Fraud Management

TM Forum Members Only
TM Forum Members Only
The full version of this page is only available to members of the TM Forum. Learn more about becoming a member.

In order to access a TM Forum Member only area of the website you must be a registered user and work for a TM Forum Member Company. If this applies to you please login above.

Not a Registered User? Register Now
Registration is free, quick and simple, and will give you access to a large library of TM Forum member content, industry documents, exclusive articles, commentaries, plus our web discussions and event features.

If you experience any problems logging in, please contact us.


RSS



Group Administrators

Fraudsters Will Be Fraudsters, But How Does Provider Indifference Help?

Share |

I just got off the phone with the provider of some of my services, and it was a notable experience in exactly how indifference to fraud by a provider enables the fraudsters to continue in their dirty deeds.

Here's the particulars--I received an e-mail in my personal inbox that was clearly a phishing attempt.  The sender e-mail domain was a pathetic attempt at spoofing the provider's, the sender identity was "resyq4ey", the body of the message contained multiple hypertext links whose text represented them as navigating to a web site to test my service, purportedly in concert with the FCC.  Hovering over the text revealed an entirely different URL that was clearly going to take me to someplace bad.

I called the customer support representative to ask if there was an e-mail address for their security department (similar to what PayPal Resolution Center offers on their web site).  Not only was he not aware of any such department, he further seemed totally disinterested in my problem or the possibility that he was just unaware of such a department that might exist in his enterprise.  His entire response was "Just delete it."

I don't really hold the excessively-relaxed CSR in this case, but rather his management.  Either there is, in fact, no arrangement for reporting fraudulent activity, or there is and the employee is unaware of it.  In either case, management is holding the bag in this case.

This institutional blind spot to Enterprise Risk Management is not new nor confined to CSPs.  I poignantly remember the situation from earlier in my career where a worldwide survey of Digital Equipment Company VAX minicomputers discovered 98% of the installed base to have the remote access superuser maintenance port still configured with the userid/password combination set to "test/test", much to the chagrin of the US Sandia National Laboratories when a cabal of Boy Scouts wiped their e-mail server clean.

I'd suggest that the industry should at least set a basic goal of making the fraudsters at least break a sweat as they perpetrate their nasty business.


Posted 02-08-2012 9:31 AM by Steven Cotton

Comments

Raul Azevedo wrote re: Fraudsters Will Be Fraudsters, But How Does Provider Indifference Help?
on 02-08-2012 7:43 PM

I would like to believe that it was just lack of knowledge from the customer support representative, but my experience tells me that this kind of situation is not having the appropriated attention from CSPs. The same thing happened in banking until they realize the growing losses that were resulting from credentials theft.

CSPs are heavily investing in electronic channels to manage accounts and subscribe services, but are incurring in the same negligence that banking did and that has started being minimized only when banks assumed that fraud exists and their customers need to know about them and need to know how can they prevent it.

My perception is that, for CSPs, this is still a taboo subject, but surely we have different realities in different CSPs. It would be interesting to have opinions from our members on this.

Bruce Frankel wrote re: Fraudsters Will Be Fraudsters, But How Does Provider Indifference Help?
on 02-09-2012 9:01 AM

I know that I received communications from financial institutions warning about phishing attempts, but I can't recall ever receiving anything similar from my telecom, or cable, or any other type of service provider.

Hopefully all industries and companies will start to take this seriously.

Dharmendra Misra wrote re: Fraudsters Will Be Fraudsters, But How Does Provider Indifference Help?
on 02-13-2012 3:37 AM

Hi Steve

I believe that CSR in telecom industry are still not mature to an extend that they can understand all problems and resolve them or escalate them properly, specially in India. When I call to Bank CSR and try to get solution, I feel more satisfied than when I call a CSP CSR. May be that in fast moving industry and high attrition, it is difficult to train them or may be that CSPs are investing very low/outsourcing to cheap vendors for CSR services that prefer to avoid investment per say in them. Its my personal experience with my service provider and others may defer. More thoughts on this may help all.

Bruce Frankel wrote re: Fraudsters Will Be Fraudsters, But How Does Provider Indifference Help?
on 02-13-2012 9:27 AM

While I will agree that my CSR experiences with banking are almost always satisfactory, I have to admit that my experiences with my wireless provider (AT&T) have also been pretty good, expecially in the last few years.

Not sure I have the same praise for my cable company though.

I don't know that I can infer any generaizations about why one is better than the other, other than the fact that my bank and wireless companies are much bigger, older, and more profitable that my cable company, so perhaps they can afford to (or feel the need to) invest in better quality customer care.

Eric Klein wrote re: Fraudsters Will Be Fraudsters, But How Does Provider Indifference Help?
on 02-19-2012 6:22 AM

I love the closing line:

"I'd suggest that the industry should at least set a basic goal of making the fraudsters at least break a sweat as they perpetrate their nasty business."

If only this was possible.

Ken Dickenson wrote re: Fraudsters Will Be Fraudsters, But How Does Provider Indifference Help?
on 02-20-2012 4:52 AM

I think the awareness is often linked to the levels of crime or perceived levels of crime in a country. In South Africa we have a relatively high crime rate and this raises everyones awareness so we have multiple mechanisms for reporting crime and I do not believe that this is true where the general population does not come into contact with crime on a regular basis.

We welcome your feedback! To comment on this blog post please either Log-In or Register to the TM Forum Community

Paid Advertisement
About TM Forum
Introduction, History, Board, Management Team...
Membership
How to Join, Benefits, Member List...
Community
Community Home, Groups & Teams, Blogs...
Conferences
Event Calendar, Management World, Supported Events...
Training & Webcasts
Upcoming Training Courses, Upcoming Webinars, Podcasts, On-Demand Webcasts...
Initiatives
Cable, Enabling Cloud Services, Government and Defense...
Best Practices & Standards
Frameworx, Business Process Framework (eTOM), Information Framework (SID)...
Resources
Document Library, Case Studies, White Papers
Research & Publications
Business Benchmarking, Newsletters, Insights Research...
Copyright © 1988-2012, TeleManagement Forum. All Rights Reserved
Contact Us
Careers with TM Forum
News Room
Privacy Policy
Terms of Use
Sitemap