Auto-translation used
Read the original

Protection from fraud is a direct responsibility of Commercial Banks and the National Bank of the Republic of Kazakhstan, and not a headache for customers.

Recently, the National Bank of the Republic of Kazakhstan has once again issued a warning about new fraud schemes.

The news, which caused many IT specialists, including me, to feel righteous anger instead of a sense of security. Not from the ingenuity of the scammers, but from the depressing passivity and, let's be honest, the technological backwardness of some financial institutions that persistently shift responsibility onto their clients.

We are told: "Do not tell anyone the SMS code!". Sounds simple, doesn't it? But this is a cynical simplification of a complex problem.

Scammers are not just "hello, Mom, I'm in trouble."

These are professional social engineers who use years-honed techniques of psychological pressure and verbal hypnosis. They don't hack systems, they "hack" a person.

To understand how vulnerable the human psyche is, just watch the YouTube video of the famous English mentalist and hypnotist Derren Brown. On the streets of London, in a matter of minutes, during a routine conversation, he left people without wallets, watches and keys. The victims themselves, voluntarily, gave him their belongings, being in a state of light trance caused by a specific manner of speech and unusual behavior. It's not magic, it's the science of human perception. And if a professional can do this live, then what about a phone conversation where a fraudster builds a scenario in advance, puts pressure on emotions and does not give time for critical reflection?

Accusing a person of "giving the code himself" is like accusing a robbery victim of "walking down a dark street by herself." This is shifting the blame from the aggressor and, most importantly, from the one who was responsible for ensuring security. And in the financial world, this "someone" is a commercial bank.

While regulators and some banks are lecturing us, highly paid programmers at BigTech companies and advanced fintech startups have long created and implemented software solutions that can stop most of these attacks in the bud. And these are not space technologies, but fully feasible and, by the standards of bank budgets, inexpensive protective mechanisms.

Let's sketch out some elementary examples that any competent developer could implement.:

  1. Validation of the SMS code source: That's the most obvious thing. If the bank sends an SMS code to confirm the operation to the customer's number, and the attempt to enter this code occurs from a completely different device, from an unknown IP address or from another country, the system must immediately block the operation. Instead of debiting funds, the client should receive a notification: "Suspicious activity has been detected. Your operation is blocked. We didn't ask you for the code over the phone. If it wasn't you, contact the bank immediately." Simple? Elementary.
  2. Behavioral Anomaly Analysis: Modern anti-fraud systems analyze thousands of parameters in real time. An uncharacteristic transfer amount, an unusual time of day for a transaction, a new, previously unused recipient, an attempt to change the password immediately after a call from a suspicious number – all these are "red flags". The system may automatically freeze such a transaction and require additional, more complex verification. For example, a video call to the bank or a personal visit.
  3. Geo-targeting and whitelisting: If the client has never traveled outside of Kazakhstan, an attempt to log into his account from another country should cause immediate blocking until the identity is confirmed. If a client regularly transfers money to the same 10-15 recipients, transferring a large amount to a completely new account is a reason for additional verification.

Large banks that respect themselves and their customers are actively investing in such systems. They understand that reputation and trust are more expensive than short-term savings on IT security. But what do we see in practice? A significant part of fraudulent write–offs are made by customers of "medium-sized" banks and those who still live in the "software is a cost, not an asset" paradigm. They prefer to save on developing and licensing high-quality anti-fraud software, and then issue press releases in the spirit of "be vigilant."

It's time to stop this vicious practice.

Protecting the client's money is a direct, integral responsibility of a Commercial Bank. And this obligation should be fixed by law.

It is necessary to adopt a rule according to which the bank bears full financial responsibility for all fraudulent write-offs, unless it proves in court that its security system meets the highest modern standards. If the money is gone from the account, it means that there was a "hole" in the bank's program code. And it's not a pensioner or a teacher who has to pay for this "hole", but the financial institution itself.

And here the responsibility lies not only on commercial banks, but also on the National Bank of the Republic of Kazakhstan. It is the regulator that allows players with weak, outdated and inadequate software to enter the market. If we conduct an independent security audit and analyze all fraud cases over the past year, I am sure we will see a clear correlation: customers of only a few technologically backward banks are robbed.

The argument "scammers are abroad" is an excuse for the poor.

Firstly, all transactions leave a digital footprint, which is an irrefutable evidence base. Secondly, there is Interpol and international agreements for this purpose. With the political will and competent work of law enforcement agencies, you can find anyone, anywhere. But you have to work for that.

And the state bureaucracy, as we know, is not about taking care of people.

As a programmer and as a person who has studied the psychology of influence, I declare that the only reliable protection against modern fraud is smart program code. A code that a priori considers any transaction suspicious until proven otherwise. A code that protects the client even from himself, from a momentary confusion caused by a professional fraudster.

The time has come to demand from Commercial banks not empty warnings, but real, working technological solutions and full financial responsibility for the security of our money.

And the Astana Hub IT community should become the vanguard of this demand, because who better than us understands the true cost of technological ignorance and inaction.
90
avatar

Daulet Baimurza

July 15, 2025 18:29

Comments 0

Login to leave a comment