Super-app scams in spotlight as Grab beefs up its anti-fraud team

Singapore

WITH their fingers in many pies of the digital economy, super-app players like Grab and Gojek could become increasingly attractive targets for malicious actors.

Industry watchers say that while Grab's move to expand its anti-fraud team is a positive sign, the long battle ahead will require sustained pre-emptive efforts.

Grab will grow its regional anti-fraud team from 120 employees to 200 by the end of this year, to strengthen its defences against scammers in the digital economy, the company announced to reporters on Friday.

Foo Wui Ngiap, head of trust, identity, safety and information security at Grab, identified fraud as a particular concern as Grab "goes into a platform play", necessitating better protections.

" As we enlarge our footprint, this forms a strong fundamental for us to avoid a leaky boat," he said.

Grab's move comes as three individuals in Singapore were charged in court on Wednesday for alleged payments fraud involving its carpool service GrabHitch. The individuals are said to have made more than 300 fraudulent transactions resulting in payments of over S$5,600.

Between February and April, Grab detected at least 13 driver accounts with more than 2,000 fraudulent transactions amounting to more than S$41,800 in losses, said the police on Tuesday.

The sheer volume of low-value transactions that super-app players process across multiple verticals - from ride-hailing and food delivery to e-payments - make them ideal targets for bad actors, said Kwek Chin Yong, associate managing director of the business intelligence and investigations practice at Kroll, a risk consultancy.

"Usually, these high-volume scams require multiple people working in concert, making detection even harder. The high volume of transactions also makes detection difficult and the monitoring expensive," he said.

Eugene Tan, associate professor of law at the Singapore Management University, agreed, saying that super-app players will need to operate with the baseline assumption that fraudsters will constantly try to game the system.

"There's no doubt that there will be this cat-and-mouse game. But all of this is part of business risk, but as long as they deal with it adequately, it remains a risk, and not an uncertainty that undermines the (confidence of the) different stakeholders."

In some ways, the fraud risk that super-apps face today are reminiscent of the spate of credit card scams that banks battled in the early 2000s. Mr Kwek said that a potential learning point from that experience is to invest more in pre-emptive measures.

"What Grab can do is to take the lead from banks and use algorithms to detect abnormalities before getting someone to review the irregularities," he said. But building up a strong anti-fraud team is also an imperative.

For its part, Grab appears to be building up anti-fraud capabilities aggressively. The company will add more tech talent on this front, including data scientists, risk and operations analysts and product managers to deal with the "end-to-end" nature of fraud, said Mr Foo.

Grab has an internal benchmark maintaining its fraud rate at under 1 per cent of Gross Merchandise Value across all markets.

While declining to comment directly on the GrabHitch case, he noted that fraudsters are growing increasingly sophisticated. In some regional markets, for instance, there are "black markets" for driver accounts, where fake accounts are sold to drivers who have been banned on Grab.

One of the biggest areas of fraud that Grab sees is incentive abuse. In such cases, drivers set up multiple accounts and pretend to execute many rides in cash, reaping bonus payouts.

Other fraudulent techniques include GPS spoofing - in which drivers use fake location tools to simulate completed rides, and use fake Grab apps that have been tampered with or obtained from outside the official app stores.

While many of the fraud cases have been in the ride-hailing segment, the bad actors are "following the money" into other growing verticals such as food delivery; some fraudsters even setting up fake restaurants, Mr Foo added.

Ultimately, while battling the bad guys, Grab also wants to "educate its users that the company is doing a lot for them, and that they should feel a little safer on our platforms". "In the past, we've never talked about it, so what people don't know, they don't see," Mr Foo said.

Like Grab, Gojek appears to have been hit by fraud. The Straits Times reported about a week ago that the firm was planning to go to the police over a suspected online flat-fare scam. Gojek did not respond to a request for comment from BT.