Case study: How one bank is fighting back against social engineering

Citizens Bank protects customers while reducing fraud losses with a 40% decline in gross claims

Fraud: An industry-wide problem for issuers

Imagine being tricked by a fraudster disguised as a bank employee to gain access to your account. With an increase in e-commerce transactions and more sophisticated social engineering tactics the past few years, this is an all-too-real occurrence for cardholders — and one of many scenarios that banks are trying to prevent.

Research shows North American financial institutions had 10 times more reports of social engineering scams in 2024 vs. 2023¹.

Citizens Bank is among those that have faced such adversity, with customers being targeted during a digital wallet event in late 2023. Citizens has since ramped up its fraud prevention measures by working with TSYS to add a model based on their specific portfolios to fight card authorization takeover. Results include a reduction in fraud losses, a decline in claims rate and more satisfied cardholders.

Key problem: Charge-off ratio

Fraud teams at all major card issuers manage their charge-off values as well as losses. Both fraud losses and charge-offs must be closely monitored to meet acceptable charge-off ratios through recovery. However, in 2023, Citizens trended above budget for fraud charge-offs, catching the attention of its executive leadership.

Citizens Fraud Manager Harish Raghav Sabapathy and his fraud strategists were challenged with several fraud events in late 2023, including a malicious BIN attack. Citizens also faced a digital wallet event in which several cardholders were enticed through social engineering to give personal information away to fraudsters — even one-time passcodes (OTPs). Based on these events and their net charge-off to close the year, Citizen’s fraud management team needed to reduce fraud card losses — fast.

Fraud modeling: Consortium scores and custom models

Sabapathy and the card leadership team zeroed in on TSYS Foresight Score. Traditionally, Citizens managed fraud modeling with only consortium models. Consortium models add the complexity of requiring continuous profile updates and model integrations to avoid downstream effects such as increased decline rates on card transactions and increased call volume levels at their contact centers.

As consortium models are developed annually and built off of a group of issuers’ data, Citizens did not have a model customized for its portfolio.

TSYS recommends issuers use consortium models such as Visa’s Advanced Authorization, Mastercard’s Decision Intelligence and FICO’s Falcon Fraud Manager in combination with Foresight Score, a model customized to a card portfolio that tends to be more stable, depending on the strategy used. By fraud modeling across different scoring tools, fraud managers may use each model where it is most beneficial.

Maintaining fraud neutrality

Sabapathy and his fraud strategists had to readjust their strategies, monthly or bi-monthly, based on profile updates and model integrations with the consortium models. These were real pain points for the team.

As Sabapathy pointed out, “[Citizens] approached the idea of what we could do to reduce our fraud parameters.”

Overall fraud performance would be based on prediction.

“How much fraud could we contain?” he said. “And how much fraud capture could we attain?”

Sabapathy wanted to develop a new pattern of fraud containment from additional modeling, but also be cognizant of the customer experience. Fraud strategists prefer to maintain a fraud neutrality approach.

Authentication and identity verification were equally as important. What were they putting their cardholders through? How many card transactions were abandoned as purchases interrupted by fraud strategy?

Sabapathy wanted to maintain fraud neutrality and solve two problems: Reduce fraud losses and the total cost of fraud while balancing the customer experience and ensuring uninterrupted card transactions.

The solution: TSYS Foresight Score

Over time and starting with monthly fraud losses exceeding $1 million, Citizens brought fraud losses down considerably using Foresight Score as its primary criteria sitting atop its rule hierarchy. Citizens used a filtering criteria of 800+ and declined anything above 900.

Citizens achieved better results than initially planned, and increased savings against the overall cost of fraud — including more than 30% less in net losses. Fraud losses were reduced with a 40% reduction in gross claims, which generated multiple downstream benefits.

Downstream savings included reductions in the total cost of fraud, and newly realized efficiencies in the number of full time employees (FTEs) — FTEs that handled thousands of units of individual claims processing along with fewer call center calls. Cardholder authorization approval rates also improved as the model matured.

Sabapathy and his team rely on TSYS to cross-evaluate and validate the model and how it is running. They look at approvals and declines to see if the model is degrading. They also review modified strategies monthly and run a post implementation process.

Operational benefits of Foresight Score

Three months before implementation, the top objective was charge-off ratios and reducing net losses. Still working at a good false positive rate (FPR) level, loss lines were too large and Citizens experienced significant losses on several fraud events including a digital wallet issue where cardholders were socially engineered by fraudsters to capture their one-time passcodes. These types of fraud events are difficult to stop.

Existing models did not react as well to these fraud events as Foresight Score would. The technology uses machine learning to quickly adapt, allowing Citizens to reach below the benchmark and also improve the customer experience.

After four months of data, they had proof Foresight Score was working as intended. Sabapathy and his team had the strategies and evidence to rewrite their rules. Once they had a read of volumes, they implemented the new rules based on the baseline data. With baseline control, they pushed Foresight Score to the top across different products and portfolios (consumer credit and commercial credit, with plans to add debit). Since Foresight Score implementation in 2024, it has been the leading score, and Citizens has seen their decline rate improve by 10%.

Single vendor fraud ecosystem

With TSYS as its credit card portfolio processor, Citizens has benefited from the speed and efficiency of working with just a single vendor. It also opened their fraud ecosystem to other TSYS products and solutions, including CardGuard, ADS I, ADS II and Determinator.

Citizens now further realizes the benefits of using Foresight Score within the TSYS Fraud ecosystem. They are filtering authorizations to the most granular decisions in real time, feeding Foresight Score into ADS I and ADS II, Determinator and CardGuard.

A path to future success

Early on when evaluating additional scoring models, TSYS provided 30-60-90-day scorecards which allowed Citizens to validate the data and reach a comfort level with how the model reacted. TSYS consultants reviewed the scorecards with the Citizens fraud team post implementation to answer questions and validate, monitor and review model performance. The results of those discussions can be seen in the overall value of the adoption.

Citizens is now working with TSYS to explore applying Foresight Score to its debit portfolios, which has the potential to drive even greater fraud management efficiency and effectiveness.

Sources
1. PR Newswire, ”North America sees social engineering scams multiply by a factor of 10”, November 2024.