IoT and Fintech: Pioneering Secure Transactions or Unveiling New Threats?

Speaker A: Hello everyone. Welcome and m, thank you for tuning into the Credex podcast series. Uh that is FinTech X. I am Hemant Joshi, Vice President Product Management at Credex, which is India's largest supply chain finance platform. And I am happy to be moderator today uh for today's discussion. Uh, today's topic is uh IoT and fintech the future uh of secure transactions or a breeding ground of new uh threats to the ecosystem. Uh, allow me to set a context uh for the topic. The intersection of inter of the Internet of things uh and uh financial technologies uh is revolutionizing the way transactions are conducted today making it convenient and more efficient. IoT devices from smartwatches to connected home appliances are increasingly being uh integrated into the financial services enabling uh seamless real time transactions and personalized banking experiences. However this also brings in significant security concerns. The proliferation of uh uh interconnected devices create a vast network that is vulnerable to cyber attacks, potentially exposing sensitive financial data to uh cyber criminals. As the uh IoT and fintech landscape evolves, balancing innovation with robust security measures will be crucial uh to harness its benefit while mitigating its risks. That being said, allow me to introduce today's distinguished panel of speakers who bring uh a wealth of experience and expertise uh onto this topic. Firstly allow me to introduce Mr. Gautam Sinha. He is CEO of UH LTFLOW which is a division of Loan Tap. Um it is a retail uh loan infrastructure for lenders. We also have with us Mr. Yatin Pednekar who is co founder and CTO of Mobicule Technologies which is uh digital debt collection, debt recovery and debt reposition uh platform. Uh a very warm welcome to both of you uh to FinTech. FinTech X powered by Credex. Now without further delay, let's delve into the discussion. Uh um so um, I would like Mr. Gautam to uh uh share um his thoughts around how do IoT and fintech intersect uh and why are secure transactions crucial to uh the digital economy and how these can be achieved by the combination of both.

Speaker B: Sure. Thank you Mr. Hemant. Uh, thank you for this opportunity. Um so on my thoughts, the IoT device and FinTech intersection rate, probably we'll talk about IoT devices why and where these are getting famous. Right. We can see the IoT devices uh usage has is continuously increasing. Right. And um be in terms of wearable device or in terms of like uh wristwatches or in terms of uh our appliances, um vehicle we are driving. Most of this now carries sensor. What does it mean that it Will collect plethora of information about the execution of those engines as well as the customer, how they are using it. Now it brings a lot of information in terms of uh customer behavior for processing. Fintechs are in need of these informations, right? Uh in terms of processing this information and bringing uh rightful insight out of it. Now earlier also there's a input which is given by user and that information is being processed by fintech and meaningful informations are coming out from there and actually are based on that. Uh whereas your IoT devices are giving you complete information without user interventions as well which means it is coming very naturally now in terms of information which can be processed by fintechs and obviously we have AIML and a lot of other technology analytics are ah there to process that and bring out some sort of algorithms, outcome and decision engine. So decisioning on part of these information becomes very very useful, crucial for fintech industry. Give a uh action to the lender or like any financial institution to give a particular product and services. Right? So this is becoming very, very uh generous these days. Obviously it comes with security. You are taking a data and without a user intervention. In terms of IoT devices, with or without user intervention, data is paramount, right? It contains personal data, uh, a lot of data which even uh customer would not like to uh share in, in case if they are punching those data into some sort of devices. Right. So it becomes very important to have a security of those data. Right? Uh should be with the consent uh appropriate uh encryption um technique has to be there in terms of ah processing those data. And then again it has to be the first thing which need to be tacked which is the security of those data.

Speaker C: Right?

Speaker B: So this is what for this I could say, right? Um security is paramount in this particular way how we are actually gathering, generating data for uh financial services.

Speaker A: All right, great, great. You want to add something to it. Uh, you come from very interesting uh uh domain. I mean the debt collection, I mean it is one of the crucial piece and in uh lending usually we say uh lending is not a business of uh uh uh disbursing money but rather collecting money where you, your role comes into picture. So how do you see IOT and uh, uh the uh fintech especially the debt collection use cases intersect. And what are the uh different pieces uh you can think of uh combining uh to achieve better results in the particular domain.

Speaker C: Um hi Amant, uh thanks uh for inviting me. And so uh, on the onset you know the four areas um, you know maybe we can look at when it Comes to FinTech and IoT and the overall interaction with the consumer. So you from a consumer perspective uh you know anything uh, uh which they are you know kind of buying online or maybe transacting at a particular shop or you know something like a payment. So these that, that is one area where we see that you know that uh IoT devices could help ease the entire experience for the consumer. And then uh from there if you look at the uh, the bank branch interactions or maybe the interactions with the infrastructure which uh the consumer is exposed to like an ATM or something like that. So all these areas become uh you know uh, places where a lot of the data which uh you know is uh Gautam mentioned can be captured wherein now what kind of uh transactions are done, what kind of products are what uh, where these uh transactions are happening. So a lot of data can be uh, you know uh taken into the system and what it then builds is you know kind of a customer profile. So you can use the various machine learning models and there is huge amount of data which already bank has from the past. And uh overlaying this data with the uh, with the interaction with the consumer is uh having now the, with all these systems would add on to the you know the entire profiling exercise which will then help in both ways. So one is obviously the uh entire lending will be enhanced wherein uh how we are lending or how the fintechs are lending finally would uh give them you know some kind of a rating score and that would help uh you know giving the right product, um, right from a loan or maybe insurance or things like that. Um you know it could be even uh, let's say usage uh based. So if, let's say if you're um, uh insuring a car and if uh the car itself is you know transmitting all this data as to how much usage uh is happening, what is the wear and tear etc. So there could be a very uh, a lot of customized products that can be created uh through this particular data and that would then eventually uh land up in the uh. The entire profiling would definitely land up in the entire collection part where uh, based on the profiling what kind of reach outs that need to be made, um maybe through the digital channel or maybe call center, what kind of strategy, uh collection strategy that need to be applied. You know all these things uh would uh come into picture. So that is what I feel that you know using this entire data, how that travels from the origination point to the uh entire ecosystem in terms of lending and till the Collection bit that can be you know kind of uh used.

Speaker A: All right, so Yatin talked about very interesting fact that the uh the data from the IoT devices can be used to generate certain credit rating. So I'll go to Gautam, I mean uh, he is in the origination business. So how do you see uh usage of uh these kind of alternate data uh uh to basically um uh bring uh better customer experience uh for the, I mean for the, for the borrowers at the time of origination. I mean can this be converted into credit models or how it can be used uh maybe uh it can be used to uh in a hypothetical scenario. Again we know there are certain regulations around financial services as well but in a hypothetical situation let's say substituting KYC with uh the data available from the uh IoT devices. What are your thoughts?

Speaker B: A very interesting one because origination is very very important uh to see the right uh to pick the right customer right, right borrower prospect what we call it. So there's a part of it right uh at the time of acquisition of customer we have to build a customer profile or customer Persona right. It might be a scenario where the product and services customer has applied for might not be the right suited product for the customer and alternate can be offered. Also it is very important for a uh fintech or for a NBFC bank to put the right amount of effort in the processing those data uh right. In terms of increasing the efficiency. Now as with the IoT devices the um, amount of data flowing to a lender on the digital app is very very high. Now if they start up processing all the customer, all the borrower it will be like they will be missing out some of the prospect Here the important part is identifying the prospect which will actually go to the last stage. So in, in our case we have a uh Persona defined and a decile model in terms of AI where we say that style will definitely go for a conversion and lower decile will drop out at some other places. Now this is not only created on the basis of the uh data which a ah, uh borrower or a fintech has right? But it is also on the basis of external data which is coming up. External data is a very important in terms of building up the Persona of the customer and accordingly when the customer comes in it at the time of acquisition we are able to identify whether this is going to get converted or not. Now KYC comes the other part. To decide who to give a KYC link is also very very important right. Uh, probably not to uh focus streamline our processing. It's important to identify who are ready for kyc, who are adequate for KYC and where the uh effective borrower who is going to complete the entire journey. At times it is very important to do a cross sell as well. Right. As a lender will not be focusing entirely on all the product, it will be two or three product will be focusing them. But there are partners available in the market who will take up this particular request. Right. It comes like uh I as a borrower ask for a home loan and

Speaker A: then I'm not fitted for that.

Speaker B: Probably will be giving lab, right. Or a gold loan and my other partner is expert in giving gold loan or lab would be processing that particular request definitely on the basis of customer consent. So this Here the device, IoT device produce a lot of data as well as like uh the AI ML model create a scoring pattern for identifying the propensity of a customer to complete an application. Propensity of customer to default as well. Right. If their propensity is very very high, probably will not be so uh propensity of a customer of uh completing an uh application. Propensity of default, how much to lend.

Speaker A: Right.

Speaker B: Is some of those important part. And what are the various cross sell options available for this particular profile? Accordingly the action will happen and the application will be rooted.

Speaker A: Great, great. And uh, when it comes to uh, uh the operational efficiency of the fintech, I mean uh you are, you both are running a fintech organization. So when it comes to the operational efficiency within your organization how do you see uh the advent of uh IoT devices and data generated from these devices can help you in uh streamlining your uh internal uh efficiencies.

Speaker C: So uh, I hope you mind I don't take, I take it.

Speaker A: Right. Yeah.

Speaker C: So uh, so the way uh you know you can look at it is um the amount of data that is getting captured through the IoT devices, you know that is the most important part and it is beyond your single bank. So it is beyond uh uh so let's say if uh so for in our example we do the entire collection for uh you know banks and NBFCs. So there the customer profile is very very important because you don't want to bombard the customer with messages because collection is a very dirty, you know kind of game. And um, if one mistake and you can um. The reputation of the bank can get you know severely jeopardized. So uh, the external data which is very scarce at the moment, what you have with the bank is the you know Historic data of their transactions and the banking. But the external data adds on to a new dimension into the entire profiling. And then we can categorize them into low, medium, high and you know, ensure how the communication is then happening to the customer. So if a low, uh, low risk, uh customer can be given very soft uh, you know, kind of uh, um uh soft um communication and uh, they can, you know, definitely are people who are. So basically 90 of the people would definitely want to pay their loan. It is only some difficulties which they face and then you know, tend to bounce or have become delinquent. So all these data would then help uh the entire collection mechanism or the strategy as to how the communication should happen, who would then reach out and if there are ways in which we can help the consumer end consumer. Because every bank would want, would not want their loans to become NPAs. So how would they want to convert those potential NPAs into you know, profitable business? So that is where we see that you know, how uh, this data can be leveraged and create the required models to generate this kind of uh, customer categorization.

Speaker A: All right, all right. So uh, when it comes to uh, the innovation, uh in terms of product offerings, how do you see. So uh. I'll give. I mean, uh, so uh, when the uh combination, let's say uh. There is a combination of smart uh switches, smart vehicles, uh smart watches, wearables, data generated from these. So within the financial services, uh in terms of innovation, I mean I would say not just restrict to the borrowing space which I mean you are expert in. Uh, but you keep on talking to different founders from different uh industries like payments, uh regtech, uh and whatnot. So what are the innovations do you see? Uh, with the combination of IOT and uh. Uh financial services can bring in uh in future.

Speaker B: Yeah. So um, the device, iot, um generating lot of data. Right now data is very, very important uh not only to financial services but also on the wealth management side. So on the supply chain you talked about uh, is one of the important part and also on the cross bordering uh, like lending. And you can talk about trade finance as well. Okay. Recently you might have heard about defy, right. Uh decentralized uh financing.

Speaker A: Right.

Speaker B: In terms of uh, doing it cross border and associating with a particular lead with a blockchain. Okay. So where, where the data is pretty much on the blockchain and uh, it is open. And as you know that security is very, very uh well defined in blockchain which is accessible to most of the people. Right. They can See it very well. Also all these data generated as I talked about, cross selling. Right. Um, it's not only restricted to what type of borrowing product they can take but also in terms of a wealth management site where there are various other offerings which are there eight uh, most of the banks these days ah are planning to increase their casa. Okay. That is uh, uh, deposits. Right. This is also um, the data generated also go as a campaign to multiple people who can see the different sort of um, deposits as well as like uh, I mean initially it starts with the deposits as well.

Speaker A: Right.

Speaker B: They can attract the crowd for deposits as well and then for the other products can be offered to them. So some of those, I mean innovation which has happened over here is again I will restrict it to say customer profiling in town and customer cross selling. Right. Profiling and then deciding which particular product can be given. Right? It can be a product, can be n number of product. Uh, in terms of uh, IoT devices I would say they are quite smart in terms of identifying the access. Right. Access fraud and preventing them from uh, anyone else to access the same um, wearable devices which are coming up are very, very well defined and it is uh, very much integrated with human behavior. Touch as well as a reflection which is coming up from a specific user. And there are multiple level authentication which happens at a click of a button.

Speaker A: Right.

Speaker B: Or click or on a touch itself. Right. Which make it very secured. Uh, so I talked about the um, wealth management which is important aspect which is there a defi. Right. Decentralized financing stands on blockchain, right. As well as like uh, tokenization and various type of lending profiles which are getting created for the customer.

Speaker A: Got it. Um, anything you want to add in this?

Speaker C: Yeah, so one area that uh we could also look at is how this data can be made available. So you know the, the way UPI and the way Aadhaar and you know ondc, the way they have come up as a uh, you know entire tech stack. So we can visualize this entire thing as a tech stack with the data exchange, um, although with the entire consent, uh, with the customer. But uh, you know, kind of helps in various areas as you said, you know not just banking but even probably outside banking, um, certain areas can be exposed and you know how will it benefit the consumer is that uh, maybe if they get a better offer somewhere or maybe if they are getting uh, a uh, better deal, uh, you know that uh, that should be available to the consumer and uh, that that would definitely help. So if we create a kind of an Open platform, uh with open APIs, uh and these are certified through the entire framework and ensure the various uh security plug points are there uh in terms of hardware and software and then the relevant certification is uh you know kind of managed. This data can be extended uh even outside banking products. Yeah.

Speaker A: Another area I can think of as uh which comes under like uh financial services as insurance. So you can, I mean with the IoT data you can uh underwrite, let's say vehicle uh is having uh the IOT and you have the driving pattern and everything available for a driver. You can do a vehicle insurance and decide premium on the basis of that or maybe the variables uh can get into the health insurance insurance kind of thing. So that is another area I can see uh, which which can uh get revolutionized after the advent of uh uh and like with, with more coverage of uh IoT in day to day life. So now moving to uh a slightly uh technical aspect of it. So uh, when it comes to uh enhancing the authentication uh so Fintech is susceptible to a lot of fraudulent transactions and uh, I uh mean abusers and authentication becomes crucial in uh financial services. So how uh IOT can uh uh enhance uh the authentication of users uh using uh the combination of IoT. Okay, thoughts on it? Yes.

Speaker B: So wearable devices or any other IoT devices, they provide data on the basis of user uh wearing it, providing some other form of consent. This is a clear cut uh authentication and encryption mechanism which is between the devices and the server where they are actually sending out the data. This is the one part which has to be developed first. Right. And the security first is becoming very very important. Right. And uh, then how we are going to process the particular data. Various form of encryption mechanisms uh are available as of now. Tokenization formats are available. Right. So which encrypts the data and uh, then decrypts it. There are certain encryption mechanism which is like one way encryption. Right. There are handshaking ways, various form of security measures which are there. Uh fintech and banks rely more on getting certain or uh CISA certifications. Right. In terms of where their entire data is uh authenticated by audited and then the certificate is provided to them. Sometime back there was also a concern about our data localization part where the data moving out of the country as part of the backup. Right now there are now our RBI policies and uh cyber security guidelines are very very stringent to help people understand that data is very much secured in terms of the check for um entire authentications that they check for um their configuration, audits are happening, their localization audits are happening. Right, all sorts of audits are happening. You know and then only there is a partnership or data handshaking which happens right today. Any, any partnership which happens with uh, any IoT device or say anywhere we are sharing the data. Uh there is a clear cut guideline and certain set of uh authentication checks which happens. Audit happens before we start working on that event. This is becoming very, very important out here.

Speaker C: Yeah. Adding to that uh, the uh, or you know the initial space. I mean where this is getting extensively used is you know from authentication perspective is the biometric authentication. Where your biometrics are used to you know kind of uh, validate your identity. And uh, added to that we can also add the multi factor authentication wherein it is not just the SMS or OTP which is you know currently acting as the multi factor but there could be devices, uh, wearables or maybe at the consumer place there could be uh, you know, certain devices which are that capturing the, or rather authenticating the third uh factor uh and helping into the entire transaction uh bit. And also uh, there would be certain devices which you are wearing like variables on the continuous basis and uh, you could look at you know um, uh services which are um provided based on because you know it identifies that you are the user and then you don't have to get into an entire uh exercise so you know the entire past key uh which uh, you know Google has and a lot of uh, uh the players have now introduced when you don't need to put your password or anything, you have to just touch your finger or maybe your biometrics and you get logged into your Google account. So that adds a dimension to the entire convenience bit and you know a faster delivery of the product and you know the actual thing which the consumer and uh, lender wants to actually uh, wants the consumer to get exposed to.

Speaker A: All right, all right.

Speaker B: Yeah.

Speaker A: Passwordless authentication would be very interesting uh thing that can come up. So now talking about uh. So authentication has uh other side. I mean when there is theft of identity or something, uh that is something uh we call it as a fraud. So in when it comes to the fraud prevention or anything, uh how do you see uh the IoT devices playing their um role?

Speaker C: So one of the areas that uh, you know from a transaction monitoring perspective even today we have uh certain things like if you make a transaction which is let's say high value, then you get a call from the bank and they want you to you know kind of uh, approve the transaction. So a lot of dimensions can be used over here as to where you're doing the transaction. Is that your area where you generally do your transactions or whether you are on you know some vacation, if you made some transaction at that point uh previously, uh those uh data points uh can be included to take you know the decisions and give an early warning um, uh to the consumer that you know probably the fraud is happening. And all this individual data can be you know monitored through various IoT devices um in the infrastructure uh elements uh where the servers are hosted, where all the data is residing and uh, it can continuously monitor these things and you know come up with uh, uh any kind of issues or if any attempts to you know breach the security are made. All these uh can uh be detected and you know kind of action can be then uh, uh taken on those uh, those events.

Speaker B: Yeah, I think it's been well said about this, right? Um, ah so security is continuously review process the cybers uh attackers as well as like hackers. They are on a continuous move to find out a new way the OEM of this IoT devices, right? They have to continuously enhance the security of the IoT devices at the same time. Like uh, these uh are remote devices and wherever the data is coming and we are accepting the data uh from these devices, it is very crucial for us to identify it is coming from the right source. Well authenticated early warning signal as uh, I think talked about is very very important. Uh understanding the anomaly in transaction pattern in terms of the behavior pattern and uh blocking the transaction or re authenticating it's very important. Like um, these days uh we start getting a phone call on a very high value transition, right? Uh, or it can be even in the lending line um pattern where the drawdown happens, right? And we um, we continuously see a different pattern of drawdown is happening. So uh, lending also like the lending line pattern which is there, right where we give a line to the customer and can withdraw any point of time thought uh can happen in that area as well, right? The type of uh drawdown which is happening and not being uh, being paid off. Right? So these are the various uh issues which are there and I think on a continuous move the security enhancement is happening um at both the sites where the supply and demand is getting stringent in terms of security.

Speaker A: All right, so uh, we are talking about security lately in the answers both Yetin and Gautam. But uh, for our listeners could you elaborate like uh, um what are the uh, like attack surface that are uh new attack surfaces that are opened up by the creation of IoT devices. And what are the different challenges uh, in containing those uh, vulnerabilities.

Speaker C: So one. Yeah.

Speaker B: Uh, sorry. Usually we have seen that IoT devices uh add some touch of um, in terms of voice modulation and types of uh, uh, voice detection as well. Okay. Um, and lately we have seen that um. Um. Voice identification is becoming very, very important. There are authentication which also happens in terms of the exact customer is speaking and answers some of the question. We have seen uh, attack on that area as well in terms of um, uh, like fingerprint touch. Also we have seen some of those uh, fraud which has happened. So these are the areas which require to be strengthened. Right. Ah. Um, these are. I mean here the security is getting more and more stringent now.

Speaker A: Right.

Speaker B: And uh, as I said, uh, the OEMs need to stand in this area before the authentication also start. They have to. There also they have to have a two factor authentication which might not be a otp. Right. It can be uh, same one layer above the others. Yeah, yeah.

Speaker C: So one uh area which could be a very big concern is the man in the middle kind of an attack. Because all these devices would be you know, let's say scattered in your house and uh. Maybe at stores, at banks and uh, maybe at an atm. And uh. Uh. It could be a potential area where uh. Some. Some snooping or something. Uh if enabled could uh, you know, lead to a drastic uh loss of you know, kind of data. Um not just for a particular consumer but could be for multiple. So these areas. So obviously traditionally there have been lot of uh ways in which uh these kind of attacks I know, kind of mitigated by using asynchronous uh encryption or uh. Using some kind of token approach and ensuring that you know the. There are pinning uh. Uh, pinning technologies that can be used. So the definitely uh, you know the. That that could be an attack. So the mitigation, uh. One of the thing which uh we could look at is you know, kind of create a kind of entire uh, you know, uh. Um protocol or uh. You know the way UPI works. You create an entire ecosystem of the protocol where everyone has to you know, comply by a certain guide guidelines that how they are sending the data, what are the ways in which they are encrypting it, uh, what are the you know, um. The level of encryption, uh256RSA, you know, what are the compliance that are required. So and these would require then certifications as Gautam said, You know, it is a continuous process. It cannot be that I deployed something and it stays secured. Because the way uh, uh, the innovation is happening in all the positive side, there's a lot of innovation which is happening even in the uh, places where all these uh, devices and you know, the entire hacking or uh, this uh, identity thefts and ah, you know, areas uh, which come under that. So uh, it is a continuous process. Uh, there has to be uh, you know, continuous um uh, RBI guidelines and you know, uh, guidelines which are uh, uh, you know, improving and compliance and audits which need to be then um, conducted in all these areas.

Speaker A: All right. All right. So it was, I mean, uh, great learning uh from this session. I mean you added very uh, valuable and insightful points from uh, uh, the uh, usage of IoT devices for customer profiling, cross selling their use cases and innovations in the wealth management, supply chain finance, uh, using it as authentication mechanism as a biometric uh, password, uh, sorry, OTP less multi factor authentication or even passwordless authentication. Along with that, I mean you discussed and uh, through insights on um, the different threats, um attack surfaces, vulnerabilities and how uh, we can solve it, uh by designing uh, the standardized uh protocols, uh, building on encryptions, taking certifications and following compliances. So it was I'm sure, uh, a very uh, learning session uh for our um, listeners and I thank you both Gautam and Yetin, for your uh, participation in today's discussion. And uh, we got plenty of takeaways uh, from the discussion. It was really great. Uh, thank you.

Speaker B: Thank you.

Speaker A: Thanks.