Founded in 2013 to make banking easier and more transparent, N26 now serves over five million customers across 25 countries. Since 2018, Fourthline has been a proud partner of N26 in the global fight against fraud and financial crime.
Remco Vlemmix: Thanks for joining us today, Ro. Please tell us about your role at N26 and your background in fraud prevention.
Ro Paddock: I am the head of Anti-Financial Crime for N26, covering Know Your Customer (KYC), Anti-Money Laundering (AML) and fraud for N26. Prior to my current role, I was in charge of Know Your Customer (KYC) at N26. Before joining the bank, I was in Cape Town, South Africa, working in e-commerce and m-commerce for companies ranging from online gambling and airlines to retail and micro-credit in developing countries. My background is very strong in fraud and operational risk reduction—achieving an average of 90 to 95 percent reduction in fraud over a minimum of three and a maximum of nine months.
RV: You have been in fraud detection for such a long time in different geographic and industry settings—what makes you so passionate about it?
RP: Throughout my academic career, I was fascinated by the way the human mind works. In a desire to figure out why individuals act in a certain way, I developed the ambition to get into medical school and study neuropsychology. My background in psychology and computer forensics has really helped me in understanding both the human behavior and the data side of fraud detection. Being aware of the motivations that drive individuals to commit fraud in a variety of fascinating ways enables me to do my job better. More specifically, I have honed the ability to identify “behavioral traits” through data analysis.
> It is important to remember that fraud is not committed by a computer, but by the person who is sitting behind the computer.
For example: Given that N26 only allows one account per individual customer, data on how each customer is interacting with our onboarding process can tell us if they may have been coached or have attempted to open a bank account before. Variables like these prove valuable to understanding more about the human side of fraud detection. It is important to remember that fraud is not committed by a computer, but by the person who is sitting behind the computer.
RV: Can you describe one of the key things you discovered by combining this data perspective with your knowledge of how the human brain works?
RP: Being able to identify outliers from a data perspective is indicative of behavioral changes in the customer. At N26, we segment human customers into user categories by looking at a variety of variables, including time of day, number of attempts, the human interaction with an app and engagement with a product. Applying statistical models on these user categories then identifies the expected user journey and detects applicable thresholds. Any behavioral change that falls outside of that realm receives a flag on it that prompts investigation.
RV: You clearly state that data is a core element of fraud prevention.
RP: Yes, I believe that AI and machine learning have a very special place within fraud detection. Working with data and decision scientists throughout my career, I have done much research into the best way to leverage different models of machine learning. What I have learned is that it is very important to understand that 100 percent machine learning is not efficient, and that a human element is still needed. It is critically important when you are using machine learning to have thresholds in place to trigger re-initiation and a remodel. Data needs to be trained. Otherwise, a model will continue to train itself and evolve in divergent ways.
Moreover, my previous experiences working with credit risk showed the importance of configuring the output of machine learning models. Instead of being binary (“fraud” or “not fraud”), the ratios should be put in the form of a Gini coefficient: for example, if you have a cut-off at 0.82 and 1 is fraud and 0 is not fraud, an automated decision would be fine and even take out the human bias. However, we should also pay attention to the other side of it: what do you do when a customer who started at 0 moves into a grey area closer to fraud? It is important to run advanced analytics on that grey area on a weekly basis. Segmenting and individualizing fraud detection is something that really fascinates me.
RV: How important is fraud detection for N26?
RP: Fraud detection is critically important, both because of the challenger bank arena we are in and the customers who are entrusting us with their funds. For our customers, N26 should set a high bar for success and make use of cutting-edge technology to avoid onboarding customers that enter our bank with the wrong intentions. Moreover, it is essential to the challenger bank industry that all banks prioritize fraud detection. Regulators could suddenly decide to shut down the entire segment if they believe that there is too much fraud going on. The changes over the last 5-10 years regarding traditional banking vs. disruptive banking have offered many possibilities to fraudsters. Statistics show that fraud numbers are increasing at a high rate, resulting in a multi-billion-euro fraud industry. It is unfortunate that a person with very little skill can still sometimes fraudulently open up a bank account in this day and age. But while the fraud is increasing, N26 is doing a tremendous job using the newest technologies to identify fraudulent people and prevent crimes.
> It is essential to the challenger bank industry that all banks prioritize fraud detection.
RV: What does it take to be as successful as N26 in an environment with high regulatory risks and continuous attention on your bank?
RP: It all comes down to being better than your competitors. When you are chased by a lion, you have to run faster than your peers. A similar formula is applicable in terms of fraud detection. Once you identify a bug or a loophole, it is necessary to plug it as quickly as you can to make the problem go away (whilst in fact, the bug becomes the problem of a different competitor with a similar infrastructure).
Moving to fully digital is uncharted territory, in some cases, so it is necessary to be extremely vigilant and employ smart people who are constantly thinking outside of the box. Stay ahead of the game by monitoring wherever you can and running advanced algorithms to identify data inconsistencies you haven’t seen before.
At the same time, challenger banks should be aware that we are in this ecosystem together. The question is then: how can an individual company perform better than competitors whilst simultaneously strengthening the ecosystem? Our answer requires collaboration with both each other and with regulators: together we can increase visibility and standardized regulation on the utilization of advanced technologies. These collaborative practices are necessary in order to prevent the same actions being treated differently across geographies, and consequently becoming a breeding ground for fraud. The Public Affairs department of N26 aims to uplift the entire ecosystem by making sure that N26 participates in regular roundtables with other neobanks and contributes to conferences on AML. Sharing knowledge and working together is important to increase the robustness of the ecosystem.
> When you are chased by a lion, you have to run faster than your peers.
RV: What fraud trends have you seen emerging during COVID-19?
RP: Since the beginning of the COVID-19 outbreak, people have been misusing the government bail-out schemes to facilitate additional forms of abuse. The KYC-related fraud has been consistent throughout the emergence of COVID-19, mainly consisting of identity theft. Whilst we see that people have gotten smarter at fooling the system, we are also getting smarter at picking up on these fraud patterns through observant people, as well as data analysis.
The future of KYC and customer onboarding is highly fascinating to me. My belief is that it could stay on the current path or move into an area wherein every individual possesses a financial ID (eID) which is linked to his or her physical biometrics. Leveraging an eID is a completely new innovation that could likely bring an entire new wave of fraudsters. The next 3 to 5 years will be incredibly interesting in this regard.
RV: N26 has thus far always been at the forefront of innovation—will this also be the case with eID?
RP: I don’t know whether N26 should aspire to being a leader in eID, as there are other companies with more expertise and resources around this technology innovation. I believe that it would be most beneficial if those companies jump in the pool first. Rather, N26 could become a leader in ID authentication and leverage this competency to eventually excel at eID without incurring the risk of being an initiator.
RV: Do you believe that KYC can be fully digital or is a human element necessary in the customer onboarding process?
RP: The KYC flow is more robust and accurate when human detection is built into the process. Eighty percent machine learning and twenty percent human detection would be a good ratio, although in some cases, ninety percent for machine could also be justifiable. Overall, it is of critical importance to include human verification in the process to make sure that decisions are qualitatively controlled. If you don’t know what the computer is doing, there is no way to make changes or challenges to it. When using machine learning, it is therefore incredibly important to understand your business risk appetite. A blended process with machine and human elements is the best way forward.
> A blended process with machine and human elements is the best way forward.
RV: How does fraud detection fit into the full lifecycle of the client?
RP: An area that has not been looked at enough is the end of a customer’s lifecycle. When there are still funds in an account that is closed because a customer has died, a bank has to authenticate this and transfer the remaining funds to the right people. When I lived in South Africa, it was common to receive a phone call every six months or so wherein a bank officer would ask me to confirm my death: someone had presented himself as my nephew, brother or other family member and had shown a fake death certificate with my name on it before asking the bank to transfer the funds to his/her personal bank account. It is therefore unsurprising that I am waiting for “offboarding KYC” to come to Europe.
RV: What about N26 makes you really proud?
RP: N26 does a tremendous job at forward thinking and utilizing new technologies in order to identify how customers are interconnected and to see the broader picture. N26 is also a strong player in the field of data visualization as a way to support investigation.
> Moving from a reactive to a proactive state of fraud detection will enable us to identify fraud very early on and make transaction monitoring alerts less relevant.
I am really looking forward to the next chapter: shifting focus to the broader landscape of fraud. I want to encourage my team to see the many opportunities for improvement, and to focus on fraud prevention rather than treatment. Instead of putting a band-aid or plaster on a bullet hole, like reactive treatment, N26 should seek to perform the surgery and remove all the bullets from the shops so that a similar accident cannot happen again. Moving from a reactive to a proactive state of fraud detection will enable us to identify fraud very early on and make transaction monitoring alerts less relevant.
RV: Any advice for any other banks that are not yet as good at detecting fraud?
RP: My suggestion is understanding what you qualify as fraud, knowing the feasibility of your risk appetite, and determining what you are willing to compromise on with regard to that appetite.
Download the interview Chased by a lion: Insights on fraud and risk from N26's Ro Paddock
