). 

Ally Financial, for example, has partnered with San Francisco-based tech company Informed.IQ to fight identity fraud, according to Kevin Faragher, senior director of product and strategy at the $188 billion lender.  

“We are using RPA to comb through … deposit records and patterns, trying to find … things that are out of the ordinary so that we can be proactive in trying to catch up,” Faragher said in September at Bank Automation Summit Fall 2022. 

Pattern recognition, defined rules are key 

Fintechs and financial institutions are constantly updating RPA technology to flag fraudulent patterns and suspicious behavior to stay ahead of potential fraudsters.  

Cleveland-based KeyBank, for example, uses its own bots to help deter cybercriminals through analytics and advanced modeling that identifies questionable behaviors, Jen Martin, head of enterprise fraud services at the $139 billion bank, told BAN. 

“[KeyBank’s] enterprise fraud services and the process digitization team work closely together in an agile approach identifying use cases where bots can make an impact on fraud avoidance and/or process efficiency,” Martin said. “The bots are built and staged to test effectiveness and impact. Once tested, new bots are brought into the production environment and monitored.” 

RPA’s primary goal is to “minimize manual interactions on a case or investigation” to help automate the aggregation of case information, keep up with changing risk factors and help protect against “ever-changing fraud threats at a high velocity,” she added. 

RPA provider UiPath similarly uses pattern recognition to keep its bot rules up to date as threats evolve, Nitin Purwar, senior director, banking and financial services industry at UiPath, told BAN. The $839 billion BMO Financial Group leverages UiPath’s technology for risk and cybersecurity.  

UiPath tracks the volume of fraud scenarios, along with patterns, Purwar said, noting, “If there is a fraudulent pattern which has been identified, then how do we make sure that that fraudulent pattern is not repeated again?” 

Bots at work

Once RPA or bot technology has been implemented, risk scenarios defined, and rules written for the bots, the next step is putting the technology into practice against real-world potential threats.

A main threat to banks are botnets, or “networks of hijacked computer devices used to carry out various scams and cyberattacks,” according to cyber defense company Kaspersky. Using a botnet, criminals can automate and accomplish mass attacks, such as data theft or server disruptions. 

Fraudsters only need to invest a small amount of money to run these botnets 24/7, and each time they are successful in penetrating a system, the small investment produces bigger cash results, Frances Karamouzis, analyst at Gartner, told Bank Automation News.  

And according to KeyBank’s Martin, once the bots recognize a potentially suspicious transaction, like a botnet, RPA can then act on the findings. 

“Our bots, for example, place restrictions on accounts and assist in client notifications. The faster we can be made aware of potential fraud, investigate, and restrict the accounts, we can prevent future fraud on those accounts and assist our clients in establishing new accounts,” Martin said. “We also use bots to assemble investigation data from across disparate systems that enables our fraud mitigation and investigations teams to quickly identify new trends and insights.” 

Limitations in RPA 

While the widely used RPA technology has its benefits, there are limitations to what the bots can do, especially without humans in the loop. Bots can respond to threats that are outlined within the technology’s rule set or scripts, but the onus is still on the development team to ensure that rules are up to date to combat current threats. 

Software company Point Predictive uses its FraudBots technology to identify suspicious transaction attempts in banking and auto finance lending and found that the main limitation is that bots do not respond to new threats as they change, Point Predictive Chief Strategist Frank McKenna told BAN. 

In an 18 month period that ended July 2021, Point Predictive scanned 170 million new fraud data points with the help of the technology — and detected between $10 million and $14 million in fraudulent transactions, McKenna said, noting there’s more fraud to fight. 

“The limitations are really what the humans program the bots to do. I think eventually we’ll be able to use more artificial intelligence to have that define the [fraud] clusters for us,” he said. “That’s very difficult, because when you let the AI do it alone, it can come up with outliers of things that are kind of interesting, like test accounts, which would be a false positive.” 

While RPA and bots are advanced in what they can detect, the ability to adjust to new threats is not yet a reality. As machine learning and AI continue to advance, the ability for a machine to change its potential targets should catch up, McKenna said. “Banks, I would say, are probably missing in the order of millions of dollars a year and in lost opportunity by not using bots to mine for patterns of fraud in their data.” 

Bank Automation News also reached out to Bank of America and Truist, which both use RPA technology, however, both banks declined to comment on their security measures.  

Bank Automation Summit US 2023, taking place March 2-3 in Charlotte, is a crucial event on automation and automation technology in banking. Learn more and register for Bank Automation Summit US 2023.