NuData Shines Digital Behavior Light on Operating Telecoms Securely in a World Darkened by Identity Fraud

Another day, another data breach.  It’s fairly common news these days to see the reputations of big brand companies tarnished by the theft of sensitive customer information.

Very recently a breach at T-Mobile exposed the email addresses, account numbers, and phone numbers of 2 million customers.

Now it’s worth highlighting how hard it actually is to protect customer-specific information these days:

• The digital ID footprint of your average person today is quite large.  It includes many PIIs (personally identifiable information): user names, credit/debit card numbers, driver’s license — you name it;
• Thanks to social media, public databases, and phishing emails, much of our personal information is already exposed to some degree; and,
• Hit and run data theft is bound to happen on occasion because employees who have access to sensitive account information are only human.  They can be bribed to reveal passwords that open the door for criminals to do their dirty work.

Recognizing the security risks that exists today, businesses — especially banks, telecoms, e-commerce, and healthcare firms — have built elaborate verification systems to protect themselves and their customers.

One of the most successful of these verification systems involves tracking and analyzing digital behaviors, basically studying the actions of a digital user to create an accurate virtual profile of the user above and beyond the actual PII which might be compromised.

Digital behavior analysis is the specialty of NuData Security, the 10-year old formerly private firm acquired by Mastercard in early 2017.  Today NuData operates as a wholly owned subsidiary offering managed services to global clients.

I recently spoke with Ryan Wilk, VP of Customer Success for NuData.  In our interview, he not only gives a great tutorial on digital behavior analysis, he also explains how NuData drives value for telecoms in: 1) greater fraud protection and 2) intelligence to improve the digital experience of customers.

	Dan Baker, Editor, Top Operator: Ryan, as an outsider to your industry I’m tempted to lump you in the same category as credit service bureaus like Equifax and TransUnion.  But I understand NuData’s business is actually quite different.

Ryan Wilk: Yes, Dan, at NuData we are less concerned with the PII or the PCI data and that’s what the credit bureaus really look at.

Our mission is to better understand digital behaviors — how people “act” as they interact with the digital world.

Think about how you use your senses in the physical world.  Throughout the day you look, you touch, you taste.  And along the way you begin to understand your environment and learn about the people you interact with.

Well, we are making similar observations in the digital world to discover when people might be doing something abnormal or unexpected.

As you look across multiple factors of interaction — device, connection, behavioral analytics, and passive biometrics — you can better understand when data is being misused in the digital world or when that same data is being used in a way unexpected or not valid for a user.

So, that’s our key value proposition: understanding what risk looks like in the digital world, and how can we create more trust in that ecosystem.

	How would you define digital behavior?

Well, as we look at digital behavior, there are four key factors involved:

• The first factor is device/connection and geo location.  This is knowing where the user is coming from, the type of devices that they are interacting with, and the connection they are using.  Our analysis aggregates data into historical profiles based on the digital scenario or environment.  It allows us to identify things like account testing, account takeover, and automation — both browser-level or device-level automation.  It’s about being able to dig down and know what the device and connection are doing.
• The second layer we look at is passive biometrics where we learn how the user actually behaves with the device.  What does their typing speed look like or their keystroke deviation?  We want to know what each user looks like in the digital world.  Do they exhibit the same behavior time and time again?  Or is there a deviation from their normal inputs?
• The third layer is behavioral biometrics, which analyzes the environment data such as the type of browser used, the browser version or the device settings — language, brightness, etc.
• And fourth is our real-time trust consortium, the ability to look across the billions of behavior data points in our whole network and to analyze with our machine learning system in real-time to understand what’s risk and what’s not risk — and return those results to customers.

	Where are you delivering the most value for telecom operators?

We work with a number of telecom carriers to better protect them as new accounts are created.  We also help prevent malicious activity such as someone trying to get services for free.

What’s more, we give them a better understanding of who their customers are.  It’s being able to dynamically protect your good user accounts from things like account takeover, protecting different types of site interaction — that’s our focus.

Now it’s easy for operators in the mobile market to lose customers because mobile service from one operator to the next often looks similar.

And if you’re careless about protecting the customer from account takeovers or if you fail to use your data properly, you can make mistakes that will cause you to lose a customer forever.

The first step is being able to safely offer services to customers digitally.  From there you can begin to understand: is he my correct customer?  Can I give him a better experience?

So NuData helps cultivate that sense of community and being protected.  And that’s often the most valuable thing we bring to our telecom clients.

	Comparing NuData to its rivals in the digital behavior analysis business, what are your strengths?

First up, NuData has one of the longest histories of doing this.  And while we are backed by Mastercard, many of our rivals are small firms.

We also have one of the largest behavioral datasets of any company in the world doing this.  We now support major companies, processing over 400 billion behavioral events this year.  That’s a huge volume that passes through our system and we’re doing that in real-time and in-line for some of the largest banks and e-commerce companies in the world.

We also have a proven track record.  When customers have matched us up with our rivals, we’ve beaten them quite dramatically.  Finally, our customer base includes some of the largest brands — these are household names.

	I’m curious what you think of national biometric programs.  For instance, India has a national biometric ID database that covers a billion people.  Will that approach work in other countries?

I think they could definitely work in some countries.

I have mixed feelings about whether it would work in the United States.  It seems to get a lot of negative reactions when people talk about a national ID card, for instance.

The other day I spoke to an organization in Japan who plans to build out a system to identify users based on your mobile device, storing your past behaviors.  Their idea is that when you are walking by a store where there’s a 90% probability you would buy things from, you can tell the store to be ready to bring you in and have things ready for you.

Companies require a much higher level of trust from customers because the company is catering services based on the customer’s digital profile and digital identity.  But I think such a service could work in some countries with that level of trust, and we may see the next steps go in that direction.

	And what about consumer and credit card fraud prevention programs across the world.  How mature are we today?

The U.S. is one of the strongest markets out there from an eTail perspective, whether it’s e-commerce or any kind of remote sale.  The U.S. has a powerful formula in our credit card system: it’s trusted and the merchant is the first level of defense to stop fraud.

Countries that use 3-D secure — one of the credit card company protocols that help mitigate risk — have improved their security.

On the other hand, we see an over-reliance on these mandated tools, and some countries have not made investments in additional internal infrastructure.

So the ecosystem here in the U.S. has forced companies to become generally more mature in the risk area.

	Now even though you are owned by Mastercard, I understand you offer your services to any enterprise regardless if they are inside or outside the Mastercard family.

Yes, Mastercard acquired NuData because it saw how our mission complements their operations.  For example, NuData recently started offering the 3DS 2.0 service. 3DS 2.0 is a tool that merchants use to better validate that a card is being used by the correct user.  And the service is now being provided as part of the Mastercard offering.

The 3DS service shares additional information with players in the card approval chain to make smarter decisions.

	Thanks for this fine briefing, Ryan.  Sounds like NuData has a dual strategy: 50% protection and 50% optimization and retention.

That’s right.  It is the ability to identify the good and bad.

Our behavior analysis allows our customers to better conceptualize their users’ behavior.  And by the way, that behavior is not always going to be risky.  If the risky interactions are 2% of your environment, the valid interactions are 98%.  Now if you focus all your time on the 2%, you are not giving that 98% a better experience.  So that’s the wrong approach.

The irony is that when you make more effort to understand the 98% good customers, you learn about behaviors that will also help you better identify and stop the risk of those 2% maybe-fraudulent interactions.