Location verification can prevent QR code fraud


Mobile Payments Today interviewed André Ferraz, the CEO and co-founder of Incognia, a private identity company that provides fraud prevention by using frictionless identity location verification.

Contactless is a word being thrown around a lot when it comes to payments in today’s world. Contactless, cashless, touchless, tap-and-pay, whatever the process, the point is these days consumers are leery of person-to-person contact when purchasing any goods from food to furniture. But consumers could be under the impression that by going contactless, that also means it ensures against fraud, which isn’t the case.

André Ferraz is the co-founder and CEO of Incognia, a company focused on preventing fraud by location technology. Headquartered in Palo Alto with teams across the country, the company uses what they call anonymized location data to increase account security and reduce fraud.

“The COVID-19 pandemic has accelerated the move to contactless payments,” Ferraz said in an interview with Mobile Payments Today. “The benefits for customers include health, safety and less friction. However, the main challenge that customers are seeing is security, particularly [regarding] QR codes.”

Ferraz explained that QR phishing attacks could increase, given the new trend of companies providing and consumers scanning QR codes. As contactless payments rise, fraudsters are learning how to create fake QR codes that when used, could leave a consumer vulnerable.

Through location-based identity verification, Ferraz’s company helps to prevent this type of mobile fraud.

Behavioral patterns will help prevent fraud

Using network signals and on-device sensor data, the location technology detects physical places visited by the app user through their phone and creates a unique digital identity built from their behavioral patterns. These locations are verified in real-time and are continually updating. If a user goes to the same grocery store, that’s part of their digital identity.

To prove the applicant’s identity, the location-based solution matches the home address provided during onboarding to the user’s actual location behavior. If there is a match, a low score is delivered; if there is no match, a high-risk flag is delivered. All the location verification processes happen silently in the background without any friction for the customer.

Even if a user attempts to log in with a new device, the process continues to work. The company checks their exact location and compares it with the customer’s historical behavior. If there is no match, a high risk signal is delivered and checked.

“The trend toward contactless payments opens up the fraud playing field as mobile payments accelerate,” said Ferraz. “Location behavioral biometrics can link the expected physical location of the QR code and match it to the customer’s real-time location. Even though the credentials may appear legitimate, if they don’t match the user’s location behavior, it will be flagged as high risk.”

And that flagging will help consumers and companies avoid fraud as contactless payments continue to increase.

“I believe contactless and frictionless payment methods will be more widely used,” said Ferraz. “I’m definitely seeing QR codes everywhere, but your wallet can stay in your purse or back pocket; all you need to have your location verified is your phone.”