PSB’s FinTech Cybersecurity Hackathon 2025

Develop Credit Risk Management Model using alternative data to arrive at probability of default search and tracking of defaulter

This leads to a large part of the population in most emerging markets failing to access banking channels and consequently remain unbanked or underbanked, effectively denying lenders a gauge of their creditworthiness. Traditional thinking basis for traditional credit scoring models depends on historical financial data like credit reports and bank statements to exclude persons and small-sized businesses with limited financial track records. Fintech companies are starting to use alternative sources of information, such as social media activity, mobile phone usage, and utility payments, to determine the credit risk far more accurately than traditional methods.

Traditional credit scoring models are inadequate for assessing the creditworthiness of individuals and businesses without extensive credit histories.

The desired output is a new credit risk model that uses alternative data sources to improve the accuracy and representation of credit assessments. It needs to be transparent, scalable, and comply with data privacy regulations for it to allow lenders to extend credit to under-credited populations with minimal risks involved.

Impersonated Registration/Frauds in Mobile & Internet Banking along with behaviour-based user authentication with password less login

Registrations by fraudsters, impersonated as customer, in mobile & internet banking applications is a major security concern. Fraudsters impersonate as bank, courier, customs or police officials and send dubious link to customer to install apps. Then initiate mobile banking registration on fraudster’s device and obtain OTP, debit card details or other authentication details from customers. After successful registration they transfer funds to fraudster’s account.

• Common techniques used are SIM swap fraud, vishing (voice phishing), and email scams. Fraudsters send fake emails, SMS (smishing), or phone calls (vishing) impersonating the bank to trick users into sharing sensitive information like login credentials, OTPs (One-Time Passwords), or account numbers. Once fraudsters obtain the information, they can gain access to the user’s mobile banking account and conduct unauthorized transactions. - As per current sim binding process, mobile number, IP, device id etc. is captured.
• Behavior-Based Authentication involves monitoring and analyzing the unique behavioural traits of users. By continually verifying the user throughout their session, behavior-based authentication prevents many forms of fraud, including account takeovers. Behavior-based user authentication provides a dynamic, secure, and user-friendly way to protect mobile banking applications from fraud. However, optimum balance of security, user convenience, and privacy is not achieved yet.
• Behaviour based adaptive authentication technologies are in nascent stage and rule-based authentication technologies lack behaviour based flexibility. Hence it is required that risk score basis behaviour of the customer including behavioural biometrics and anomaly detection is implemented efficiently

Participants are expected to provide solution to banks to differentiate between actual customer Vs fraudster initiated mobile/internet banking registration.

• Advanced fraud detection algorithms to detect suspicious activity that may indicate a cloned SIM card/ dual sim card etc.
• Algorithm to identify distance/difference between current location of customer basis location of mobile number/SIM and current location of person initiating the registration.
• Set up alerts for suspicious activities, such as login attempts from new locations or devices, multiple failed login attempts, or changes to account details.
• Implement strong authentication methods that cannot be bypassed even if phishing is successful.
• Notify users immediately if a SIM swap is detected or if suspicious activity (such as logins from a new device) occurs.

Solution must provide option to traditional authentication factors which are now getting exploited by fraudsters to enable password less login.