US-based Broadcom announced the launch of Arcot Scam Defense, a new feature within Arcot by Broadcom, the company’s 3-D Secure payment authentication offering. The feature targets social engineering fraud in card-not-present (CNP) transactions, where cardholders are manipulated into authorising fraudulent payments themselves.
According to Matt Cooke, vice president and general manager, Payment Security Division, Broadcom, financial institutions are recording broad increases in fraud attempts linked to AI-assisted social engineering. As technical security controls have become more effective at stopping fraud, fraudsters have shifted towards targeting customers directly. They impersonate trusted brands and institutions to persuade cardholders to disclose passwords or complete step-up authentication. In many cases, cardholders only realise they have been deceived after the scam has taken place.
In a standard payment flow, once a cardholder completes a 3-D Secure challenge by entering a one-time password (OTP) or using biometrics, the transaction is treated as legitimate and approved by the financial institution’s primary risk models. In addition, Broadcom notes that real-time risk assessment models are effective at flagging suspicious activity. However, they are not built to stop a genuine account holder who is acting under the influence of a scammer.
With this in mind, Arcot Scam Defense is positioned as a second, real-time layer of defence applied during authentication. It is designed to flag suspected fraud even after a challenge has been completed successfully. According to the company, the aim is also to reduce fraud losses and protect cardholders while continuing to approve legitimate transactions.
How the feature works
The feature analyses signals across transaction data, device intelligence, historical behaviour, and the challenge interaction itself to detect patterns associated with social engineering. Examples include inconsistencies in location and behaviour between the checkout device and the authenticating device, delayed OTP entry, the use of an alternative authentication method, and a significant physical distance between the two devices.
These signals are assessed together to support a real-time decision, rather than relying on any single indicator. Arcot Scam Defense can also integrate with third-party solutions to establish whether the authenticating device is on an active phone call, which Broadcom identifies as a key indicator of social engineering. The intention is that even when a cardholder has handed over credentials, the shift in behaviour can be detected and the transaction blocked in real time.
Scale of the problem and pilot results
Broadcom states that nearly USD 500 million in fraud was reported over the past 12 months on successfully authenticated challenges. In pilot testing validated against a full month of live data, reviewing only the top 1% of successful challenges at one pilot issuer would have protected an estimated USD 4 million in fraud within that month. This came at a cost of 0.38 points off the issuer’s authentication success rate.
The figures show the trade-off issuers face between intervening on already authenticated transactions and maintaining authentication success rates.
Planned developments
Broadcom plans to extend the feature with new signals, including cardholder and device attributes. It also plans to add a dedicated challenge history profiling engine that will learn each cardholder’s past challenge behaviour.
For issuers, the development reflects a move towards using authentication data to assess two things: whether the person completing a challenge is the genuine cardholder, and whether that cardholder may be acting under external pressure. Arcot by Broadcom remains exclusively focused on 3-D Secure payment authentication.
