PNB Adopts Risk-Based Adaptive Authentication For Fraud Prevention

Punjab National Bank, one of India’s leading nationalised bank, has implemented risk-based adaptive authentication for fraud prevention. The system allows proactive prevention of any fraudulent online transactions by studying and analysing customer transaction behaviour. Fraudulent online transactions are one of the biggest worries for banks today as they struggle with the menace of phishing attacks.

According to Ajay Misra, GM – IT, Punjab National Bank, people have fallen prey to phishing emails and divulged their credentials to the phishers, and then suddenly one will find transactions originating from an altogether new and different geography. The risk-based adaptive authentication system will help the bank in ensuring that such transactions do not get through.

The system studies the customer’s transaction behaviour on the Internet. Among others, this includes factors like geographic location, the machine’s IP address, and the pattern at which the customer normally does the transactions. Based on this the system’s intelligence frames a risk profile of the customer. Any aberration to the set pattern triggers concern.

Misra informs that when there is any transaction a customer makes that does not conform to his/her set pattern the system will raise a risk score. Based on that then, it will either challenge the transaction or outrightly deny it. When it challenges the transaction, a challenge question is raised. The customer has to respond correctly to the challenge question for the transaction to be concluded successfully, else the transaction is denied.

For instance, if a customer has been mostly doing online transactions sitting in Delhi from a particular and all of a sudden there is a transaction from his account that originates in Greece and on a different IP address, the system will be alerted. The system after seeing that the IP is not the same from where this customer normally does the transaction will raise a very high risk score. And, the transaction is either denied or a challenge question is raised.

Misra further informs that in the second phase, the bank is also going to consider outbound call to the customer in the event of any abnormal transaction. “When any such transaction is about to happen an automated call may be given to the customer’s registered mobile number confirming whether he/she is actually doing the transaction or not,” he explains.