Founded in 2013 to make banking easier and more transparent, N26 now serves over five million customers across 25 countries. Since 2018, Fourthline has been a proud partner of N26 in the global fight against fraud and INTERVIEW , JULY 2020 financial crime. Chased by a Lion: Thanks for joining us today, Ro. Please Insights on Fraud tell us about your role at N26 and your and Risk from background in fraud prevention. I am the head of Anti-Financial Crime for N26, covering Know Your Customer (KYC), Anti-Money Laundering N26's Ro Paddock (AML) and fraud for N26. Prior to my current role, I was in

N26’s Head of Anti-Financial Crime, Ro Paddock, recently sat down with Fourthline’s COO, Remco Vlemmix, to discuss fraud trends, mitigation best practices, and the importance to digital banks of prioritizing fraud prevention. Ro Paddock Remco Vlemmix HEAD OF ANTI FINANCIAL CRIME N26 CHIEF OPERATING OFFICER FOURTHLINE WHITEPAPERAPRIL 2020 Chased by a Lion: charge of Know Your Customer (KYC) at N26. Before It is important to remember that Insights on Fraud joining the bank, I was in Cape Town, South Africa, working fraud is not committed by a and Risk from N26's in e-commerce and m-commerce for companies ranging computer, but by the person who is Ro Paddock from online gambling and airlines to retail and micro-credit sitting behind the computer. in developing countries. My background is very strong in

fraud and operational risk reduction—achieving an average RO PADDOCK, HEAD OF FINANCIAL CRIME AT N26 of 90 to 95 percent reduction in fraud over a minimum of three and a maximum of nine months. For example: Given that N26 only allows one account per Legal framework: regulations are easy, individual customer, data on how each customer is You have been in fraud detection for directives create complexity interacting with our onboarding process can tell us if they such a long time in di!erent geographic may have been coached or have attempted to open a bank European law, broadly speaking, consists of regulations and industry settings—what makes you account before. Variables like these prove valuable to understanding more about the human side of fraud (which are binding across the EU) and directives (which so passionate about it? detection. It is important to remember that fraud is not set goals ). For KYC, the two most relevant pieces of Throughout my academic career, I was fascinated by the committed by a computer, but by the person who is sitting European legislation are the GDPR (which is a regulation way the human mind works. In a desire to figure out why behind the computer. and hence uniform across the EU) and the fifth AML (a individuals act in a certain way, I developed the ambition to directive, along with its four predecessors). By get into medical school and study neuropsychology. My transposing AML directives into national laws, countries background in psychology and computer forensics has Can you describe one of the key things can impose stricter requirements. really helped me in understanding both the human you discovered by combining this data behavior and the data side of fraud detection. Being aware perspective with your knowledge of The best-known example is the German implementation of the motivations that drive individuals to commit fraud in how the human brain works? a variety of fascinating ways enables me to do my job of 5AML (also known as the GwG), which requires an better. More specifically, I have honed the ability to identify Being able to identify outliers from a data perspective is onerous video KYC process that prescribes in great detail “behavioral traits” through data analysis. indicative of behavioral changes in the customer. At N26, what a customer must do to pass identification and we segment human customers into user categories by verification. While this process works relatively well in the INTERVIEW BERLIN, JULY 2020 German market, it hurts conversion in other European markets. Other examples of additional requirements imposed by national law include (requires enhanced liveliness detection), (requires a secondary ID document), and (requires seven additional risk checks). Chased by a Lion: looking at a variety of variables, including time of day, Moreover, my previous experiences working with credit risk Insights on Fraud number of attempts, the human interaction with an app showed the importance of configuring the output of and Risk from N26's and engagement with a product. Applying statistical machine learning models. Instead of being binary (“fraud” Ro Paddock models on these user categories then identifies the or “not fraud”), the ratios should be put in the form of a expected user journey and detects applicable thresholds. Gini coe!icient: for example, if you have a cut-o! at 0.82 Any behavioral change that falls outside of that realm and 1 is fraud and 0 is not fraud, an automated decision receives a flag on it that prompts investigation. would be fine and even take out the human bias. However, we should also pay attention to the other side of it: what do you do when a customer who started at 0 moves into a You clearly state that data is a core grey area closer to fraud? It is important to run advanced element of fraud prevention. analytics on that grey area on a weekly basis. Segmenting and individualizing fraud detection is something that really Yes, I believe that AI and machine learning have a very fascinates me. special place within fraud detection. Working with data and decision scientists throughout my career, I have done much research into the best way to leverage di!erent models of How important is fraud detection for machine learning. What I have learned is that it is very N26? important to understand that 100 percent machine learning is not e!icient, and that a human element is still Fraud detection is critically important, both because of the needed. It is critically important when you are using challenger bank arena we are in and the customers who are machine learning to have thresholds in place to trigger re- entrusting us with their funds. For our customers, N26 initiation and a remodel. Data needs to be trained. should set a high bar for success and make use of cutting- Otherwise, a model will continue to train itself and evolve edge technology to avoid onboarding customers that enter in divergent ways. our bank with the wrong intentions. Moreover, it is essential to the challenger bank industry that all banks prioritize fraud detection.

INTERVIEW BERLIN, JULY 2020 Chased by a Lion: It is essential to the challenger bank What does it take to be as successful as Insights on Fraud industry that all banks prioritize N26 in an environment with high and Risk from N26's fraud detection. regulatory risks and continuous Ro Paddock attention on your bank? RO PADDOCK, HEAD OF FINANCIAL CRIME AT N26

It all comes down to being better than your competitors. When you are chased by a lion, you have to run faster than Regulators could suddenly decide to shut down the entire your peers. A similar formula is applicable in terms of fraud segment if they believe that there is too much fraud going detection. Once you identify a bug or a loophole, it is on. The changes over the last 5-10 years regarding necessary to plug it as quickly as you can to make the traditional banking vs. disruptive banking have o!ered problem go away (whilst in fact, the bug becomes the many possibilities to fraudsters. Statistics show that fraud problem of a di!erent competitor with a similar numbers are increasing at a high rate, resulting in a multi- infrastructure). billion-euro fraud industry. It is unfortunate that a person with very little skill can still sometimes fraudulently open Moving to fully digital is uncharted territory, in some cases, up a bank account in this day and age. But while the fraud so it is necessary to be extremely vigilant and employ is increasing, N26 is doing a tremendous job using the smart people who are constantly thinking outside of the newest technologies to identify fraudulent people and box. Stay ahead of the game by monitoring wherever you prevent crimes. can and running advanced algorithms to identify data inconsistencies you haven’t seen before.

At the same time, challenger banks should be aware that we are in this ecosystem together. The question is then: how can an individual company perform better than competitors whilst simultaneously strengthening the ecosystem?

INTERVIEW BERLIN, JULY 2020 Chased by a Lion: Our answer requires collaboration with both each other The future of KYC and customer onboarding is highly Insights on Fraud and with regulators: together we can increase visibility and fascinating to me. My belief is that it could stay on the and Risk from N26's standardized regulation on the utilization of advanced current path or move into an area wherein every individual Ro Paddock technologies. These collaborative practices are necessary possesses a financial ID (eID) which is linked to his or her in order to prevent the same actions being treated physical biometrics. Leveraging an eID is a completely new di!erently across geographies, and consequently becoming innovation that could likely bring an entire new wave of a breeding ground for fraud. The Public A!airs department fraudsters. The next 3 to 5 years will be incredibly of N26 aims to uplift the entire ecosystem by making sure interesting in this regard. that N26 participates in regular roundtables with other neobanks and contributes to conferences on AML. Sharing knowledge and working together is important to increase N26 has thus far always been at the the robustness of the ecosystem. forefront of innovation—will this also be the case with eID?

What fraud trends have you seen I don’t know whether N26 should aspire to being a leader in emerging during COVID-19? eID, as there are other companies with more expertise and resources around this technology innovation. I believe that Since the beginning of the COVID-19 outbreak, people have it would be most beneficial if those companies jump in the been misusing the government bail-out schemes to pool first. Rather, N26 could become a leader in ID facilitate additional forms of abuse. The KYC-related fraud authentication and leverage this competency to eventually has been consistent throughout the emergence of excel at eID without incurring the risk of being an initiator. COVID-19, mainly consisting of identity theft. Whilst we see that people have gotten smarter at fooling the system, we are also getting smarter at picking up on these fraud patterns through observant people, as well as data analysis.

INTERVIEW BERLIN, JULY 2020 Chased by a Lion: Do you believe that KYC can be fully How does fraud detection fit into the Insights on Fraud digital or is a human element necessary full lifecycle of the client? and Risk from N26's in the customer onboarding process? Ro Paddock An area that has not been looked at enough is the end of a The KYC flow is more robust and accurate when human customer’s lifecycle. When there are still funds in an detection is built into the process. Eighty percent machine account that is closed because a customer has died, a bank learning and twenty percent human detection would be a has to authenticate this and transfer the remaining funds good ratio, although in some cases, ninety percent for to the right people. When I lived in South Africa, it was machine could also be justifiable. common to receive a phone call every six months or so wherein a bank o!icer would ask me to confirm my death: someone had presented himself as my nephew, brother or A blended process with machine and other family member and had shown a fake death human elements is the best way certificate with my name on it before asking the bank to forward. transfer the funds to his/her personal bank account. It is therefore unsurprising that I am waiting for “o!boarding RO PADDOCK, HEAD OF FINANCIAL CRIME AT N26 KYC” to come to Europe.

Overall, it is of critical importance to include human What about N26 makes you really verification in the process to make sure that decisions are qualitatively controlled. If you don’t know what the proud? computer is doing, there is no way to make changes or N26 does a tremendous job at forward thinking and challenges to it. When using machine learning, it is utilizing new technologies in order to identify how therefore incredibly important to understand your business customers are interconnected and to see the broader risk appetite. A blended process with machine and human picture. N26 is also a strong player in the field of data elements is the best way forward. visualization as a way to support investigation. I am really looking forward to the next chapter: shifting focus to the broader landscape of fraud. INTERVIEW BERLIN, JULY 2020 Chased by a Lion: Moving from a reactive to a Any advice for any other banks that are Insights on Fraud proactive state of fraud detection not yet as good at detecting fraud? and Risk from N26's will enable us to identify fraud very Ro Paddock early on… My suggestion is understanding what you qualify as fraud, knowing the feasibility of your risk appetite, and

RO PADDOCK, HEAD OF FINANCIAL CRIME AT N26 determining what you are willing to compromise on with regard to that appetite.

I want to encourage my team to see the many opportunities for improvement, and to focus on fraud We are here to help if you are seeking prevention rather than treatment. Instead of putting a expert fraud prevention guidance on how band-aid or plaster on a bullet hole, like reactive treatment, to best design your KYC process.

N26 should seek to perform the surgery and remove all the Please email us at [email protected] or bullets from the shops so that a similar accident cannot visit www.fourthline.com. happen again. Moving from a reactive to a proactive state of fraud detection will enable us to identify fraud very early on and make transaction monitoring alerts less relevant.

INTERVIEW BERLIN, JULY 2020