Facial Recognition and OTP to Uncover Fake Salary Recipients

- Dual authentication for salary earners up to 300 dinars, and for any withdrawal, transfer, or payment of 25 dinars or more.

- Updating the beneficiary’s banking classification upon confirmation of any change in their salary.

- Reviewing “Know Your Customer” (KYC) data and the channels used in related transactions.

- Reviewing salary reversal or refund transactions and verifying their reasons and supporting documentation.

- Prohibition of depriving an employee of their salary or restricting their rights without legal grounds.

- A comprehensive electronic record documenting all escalation and closure processes.

- Suspicion indicators:

- Repeated withdrawal or transfer of 80% of the salary within 72 hours.

- Similar transactions by five employees or 20% of beneficiaries within a single payroll cycle.

- Transfer of 50% or more of the salary to the employer or a related party within 72 hours.

- Transfer of salaries from five or more beneficiaries at the same employer to a common beneficiary within three days.

- Unusually frequent withdrawals from a single ATM or online banking platform within a short period.

Once the Public Authority for Manpower announced the launch of an electronic linkage system with the Central Bank of Kuwait to verify salary disbursements through a centralized, approved platform for monitoring private sector payroll payments via local banks, specialized and public discussions inevitably raised interconnected technical, procedural, and logical questions regarding how to verify, both banking-wise and supervisory-wise, whether salary payments were legitimate or merely fictitious.

In this regard, the Central Bank specified the procedures banks must adhere to in order to enhance the effectiveness of Kuwait’s Wage Payment System (KWPS), which was launched on September 28. Banks were granted a three-month deadline from the system’s launch date to complete the registration of employers’ data in the system. Each bank is required to submit a monthly report through KWPS no later than the fifth working day of the month following the payroll month.

To strengthen banks’ verification of beneficiary identities and ensure their consent to transactions executed on their accounts, and to mitigate the risks of bank accounts or associated payment instruments being used by employers or other parties without the beneficiary’s knowledge or consent, banks have unified their procedures to implement dual authentication, which will likely include facial recognition and a one-time password (OTP). This enhances the beneficiary’s ability to actually benefit from the salary once deposited into their account.

Dual authentication applies to beneficiaries whose monthly salary does not exceed 300 dinars. The eligible category is determined based on the latest documented and available salary data held by the bank, without relying on the bank account balance or the value of a single transaction. Banks are obligated to update the beneficiary’s classification upon confirmation of any change in their monthly salary.

Banking regulations require the application of dual authentication to every withdrawal, transfer, or payment of 25 dinars or more executed by the beneficiary using the bank account designated for receiving their salary, or using payment instruments linked to that account, regardless of the banking channel used. It should be noted that the 300-dinar threshold pertains to the beneficiary’s monthly salary to determine the eligible category, while the 25-dinar threshold applies to the value of an individual transaction subject to authentication. The mere crediting of the salary to the beneficiary’s account does not require dual authentication.

Regarding the mechanism for implementing two-factor authentication, banks will employ two distinct categories of initial verification factors, going beyond the authentication performed during initial registration or first-time access to banking channels. Authentication must be conducted for each transaction amounting to 25 Kuwaiti dinars or more, to verify the beneficiary’s consent to the specific transaction. Furthermore, essential transaction details—including the transaction type, amount, and beneficiary entity—must be displayed to the beneficiary prior to confirmation, depending on the nature of the executed transaction.

To safeguard two-factor authentication and ensure its effectiveness, verification methods must be personally linked to the beneficiary, who must be able to use them and complete the authentication procedures independently. Consequently, banks must verify the validity of contact information and authentication methods upon registration, modification, or recovery. Banks cannot rely solely on data provided by the employer without directly verifying it with the beneficiary through appropriate and approved channels. Additionally, any bank account used directly or indirectly to channel salaries or portions thereof to the employer or any associated party must be scrutinized.

Successful authentication alone does not constitute evidence that suspicion is unfounded or that the beneficiary was not subjected to pressure or influence compelling them to return their salary, in whole or in part. Accordingly, banks remain committed to monitoring, examining, and reporting suspicious indicators in accordance with these procedures, including transactions valued below 25 Kuwaiti dinars.

The Central Bank noted that a beneficiary’s act of withdrawing their salary in cash, in whole or in part, cannot be considered, by itself, sufficient evidence of fictitious payments unless accompanied by additional indicators or circumstantial evidence supporting suspicion. It emphasized that delaying the crediting of salaries to a beneficiary’s account or restricting their right to use funds deposited in their account cannot be justified solely on the basis of a suspicious indicator related to fictitious payments, unless such action is supported by legal grounds. When evaluating transactions, the nature of the beneficiary, their income level, and their usual financial behavior must be taken into account, as direct cash withdrawals or rapid disposal of salaries may represent normal behavior for certain segments of actual beneficiaries.

Suspicious indicators include:

1. Withdrawing or transferring 80% or more of the salary value within 72 hours of its crediting, if this occurs repeatedly over two out of the last three payroll cycles.

2. Transferring 50% or more of the salary value to the employer’s account or to an account of a party associated with the employer within 72 hours of the salary’s crediting, or within another timeframe determined by the bank.

3. Transferring salary amounts from five or more beneficiaries employed by the same employer to a shared beneficiary account within 72 hours of salary crediting, or within another timeframe determined by the bank.

4. Executing cash withdrawals from an ATM or online banking platform by an unusual number or proportion of beneficiaries employed by the same employer within a short period, according to a documented and approved monitoring methodology established by the bank.

5. A documented complaint from a beneficiary stating that they were forced to return their salary in whole or in part, or that they were unable to freely use their bank account or dispose of their funds.

Additional suspicious indicators include:

1. Transferring the entire salary or a portion thereof from the beneficiary’s account to the employer’s account or to an account of a party associated with the employer, without an apparent legitimate reason justifying such action.

2. Multiple beneficiaries employed by the same employer transferring portions of their salaries to a shared beneficiary account after salary crediting, with indicators suggesting a link between that beneficiary and the employer or arrangements for salary refunds.

6 - Withdrawing a high proportion of the salary within 72 hours of its crediting date, when this represents unusual behavior for the account, with the proportions and monitoring periods determined according to an approved but non-disclosed internal methodology, which shall not be shared with external parties.

8 - The account balance dropping to a very limited percentage of the salary value within 72 hours of its crediting date, in a repeated and patterned manner.

9 - The bank account being used almost exclusively for receiving the salary and withdrawing or transferring it directly, or the absence of any other financial transactions on the account throughout the month (dormant account), except during the period when salaries are credited.

3 - Verifying the existence of a direct or indirect relationship between the beneficiary and the employer or any affiliated parties, based on information available to the bank.

5 - Verifying the existence of similar financial indicators or patterns among other beneficiaries working for the same employer.

7 - Documenting the results of the review and audit, the data and information relied upon, and the reasons and justifications underlying the decision to classify the payment as fictitious.

* High Risk: Cases showing strong indicators of the likelihood of fictitious payments, including:

2 - A repeated and common financial pattern among several beneficiaries working for the same employer.

4 - A documented complaint from the beneficiary stating that they were forced to return the salary or were deprived of its benefits.

* Medium Risk: Cases showing repeated withdrawal or transfer of most of the salary, coupled with one or more additional indicators supporting suspicion, or the emergence of a similar financial pattern among a group of beneficiaries working for the same employer.

* Low Risk or Under Monitoring: Cases showing a single indicator not supported by additional circumstantial evidence or information, such as a one-time cash withdrawal, without an apparent relationship between the beneficiary and the employer, nor repetition of behavior or other indicators reinforcing suspicion.

3 - Unjustified changes in the number of beneficiaries or the total salary amounts, compared to previous payroll cycles.

10 - The use of shared contact details, electronic devices, addresses, or login credentials by multiple beneficiaries’ accounts, where such information is available to the bank.

11 - Indicators suggesting that the beneficiary’s bank account, card, or login credentials are actually managed or used by the employer or any third party.

12 - Unusual changes in the beneficiary’s behavior regarding the deposited funds after salary crediting, compared to their usual financial behavior in previous periods.