India’s fintech lending industry has grown rapidly since 2014, with the evolution of new models and approaches to lending. This rapid growth offers the potential for many upsides in the form of <a href="https://www.cgap.org/blog/indian-start-for-digital-credit" target="_blank" rel="noopener noreferrer">easier access to much needed credit and including hitherto excluded consumer segments</a> who may not have the ability to prove their ‘creditworthiness’. In India, as in other parts of the world, the growth in digital lending has been accompanied by a variety of risks. Some of these risks – such as over-indebtedness, poor market practices of aggressive marketing and collection, and pricing – have long been associated with lenders and need to be addressed as a market conduct issue. However, the digital nature of fintech lending poses several new risks that, combined with traditionally known risks, create an environment of poor consumer outcomes and mistrust of the industry.
<h1>Fintech Risk Barometer Study</h1>
While there has been extensive media coverage around several of the fintech lending risks, these cases tend to be anecdotal and do not provide a sense of which risks are highest priority as the industry evolves. To better understand the multitude of risks the Indian fintech lending industry faces, the <a href="https://faceofindia.org/" target="_blank" rel="noopener noreferrer">Fintech Association for Consumer Empowerment</a> (FACE) and CFI partnered to conduct a risk barometer study. The resulting <a href="https://www.centerforfinancialinclusion.org/fintech-lending-risk-barometer-2022-2023">fintech lending barometer report</a> is the first attempt at identifying how risks are perceived by various stakeholders associated with the fintech lending industry in India and is a crucial first step to documenting how risks evolve.

For fintech lenders, this report presents an opportunity to understand the landscape, identify the opportunities and dangers, and plan or correct their course of action. For regulators, supervisors, and policymakers, the survey findings signal what areas within the Indian fintech industry need to be more closely examined and addressed with urgency.

The fintech lending barometer study followed a mixed methods approach. First, a survey was used to gather initial perceptions of risks, which then was followed by a series of qualitative interviews with select respondents to further understand how emerging risks impact consumer lives. For each risk, the survey asked participants to rank 23 risks on a scale of 1-7, with one being the lowest severity risk and seven being the highest. The survey also captured comments and feedback from survey participants on these risks and the top three opportunities.

Top 10 Risks Identified by Survey Respondents

<img class="alignnone wp-image-45643" src="https://content.centerforfinancialinclusion.org/wp-content/uploads/sites/2/2023/01/Screenshot-2023-01-13-at-2.02.11-PM.png" alt="" width="666" height="775" />

The top three risks identified were unscrupulous fintech lenders, rising cyber fraud and crime, and issues around data privacy. The report is being released at the <a href="https://inclusivefinanceindia.org/" target="_blank" rel="noopener noreferrer">Inclusive Finance India Forum 2023</a> and can be accessed <a href="https://www.centerforfinancialinclusion.org/fintech-lending-risk-barometer-2022-2023">here</a>.
<h1>Consumer Protection Implications</h1>
<blockquote class="pullquote--right">Industry associations have an inherent advantage in gathering early insights on consumer complaints and experiences from their members and in getting inputs on market trends.</blockquote>
Kate McKee, former senior policy advisor at CGAP, who pioneered thinking on consumer protection for inclusive finance, often referred to the three legs of the ‘<a href="https://www.mfw4a.org/sites/default/files/resources/Kate_McKee_english.pdf" target="_blank" rel="noopener noreferrer">consumer protection stool’</a> –  regulation, market monitoring and self-regulation, and building consumer awareness – where each of the three legs must be stable in order to responsibly and reliably provide for consumers. While the Reserve Bank of India has been proactive as a regulator in issuing guidelines on digital lending, there is a role to be played by industry associations like FACE and others in enabling market monitoring. Industry associations have an inherent advantage in gathering early insights on consumer complaints and experiences from their members and in getting inputs on market trends. For instance, they may hear about specific instances of fraud from their members which can erode the reputation of the industry in general. This provides associations with a unique opportunity to identify emerging risks and either escalate them to supervisors or establish responsible market conduct. This in turn can boost trust in businesses and offer long term value. For supervisors, this interaction with industry associations can help them stay abreast of market developments and assists with considerations for investing in appropriate suptech tools depending on the nature of risk identified.

A host of market monitoring tools exist and several are summarized in <a href="https://www.cgap.org/topics/collections/market-monitoring-tools" target="_blank" rel="noopener noreferrer">this toolkit</a> by CGAP. However, effective market conduct supervision depends on timely identification of market risks and reviewing how these risks evolve with market growth. CFI’s consumer protection strategy focuses on strengthening market conduct supervision by researching emerging risks and working with partners who can elevate these risks to supervisors. This partnership with FACE is a step towards this goal and offers insights for industry associations of digital lenders in other markets.

Matters of Urgency: Insights From a Fintech Risk Barometer Study

The past decade has seen an increase in predatory and fraudulent practices in digital finance and fintech. In the last 10 months, there has been an increase in anecdotal evidence that the COVID-19 pandemic has led to a proliferation in the methods and tools predatory and fraudulent providers are using to exploit vulnerable households and businesses (see recent media coverage <a href="https://www.bloombergquint.com/law-and-policy/financial-frauds-have-seen-a-spike-due-to-dependence-on-digital-payment-platforms-ajit-doval" target="_blank" rel="noopener noreferrer">here</a> and <a href="https://www.mediapost.com/publications/article/354201/finance-mobile-apps-most-exposed-to-fraud-gaming.html/" target="_blank" rel="noopener noreferrer">here</a>).

In exploratory work using high-frequency mobile application data for 71 countries, we document the <a href="https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3588453" target="_blank" rel="noopener noreferrer">increasing scale and scope of these new methods</a>. We observe that some of the most downloaded mobile apps in a number of countries following the outbreak of COVID-19 include finance-related apps that show signs of being either predatory or entirely fraudulent. For example, there is a growth in personal lending apps luring new users to pay nominal service fees to obtain access to cheap loans, but which are revealed to offer no actual service. The release dates of these apps coincide with the onset of COVID and related government lockdowns and are initially buttressed by extremely high ratings driven by tens of thousands of apparently fake reviews. After a duration, some appear to be eventually removed or blocked on the app stores.

For this and other reasons, we categorize these apps as being highly likely instances of fraud. The graph below depicts this after the onset of lockdowns in India, where we saw a wave of lenders fitting these criteria pop up and quickly attract many users. Notably, the adoption of these fraudulent lending apps surpasses that of pre-existing lending apps from known, legitimate providers during this period. We also observe examples of apps set up to mirror legitimate sites (e.g., mimicking existing government or finance apps), but that appear to be designed to phish sensitive information from unsuspecting users. (India is used to illustrate such issues, but similar examples occur in a range of other markets, such as Nigeria, Philippines, etc.)

Combating the Rise in Fraudulent Fintech Apps

Although the CARES (Coronavirus Aid, Relief, and Economic Security) Act has mobilized a whopping <a href="http://crfb.org/blogs/whats-2-trillion-coronavirus-relief-package">$293 billion</a> to provide one-time economic impact payments to American households, many are ineligible for this federal support due to <a href="https://www.nilc.org/resources-covid19-crisis-and-consequences/faq-eligibility-for-assistance-based-on-immigration-status/">their immigration</a> status or living in a <a href="https://www.nytimes.com/2020/04/28/us/coronavirus-undocumented-immigrants-stimulus.html">mixed-status household</a>. Cities, counties and states across the United States are stepping in for these residents by bridging the gap with cash transfer programs of their own.

Beyond the inherent complexity of quickly establishing a safe and efficient cash distribution program, serving this marginalized population presents specific challenges. First, local governments need to identify and enroll beneficiaries from a population that generally lacks official identity documentation and can be difficult to reach. Second, in addition to being undocumented, this population is often unbanked or underbanked, raising questions about how cities and counties can safely deliver financial stimulus in a cost-effective manner. Third, data protection is high stakes for this population, which tends to be at greater risk for financial fraud or exploitation, as well as targeting by Immigration and Customs Enforcement (ICE).

Given these challenges, how should US cities design cash transfer programs to serve undocumented communities?

With support from Open Society Foundations, CFI identified more than 70 examples of city- and county-led municipal identification initiatives (active, inactive, and proposed) that sought to address challenges residents face in obtaining government-issued forms of identification. For marginalized and vulnerable populations—such as the undocumented, those experiencing homelessness, and the elderly—a lack of official identification makes everyday tasks like accessing social services or opening a bank account difficult.

Cities that have established these programs, particularly those that have sought to leverage them to advance financial inclusion, provide several lessons to cities facing similar challenges while establishing cash assistance programs in response to COVID-19.

&nbsp;

&nbsp;

Municipal IDs Offer Cities Lessons for COVID-19 Cash Assistance Programs

<h1>Why Consumer Rights and Responsibilities?</h1>
The <a href="https://www.smartcampaign.org/about/smart-microfinance-and-the-client-protection-principles">Client Protection Principles</a> provide a common framework for financial service providers (FSPs), policymakers, and clients to better understand and discuss consumer protection issues. While much of the Center for Financial Inclusion’s (CFI) work with the financial inclusion industry has focused on providers and regulators, there is a third crucial constituency: clients.

Client awareness and capability is a critical component of effective financial consumer protection. Clients have the right to demand fair treatment and lodge complaints with government authorities, but these rights mean little if they don’t know what constitutes lawful treatment or how to access complaints channels. Similarly, clients play a role in protecting themselves by practicing behaviors to maintain their privacy and safety. While FSPs can institute protective processes and regulators can craft policy safeguards, improving client awareness of their rights and responsibilities helps consumers play their part to support a sustainable financial system.

This report provides lessons learned from initiatives in Ghana, Uganda, and Benin to raise consumer protection awareness among clients through multimedia campaigns, digital tools and other outreach strategies. It covers country-specific consumer protection issues and the individualized campaigns to address these issues. We also offer five key takeaways to help inform future client protection and empowerment awareness building activities.

Clients Deserve to Know: Using Radio to Educate and Empower Consumers in Africa

As readers of CFI reports and blog posts, you’ve probably noticed that we’ve been paying a lot of attention to “<a href="https://www.centerforfinancialinclusion.org/getting-data-right">getting data right</a>” over the last few months. We aren’t just hitching our wagons to the latest tech news trends. Data breaches can and do have negative impacts for vulnerable, underserved populations in developing countries. Those seeking access to financial tools and products to improve their lives, whether it’s starting a family business or sending their children to school, need safe and reliable digital financial services, and many financial inclusion practitioners would greatly prefer to focus on growing their markets and not have to worry about cyberthreats.

In January, our Managing Director, <a href="https://www.centerforfinancialinclusion.org/bio/elisabeth-rhyne">Elisabeth Rhyne</a>, wrote about how <a href="https://www.centerforfinancialinclusion.org/consumer-harm-from-data-breaches-is-a-black-box">hard it is to find public information</a> documenting the consequences of data protection shortcomings, their frequency or severity.

Following up on that post, Andriana Moskovska, a tech blogger and contributor, sent us a detailed infographic that can help non-expert readers wrap their heads around the ways data breaches work and how many people they affect. The infographic documents the <a href="https://hostingtribunal.com/blog/biggest-data-breach-statistics/">biggest breaches</a> over the past few years – the tip of the iceberg in terms of the absolute number of incidents.

What does this mean for the future financial inclusion? Are laws and technologies adequate to contain the threats? How can we protect both financial service providers and their customers?

Check out the infographic below, which <a href="https://hostingtribunal.com/blog/biggest-data-breach-statistics/">originally appeared</a> on <a href="https://hostingtribunal.com/">Hosting Tribunal</a>, a website that reviews and ranks hosting sites and receives support from affiliate marketing. Let us know what you think!

<img class="wp-image-35345 size-full aligncenter" src="https://content.centerforfinancialinclusion.org/wp-content/uploads/sites/2/2019/05/infographic-data-breaches-1.png" alt="" width="990" height="24754" />

Infographic: “75 Records Compromised Every Second”

The <a href="https://www.centerforfinancialinclusion.org/about/what-we-do/the-smart-campaign/">Smart Campaign</a>'s senior director discussed the motivation behind the survey and forthcoming report with <a href="https://www.newtimes.co.rw/">The New Times</a>, a leading Rwandan news provider.

“We want all stakeholders to understand the actual experiences and concerns of the clients they are serving, protecting or advocating for, because there hasn't been a comprehensive survey underpinning the conduct of this digital financial service before,” <a href="https://content.centerforfinancialinclusion.org/people/alexandra-rizzi/">Rizzi</a> said.

Fraud was a "major problem" for about 40 percent of respondents (with 10 percent falling victim themselves), and while nearly 90 percent trust mobile money services, that trust extends to specific services, namely person-to-person (P2P) transfers. There are approximately 11 million mobile money users in Rwanda.

The report will be available for download on this site in the coming weeks. The results were discussed at a workshop of regulators in the Rwandan capital Kigali in March and will be discussed at the <a href="https://sptf.info/annual-meetings/2019-summit-inclusive-digital-future">Inclusive Digital Future Summit</a> in Nairobi in June 2019.

Read the<a href="https://www.newtimes.co.rw/business/mobile-money-services-enjoy-public-confidence-fraud-remains-threat-survey-reveals"> full article</a> and learn more about the <a href="http://smartcampaign.org/tools-a-resources/1075">Client Voices Project</a>.

&nbsp;

&nbsp;

In The New Times: Smart Campaign's Alex Rizzi Interviewed About Client Voices Project Survey in Rwanda

Extensive coverage of the "You Deserve to Know" (#YouDeserveToKnow) campaign in the national Ghanian media features quotes from <a href="https://www.centerforfinancialinclusion.org/bio/alexandra-rizzi">Alex Rizzi</a>, Director of the Smart Campaign.

"This series aims to equip clients with the knowledge they deserve to know to make the best financial decisions for themselves,” Rizzi stated in a <a href="https://www.pulse.com.gh/lifestyle/events/consumer-protection-global-consumer-advocate-launches-you-deserve-to-know-campaign/72tlsjv">Pulse</a> article. Coverage of the campaign also appeared in <a href="https://www.graphic.com.gh/news/general-news/financial-literacy-campaign-launched.html">Graphic Online</a> and <a href="https://citinewsroom.com/2019/02/26/global-consumer-advocate-launches-youdeservetoknow-campaign/">Citi Newsroom</a>.

The campaign focuses on improving the financial enabling environment by educating the public in two topic areas, transparency and fraud.

Listeners in Ghana can tune in to <a href="https://www.facebook.com/adom106.3/">Adom 106.3 FM</a> on Thursdays, 5:30 pm local time, to hear the programs. The episodes include drama and expert interviews on the topics. <a href="https://radio.modernghana.com/station/adom1063fm">Live streaming</a> of Adom 106.3 FM is also available.

The "You Deserve to Know" campaign is in collaboration with <a href="http://www.fiforumafrica.org/">Financial Inclusion Forum Africa</a>.

This Smart Campaign video below provides an introduction.

Smart Campaign's "You Deserve to Know" Radio Campaign Featured in Ghanaian Media

This post originally appeared on American Banker's <a href="https://www.americanbanker.com/opinion/consumer-harm-from-data-breaches-is-a-black-box">BankThink</a> page.

Data privacy and security concerns are red-hot right now, with near daily headlines about yet another breach. Often missing from the conversation, however, is information about the nature and prevalence of harms consumers actually experience as a result of poorly protected data. We appear to enjoy speculating about what might happen to consumers more than documenting what does and has happened. And yet, there is no better guide to prioritizing remedial action than clear documentation of the consequences of shortcomings, their frequency and their severity.

The Center for Financial Inclusion at Accion, an action-oriented think tank focused on financial inclusion, examines issues around data protection among financial service providers around the world, with an emphasis on those serving the base of the pyramid. From the financial inclusion point of view, we need to understand the financial losses that customers experience — primarily theft and fraud — when data breaches occur.

While we have been able to <a href="https://www.centerforfinancialinclusion.org/digital-finance-and-data-security-2">explore security vulnerabilities</a> by working with the computer scientist Patrick Traynor of the University of Florida, we have found it more difficult to find good data on the consumer side. How often do consumers experience theft and fraud, how harmful are these events to consumers and financial institutions when they do occur, and how do they relate to security lapses or poor policies among financial institutions and their regulators? Without this data, we as a sector can only view part of the problem. We are unable to analyze the link between security system measures and actual consumer harm. It’s as though we have lost the car keys but are only able to look for them under the streetlight.

It sounds overly simplistic to say that a data breach leads to negative consequences only when those who obtain personal information actually use it. But while the breach of data from millions of bank accounts makes front-page news, we know startlingly little about the number of uses of those identities or the amounts of money lost. One estimate of incidence comes from the Identity Theft Resource Center, a nonprofit dedicated to assisting victims. It cites 1.6 billion record breaches since 2005, but only 16.7 million identity theft victims. A quick hallway poll of my own colleagues revealed many experiences of fraud, generally through idiosyncratic events rather than massive ones, underlining the fact that hackers and fraudsters tend to rip people off quietly and often individually. When this happens, victims themselves may not know how or when their personal data was tapped. As an industry, we are short of information about the pathways hackers use to turn data breaches into monetary thefts.

Where could the industry begin to gather this information?

Cybercrimes units among law enforcement agencies undoubtedly have a great deal of information about the incidence of theft resulting from fraudulent uses of personal data. In theory, their financial forensics can work backward from a monetary theft to the data breach that made it possible. But we need to ensure that such units address losses by ordinary consumers and not just big ticket white collar crimes. We also need to ensure that law enforcement knowledge translates into useful advice for financial institutions and regulators.

Large banks and major card providers also have masses of relevant information and expertise. They have invested enormous resources over decades to identify and cope with fraud, creating fraud detection systems and workforces dedicated to assisting customers who are victims, and they still write off millions of faulty transactions. While it may be expensive, that very investment is a major source of their business success: It makes it possible for consumers to trust that when their credit card information is stolen, they will not be liable. But what about smaller financial institutions and new market entrants that cannot afford the sophistication of major card providers? They need to know more about how consumers experience fraud and theft. It would be valuable for the regulators, researchers and industry associations that monitor the financial sector and have a stake in its success to gather more systematic demand-side research to document these consumer experiences — and that information needs to be publicly available so that financial service providers and their consumers can benefit from it.

These recommendations are a starting point to better inform consumers and the financial services industry about the risks associated with data breaches, and how they can be prevented and addressed. Better information on the incidence and severity of consumer harms can enable financial service providers and policymakers to weigh trade-offs between data protection investments and the risks associated with incomplete protection. As a result, they can target remedial actions more effectively, avoiding both over-spending and running unacceptable risks — with better outcomes for consumers.

Consumer Harm from Data Breaches is a Black Box

As digital credit providers have grown exponentially over the past few years, and as digital products and models have proliferated, so too have concerns around consumer protection. In the recently published report, <a href="http://www.centerforfinancialinclusion.org/publications-a-resources/browse-publications/1036-responsible-digital-credit">Responsible Digital Credit</a>, I argue that ensuring that digital credit customers receive responsible treatment requires more than enhanced consumer protection laws and regulations. It also requires strong commitment from the digital credit industry. Finally, it needs consumers who are empowered to play a more proactive role in managing their digital credit responsibly.

Over the past year, I have interviewed digital credit industry associations, credit providers and their third-party data analytic providers, regulators, policy makers, and various consumer protection leaders. Many of these groups are working to develop responsible digital lending principles. With their input, my report proposes a guiding framework for responsible digital lending.  The framework uses the Smart Campaign <a href="https://www.smartcampaign.org/about/smart-microfinance-and-the-client-protection-principles">Client Protection Principles</a> as a basis for grouping the issues. In addition, I propose an eighth principle: security and fraud protection.

Digital credit, and especially the use of mobile phones, significantly alters interactions between borrowers and lenders. Lenders utilizing the mobile channel to advertise, acquire and transact with customers must pay particular attention to the limitations of mobile interaction with customers and follow industry <a href="http://onlinelendersalliance.org/wp-content/uploads/2016/03/Best-Practices-2016-1.pdf">mobile best practices</a>. While many of the standard consumer protection practices continue to apply, new concerns, or more accurately, new faces on older concerns, have emerged. In this post, I want to highlight several of the considerations I found most important and relevant for the digital lending industry.
<h2>Responsible Algorithms</h2>
Many digital credit models rely on algorithms to process data about clients and make credit decisions. Because most lenders consider their algorithms proprietary, it is difficult for observers to know on what basis credit decisions are actually made. This opaque situation raises the spectre of discrimination. Attributes that are considered inappropriate bases for differentiation, such as religion, language, gender, or ethnic origin, are areas of particular concern with regard to algorithm-based lending practices. As highlighted by a Smart Campaign <a href="http://www.centerforfinancialinclusion.org/publications-a-resources/browse-publications/916-smart-brief-tiny-loans-big-questions">report</a>, while credit offers may differ based on risk analysis, such differentiation should be consistently applied, stated in advance, and made with the goal of benefitting clients. To prevent discriminatory digital credit practices, some recommendations include:
<ul>
 	<li><a href="https://www.whitecase.com/publications/insight/algorithms-and-bias-what-lenders-need-know">Pretest, test and retest for potential bias</a>. Digital credit providers and third-party data analytics providers should continuously monitor the outcomes of their algorithmic programs to identify potential problems. Such testing could involve running scenarios to identify unwanted outcomes and developing and building controls that prevent adverse outcomes.</li>
 	<li><a href="http://www.ijmo.org/papers/43-A10212.pdf">Document the rationale for algorithmic features</a>. Digital credit providers should be able to provide visualization and a decision tree for the factors their algorithms analyze, as well as the justification for relying on these factors. The rationale should address how borrower debt capacity is assessed, given the importance of this concept in traditional underwriting.</li>
 	<li>Independent review of companies' proposed data sets and/or algorithms.</li>
</ul>
A self-regulatory approach could be used to develop best practices guidelines for data inputs and the development of nondiscriminatory artificial intelligence systems, following the model that has been successful for the Payment Card Industry Security Standards Council.
<h2>Indebtedness Monitoring</h2>
Because digital lending is often based on non-traditional underwriting criteria, to prevent over-indebtedness among digital borrowers it may be relatively more important to monitor outcomes at the portfolio level. Some of the ways to do this include:
<ul>
 	<li>Avoidance of debt traps by ensuring that clients are not forced into automated repeat loans.</li>
 	<li><a href="http://www.responsiblebusinesslending.org/">Responsible credit reporting</a> – Better compliance with reporting strengthens markets and leads to better client protection practices.</li>
 	<li><a href="http://www.centerforfinancialinclusion.org/storage/documents/Smart_Brief_Tiny_Loans_Big_Questions_Final_092617.pdf">Monitoring digital credit provider’s portfolio quality</a> – Industry benchmarks for portfolio quality can help to advance the understanding of risks and avoid business models that rely for their success on high default rates.</li>
</ul>
<h2>Digital Transparency </h2>
Digital credit platforms allow for 24/7 communications with clients that, if harnessed properly, can assist them with immediate technical support, remind them about upcoming payments and even identify counselors or resources for clients in financial stress. However, when communication is totally digital, there are heightened concerns about ensuring that clients really know what they are signing up for. Disclosure must lead to client understanding. Borrower disclosure standards should address:
<ul>
 	<li>Standards for honest advertising and penalties for misleading marketing materials of credit products. Furthermore, providers should advertise the name of the financial regulator they report to in all advertising materials.</li>
 	<li>Readability and format – Disclosures need to be easy to comprehend, available in the customer’s local language, and provided in print and digital formats.</li>
 	<li>Comparative tools – Standard summary disclosure documents would allow borrowers to compare credit offers, both digital and traditional.</li>
 	<li>Adequate notice periods – Consumers should be notified in advance of changes to interest rates, fees or terms and conditions.</li>
</ul>
A somewhat different but related and relevant concern, often overlooked in this context, is the vulnerability of individual investors who put their money into pure peer-to-peer (P2P) lending platforms. Protections need to be extended to them as well, with a focus on ensuring that they receive the information they need to evaluate risks and that they have recourse channels when something goes amiss.
<h2>Data Privacy and Usage Standards</h2>
While many regulators and most industry groups agree that it is important to protect the confidentiality and security of customers’ information, data use and the level of disclosure about its use are challenging topics. In the <a href="http://ec.europa.eu/justice/data-protection/reform/index_en.htm">EU</a> and in countries such as <a href="https://www.pc.gov.au/inquiries/completed/data-access/thedraft">Australia</a>, regulators are enacting rules mandating that individuals be notified about the use of their personal data and allowed to opt out. Opt-out rules should be considered as a potential requirement for all digital credit providers, especially in markets where mobile push-marketing has become problematic.

Over the next several years it will be important for laws or regulations to be put in place to protect consumer data privacy and guide information sharing. The rules need to:
<ul>
 	<li>Provide for informed consent, such that customers explicitly permit electronic data collection prior to its collection and use, and are given the option to consent or not.</li>
 	<li>Require providers to have a clear data collection and handling policy which limits the amount of data collected as well as the timeframe it is stored.</li>
 	<li>Inform clients about their data trails and credit histories, including the ability to ensure accuracy and correct for any errors or discrepancies.</li>
 	<li>Give regulators the power to discipline providers who repeatedly allow personal data to be misused.</li>
</ul>
<h2>Fraud Prevention and Security </h2>
New security vulnerabilities arising from digital credit strongly point to fraud and cyber-security as consumer protection concerns. It is increasingly urgent for digital credit providers to adopt standard security compliance measures and then to regularly test and update them. Providers must also be responsible for ensuring that the third-parties they use, including lead generators, brokers, agents, and data analytics providers, also have adequate security in place. Ultimately, providers need to be responsible for the actions of their third-parties (e.g., agents, contractors, lead generators, brokers and collectors).

Consumers should be made aware of the potential for fraud and encouraged to report suspected fraud cases or security breaches. Consumer awareness campaigns on the most common incidents of fraud (via the internet, SMS alerts, signage at agent kiosks, etc.) can help with this.

While the recommendations just listed do not apply in all markets, they do point to the urgent need for regulators, industry bodies, individual providers and consumers to work together to construct the ground rules for responsible digital credit that will ensure that consumers are adequately protected.

Editor's Note: This research was made possible by support from Mastercard Foundation and other partners.

&nbsp;

A Framework for Responsible Digital Credit

The following is part of the Smart Campaign’s #FintechProtects mini campaign. We’re raising awareness about responsible digital financial services, spotlighting work from the Smart Campaign and others, and engaging with industry actors on how fintech can move forward in a way that’s best for clients.  

Do you have a credit card you don’t know about? Last week, <a href="http://files.consumerfinance.gov/f/documents/092016_cfpb_WFBconsentorder.pdf">we learned</a> that over 5,000 employees across Wells Fargo, the United States’ biggest home lender and one of the nation’s largest banks, had opened at least two million unauthorized deposit and credit card accounts in clients’ names. In an effort to meet high sales targets and earn bonuses, bank employees transferred funds from customers’ existing authorized accounts to unapproved accounts in customers’ names. Clients had not consented and were mostly unaware of this, despite incurring late fees and other charges on these new unapproved accounts. The <a href="http://www.consumerfinance.gov/about-us/newsroom/consumer-financial-protection-bureau-fines-wells-fargo-100-million-widespread-illegal-practice-secretly-opening-unauthorized-accounts/">widespread practice</a> had somehow gone undetected for 5 years.

The U.S. Consumer Financial Protection Bureau (CFPB) and the Office of the Comptroller of the Currency announced that Wells Fargo would be <a href="http://www.usatoday.com/story/money/2016/09/08/wells-fargo-fined-185m-over-unauthorized-accounts/90003212/">fined $185 million</a> and will have to pay $5 million directly to customers who incurred costs. The bank also faces a related <a href="http://freepdfhosting.com/c7384fa6fc.pdf">Los Angeles County Superior Court lawsuit</a>. The bank has agreed to resolve the CPFB allegations but refused to admit wrong-doing. Regardless, the bank’s reputation has taken a hit. Wells Fargo will have to respond to difficult questions during next week’s September 20th Senate Banking Committee session.

How could such extensive fraud happen at a major bank with a solid reputation for customer service in a well-regulated market? We at <a href="http://www.smartcampaign.org">the Smart Campaign</a> have long cautioned about the very thing that caused this widespread breach of customer trust: inappropriate staff incentives.

The bank has historically mandated and incentivized staff to “cross-sell” existing customers for additional products and services. While many peer institutions do this today, cross-selling was a big part of Wells Fargo’s success story in becoming an industry leader. Its former CEO is <a href="https://www.google.com/webhp?sourceid=chrome-instant&amp;ion=1&amp;espv=2&amp;ie=UTF-8#q=richard%20kovacevich%20and%20cross%20selling">widely seen</a> as having invented the cross-selling strategy. Banks often see cross-selling as a way to increase profit.  After all, a client simply in need of a checking account is less appealing than that same client who also has a credit card and other products, especially products that generate regular fees.

Wells Fargo’s pursuit of cross sales led it to organize its staff incentives around targets that motivated bank employees to open new accounts in order to meet sales goals and earn bonuses. Employees who cannot make the number of expected deals were tempted to engage in aggressive sales, or even, as happened in this case, turn to fraudulent practices. At the Smart Campaign, we emphasize the importance of pay and commission structures in ensuring positive client treatment and limiting risky practices. After all, staff with adequate base pay are less likely to push bad loans on customers than those desperate for better commissions. We have focused mainly on the risk that poorly designed incentives will provoke loan officers to approve risky loans. The Wells Fargo example demonstrates that the same problem can occur in any aspect of bank operations. We recently drafted a <a href="http://www.smartcampaign.org/tools-a-resources/1096-balanced-incentive-for-frontline-staff-a-tool-for-financial-institutions">tool</a> for the providers we work with describing non-financial incentives to improve performance. It targets outcomes that relate to both portfolio growth and strong customer service. Such incentives can for instance be a <a href="http://www.smartcampaign.org/tools-a-resources/905-use-of-nonfinancial-incentives-to-manage-performance-at-bandhan">powerful long term motivator</a> for sustainable accomplishments, teamwork, and portfolio quality.

This incident spotlights the importance of effective disclosure and client engagement. While it appears that most clients were completely unaware that their names were used in unauthorized accounts, and that Wells Fargo employees effectively “leapfrogged” disclosure, there were instances after the initial account opening where clients became aware that they had a “surprise” account. Some received debit cards they did not request or paid overdraft charges and insufficient fund fees for these accounts. Would financial education, clearer explanations of fees, or knowledge of their right to efficient recourse have made a difference? Not likely. The focus here would be on how to ensure disclosure at the relevant time (i.e. upon account opening) and in ways that capture client attention.

The Wells Fargo case raises governance questions. Could the board have implemented any internal controls to detect such widespread fraud? Was the board aware of the employee culture and incentives? Has the focus on e-commerce meant a greater disconnect from end-clients? This was, after all, not an isolated incident with one ringleader but rather widespread, blatant, and pervasive, at a scale that suggests a very problematic corporate culture. Bart Naylor, a financial policy advocate for Public Citizen, <a href="https://www.washingtonpost.com/news/wonk/wp/2016/09/13/wells-fargo-fired-5300-workers-for-illegal-sales-push-executive-in-charge-retiring-with-125-million/">said</a> “There are two possibilities: Customer abuse was part of the business model, in which lots of high ranking people need to go to prison. Or the bank is too big to manage, and folks high up don’t even know that laws are being broken a few levels down." Given that thousands of employees were involved, risk management monitoring, staff training whistle blower policies, and auditing measures were clearly missing or ineffective. It is especially troubling that Wells Fargo is only now <a href="http://www.usatoday.com/story/money/business/2016/09/13/wells-fargo-eliminate-bank-sales-goals/90295538/">considering limiting bank sale goals</a> and <a href="http://www.bloomberg.com/news/articles/2016-09-13/wells-fargo-eliminates-product-sales-goals-for-retail-bankers">doing away with cross-selling</a> to rebuild consumer confidence - because these issues are not new in the industry. In fact, The Los Angeles Times first reported such fraud at Wells Fargo in 2013 and The Wall Street Journal began uncovering related trouble in 2011, <a href="http://www.newyorker.com/business/currency/the-record-fine-against-wells-fargo-points-to-the-failure-of-regulation">according to New Yorker</a> journalist Adam Davidson, and this was the same period that Wells Fargo CEO John Stumpf made $20 million and won two prestigious banking CEO of the Year awards. Comparisons to the stonewalling behavior of Volkswagen about its massive diesel engine fraud are apt here.

Ultimately, responsibility for this fiasco lies at the top, with CEOs and investors. We’d like to know to what extent Berkshire Hathaway Inc., Wells Fargo’s largest shareholder, emphasized consumer protection to the bank’s leadership. <a href="http://www.nytimes.com/2014/05/04/magazine/only-one-top-banker-jail-financial-crisis.html?_r=0">To date CEOs have not had to worry</a> about personal criminal prosecution or job-jeopardizing fines.

The fine levied in this case and the CFPB’s decision are historic. But compare the $185 million fine CFPB levied with the compensation that will follow the executive who headed the unit into retirement: <a href="http://fortune.com/2016/09/12/wells-fargo-cfpb-carrie-tolstedt/">$124 million according to Forbes</a>. The fines themselves are a small price to pay for a very large, profitable bank. The hit to the bank’s reputation will be more important. We hope consumers take action in response. At the end of the day, Wells Fargo fired 5,300 lower-level employees. Meanwhile, as Davidson <a href="http://www.newyorker.com/business/currency/the-record-fine-against-wells-fargo-points-to-the-failure-of-regulation">points out</a>, Stumpf was recently reappointed to the Federal Reserve Board’s Advisory Council, mandated to provide guidance to our nation’s leading bank regulator.

It may unfortunately come as no surprise that it is not just in the United States, a country with <a href="http://siteresources.worldbank.org/EXTFINANCIALSECTOR/Resources/Good_Practices_for_Financial_CP.pdf">relatively strong laws and regulatory practices</a>, that such bank fraud occurs. In fact, <a href="http://indianexpress.com/article/business/banking-and-finance/how-banks-cut-their-zero-balance-jan-dhan-accounts-one-rupee-trick-3028190/">as highlighted by a recent case</a> in India where bank officials, under pressure to improve zero balance account numbers, were dressing data by themselves making one rupee deposits to client accounts, low-income clients are particularly vulnerable in developing markets with weaker regulatory environments. In an effort to protect all customers, the Smart Campaign continues to advocate for standards of consumer care, provide tools and incentives to financial service providers, and give low income clients a voice. Our goal is to integrate client protection practices into the institutional culture and operations of financial institutions all over the world.

Have you read?

<a href="https://cfi-blog.org/2015/02/04/keeping-score-the-client-protection-principles-vs-the-u-s-subprime-auto-loan-market/">Keeping Score: The Client Protection Principles vs. the U.S. Subprime Auto Loan Market</a>

<a href="https://cfi-blog.org/2016/05/31/smes-speak-out-on-online-lending-if-you-build-the-website-they-will-come-but-they-might-be-a-little-confused/">SMEs Speak Out on Online Lending</a>

<a href="https://cfi-blog.org/2016/05/12/the-lending-club-scandal-and-what-it-means-for-marketplace-lending/">The Lending Club Scandal and What It Means for Marketplace Lending</a>

Why the Fraud at Wells Fargo Is a Big Deal

Sugandh Saxena

Jayshree Venkatesan

Jonathan Fu

Mrinal Mishra

Tess Johnson

Eric Noggle

Malacci Ohrt

Alexandra (Alex) Rizzi

Alex Kessler

Ezra Mannix

Andriana Moskovska

Elisabeth Rhyne

John Owens

Nadia van de Walle

Susy Cheston

India

South Asia

North America

United States

Benin

Ghana

Uganda

China

Client Treatment

Consumer Protection

Enabling Environment

Financial Service Providers

Fintechs

Fraud

Privacy

Complaint Resolution

Responsible Digital Finance

Transparency

Trends

Payments

Policy, Regulation and Government Initiatives

Credit

Delivery Channels

Digital Credit

Digital Financial Services

Financial Capability

Product Pricing

Telcos

Challenges and Crises

Financial Technology

Mobile Banking

Over-indebtedness

Credit Provision

P2P Lending

Data Analytics

Impact Investing

Blog Post

Brief

Report

India is a global leader in financial inclusion. For over a decade, Accion has worked with and learned from India’s innovators, investors, and policymakers to expand economic opportunity for its people and businesses.

China’s economy has experienced tremendous growth in recent years, with a booming micro, small, and medium enterprise (MSME) market. There are over 50 million MSMEs in China that collectively account for over 60% of China’s GDP and over 50% of the government’s tax income. These businesses create 80% of total employment in China’s urban areas.

Despite China’s overall economic growth, the need to foster full financial inclusion is still imperative. In 2010, 38 million MSMEs lacked access to formal financial services, forcing them to borrow informally from friends, family, and moneylenders.

<a href="http://cfi-blog.org/category/financial-inclusion-2020/"><img class="alignright wp-image-8777" style="border: 0 solid #000000" src="https://centerforfinancialinclusionblog.files.wordpress.com/2012/11/fi2020_antilogo1.jpg" alt="" width="321" height="71" /></a>The news is out. Ezubo is a Ponzi scheme. The lending company, a P2P platform in China, has bilked 900,000 private investors out of a stunning <a href="https://www.washingtonpost.com/world/asia_pacific/how-a-huge-chinese-ponzi-scheme-lured-investors/2016/02/08/fcbae776-ca9c-11e5-b9ab-26591104bb19_story.html">US$7.6 billion</a>. Ezubo is China’s largest ever online scam—but it is not alone. It is one of 2,612 P2P sites that bring lenders and borrowers together in China’s <a href="http://www.cnbc.com/2016/02/01/chinese-police-bust-76b-ponzi-scheme-at-p2p-lender-ezubao.html">$2.6 trillion</a> wealth management industry. Of those, the China Banking Regulatory Commission (CBRC) says that <a href="http://www.bloomberg.com/news/articles/2016-02-03/china-s-biggest-ponzi-scheme-shows-rot-in-internet-financing">more than 1,000</a> are “problematic.” We expressed concerns about this very P2P lending market in China in our <a href="http://www.fi2020progressreport.org/">FI2020 Progress Report</a> released four months ago.

But first, how could this happen with Ezubo? Ezubo had been in the vanguard of the hot e-finance market, and was <a href="http://www.cnbc.com/2016/02/03/investors-scared-of-china-stock-markets-were-lured-by-ezubo-ponzi-scheme.html">named</a> "online credit financial brand of the year" by China's National Business Daily in 2015. It was lauded on Chinese state television and received implicit endorsement from high government officials. It engaged in cross-border trading with Myanmar—something that would not seem possible without government oversight. China is supposed to be in a big campaign to root out corruption. Yet it seems there are just two possibilities: Chinese regulators either knew about the scam and kept silent, or they missed it altogether. Could Ezubo have duped or paid off every one of the local, provincial, and national authorities who had oversight?

That’s why people who were suddenly stripped of their wealth not only feel duped by Ezubo, they also feel duped by the government. After all, this is only the latest allegation of fraud against a market that has been enthusiastically championed by the government and only loosely regulated.

While we didn’t call out Ezubo by name, we did throw down a warning about the Chinese e-finance explosion in our <a href="http://www.fi2020progressreport.org/">FI2020 Progress Report</a>, saying:

The Institute of International Finance reported in November 2014 on the particular challenges of exponential growth in financial services through e-finance in China. The report lauded the great promise of e-finance for improving financial inclusion, but <a href="https://www.iif.com/publication/research-note/chinese-internet-finance-explosive-growth-challenges-ahead">noted</a> concerns about consumer protection. In the midst of stratospheric growth of <a href="https://www.nri.com/~/media/PDF/global/opinion/lakyara/2014/lkr2014202.pdf">P2P lending</a>, China has seen many P2P lenders abruptly closing shop and vanishing. In 2014 alone, 275 P2P platforms in China failed. China has proposed regulations designed to crack down on platforms that are not sufficiently capitalized or are at higher risk of default. In the meantime, individual investors are at risk. In some of the most egregious cases, P2P fraudsters absconded with investors' money on the first day that they opened for business.

This paragraph was part of our analysis of <a href="http://www.fi2020progressreport.org/client-protection/">Client Protection in the Digital Age</a>. In the FI2020 Progress Report, we said that technology has the potential to decrease fraud and increase protection—but that technology can also bring new dangers, including new kinds of fraud that can emerge when regulators have not caught up to the advances of financial technology. No matter what technology is involved, the bottom line is that customer protection policies need to develop alongside technology innovations.

In China today, the price of failing to do so is 900,000 people who have been robbed of their wealth—and 21 Ezubo executives who are now in custody. We’ll hope that client protection indeed catches up to the P2P platforms, lest another Ponzi is in the works.

Kudos to the sharp economists of the Institute of International Finance who first clued us in to the dangers of China’s e-finance market.

Financial Inclusion 2020 (<a href="http://www.centerforfinancialinclusion.org/fi2020" target="_blank" rel="noopener">FI2020</a>) is a global multi-stakeholder movement to achieve full financial inclusion, using the year 2020 as a focal point for action. This blog series will spotlight financial inclusion efforts around the globe and share insights from key thought leaders in financial inclusion, with a specific focus on quality beyond access.

Have you read?

<a href="http://cfi-blog.org/2015/09/15/insights-into-an-evolving-peer-to-peer-lending-industry-in-china/">Insights into an Evolving Peer-to-Peer Lending Industry in China</a>

<a href="http://cfi-blog.org/2015/10/01/rating-progress-toward-financial-inclusion-on-a-scale-of-1-to-10/">Rating Progress on Financial Inclusion on a Scale of 1 to 10</a>

<a href="http://cfi-blog.org/2014/09/23/chinas-microfinance-landscape-nonprofits-microcredit-companies-rural-financers-and-alibaba/">China's Microfinance Landscape: Nonprofits, Microcredit Companies, Rural Financers, and Alibaba</a>

&nbsp;

Why We Aren’t Surprised that Ezubo, the P2P Lender in China, Is a Ponzi Scheme

&gt; Posted by Center Staff

<a href="http://newsfeed.financialinclusion2020.org/"><img class="aligncenter wp-image-19368" style="border:1px solid #000000" src="https://centerforfinancialinclusionblog.files.wordpress.com/2015/09/9-14-news-feed.png" alt="" width="615" height="331" /></a>The latest edition of the <a href="http://newsfeed.financialinclusion2020.org/">Financial Inclusion 2020 News Feed,</a> our weekly online magazine sharing the big news in banking the unbanked, is now available. Among the stories in this week’s edition are a new publication from GSMA that outlines operational guidelines for mobile money providers offering interoperable services, the Bank of Ghana issuing logos to licensed microfinance institutions so that they're discernible from unlicensed ones, and, in the United States, the Department of Housing and Urban Development (HUD) working with the Consumer Financial Protection Bureau (CFPB) to target incidences of redlining (the practice of lenders charging minorities more for products or excluding them from services altogether). Here are a few more details:
<ul>
	<li>Account-to-account mobile money interoperability can bring significant benefits to providers and customers if conducted correctly, but weak implementation can bring a slew of negative ramifications; the new GSMA report highlights key requirements for effective interoperability and actions for providers to realize them.</li>
	<li>To combat unlicensed microfinance institutions frauding clients in Ghana, the government revealed a new system of logos to be issued to licensed MFIs, helping clients know which institutions they can and can't trust.</li>
	<li>At a recent conference, officials from HUD and CFPB, citing recent cases of redlining, announced they had signed a memorandum of understanding to work together in sharing information and investigating mortgage lending discrimination.</li>
</ul>
For more information on these and other stories, read the latest issue of the FI2020 News Feed <a href="http://newsfeed.financialinclusion2020.org/">here</a>, and make sure to subscribe to the weekly online magazine by entering your email address in the right-hand menu so you can be notified when the latest issue comes out.

Have you come across a story or initiative you think we should cover? Email your ideas to Eric Zuehlke at <a href="mailto:ezuehlke@accion.org">ezuehlke@accion.org</a>.

Interoperability Guidelines, Microfinance Logos, Redlining – the Latest FI2020 News Feed