Helping To Protect Credit Unions from Fraud, Account Takeovers and Pig Butchering

By Roy Urrico

The rising sophistication of financial crime demands new approaches in the way credit unions, banks, and other financial services organizations address fraud detection. That is the position Chris Purvis, director of business development at GeoComply, a cybersecurity firm specializing in geolocation and fraud prevention technology, took in a conversation with Finopotamus.

Chris Purvis, director of business development at GeoComply.

“Our reputation is in gaming compliance, but over the last several years, we're trying to get into the fraud and security business and moving that into financial services because of some of this location intelligence,” said Purvis.

Vancouver, British Columbia, Canada-based GeoComply, founded in 2011, gained recognition for its work with online sports betting and gaming, helping companies like FanDuel and DraftKings prevent financial crime, provide consumer protection, and stay in compliance with regulations. Now the company is leveraging its expertise to help credit unions and banks with know your customer/anti-money laundering (KYC/AML) requirements, fraud prevention, and criminals using sophisticated techniques to mask their location and identity to access financial systems.

Started in Gaming

“GeoComply really exploded in growth in 2018 when the United States essentially legalized sports betting and ‘iCasinos,’ but they left it to be regulated by the States,” explained Purvis. iGambling, also known as online gambling, covers numerous betting activities undertaken digitally including virtual casinos, poker, sports betting, lotteries, bingo, and horse racing,

Purvis continued, “Because some of the solutions that they had built around compliance, and then more importantly around the fraud aspect, (GeoComply) wanted to know whether (their solutions) fit very well into finance. Can we move this into the banking world, into the credit union world, into the fintechs and cryptos?”

More than 15 financial institutions currently leverage GeoComply’s anti-spoofing technology to detect virtual private networks (VPNs) and proxies to reduce risks related to sanction compliance, money laundering and general cybersecurity.

Those include:

• Four of the top 20 U.S. banks and one of the top five Canadian banks.

• More than five international banks across Europe, Latin America and Asia-Pacific (APAC).

• A leading global money transfer business.

• More than five crypto wallets and exchanges.

  
  

Source:GeoComply.

Validation in the Gaming Business

In gaming, GeoComply validates whether the user can legally place a bet. Explained Purvis, “If I live in California, there is no online sports betting here. The regulation states you physically have to be in New Jersey (where online betting is legal) in order to place a bet. I want to say I am in New Jersey. I just simply go download a VPN, turn it on, and say, I am in New Jersey. We have proprietary methods for looking at the real nasty ways to spoof your location.”

GeoComply look for signals such as GPS Wi-Fi that connect to routers and even cell tower information connected to a mobile network. “We create a big picture using all of those signals to understand, are you where you say you are and are you trying to spoof it? If I say ‘I'm in New Jersey, but I'm connected to a cell tower in Los Angeles,’ that's a pretty big risk signal when you're talking about compliance,” Purvis continued. “We have got a reputation for being known in the gaming industry and compliance, but we really have a lot of experience in fraud as well.”

Between 2018 and 2025, GeoComply incorporated intelligent fraud rules, device intelligence information, anti-spoofing methodology, and even some machine-learning models to create “a very sophisticated and really innovative solution from a fraud risk and authentication perspective,” he said. This GeoComply solution, he added, is tailored to financial services including credit unions, banks, fintech, and crypto firms.

Helping Financial Institutions Detect Fraud

GeoComply solutions can help financial institutions stay ahead of fraud and compliance risks,” said Purvis. “Our solutions are relatively basic and easy to install. From a technology perspective, it is a simple SDK (software development kit) that is installed into the mobile banking or the credit union apps in JavaScript collectors that are installed on a webpage.”

Purvis also noted that GeoComply understands that integration can be different for an institution like Bank of America, which maintains its own infrastructure and fraud detection capabilities, when compared to credit unions. “You do not have to replace anything. You can use our data, our analysis, our rules, and our decisions that come in, inserted into the existing infrastructure.”

Purvis compared fraudsters probing for system weaknesses to squirrels trying to penetrate bird feeders. “They try to get that bird seed 24 hours a day, seven days a week. That is what they want,” Similarly, fraudsters constantly probe banking systems for weaknesses. People working in fraud and security “have to be up to date in your solutions, and you have to be flexible, and implement things pretty quickly.”

Purvis added, “I was talking to one of my credit union clients just this month. They typically see about 500,000 logins per month. So not too big, not too small. In the month of April, they saw an increase to 50 million logins. They found out that the majority of those, about 49 and a half million were invalidated logins. It was a credential stuffing attack that was coming at them. It took them a month to realize this was happening. We can detect these bots; we can detect unusual traffic.”

Fraud Trends

Purvis mentioned account takeover and data breaches as currently trending. “We are seeing a lot on the scam side too. So, scams are, are one of those things where I see people tending to fall back to more traditional fraud types instead of digital fraud types. Instead of trying to attack the digital channel, they are trying to attack other weak spots.”

Some scammers are also infiltrating the account opening procedure, he said. “Bad guys are starting to interrupt that process in the middle of this session. They get all the information entered, and as soon as it comes time to scan my driver's license, they cut the internet connection. It says, ‘We're sorry, we can't complete this transaction.’” Meanwhile the scammer has obtained enough information to create a fake credential, he added.

Another scam category gaining notoriety in financial services is called “pig butchering,” which is an investment scam where fraudsters gain the trust of victims over time and then deceive them into investing in fake crypto assets or another fraudulent investment opportunity. More than 92% of identified devices from regions associated with pig butchering are connected to Wi-Fi, according to the FDIC Office of Inspector General, Purvis said. GeoComply provides tools to detect pig butchering scams.

Location Dashboards and a Quick Implementation

GeoComply creates high-risk location dashboards, explained Purvis, “based on information from everybody we do business with. We are doing 50 billion transactions a year among all of our client base. That is gaming, media and entertainment, financial services, retail, e-commerce. We see when fraud repeats at the same location.”

Purvis pointed out that GeoComply is currently beta testing KYC processes with clients. “You've validated my address, you know where my home is. Why not make it easier for a customer to transact from home? You can validate I am sitting in my living room, why not have my wire transfer limit increase from $5,000 to $25,000 because I am in a trusted location. Why not allow me to seamlessly open an account without a lot of friction. Make it easy for people to do business with you. That is how you gain traction. That is how you gain customer trust,” said Purvis. “That's how members at credit unions are going to be members for life. You make a really good experience for them.”