A major cyber attack soon to hit Pakistani banks + 4 other unsettling predictions about digital banking

“Pakistan’s first Unicorn [a billion-dollar startup] will be a fintech, which will provide a platform play as opposed to a single app,” Planet N Group of Companies’ Founder and Coach Nadeem Hussain said at Digital Banking and Mobile Payments Summit 2017, a gathering of who is who in the country’s banks, fintechs and telcos.

The financial clairvoyant didn’t stop there. “I see a major cyberattack in our digital world in the next three years. It’s at that time our [banking] industry will wake up to see the significance of what cyber security is,” he said.

Considered to be a pioneer of mobile banking, Hussain also predicted that Pakistani commercial banks would not come up with anything of significance in the digital space and their customers would force them to open up their systems to APIs [application programing interface] of fintechs. He followed up with one more prediction: these banks will end up buying fintechs as opposed to creating them.

When it comes to digital banking, Hussain has a knack for seeing the future well in advance. But, are his predictions just plain obvious or alternatively more like a shot in the dark? To find out the rationale behind his predictions, Profit caught up with him later and expanded the discussion further.

Pakistan’s first Unicorn will be a fintech platform play?

The highest possible chance Pakistan can create a Unicorn will be a fintech platform play, Hussain said. “We don’t have that kind of power in any single app. We may have got an app valued at $100 million or $150 million, but a billion dollar is a big number,” he said explaining why he thinks the country’s first Unicorn will be a fintech company.

Explaining, Citibank’s former country head said that a fintech platform, which can develop multiple solutions like those offered by Chinese ecommerce giant Alibaba Group will have a real chance of potentially becoming a Unicorn.

Alibaba Group is the holding company of Ant Financial, the world’s largest fintech company valued at $60 billion – that equals four Deutsche banks. Yes, you read that right. Fintechs are typically standalone Internet-based financial services companies that compete with traditional banks in a marketplace. Over the past decade, they have changed the way banking and financial transactions are done thus increasingly getting high valuations by investors.

“The top five valued companies of America in 2016 were the Googles, the Apples and the Amazons, they are no longer the Exxons, the Fords and the General Motors,” Chris Skinner said explaining how technology has changed things in the last 20 years – he is one of the top 40 most influential people in financial technology and a leading expert on information security.

Has Pakistan the potential to produce a Unicorn?

“Something is changing. The digital platform revolution that we are seeing today… the integrated open marketplaces, which connect people who have money with those who need money, just as Uber does with cars,” Skinner said in his presentation in the digital banking summit.

The industrial model of high valuation businesses, which require physical manufacturing of products, has changed and tech companies are frequently becoming high-valued entities, the expert said, backing it with examples, particularly from fintechs.

Paypal, valued at $48 billion in October 2016, may be the oldest and most established fintech company in America, but it doesn’t stop new fintech startups from gaining traction. It is evident from Paypal’s new competitor Stripe, which saw its valuation increased from $5 billion in 2015 to $9 billion a year later.

“Stripe is an API for doing merchants accounts online that’s really easy to use. It is expanding rapidly across Asia, which is why its valuation almost doubled in a year,” he added.

Cutting-edge fintech companies and financial innovation are changing the competitive landscape, and are redrawing the lines of the financial services industry, says Global Fintech Report 2017 by PricewaterhouseCoopers. This growing market segment has already produced many Unicorns, a clear indication fintechs are on a roll. But, has Pakistan got the potential to produce one?

Can do, says Hussain

“You have to be cognizant that it can be done,” Hussain said adding as one builds up a billion-dollar business, he should be clear on how much money he is prepared to spend and risks he is willing to take. “If you do that you are on the right track.”

Nadeem Hussain himself has invested in startups to exploit the areas that he predicts will soon become relevant. But, are his predictions a case of crying wolf to generate business for his startups or he is actually putting his money where his mouth is?

There are currently 27 fintech companies in Pakistan, out of which seven belong to Planet N Group, which is 90 percent-owned by Hussain, His holding company is in the process of launching Publishex. This upcoming startup has integration with Telenor, Zong and Jazz and will offer nano payments based on credit balance on customer’s SIM as opposed to his mobile account.

“They [banks] haven’t created any model that looks at the long tail customers, which is typically what the fintechs look at. That is, small ticket items with high value,” Hussain said – and he seems to be doing exactly that. Publishex’s integration with top three telecom operators would mean a target market of 122 million SIMs, their combined user base as of May.

However, Hussain’s Planet N is not the only contender for first movers’ advantage in the fintech race. Financial Ninja (Finja) is another interesting fintech startup to watch out for.

“We wish to digitalize the money. What Whats App has done to messaging, we want to do to payments in Pakistan,” Finja’s Founder and CEO Qasif Shahid told Profit in an interview. His company, in partnership with Finca Microfinance Bank, is developing a digital payments platform SimSim.

Digitalizing money, making Pakistan cash-light

Shahid aspires to make Pakistan a cash-light economy in the next three to four years and he chose to do it with ‘free payments’ through SimSim. “Our value to the microfinance bank is that through this opportunity the bank has to grow exponentially that has never happened before for a microfinance bank,” he said.

Giving background of his statement, the CEO said microfinance banks have failed the world because their business model is analog. For example, he said Professor Muhammad Yunus made this model 40 years ago in Bangladesh but this model had only 300 million global customers during this time. By contrast, cellular companies gained five billion in 20 years. “That type of growth is very elusive for a microfinance bank on its own,” Shahid said referring to the latter.

Right now, Finja has 20,000 users and a few hundred merchants on its platform but it believes if e-commerce remains free, there is a real chance that 100 million people will reinvent their relationship with money in three to four years – that’s the market it aims to tap into.

The numbers for fintechs may look small at the moment but Hussain thinks it will take one to three years for these companies to fully evolve and provide full range of services in payments, savings, credit, wealth management, and information – the five areas of fintech that people grow in globally.

Standalone fintechs have been a major business threat to financial services sector, but one can’t write off cellular operators when it comes to digital payments. According to the PwC study, telcos and big tech companies are seen as potentially large disruptors to the banking sector because they are able to innovate at a far faster pace than incumbents.

“Telcos can play a big part in the digital revolution from a fintech prospective,” Hussain said. They will end up giving voice for free because data is going to drive the fintech play, he said. They have a large customer base (140 million), they need to translate this data through machine learning and Artificial Intelligence to create solutions for their customers’ financial need, he added.

Telcos have long been dominating the digital payments scene in the country. The country’s first mobile payments platform EasyPaisa of Telenor Bank alone accounts for 70 percent of the market. It claims to have processed five per cent of Pakistan’s GDP in 2016 at more than 1 million transactions a day – the country’s official GDP was $300 billion as measured in May, 2017.

“We are aiming to digitize almost 100,000 merchants by 2020,” President and CEO Telenor Bank Ali Riaz Chaudhry told Profit – currently there are only 35,000 merchants that accept debit or credit cards.

Powered by a total retail merchant universe of nearly two million, Pakistan’s retail payments market is estimated to be more than $150 billion – this is nearly 10 percent more than Hungary’s entire economic output of 2014.

By contrast, the digital payment penetration remains much smaller at $150 million or mere 0.1 percent – that is almost all retail transactions are done in cash.

Bullish on the future of fintechs

Hussain may have the most bullish take on future of fintechs, but he doesn’t seem too optimistic about commercial banks’ understanding of threats facing digital banking.

The Planet N’s founder says Pakistani banks don’t think they are vulnerable and they are not even bothering about information security. “Not a single [Pakistani] financial institution or telco was using their services,” Hussain said, referring to Pakistan-based information security companies that are developing solutions for clients all over the world but not contacted by local financial institutions.

These banks are using technology that just feels comfortable, the banker said. They may have their own systems but the fact that these banks are complacent makes them vulnerable, he said. “Banks think the safeguards they have in place are adequate,” he added implying it may not be a good idea.

When Hussain was running Tameer Microfinance Bank’s EasyPaisa service, the bank was hacked. As a result, it had to bring its system down, and spend a lot of money to fix it. “We had a high-powered telco as a partner with sophisticated firewalls and hacking pulse, but we still got hacked,” Hussain said — he refused to reveal the details though. If a sophisticated player can get hacked, other places, which have weak cyber security protocols, are certainly vulnerable, he said.

“I think only an attack, and hopefully I am wrong, will shake us up to get us to the right level of cyber security,” Hussain said. And his statement doesn’t come without a basis. The banker relates his observation to the experience he had at a commercial bank where he had seen, firsthand, sophistication of cyber hacking – the recent developments in online security tell a similar story.

According to a post by information security research firm, SecurityIntelligence, there has been a fundamental shift in the manner online crimes are taking place and they are happening at a scale not seen before. These crimes are committed by groups of people who use increasingly sophisticated techniques and collaborate with each other to target financial institutions.

“There is a real chance that a bank will fall in 2017 as attacks get more advanced and the hackers get further inside the network,” said Aden Davies, Director of Portfolio Management at 11FS, a top-notch fintech consultancy company based out of United Kingdom. “The challenges faced by SWIFT in 2016 show that critical infrastructure is at risk and it only takes a handful of weaknesses to be exploited for major damage to be done,” he said referring to the Bangladesh bank heist.

In February 2016, cyber criminals stole nearly $100 million from Bangladesh’s central bank, which was connected with Society for Worldwide Interbank Financial Telecommunication (SWIFT), one of the most secured information and money transfer networks globally. Shortly after that incident, Russian officials disclosed that hackers stole more than $31 million from their central bank and commercial banks. In November of the same year, £2.5 million were stolen from 9,000 accounts of Tesco Bank, England.

Looming threat

Though major incidents, these are only a handful of examples of a looming threat facing financial institutions. Media reports suggest 2015 and 2016 were the busiest years in terms of cyber attacks on banks. And that’s only the beginning. Given hackers had developed advanced techniques to breach existing security protocols, SWIFT warned that these attacks were set to rise globally.

Lo and behold! Barely five months into 2017, a major global attack ‘WannaCry’ already infected hundreds of thousands of computers in more than 150 countries across the world. Last month’s ransomware attack exploited a security flaw in Microsoft XP operating system. The attackers locked access to user files and demanded the target pay $300 if they wanted their files decrypted.

The attack wasn’t targeted on Pakistan but the attackers did come here, Hussain said– and that was even before his prediction.

We could not find any official data about how many attacks have taken place in the past or value of losses suffered or amount recovered by banks. The State Bank of Pakistan’s response to Profit’s queries – shared with them three weeks in advance – was awaited till the filing of this report. Three of the top five commercial banks, we contacted for this article, didn’t entertain us either, leaving many
important questions unanswered.

However, industry sources say cyberattacks are taking place on a daily basis and there is no system in place for sharing of such information or dealing with a sophisticated attack.

“Many cyberattacks are taking place in the country already. Our user data, such as credit card information, is being used by hackers on a daily basis but no one is sharing that information,” said Barrister Zahid Jamil, an international expert on cybercrime.

Pakistani banks, at least a few of them, are now looking set to transition from basic bricks and mortar model to the much-advanced digital banking, making online security even more relevant. But, almost all the experts we spoke to echoed Hussain’s views, agreeing Pakistan has one of the world’s weakest information security systems in place.

“One needs to make sure they have barriers to avoid such attacks and minimize the damage,” Group Chairman Standard Chartered PLC, Jose Vinals told Profit in his recent visit to Pakistan – Standard Chartered Bank (SCB) is the first bank in Pakistan to move to internet banking.

Though he acknowledged banks all over the world are attacked every day, Vinals disagreed that banks were taking it lightly. “Cyberattacks are at the top of the agenda for all international banks and many local banks in many countries of the world,” he said recalling his reflections from the meetings he had with heads of banks and regulatory bodies in many countries of the world.

The SCB’s global chief said, they have upgraded their security system recently to make it more robust. “It’s impossible to say we are 100 percent protected, but we are doing our best to avoid such attacks,” he said.

Two-factor authentication, the way to go

When it comes to cyber security of banks, some experts say two-factor authentication is an effective and nearly foolproof technology because hackers can’t access the target’s mobile phone, where the banks send temporary codes. However, not all banks use this technology. Even those who do have limited its use to funds transfer while accessing one’s account doesn’t require this additional layer of security.

“In online banking there should be two to three factor authentication as opposed to the current practice where you go online, enter your password and access your account,” Jamil said. He argues that PIN and password model only ensures user authentication, but it doesn’t tell if a document is tempered – and that is apparently what happened in Bangladesh. SWIFT says it detected a simple malware on the bank’s computer systems that targeted a PDF reader, used by the bank to check statement messages. Using malware, the hackers bypassed primary risk controls by tampering with the statements.

“The way they [banks] email monthly statements to clients without any password protection is very unsecure,” Jamil said of all Pakistani banks including SCB’s local operations. The barrister says banks should use digital signature, which is more secured and ensures encryption of documents so that no one can tamper them.

Use of decentralized ledger system can be another way to prevent against cyberattacks, according to Skinner, the information security expert. “Decentralize the structure of the system into lots of different servers around the network, rather than having one central server that runs the system,” he said during the digital banking summit while responding to a question. When a company has hundreds of points then hackers have to attack all of those to get a breach, which makes the institution far more secured than when they have only one central point, he added.

Other experts say hackers are more skilled in cyber security, therefore, only a combination of best technologies or an emergency response team, as opposed to a single solution, can help form a sound strategy. Apparently, Pakistan has none.

“We don’t have any financial computer emergency response team (CERT) in Pakistan at the moment. If I can be specific, not a single bank is prepared to deal with any major cyberattack on their systems,” Jamil said.

Under CERT banks share data with each other and depute people on information sharing on real-time basis to address threats. In fact, the handling of recent attacks by private sector and the regulator indicates such information is restricted from becoming public.

For example, EasyPaisa and JazzCash, the digital payment platforms of two large cellular service providers (Telenor and Jazz respectively) were hacked but they didn’t share any information with the industry. In fact, mobile accounts of JazzCash agents were compromised twice in a month despite the company’s claim to have fixed the loopholes exploited by hackers in the first incident – but they chose not to alert others in either case.

Similarly, the SMS service can be useful as customers can alert their bank in case of unauthorized access by hackers, but this is a paid feature that comes with a federal tax, which discourages consumers to avail this security layer.

Most banks in Pakistan have outsourced cyber security and call centers to third parties, which is dangerous from a security point of view because they are not bank employees, Jamil said. We could not figure out how much money banks are spending on information security and what their strategy is because none of those contacted, including the regulator, answered our queries.

“If a major cyber attack takes place on Pakistani banks, it will be a huge economic loss, it will be a loss of trust in electronic banking, and hurt the whole e-commerce sector,” Jamil said.

Banks not coming up with anything significant in digital arena

Hussain’s prediction about a cyberattack on financial institutions wasn’t the only bitter pill for bankers to swallow. His harshest forecast, which may have made bankers in the room rather uncomfortable, was the one about commercial banks’ inability to do anything significant in the digital arena anytime soon.

Asked to explain, the founder of EasyPaisa said banks’ business model doesn’t make them hungry for fintechs. The numbers he shared seem to agree.

More than two-thirds of banks’ earnings come from government treasury bills and Pakistan Investment Bonds, which require no brains. In a country of 200 million, there are only 1.8 million active banking customers, 40,000 point of sale machines, and 1.1 million credit card customers.

“It has been the same for the last 15 years,” Hussain said.

Most banks are in five big cities and are not expanding geographically. The total SME lending from banks has come down from 17 per cent to six per cent while credit to agriculture remains under six per cent.

“No one has really come up with an innovative model for a long time and this state of play will remain unchanged in near future,” Hussain said pointing towards the budget deficit, which forces the government to borrow. The government remains the single-largest borrower of banks for over a decade now.

“I have a sense that we [banks] will stay dependent on the government,” former finance minister Shaukat Tarin told Profit in a recent interview. Banking has a small footprint in the economy, for its coverage is only 33 percent of the GDP, he said. “Some of these banks have almost forgotten how to lend and it will take them a long time to build the capacity to lend to customers.”

When the central bank started reducing its monetary policy rate in mid-2015, banks, which were enjoying 5 to 7 percent risk-free spreads, suffered notable losses in the years that followed. As a result, they shifted focus back to consumer lending.

Hussain, however, says most of this lending is going to the salaried class and not the self-employed people.

“By and large, expecting commercial banks, barring a few, to become tech savvy and provide their customers a digital journey is a long ask,” Hussain said.

The global stats for legacy banking seem to support his point of view. Only three percent amongst CEOs of leading banks have professional technology experience, according to Skinner, the fintech expert. Even at the board level, the number is only six per cent. “When you have no one in the top management who understands fintech, you are fatally flawed,” the expert said. This, he says is the biggest problem for banks wanting to move to fintechs.

“The real challenge for banks is how to play in a marketplace when they are playing on a proprietary avenue,” he said adding it is difficult because it requires change in thinking and culture.

Agreeing with Skinner, Bank Alfalah Limited’s then CEO Atif Bajwa said, the challenges of moving to digital banking essentially emanate from the old people in the boardroom. It reflects a mindset, traditional model of revenue, and traditional ways of delivering to the customers, he said.

“We have been in this comfort zone for so long that we are finding it difficult to transition very quickly,” Bajwa said, admitting the industry needs more people in the C-suite who understand fintech, which is the number one issue they face.

The legacy banking and old mindset at the board level may have been hindering the transition to digital banking, but that is not the challenge facing the industry. For example, BAFL had the most aggressive approach in expanding its digital footprint recently, but it still faced problems in certain aspects of digital banking.

When Bajwa took charge in 2012, digital was one of the two major areas of focus for the new management. They were one of the first banks to come into Point of Sale (PoS) machines business and grew their footprint very fast, according to Amaar Naveed Ikhlas, Head of Branchless Banking at BAFL, which now accounts for 60 percent of the PoS machines in the market.

“To become the best transactional bank you have to make transactions easy, cheap, and user friendly in every way. And to do that, you need to go digital,” Ikhlas said, explaining why they focused on digital.

BAFL had been able make some inroads to digital by increasing its ATM network from 300 in 2012 to 650 now. It also makes over 10 billion in payments to more than 350,000 EOBI customers and 1.1 million BISP beneficiaries nationwide digitally.

Despite notable success on digital front, Ikhlas feels there is a lot of room to grow the existing digital payments ecosystem. They launched their branchless agent network Mobile Paisa in collaboration with Warid, but it faded away after the latter’s acquisition by Mobilink. However as the market matured and opened up an opportunity with EasyPaisa emerged which allowed them to use their agent network. He feels the cost for using other agent networks is high but opening these networks up is the right step by the likes of Telenor.
Government pays BAFL and it puts the money into customers’ accounts who either go to ATMs or agents to withdraw that money. “For them this transaction is free and we compensate the agent from the fee we charge from government,” Ikhlas said. A large part of the fee goes to the agents of EasyPaisa.

The duopoly of EasyPaisa and JazzCash is a problem for more than one player in the industry. “When you are charging Rs60 on a local remittance of Rs1,000, that is six per cent, it becomes very expensive,” Ufone’s CEO Rainer Rathgeber said in an apparent reference to market leader EasyPaisa.

Speaking to a group of journalists in Karachi earlier this year, Rathgeber said, 98 percent of all fee is going to the agents and rest to the telcos or banks, which is not a successful model. “The poorest is paying the highest and retailers are the only beneficiaries,” he said. This is one of the reasons why Ufone, the parent company of Ubank, is more into microfinance, and into payments, the CEO said.

Ikhlas, the BAFL’s branchless banking head, says the current mechanisms support big players like EasyPaisa and JazzCash but other players are not able to do it. He went a step further in suggesting people in Pakistan didn’t do banking themselves through mobile as it is done in other successful countries in the world rather rely on the agent to conduct transactions on their behalf.

“If we ask EasyPaisa about how many accounts are there in Telenor Bank, they might say 10 million, but how many are actively used is a different story,” he said, adding, activity in agents’ accounts are there, but not so much in consumers. In over the counter transaction, which still account for more than half of total branchless banking transactions, people at both ends are actually giving and taking actual cash. If one looks at over the counter transactions, the fee is under threat, he said, adding only Easy Paisa and JazzCash will survive because they have invested so much money in this.

In digital banking, the growth hasn’t come a yet. “We have not reached the tipping point yet which will allow us to leapfrog into an era of digital transactions,” he said.

Shifting strategies

Banks are very proprietary right now, but over time, they will open up their system so that fintechs can integrate with them, Hussain says. And this, according to him, will be driven by customer pressure or regulatory requirement.

“If customers demand their information to be available with a particular fintech with their consent, the banks will have to comply or they will go to another bank,” Hussain said. “Some banks will open up voluntarily because they see this as a business and build up a model where they make money but others will be forced to do it eventually,” he said. This has happened in Middle East and North Africa (MENA) and other parts of the world, he said.

According to the PwC’s latest study on fintechs, many financial services leaders fear losing business to innovators, starting with payments, fund transfer and personal finance sectors. The vast majority (88 percent) believed that part of their business is at risk to standalone fintech companies. “This business risk is due to developments in fintech and has grown to an estimated 24 percent of revenues,” the study says.

“Innovation is coming from outside financial services and being driven by a variety of sources including tech companies, e-retailers, and social media platforms,” it says, adding this approach certainly has been prevalent in some Asian markets.

Hussain says a lot of banks have jumped into branchless banking but that is not necessarily a profitable business. “It’s a fat driven herd mentality as opposed to strategically thinking what needs to be done,” he said.

“Right now, they don’t think fintech, but when they have figured out how profitable these fintechs can be and what the improved customer journey is, the same banks will have opened up to the fintech APIs and will look into acquiring them,” Hussain said.

Given fintechs are still in their infancy in the country, it may be too early to expect any merger or acquisition in this space, but recent developments indicate there have been several mergers and acquisitions in fintech space and there appears to be a shift in banks’ strategies towards them.

According to Crowdfundinsider.com, 2015 saw 427 fintech mergers and acquisitions, up 14 percent over 2014. Similarly, the PwC’s 2017-study on fintechs says funding of such startups has increased at a compound annual growth rate of 41 percent over the last four years, which comes down to over
$40 billion in cumulative investment.

Big banks’ fintech investing strategies are shifting, CNBC reported in a post in April 2016. “This year, big banks seem more eager to partner with or buyout startups challenging crucial lines of business in the financial services industry,” it said. More recently, banks are committing big bucks to buyouts and it comes after a year in which fintech funding hit new highs, it said.

Also Read:

Editorial–Incentivising consumers for desired behaviour