- 10 hours ago
The biggest threat to your money may no longer be hackers, but deception. Cynthia Ng sits down with Jason Phua, Head of Clients at Visa Malaysia, to explore how AI is changing fraud, digital payments and the future of trust.
Category
🗞
NewsTranscript
00:09Hello, you are watching AwaniReview. My name is Cynthia Eun.
00:13Malaysians lost nearly 3 billion ringgit to scams last year, almost double than the year before.
00:20In most of these cases, in fact 95%, according to the central bank,
00:24are payments that were authorized by the victims themselves after being manipulated by scammers.
00:31So it is no longer about hacked credit cards or even hacked accounts, stolen cards for instance.
00:38It is actually about deception and fraud.
00:41So today we will be discussing in this landscape how is technology actually helping us
00:48or can it really protect us from our own decisions when it comes to digital payments.
00:53And joining me for this discussion today is Jason Pua.
00:56He is the head of clients at Visa Malaysia.
01:00Thank you so much, Jason, for making time for this interview.
01:03Thank you for having me.
01:04Jason, I want to start with trust.
01:07Let's start with that because right now the trust dynamics have shifted because of these scams, right?
01:12In digital payments, Visa sits at the center of global banking.
01:17You are a global payments enabler, handling close to 700 million transactions per day globally in across over 200 countries.
01:27So talk to us from where you sit.
01:30What has changed in terms of trust in digital payments?
01:35In Malaysia, we feel that we are in the intersection of all the technology changes, the availability of multiple channels
01:46of payments.
01:47So consumers today in Malaysia, you get to enjoy payments from making payments from cards to QR payments to conducting
01:56your transactions through e-comm
01:57or even registering your credentials onto subscription services like Netflix.
02:03So the increase of some of these channels have also been provided new vectors in which fraud and scams can
02:14occur.
02:15And we also feel in more recent years, the advent of computing of AI has also accelerated the rate in
02:27which scam attacks actually happen.
02:29Now, for Visa, as an ecosystem enabler, as you mentioned, we work very closely across all the different stakeholders within
02:39the ecosystem,
02:41including the banks that we work with, merchants to regulators, and also educating consumers.
02:49I think in the question around trust, we believe is core to how we conduct our business and therefore ensuring
03:00that that trust is maintained.
03:02We maintain the integrity of the ecosystem by working very closely with all the parties involved.
03:09So I want to tap into the expertise or the scale of the payments that Visa handles every day, right?
03:19So you're looking at the big picture here because you deal with, like you mentioned, the merchants, you deal with
03:25banks,
03:26and you deal with consumers like me, but we look at the kind of frauds and cases that are happening.
03:31Most of these transactions happen at the users themselves.
03:36What can you tell us about the real weak point in the system?
03:39Is it still human behaviour?
03:42Educating the card holder is a critical part of this because we do believe that,
03:47I talked about the advent of AI, the advent of automation at scale,
03:53the technologies that are being used by fraudsters and scammers.
03:58They are also using a lot of the resources available to the normal layman.
04:03And it being able to do it very, very rapidly.
04:07We do believe that educating card holders will be critical in terms of where the key salient points
04:15and risk areas that they need to watch for.
04:19Whether educating them directly or through our stakeholders is very, very important.
04:24Now, what are the examples in terms of the factors that we see today?
04:31AI is being used to drive impersonation.
04:35And by that, we see the advent of deep fakes all the way to emulating voice.
04:41So a lot of this really boils down to card holder education as well as the merchants
04:48and working together to address not just processes and awareness but also technology
04:54and drive the same scale and automation to address fraudsters and scammers.
05:01So let's talk about that.
05:02Just taking your point, fraudsters also have the same AI tools as the banks and payment networks use.
05:09So in that environment, is AI actually giving a company like Visa an advantage
05:14or is it just making both sides faster at the same time?
05:17I think if we're looking at a more direct comparison, it's like AI versus AI.
05:23We do acknowledge those things that I just talked about.
05:26But it's not just those solutions.
05:29I think from many different vectors or even systems and technologies that we put into place.
05:35One example that I like to call out is tokenization.
05:39What essentially it means is being able to replace your card holder information
05:43with something that represents or symbolizes that credential.
05:49But if stolen and used, it will not work.
05:54So that's a simplistic way of calling tokenization along with other solutions that we have across the whole ecosystem.
06:02Things like authorization and authentication solutions that we have also baked in.
06:07To work alongside behavioral analytics, the AI solution that we talked about.
06:16We call it feature space.
06:18And what it does is it analyzes individual behaviors that we believe to be able to foresee if this card
06:27holder is actually making an authentic or genuine transaction or not.
06:31Okay.
06:32Can I just stop you there quick?
06:33Yeah.
06:33Because this is very interesting.
06:34Because when we talk about the at least the landscape in Malaysia, most of these scams are authorized.
06:40Sorry.
06:40Most of these payments are authorized by the victims themselves after being manipulated.
06:45But if you look at from the bank's point of view, if I log in with my own accounts, I
06:51get the OTP.
06:52I insert the OTP and I click OK to the transaction, right?
06:57That transaction looks legitimate.
06:59Yeah.
06:59Correct?
07:00So where does the fraud detection actually come into the picture?
07:04Where does Visa sit in identifying those things?
07:07So the solutions that I speak of also look at these such transactions where on the surface, from an authorization
07:15standpoint,
07:16there could be parameters that are already met to be able to say that this is a real transaction.
07:21But over and above that, there are certain behaviors that we also try.
07:25And there are multiple dimensions that we also look at.
07:29Like what is typical behavior of this card holder?
07:32So information like this, at scale, we believe to be able to provide a prediction in which adds another layer
07:42over and above what we already have today.
07:45So we do believe that behavioral analytics would be a way to actually address fraud at scale.
07:56Can you then talk to us about behavioral analytics and has it been successful in helping Visa determine whether certain
08:07transactions are fraudulent or not?
08:09Yeah.
08:09So we do have the solutions around behavioral analytics and it's something that we call feature space.
08:19So feature space is essentially built on behavioral analytics where it analyzes the behavior of a specific consumer to look
08:29at certain dimensions, including but not limited to.
08:33Is this normal behavior?
08:34Does this fall into the parameters of what is normally the behavior of this consumer when he buys something?
08:42So while that is actually important, it also allows the issuers to be able to approve transactions and not decline
08:53wholesale.
08:54So it's a fine balance that is transparent to the consumer.
09:00The earlier question around trust I think is an important vital one because where Visa believes that we actually need
09:09to ensure that trust is always there whenever our cards are used.
09:13We want to be the best way to pay and be paid and that involves giving peace of mind that
09:19every transaction that they conduct on is actually safe and secure.
09:24Now, what that also means is in the back as we work across the network, as we work across the
09:33ecosystem, including merchants and the banks, we have to make sure that the systems are transparent so that it doesn't
09:41intervene in the whole sales journey.
09:43And then the merchants be able to actually see their business grow and consumers don't have to worry about, you
09:53know, the transactions getting through or not.
09:55Sure.
09:56But if you talk about the problem, right, the people are being targeted first before even money is being moved
10:04around.
10:04Essentially, this happens on social media, on apps and data leaks, for instance.
10:12From where I sit, I'm looking at the fight against fraud and scams.
10:17It's not really happening in the battlefield where Visa is actually in control.
10:23Am I right or am I wrong?
10:24Where do you sit in the system when it comes to flagging for risks and stopping those risks?
10:29I think, to your point, being able to actually block transactions as and when they happen, Visa does that.
10:38I think we've been adopting AI for decades already built into the system, built into our network, where we are
10:46already declining wholesale tax on an ongoing basis.
10:52Not just in the traditional card space, but increasingly, increasingly, we are starting to see new vectors take place.
11:03And that's where the investments that we have made into new capabilities, such as feature space.
11:08So that not only block transactions at the network level, but also be able to build in intelligence that allow
11:19the right transactions through.
11:21So it's layers of protection. How does that look like?
11:23So we talked about tokenization as an example.
11:27So tokenization is one of the different layers that we talked about.
11:31So tokenization essentially allows you as a cardholder to be able to store your credentials, whether it's at a merchant
11:38or in your mobile payments, and then be able to use it.
11:44But the difference is, if the data is actually stolen, it's practically useless to whoever stole it.
11:50So whether it's the data arrested with the merchants or your mobile phone gets lost.
11:55So that's one example that we actually play a very proactive role.
12:03We also provide solutions around authentication.
12:07So authentication will be essentially who you say you are.
12:11So those 3DS is an example you talked about, verifying that you are actually conducting this transaction.
12:19So it offers you a challenge that you actually accept.
12:22Those are relatively foundational in terms of scoring that transaction.
12:27Have you entered the right details, right?
12:32And then be able to drive those and work very closely with ecosystem partners to introduce things like pass keys,
12:42things like click to pay, enabling you to actually input your credentials into a website, knowing that Visa is managing
12:51that process and storing the information.
12:53So the point here is essentially the different capabilities and different technologies that we bring across the ecosystem.
13:03But also working very closely to ensure that cardholders themselves are not easily duped by new vectors that we spoke
13:12about.
13:13No single player can solve this alone.
13:15Can you talk to us about the collaboration that you have with the banks, with central bank, with authorities and
13:20maybe even like social media platforms, for instance,
13:22to help to actually stop scams early before it actually hits the transfer button?
13:30Yeah.
13:33I think in Malaysia specifically, what we've done in the past is we've introduced something called the risk roadmap.
13:41Essentially, it's a few year journey that we establish the point of departure and where the point of arrival should
13:50be.
13:50So addressing each of the stakeholders that you actually mentioned, there are very specific plans that we drive engagement.
13:58And we hope to do this on an ongoing basis because of how threat evolves.
14:04And whether it is engagement in actually getting into discussions, very specific discussions on how we mitigate risk, solutions and
14:17capabilities that we share with the ecosystem, both at the regulatory front, but also with issuers and acquirers, as well
14:27as merchants.
14:28So having that ongoing engagement and presenting our roadmap where we are making specific commitments to the ecosystem in driving,
14:36whether it's awareness, whether it's outcomes, whether it is technology roadmaps that we would like to work with in Malaysia.
14:47Last but not least, we do believe the value of the skill that Visa brings.
14:53As being the largest network in the world, we see a lot of data, we see a lot of occurrences
15:01that happen across geographies.
15:02We hope to be able to leverage on the roadmap to be able to share our learnings with all the
15:12participants in the ecosystem.
15:14Okay.
15:15So speaking about the scale that Visa has globally, I think your global risk team says it blocked $40 billion
15:22in attempted fraud just last year, another $350 million through a dedicated scam unit.
15:28Now, these are just figures globally.
15:30I believe the real numbers are even larger than that.
15:32But none of this actually shows up in Malaysia's figure, that $3 billion fraud that was recorded last year, right?
15:40So is Malaysia getting a full version of the situation or are we not really capturing the extent of the
15:46problem just yet?
15:48I think in Malaysia, a proportion I would believe should be no different from the rest of the world.
15:58I do believe that the threats that we see across is not limited to just the other countries.
16:08Malaysia will see the same threats.
16:11But I do believe that Visa has done the same, extended the same value in terms of being able to
16:17actually block those scams and manage the risks.
16:23We do remain committed to actually address it across the ecosystem.
16:29Are there threats that emerge, even surprise your own risk team when you look at it, that has evolved over
16:36the years?
16:37I think the nature of the risk is such that the scammers will always be finding novel ways.
16:43I think that's the challenge if you look at fraud and scams in general.
16:49So the whole angle around vectors is always something that can surprise,
16:56just because they are looking for new ways that you and I and our risk teams may not have thought
17:02of before.
17:02But I think in terms of technology, scale, being able to address it and coming together of the ecosystem,
17:10we will be able to stay ahead and manage accordingly.
17:15Okay. Now Visa just expanded a program called the Argentic Radi into Malaysia,
17:19which basically allows AI agents to make purchases on someone else's behalf.
17:25So I imagine that would be less step-by-step approval because the machine is making the decisions in purchasing.
17:31How does that fit into the trust conversation?
17:33Because we've pretty much spent the last 15 minutes talking about how human is being tricked into frauds and scams
17:41by their own decisions, their own decision making.
17:44Okay. I'll talk about the program for a little while because it's something that we are piloting.
17:54We're working very closely with very selected partners by building on the established foundational pillars that we already have,
18:04things like tokenization, things like pass keys.
18:08So we want to be in a place where when Argentic Radi starts to take up and scale that we
18:16are ready.
18:17So what that means is today, the trust that we talk about, we want to be able to preserve that
18:24trust across new technologies that we are piloting.
18:28I think they're working very closely with ecosystem players.
18:33And we do believe that the rules that govern traditional payments can and should be evolved in a way that
18:40keeps pace to be able to protect cardholders like you and me.
18:44Okay.
18:44So that's the intent.
18:47Again, working very closely with our Malaysian partners to ensure that we are also innovating.
18:54So the tricky part is finding a balance between driving new payments experiences, new payments innovation, but at the same
19:05time not compromising on all things security.
19:08Okay. Can I just get your view on what does authorization then mean anymore if machines are taking over purchase
19:19decisions, making payments?
19:20That's a good question.
19:23So the whole idea around Argentic Commerce is, again, is the theme of automation, but automation with intelligence built in.
19:33And where you have decisions, the assumption is that the automation of the purchase behavior done by a machine is
19:43even more intelligent than before.
19:46So what that means also is it gives you and I as participants into Argentic Commerce permissioning.
19:54So I'm essentially giving permission to an agent to make purchases on my behalf, but it is predicated on rules
20:04that I define.
20:06So, for example, I would be able to define when the purchase is made, specific merchant locations, specific times, specific
20:16budget.
20:17So there are certain rules that we are catering for Argentic Commerce so that we can be able to actually
20:24manage both the opportunities and the risks that Argentic Commerce presents.
20:31So you pointed out this is a pilot program, but I do wonder if the visa Argentic program has been
20:41stress tested against a scam scenario.
20:45What are the outcomes?
20:47It's still premature just because there's a lot of the kinks that need to be ready because there are different
20:56standards.
20:56So if you're looking at established standards where all ecosystem providers are adhering by, I don't think we are at
21:05the place of maturity just yet.
21:07There is learnings that we want to take from this pilot to be able to ensure that all those dimensions
21:14are not compromised,
21:16whether it's rights to the consumer, rights to the merchant, what that means in terms of transactions that happen without
21:25authorization or falls through the cracks.
21:28So there's a lot of learnings that we are taking before we want to stress this.
21:33Okay.
21:35All right.
21:35So looking forward into the future, what are some of the risks that you as Head of Clients, whether you're
21:43keeping an eye out for?
21:45And in your point of view, what is the biggest risk here?
21:49Is it the technology?
21:50Is it human behavior or is it governance?
21:52I believe that really well and truly it's a whole ecosystem.
21:57So the emphasis for all players and Visa in particular is to really drive continued engagements across all of the
22:06stakeholders,
22:07which is why the whole roadmap that we are going to be launching in the next few weeks sets that
22:14ambition up.
22:15So it gives context, it gives objectives, it gives a purpose in how we actually drive that engagement, including but
22:26not limited to the consumer education piece, the merchant education.
22:31So technology, systems, processes, governance, learning at scale, all of this will come together more meaningfully through this roadmap.
22:43Okay.
22:44And what about the biggest risks that you are keeping an eye out for?
22:47Biggest risks?
22:48I think we've had some conversation around social engineering, phishing scams, love scams.
22:56So there's no shortage in terms of the creativity of scammers and just how much it captures the headlines.
23:06So these are done at the scale and the speed that we have not seen before.
23:12So that keeps me up at night just because of the ability to scale and they are leveraging on the
23:19same advanced technology that the latest technology companies are offering.
23:28Okay.
23:30And of course Visa deals with cross-border payments extensively.
23:33And how does that change the picture when you look at risks and trying to manage real-time payments?
23:40Yeah.
23:41It's incumbent on a network like ours, the scale at Visa to actually bring to bear all the learnings that
23:51we have across the world.
23:53And because we drive a lot of these cross-border payments, as you put it, it's even more important that
24:01we make sure that our solutions and our systems are able to keep up.
24:05To the point of evolving payments, behavioural analytics is something that we are embedding and enhancing our risk models to
24:15be able to keep up.
24:16And can you also speak to us about the conversations that you are having with regulators, with banks here in
24:21Malaysia about the biggest pain points they are having when it comes to frauds and scammers?
24:25Yes.
24:26I think as in the last few months, I mentioned that we are going to be launching our risk roadmap.
24:33Now to get to that stage, we have had to have multiple conversations.
24:39And if I look back from three years ago when we last did the roadmap, the stakeholders have themselves emerged,
24:48evolved.
24:49And one example will be the police and authorities.
24:56So that's just one of many different examples how we are engaging them, speaking more directly to them to get
25:03a more holistic view and a more updated view on what's happening on the ground.
25:08And I do foresee this is the right journey to be on and to continue doing this on a progressive
25:14basis.
25:15So it's not episodic that we are waiting for something big to happen.
25:19We want to drive and stay ahead to make sure that we are ahead of the curve.
25:26Alright.
25:26And just to wrap things up, Jason, after everything that we have discussed on this show,
25:31what is that shift in mindset relations need to make when it comes to digital trust and safety when it
25:40comes to digital payments in the years ahead?
25:41I believe a key part to that is really coming down to education and continuous education on an ongoing basis.
25:52I think it's also incumbent on ecosystem operators like our issuers as well as the merchants to make sure that
26:01the appropriate guardrails continue to be enhanced on an ongoing basis.
26:08But cardholders, of course, will need to be very aware in terms of where they conduct their e-commerce, requests
26:17for actually conducting transactions of a certain type.
26:20So those, I believe, will continue to evolve just because specific new generations like Gen Z are increasingly more and
26:29more digital savvy.
26:31I think educating and driving the right messaging to those stakeholders are equally important.
26:37Alright.
26:38Well, thank you so much, Jason, for your insight and thank you for your time.
Comments