In October 2013, the FBI (Federal Bureau of Investigation) bust the first modern market, SilkRoute. The website had sold stolen credit cards, weapons, drugs and other illegal products. In May 2017, the hacker group ‘Shadow Brokers’ unleashed the WannaCry ransomware, infecting computers across 150 countries. In July 2017, the online black-market, AlphaBay, was shut down by law enforcement. What was common to the three crime rings? Usage of Bitcoin as the mode of transaction. Consequently, Bitcoins have entered popular consciousness as a facilitator of criminal activities.
Bitcoin is a crypto-/digital currency that is built on blockchain technology. Blockchain is a public ledger that tracks and conducts all transactions in a decentralised fashion. The Center for a New American Security (CNAS) stated, in a May2017 report, that terror groups are not yet using digital currencies in large scale, because traditional means of transferring value such as cash, pre-paid cards and hawala are continuing to serve the funding needs satisfactorily.
Similarly, recent findings of the British think tank, RUSI (Royal United Services Institute), do not show a strong link of crypto-currency with organised terrorism. People familiar with the evolution of financial crime landscape are sure to view this as an anomaly because, typically, criminals are among the first ones to adapt and leverage new technology. To illustrate, as the Internet grew in visibility, the menace of cybercrime multiplied manifold. Blockchain is, often, referred to as ‘the greatest invention since Internet’. Hence, now might be good time to examine the repercussions blockchain technology can have on financial crime risk.
The unique feature of crypto-currency that attracts criminals is the ease of transferring value across entities/international borders without being regulated by banks. This is a stark change from fiat money, which has to pass through bank-enabled channels (such as SWIFT), and, hence, is susceptible to detection. So there may be clandestine exchanges helping crooks transact in such currency.
In India, there is uncertainty about the legality of crypto-currency. The Reserve Bank of India (RBI) has set up a committee to examine it. Consequently, current investments carry the risk of being declared illegal. Also, there is always the additional risk of getting hacked.
Riding on the wave of interest in such currencies, there has been an uptick in phishing attacks, deceiving people into sharing confidential information. Also, Ponzi schemes have mushroomed, luring hapless investors with the promise of phenomenal returns. As the debate on the criminal implications of crypto-currency rages on, a consensus seems to be emerging on the potential of the underlying blockchain technology to deter and detect crime.
Most crypto-currencies offer pseudo (and not complete) anonymity. On the one hand, it might be difficult to map individuals to their blockchain wallets. But, on the other hand, since each transaction is broadcast on the blockchain, the entire deposit/withdrawal activity of each and every blockchain wallet is public information. Consequently, for a prospective money-launderer, the entire process will be publicly transmitted and recorded for posterity in a form that is immune to forgery. Intuitively, this can act as a deterrent to using Bitcoins for criminal purposes, provided blockchains are continuously scanned by crime fighting entities.
Currently, there are security firms that leverage attributes such as transaction patterns, IP addresses and information from Internet service-providers to help authorities manage financial crime risk on the blockchain. But, on the other hand, criminals can avail services of a ‘crypto-currency tumbler’, to confuse the trail back to the funds’ original source. Some websites, like ShapeShift.io, help users convert one digital currency into another, thereby potentially aiding currency layering. But the crucial point is, all of the above automatically gets recorded on the blockchain; hence, it is quite easy for a forensic agency to get accurate data.
However, it must be mentioned that there are specific crypto-currencies (notably, Zcash and Monero) which offer a greater level of anonymity than Bitcoin. Interestingly, in May 2017, the shadow brokers switched to Zcash as the preferred means of payment, for their monthly supply of hacking resources.
A point worth noting is that blockchain transactions are irreversible. In traditional banking, merchants can be charged back if banks detect fraud charges. If a criminal uses a fraud credit card to buy digital currency on any exchange, the owner of the exchange has to bear the loss since the bank would reverse the payment made to the merchant (exchange), but the merchant cannot initiate a reversal of the blockchain transaction. Moving on, let us focus on the potential of blockchain technology to systematically curb financial crime risk.
Currently, most financial organisations individually employ data science to detect fraud charges. However, there is a lack of sharing of intelligence across banks, due to fear of confidential data leakage. Private, distributed ledgers can help in this regard. Consortiums with in-built transparency controls, where access levels of participating banks are coded (and monitored), along with foolproof audit trail of how the data is being used, can help bridge the trust gap. Fraud detection models of the future, built on such humungous data, would naturally be more adept in recognising crime patterns. In February 2017, State Bank of India announced Bankchain, an initiative to share information between banks on blockchain.
The second generation of blockchains has moved towards a new type of application called ‘smart contract’. These are user-defined programs which contain rules that govern transactions. To illustrate, in blockchain networks such as Ethereum, credit card issuers, acquirers and merchants can all come together and place in production a multitude of predictive analytics algorithms that would approve a transaction in real-time only if certain risk-control parameters are satisfied.
Similarly, to curb risk of money laundering, there is a potential for regulatory bodies to be party to every transaction. Banks could still perform know your customer (KYC) checks while onboarding customers. But when transactions are generated, the regulator and the bank can jointly analyse them from multiple perspectives and decide whether or not to raise a red flag.
Crypto-currencies have emerged as facilitators in some pockets of the criminal world. However, key features of the blockchain, such as transparency and trust protocols, can go a long way in deterring and detecting financial crime. Some believe that the current encryption techniques driving blockchain technologies would become obsolete in a world with affordable
quantum computing. In such a future, criminals might try to create counterfeit blocks. That is a whole new story arc—one that moves to the next level of the cat-and-mouse game perennially played between criminals and custodians.
(Debanjan Chatterjee is an alumni of the Delhi School of Economics and has been part of fraud analytics team of a multinational bank for the past decade.)
