The Bank of Russia announced the need to strengthen banks' control over card replenishment through ATMs and terminals with the function of accepting cash to combat fraud. But are there any proven mechanisms for the implementation of this initiative? What are the implications of an attempt to increase control over such transactions? These and other questions in his conversation with the portal are commented on by an independent expert in the field of payment security and a regular contributor to the PLUS magazine Nikolay Pyatiizbyantsev.
If funds from a client are transferred via any remote channels - be it an Internet or mobile bank, an online card transaction, etc., then in this case, from the point of view of regulatory requirements, the sender's bank is obliged to monitor such transactions and detect fraud attempts , if necessary, suspend and contact the client, clarify the legitimacy of these operations.
But if the fraudster convinces the client to withdraw funds from his account in the form of cash through an ATM with the cash-in function or a recycler, and then deposit this cash into the account indicated by the criminal, then in this case the sender's bank is absent as such - only the recipient's bank exists. It is about such operations that the regulator speaks, stating the need to increase their control.
However, I strongly doubt that in this case it is possible to use any real mechanisms for antifraud or fraud monitoring. The reason is simple - firstly, it is not clear what criteria for such operations can be considered suspicious.
Secondly, in the case of control of card replenishment operations by the payer's bank, the latter contacts his client and clarifies with him whether it is he who actually performs the operation.
However, in the case of an ATM transaction, the payer's bank does not participate in it, and the recipient's bank cannot contact the payer, since it simply does not know his contacts. Yes, he can contact the recipient, but if the recipient is a fraudster with us, he, naturally, will confirm that he expects the given funds.
On the other hand, there are a huge number of customers who legitimately deposit funds to their cards. And if the bank suspends all these payments, guided by vague criteria, we will only cause great inconvenience to law-abiding clients.
I do not see any really working mechanism for identifying suspicious signs and confirming the legitimacy of such operations.
From my point of view, the Bank of Russia should fight the so-called criminal groups. There are people who open cards in their own name, set up accounts, and then provide them to fraudsters in order to withdraw the stolen funds to them. Nothing is being done for this now.
The only requirement of the Central Bank is that if the bank finds out that it has such a client, it is obliged to set a certain limit on replenishment operations on its card or account. What is the limit - the Central Bank does not specify. And in general, what does it mean to set a limit? This means that the stolen money can be withdrawn not at one time, but in a few days, plus, in addition, in addition to fighting groups, there should be some measures similar to Federal Law 115 - this is countering the legalization (laundering) of proceeds from crime. There should be blacklists, there should be blocking of accounts, etc.
At the same time, if a fraudster stole money, they were credited to his account, and the bank received a message that the money was really stolen, he can not only block the card or account, but also return the money to the victim. However, such a mechanism does not yet exist in principle - today the stolen money can be returned back only through the courts. But if our Civil Code says that the client has decided to close the account, then the bank is obliged to return the money to him within 7 days. However, not a single court in the Russian Federation will make a decision and will not even consider the case within the specified week, at best it will take two or more months ...
If funds from a client are transferred via any remote channels - be it an Internet or mobile bank, an online card transaction, etc., then in this case, from the point of view of regulatory requirements, the sender's bank is obliged to monitor such transactions and detect fraud attempts , if necessary, suspend and contact the client, clarify the legitimacy of these operations.
But if the fraudster convinces the client to withdraw funds from his account in the form of cash through an ATM with the cash-in function or a recycler, and then deposit this cash into the account indicated by the criminal, then in this case the sender's bank is absent as such - only the recipient's bank exists. It is about such operations that the regulator speaks, stating the need to increase their control.
However, I strongly doubt that in this case it is possible to use any real mechanisms for antifraud or fraud monitoring. The reason is simple - firstly, it is not clear what criteria for such operations can be considered suspicious.
Secondly, in the case of control of card replenishment operations by the payer's bank, the latter contacts his client and clarifies with him whether it is he who actually performs the operation.
However, in the case of an ATM transaction, the payer's bank does not participate in it, and the recipient's bank cannot contact the payer, since it simply does not know his contacts. Yes, he can contact the recipient, but if the recipient is a fraudster with us, he, naturally, will confirm that he expects the given funds.
On the other hand, there are a huge number of customers who legitimately deposit funds to their cards. And if the bank suspends all these payments, guided by vague criteria, we will only cause great inconvenience to law-abiding clients.
I do not see any really working mechanism for identifying suspicious signs and confirming the legitimacy of such operations.
From my point of view, the Bank of Russia should fight the so-called criminal groups. There are people who open cards in their own name, set up accounts, and then provide them to fraudsters in order to withdraw the stolen funds to them. Nothing is being done for this now.
The only requirement of the Central Bank is that if the bank finds out that it has such a client, it is obliged to set a certain limit on replenishment operations on its card or account. What is the limit - the Central Bank does not specify. And in general, what does it mean to set a limit? This means that the stolen money can be withdrawn not at one time, but in a few days, plus, in addition, in addition to fighting groups, there should be some measures similar to Federal Law 115 - this is countering the legalization (laundering) of proceeds from crime. There should be blacklists, there should be blocking of accounts, etc.
At the same time, if a fraudster stole money, they were credited to his account, and the bank received a message that the money was really stolen, he can not only block the card or account, but also return the money to the victim. However, such a mechanism does not yet exist in principle - today the stolen money can be returned back only through the courts. But if our Civil Code says that the client has decided to close the account, then the bank is obliged to return the money to him within 7 days. However, not a single court in the Russian Federation will make a decision and will not even consider the case within the specified week, at best it will take two or more months ...
