Update on the Payments landscape – January 2022

If you think I’ve missed anything important, do please send an email to technical@treasurers.org

Interesting reports

The European Payments Council issued a report on Payment Threats and Fraud Trends. Its main conclusions include:

• Social engineering attacks and phishing attempts are still increasing and they remain instrumental often in combination with malware, with a shift from consumers, retailers and  SMEs to company executives, employees (through “CEO fraud”), payment service providers  (PSPs) and payment infrastructures and more frequently leading to authorised push  payments (APP) fraud. These techniques have greatly evolved over the last years as the targets are users rather than technology.
• Awareness campaigns are still very important countermeasures. They should target individual and corporate customers, as well as employees. Service providers can implement techniques helping customers to verify that websites and emails are genuine and can provide customers with authenticators which do not expose sensitive information. The service providers can also implement protection mechanisms in their email infrastructure and take benefit from specialised services for closing down phishing websites.
• Malware – existing in various forms - remains a major threat, in particular ransomware has been on the rise during the past year, requiring new mitigating measures. 
• Measures against malware include proper maintenance of own devices by the customers, including mobile devices (regularly update the operating system, use only needed software, install and activate anti-virus and anti-malware tools, enable secure access, etc). Service providers’ customer relations departments should inform their customers about these measures, and IT departments should implement adequate protection and control functions in their applications. Specific control and mitigation measures should also concern the usage of Cloud services by the PSPs.
• One of the most sophisticated and lucrative types of payment fraud now and for the future seems to be Advanced Persistent Threat (APT). It must be considered as a potential high risk not only for payment infrastructures but also for all network related payment ecosystems.
• Measures against APTs should start with security defence-in-depth strategy and architecture but must go beyond and include advanced security data analytics, technologies of early detection with real-time reporting and visualisation. Mechanisms to recognise APTs signs and patterns can also be effective. 
• The number of (D)DoS attacks is no longer increasing but they are still frequently targeting the financial sector. There is a continuation of botnets and because of the high volume of infected consumer devices (e.g. PCs, mobile devices, etc.) severe threats remain. 
• Against DDoS attacks, PSPs can set up a dynamic security control framework, implement services to filter fraudulent traffic and mitigating measures against application-level attacks. Testing the DDoS measures is also important, and this can include simulated attacks. 
• Botnets can act as a force multiplier for malicious activity, including DDoS, using compromised systems from computers to IoT devices. Botnets are also a preferred means to mine crypto-currency drawing on the victim’s system computing power and electricity. 
• For combating botnet threats various technical countermeasures can be adopted but regulatory and social countermeasures such as cybercrime dedicated laws, user awareness and enhanced cooperation, are also important. 
• A fraudulent payment transaction is often followed by the use of a monetisation channel such as an immediate cash withdrawal, a purchase with no trace, a money transfer or a transfer to another account (“money mulling”). 
• Raising awareness among customers, identification of “mules” combined with monitoring and stopping measures should be adopted as mitigation actions.

UK payments landscape

The Payment Systems Regulator (PSR) issued its 5-year strategy. Its four priorities are:

1. Ensure users have continued access to the payment services they rely on and support a choice of payment options.
2. Ensure users are sufficiently protected when using the UK's payment systems.
3. Promote competition between UK payment systems and the markets supported by them; protecting users where that competition is not sufficient.
4. Act to ensure the interbank systems provide the infrastructure, rules and incentives that foster innovation and competition in payments.

The PSR published its New Payments Architecture (NPA) regulatory framework. It requires pay.uk to:

• be the primary interface and decision-maker for central infrastructure services (CIS) provision
• set CIS user prices and do so using a methodology that adheres to certain pricing principles and is subject to our non-objection
• set the rules and standards for the NPA CIS and ensure that these facilitate competition and innovation
• ensure that the CIS facilitates innovation and competition
• ensure that a CIS provider does not use, or disclose to any other party including its affiliates, information and data for anything other than CIS provision
• in a timely manner, make available to the market, information and data concerning the provision of CIS that would help facilitate competition and innovation

The PSR published its Access and Governance Report on Interbank Payment Systems. Key findings included:

• The number of new direct participants in interbank payment systems continued to grow in 2019 and 2020. The rate of new membership slowed compared to 2018. However, the payment system operators’ projections for 2022 demonstrate there is continued interest from Payment Service Providers (PSPs) in gaining direct access to interbank payments systems; all the available go-live slots for the year are already booked.
• The number of indirect access providers has doubled from four to eight since the PSR was created in 2015. In June 2019, Modulr and LHV Pank became new indirect access providers (IAPs). Together with ClearBank and Starling, this group of new-entrant IAPs now has more PSP customers (combined) than two out of the four established IAPs (Barclays, HSBC, Lloyds and NatWest) have individually.