57 min
Fraudology
Fraude crediticio: cuando el solicitante perfecto es la señal de alerta
57 min
Bienvenidos de nuevo a Fraudology.
Bienvenidos de nuevo a Fraudology. Soy Karisse Hendrick y esta semana hablo con alguien que se ha convertido en un invitado habitual del programa. Matt Vega me ha acompañado a lo largo de seis años y durante su paso por varias empresas. Ahora es director de Estrategia contra el Fraude en Point Predictive, donde trabaja con Frank McKenna en el fraude crediticio. Su incursión en ese ámbito me dio una buena razón para preguntarle qué se ve diferente desde su perspectiva.
El fraude crediticio rara vez se parece al tipo de fraude que la mayoría de los comerciantes suele imaginar. Muchas pérdidas comienzan con un solicitante que exageró sus ingresos o limpió su historial crediticio mediante reclamaciones reiteradas, y estos casos conviven con ataques organizados. Matt explica cómo el fraude de limpieza de crédito y la tergiversación de ingresos difuminan la línea entre el abuso y el fraude. También muestra cómo los datos sobre fraude de un consorcio de entidades crediticias permiten a un prestamista detectar patrones que nunca podría revelar un único informe crediticio.
Luego llegamos a la parte que, en mi opinión, merece más atención. Hoy en día se puede crear rápidamente una identidad sintética con un perfil crediticio excelente y, sobre el papel, puede superar a un cliente real. Tanto si trabajas en el sector de los préstamos como en fintech o comercio electrónico, terminarás con una idea más clara de hasta qué punto tus defensas son realmente eficaces.
Lo que escucharás en este episodio:
- Cómo funcionan los datos sobre fraude de los consorcios de entidades crediticias y por qué la pérdida de una entidad puede proteger a toda una red frente al mismo ataque
- Cómo el fraude de limpieza de crédito y el abuso de las disputas ante los burós de crédito pueden convertir temporalmente una puntuación de 580 en una de 790, y por qué a veces los prestamistas no lo detectan
- Por qué la tergiversación de ingresos y el fraude crediticio de tipo «bust-out» se sitúan en un espectro que va desde el abuso oportunista por parte del propio cliente hasta los ataques deliberados
- Cómo se puede crear una identidad sintética con una calificación crediticia excelente en aproximadamente 90 días mediante un esquema de fraude con usuarios autorizados y fraude de «compra ahora y paga después»
- Por qué un perfil crediticio perfecto puede ser una señal de alerta y qué pueden detectar los equipos de crédito mediante la inteligencia de redes de fraude que un informe crediticio no puede revelar
- Cómo las herramientas de fraude basadas en LLM sin restricciones, las herramientas de fraude de la web oscura y un mercado de identidades de la web oscura facilitan la creación de identidades y documentos de identidad fraudulentos para solicitar préstamos, así como de tarjetas que coincidan con ellos
- Por qué las limitaciones de AVS y CVV para detectar el fraude y las de las herramientas antifraude de los PSP se traducen en altas tasas de rechazo, falsos positivos y contracargos
- Cómo un buen mapeo del comportamiento de los usuarios facilita la detección de anomalías, y cómo los ataques de fraude polimórficos y las granjas de dispositivos intentan imitar el comportamiento humano real
- Cómo se complementan los controles contra el fraude crediticio basados en biometría del comportamiento, la prevención del fraude mediante una estrategia de fricción y la evaluación de proveedores de soluciones antifraude, y por qué puede valer la pena aceptar una oportunidad de colaboración en el diseño de tecnología antifraude
Deberías escuchar este episodio si:
- Trabajas en el sector de los préstamos, la financiación de automóviles o las fintech y quieres conocer la situación actual del fraude crediticio más allá de las tácticas habituales de identidad sintética
- Son responsables de la estrategia del conjunto de tecnologías antifraude y buscan una forma práctica de evaluar a los proveedores consolidados frente a las tecnologías más recientes
- Eres un comercio que depende de una herramienta antifraude de un PSP y te preguntas por qué tanto tus rechazos como tus contracargos son elevados
- Necesitas argumentos para explicar las decisiones que generan fricción a los directivos y a los equipos de crecimiento utilizando datos que ya les importan
- Quieren entender por qué es importante una red de préstamos basada en un consorcio antifraude cuando los atacantes utilizan la IA para adaptarse rápidamente
Notas del episodio
El fraude crediticio abarca un amplio espectro, y el blanqueo de crédito se sitúa en una zona gris
Matt comienza explicando cómo funciona el consorcio de Point Predictive. Los prestamistas aportan señales y también las reciben. Cuando una identidad sintética o un fraude de tipo «bust-out» afecta a una entidad, toda la red aprende de ello. También señala que gran parte de lo que detecta el consorcio corresponde a fraude amistoso de primera parte, más que a ataques organizados. El blanqueo de crédito es un buen ejemplo. Una persona impugna ante los burós de crédito elementos negativos legítimos, estos se eliminan temporalmente y el prestatario solicita un préstamo aparentando ser un cliente de máxima solvencia. Un prestamista en esa situación no siempre se da cuenta. Lo que valoro es que Matt recuerde que conceder préstamos es un arte, porque algunas personas que blanquean su historial crediticio e incluso algunas identidades sintéticas sí pagan sus deudas y, con suficiente inteligencia de red, un prestamista a veces puede ajustar el precio a ese riesgo en lugar de rechazar la solicitud de plano.
Identidades sintéticas superprime y por qué el solicitante perfecto es la señal reveladora
Esta era la parte de la conversación que más quería que escucharan los oyentes. Antes, crear identidades sintéticas requería años de cuidadosa preparación. Lo que Matt está viendo ahora son identidades creadas rápidamente que superan a las reales, aprovechando el historial crediticio de líneas de crédito de usuarios autorizados y préstamos a corto plazo de «compra ahora y paga después» que se notifican a los burós de crédito. Detectó el cambio cuando los precios de las identidades sintéticas antiguas empezaron a caer en la web oscura, lo que indicaba que el mercado se estaba inundando de alternativas más rápidas. Los indicios son sutiles: un perfil impecable, líneas de crédito en su mayoría recientes o pertenecientes a cuentas de usuarios autorizados, combinaciones de ingresos y empleadores que no terminan de cuadrar y un solicitante al que el consorcio nunca ha visto. Una persona de cincuenta años con una puntuación crediticia de 800 que nunca ha solicitado un préstamo no resulta tranquilizadora. Es una señal de alerta.
Lo que la web oscura facilita y por qué las comprobaciones básicas no bastan para sostener su estrategia
Matt me explicó lo que encuentra cuando investiga la web oscura. Hay miles de mercados, y algunos ya permiten a los compradores elegir tarjetas por región, código postal y emisor, mientras que los LLM sin restricciones pueden generar una identidad sintética completa en cuestión de segundos. Como las redes de pago nunca se diseñaron para verificar el nombre del titular de una tarjeta y el AVS solo comprueba los números, una tarjeta cuyos datos coincidan con la identidad sintética puede superar las verificaciones de AVS y CVV sin demasiados problemas. Por eso insisto a los comercios en que endurecer las comprobaciones de AVS y CVV sirve principalmente para bloquear a clientes legítimos que se equivocan al rellenar un campo. Un comercio con el que hablé rechazaba hasta el 30 % de los pedidos mediante una herramienta de un PSP y, aun así, mantenía una tasa de contracargos cercana al 2 %. La forma en que Matt lo planteó se me quedó grabada: el CVV y el AVS son el mazo al que se recurre en una emergencia, pero nunca deberían constituir toda la estrategia.
Identifica primero el comportamiento de los usuarios legítimos y los actores maliciosos destacarán
El único consejo de Matt para quienes estén desarrollando una nueva estrategia es dedicar más esfuerzos a definir cómo se comportan los usuarios legítimos. Cuando se comprende todo el recorrido, incluidos los puntos en los que estos usuarios tienen dificultades y aquellos en los que abandonan, resulta mucho más fácil detectar anomalías. Además, esto permite construir un relato que los directivos y los equipos de crecimiento realmente quieren escuchar. Y cobra aún más importancia a medida que los atacantes se adaptan. Ahora los emuladores imitan el comportamiento de los dispositivos, y Matt describió filas de teléfonos pegados a tubos de PVC que se hacen rodar de un lado a otro para simular el movimiento de un teléfono sostenido en la mano. Los proveedores tienen que seguir perfeccionando sus sistemas de biometría del comportamiento para mantenerse a la vanguardia, y este juego del gato y el ratón no da tregua.
La fricción es un juego de mínima resistencia
Los defraudadores siguen el camino de menor resistencia, lo que significa que el objetivo rara vez es detener todos los ataques. El objetivo es introducir fricción de forma táctica para que los atacantes decidan que la tienda de al lado es un blanco más fácil. Matt sostiene que los datos son lo que permite justificar esa fricción. Si puedes demostrar que una medida provoca una caída del 1,3 % en la conversión durante el proceso de pago, mientras que el comportamiento de los usuarios legítimos no se ve afectado en otros puntos, puedes conseguir apoyo interno. Yo aporto el componente humano mediante la llamada mensual con comercios que organizo desde 2020. En una ocasión, una empresa de venta de entradas y un minorista de calzado se dieron cuenta de que estaban detectando el mismo patrón en los correos electrónicos, y aquella conversación fue la versión cualitativa de lo que hace un consorcio con datos a gran escala.
Cómo elegir a los proveedores de tu stack tecnológico antifraude
No existe una solución milagrosa. La verdadera pregunta es qué capas implementar y a quién confiar cada una. Matt sugiere preguntarse cuál es el objetivo principal de cada proveedor. Una empresa de pagos normalmente destinará sus recursos a la autorización y la orquestación, mientras que el fraude puede ocupar solo a una pequeña parte del equipo. Él parte de proveedores de eficacia probada como base —los Toyota Corolla que nunca fallan— y luego incorpora tecnologías más nuevas para ponerlas a prueba. Cuando una empresa joven le propone colaborar en el diseño, suele aceptar, ya que a menudo así puede conocer cómo se desarrolla la tecnología e influir en su rumbo. También coincidimos en que algunos PSP más recientes han creado herramientas antifraude muy sólidas, mientras que los más veteranos promocionan agresivamente sus productos antifraude incluso cuando pueden perjudicar las tasas de aprobación y de contracargos.
Conclusiones clave
- Una red de préstamos basada en un consorcio antifraude permite que la pérdida de un prestamista proteja a todos los demás prestamistas de la red, por lo que resulta tan eficaz contra patrones de ataque recurrentes.
- Gran parte de lo que los prestamistas consideran fraude es abuso de primera parte, incluido el blanqueo de historial crediticio y la tergiversación de ingresos, y no todos estos casos terminan en impago.
- El abuso de las reclamaciones ante los burós de crédito puede hacer que un prestatario de alto riesgo parezca temporalmente de máxima solvencia, y los elementos negativos pueden reaparecer en cuestión de semanas.
- Se puede crear una identidad sintética con una calificación crediticia excelente en unos 90 días utilizando el historial crediticio de líneas de crédito ajenas y préstamos a corto plazo de «compra ahora y paga después».
- Un perfil perfecto sin historial crediticio es, en sí mismo, una señal, y los equipos de crédito que utilizan inteligencia sobre redes de fraude pueden detectarla cuando un informe crediticio no puede hacerlo.
- Las herramientas de fraude basadas en LLM sin restricciones y los mercados de identidades de la web oscura reducen el coste y el tiempo necesarios para crear identidades, documentos y tarjetas que coincidan.
- AVS y CVV deben utilizarse como una medida de emergencia, no como una estrategia, ya que los atacantes suelen disponer de los mismos datos que introducen los clientes legítimos.
- Mapear el comportamiento de los usuarios legítimos facilita la detección de anomalías y proporciona a los equipos antifraude datos que los directivos y los equipos de crecimiento tendrán en cuenta.
- Al evaluar a un proveedor de soluciones antifraude, conviene tener en cuenta dónde invierte sus recursos; además, una colaboración de diseño puede ser una forma de bajo riesgo de probar nuevas tecnologías.
Conclusión final
Si hay una idea que espero que se lleven de esta conversación, es que las señales que nos hemos acostumbrado a buscar están cambiando. Antes, un historial crediticio impecable, un código postal de facturación coincidente y un CVV correcto resultaban tranquilizadores; ahora, cualquiera de ellos puede falsificarse de forma rápida y barata. Los equipos que resistirán serán aquellos que entiendan cómo es un comportamiento legítimo, compartan lo aprendido con una red y traten la fricción como una decisión deliberada, en lugar de una reacción automática. Nada de esto detiene todos los ataques. Simplemente hace que ustedes sean un objetivo más difícil que el negocio de la esquina.
Recursos y enlaces del episodio
Conecta con Matt Vega | LinkedIn
Conecta con Karisse Hendrick | LinkedIn
Presentadora del pódcast Fraudology
Experta galardonada en fraude cibernético
Consultora en prevención del fraude en el comercio electrónico
Asesora de startups, conferenciante y
consultora para empresas de la lista Fortune 500
Guests
Episode transcript
Karisse Hendrick
00:07
Welcome back to the Fraudology podcast. Well, today I have a fan favorite, uh, one of my favorites as well, Matt Vega. Uh, he's been on the podcast several times, uh, representing I mean, because we've had this podcast for six years, I think you've been here representing at least four different companies that I can count. Um, which is all good stuff because everybody wants you to work for them. Uh, because you're so brilliant and know a lot of things that a lot of people don't. Well, it's true. Um, so now Matt works with Frank McKenna as the chief fraud strategist for Point Predictive. I'm almost jealous because at the same time that Frank hired Matt, he also hired Jen. And uh it's I just I can't I'm sure you guys just have so much fun talking about fraud all the time.
Matt Vega
01:02
We do. It's either fraud or we're laughing hysterically at something. That's usually the the combination. Yeah. You like all three of us together. It's it's definitely fun fun vibes for sure.
Karisse Hendrick
01:12
Yes. Yes. So I wanted you on to talk you've learned you've had like a massive crash course. It's not that you didn't already know about synthetics and everything else, but you know, now that you're on the lending side of fintech, right? Like, so maybe first explain what Point Predictive does because I don't think I've ever had Frank do that and it'll give context to what we're going to talk about today.
Matt Vega
01:34
Yeah, totally. And obviously, thanks for having me on as always. It's uh, you know, all the compliments right back at you. What Point Predictive is is the best way to think of us is we we offer a variety of products. But the core uh the core value prop for Point Predictive is a data a very large data consortium model. Um and it's specifically for lending um we originally started in kind of like let's just say subprime high-risk lending. We have a lot of like auto lenders on the network um but we work with I mean you know hundreds and hundreds and hundreds of credit unions and financial institutions and fintech. Anytime from you personal credit cards to auto loans to I mean anytime that there's some sort of loan application we can sit into the flow. And um basically we are currently the largest lending data consortium model in the world, which is very cool. Little known fact, um specific to lending. Um and so I mean we have billions and billions of data points and basically the argument is is it's like a it's a wheel and hubspoke model, right? Where um we both we basically give out signals and collect signals back from a huge network. So if a let's just say a synthetic identity or a fraudster attacks you know uh Karisse's credit union down the street and you all take a loss from that individual or that identity and you're on our consortium, the entire network learns from that and becomes immune to that attack vector. Right? So we now can track and trace and warn the network that this identity is associated with an early payment default, a bust out, some sort of fraud attack, a synthetic identity. And that allows us to protect all of the lenders on the entire network from that individual defrauding them as well. So it it's basically this you know and we also do of course you know kind kind of traditional neural network modeling. Where we're risk scoring applications and we're doing some pretty sophisticated stuff on on income uh variance. And we're looking at employment variance. Yeah. So like stated income um right. So, that's a big one where people they they apply for one loan and they say they make $100,000 a year, but they only get approved for $8,000 and they needed 30,000. So, they go to the credit union down the street and they claim they make 300,000 a year. Um, and it's really hard to authenticate that because lenders do not want to apply friction through stipulations to verify income. So, but but it because you're a part of our consortium, we can see those deviations in stated income and employment and how are those employers associated with fraud or with synthetic identities and all of these other network signals. So, at a high level, that's what Point Predictive does.
Karisse Hendrick
04:10
That's great. Yeah, I I always associate it with car lending, but you're absolutely right. I know over the last several years, it's expanded into all lending. And that gives you a really unique viewpoint, right? Because there's so many different I was just writing out this on LinkedIn today about e-commerce. And how you know I think in banking most you can go from one bank to another and guess as long as they have the same products you can know what type of fraud they're seeing. But in e-commerce it really varies depending on the company the business model the you know AOV all the different things. Um I think that lending is similar because there's so many different types of fraud vectors, right? So many different types of attacks.
Matt Vega
04:58
That's right.
Karisse Hendrick
04:58
Um because and there's some it's a it's a spectrum, too, because they're not all third party fraud attacks. They're not all um you know, fraud that is malicious. Yep. It. Some of it is I mean if if a lender takes a loss, they're going to count it as fraud because the person lied on their application, said they made 300,000 a year when they only made a 100,000 a year or, you know, washed their credit or, you know, all the different things that they can do that technically isn't illegal, but still counts as a loss for the bank because it usually ends up in, you know, default.
Matt Vega
05:38
Yep, that's exactly right. Um, and yeah, you're you're spot on. And not not to mention a huge majority of what we see is more friendly first party fraud, right? Yeah. It's abuse, it's credit washing, all these things that you were describing. Um, so it it's both sides of the spectrum for sure.
Karisse Hendrick
05:54
Can you um explain what credit washing is? You actually do a really good job of it, so I'm going to make you do it.
Matt Vega
06:00
Yeah. No, no, no problem. Um, so there's a couple methods that are used, but the simplest way to describe it is anyone that has a derogatory or some sort of uh, let's just say like a misrepresentation on your real credit report. So, let's just pretend like um, someone flags my uh, my credit report, you know, my, you know, my Experian credit report for a collections, right? But it actually wasn't me. It was my roommate from five years ago that I borrowed an apartment, you know, I shared a room with, whatever. Okay. And like maybe because my my name was tied to the apartment, they're trying the collections agency is trying to tie it to me so that they could collect from me. They will hit a derogatory against my credit. Um what you can do is you can basically dispute that with the credit bureaus. I can go to the credit bureaus and say this was not me. Uh you need to remove this collection off my report and here's why. And uh that process exists for a variety of reasons, including the one that I just described, so that you are not negatively punished for other people's credit activity. If you're a victim of fraud and someone defaults on a loan and it's not you, you want to be able to make sure that you're not your credit score isn't held responsible for something that you're not involved in. Unfortunately, that can be abused. And that's what credit washing is. So credit washing is let's just say I have a 580 credit score because I have multiple collections. I have multiple late payments. I can go into the bureaus in some cases and I can just file disputes on all of it. And say for example this collection wasn't me. Someone stole my identity. I can claim fraud. I can say this isn't true. I can say I have evidence to prove that I actually made those payments on time. And what they will do is a lot of times they will temporarily remove those negative hits off of your credit report pending this investigation, right? Because like let's just say you need a mortgage and like someone stole your identity. Uh like hey, like that's not fair for you to now be like homeless or not be able to buy buy a house because someone stole your identity. So they there's a reason why the these mechanisms exist. So you can you can temporarily remove these credit uh these negative hits derogatories off your report. Then what happens is you go then and apply instead of a 580 I'm now a 790 or an 800 right. So now I'm a super prime from a subprime to a superprime and I can I can get my loan. And then 18 days later all of those derogatories hit back onto my credit report and the lender is sometimes you know none the wiser. So that's what credit washing is.
Karisse Hendrick
08:28
And sometimes I would imagine that the banks don't default on those. Maybe, you know, the person wanted a fresh start and got the fresh start and was able to pay, you know, the the fees and the, you know, repayments back. But a a majority of the time their, you know, their history is is now prologue or their past is now prologue, right? And it's now, you know, it's they're repeating history. Um,
Matt Vega
08:58
You're spot on. Yeah. And that's the part that's so tough is that a lot like that's the part that it's really an art within lending because it's not really just about fraud. It's also about like what is the likelihood that someone's going to default and and fraud is a part of that likelihood, but it's like there's tons of reasons where like someone will credit wash, but like they will pay their loan off. There's tons of reasons why synthetic identities that don't even exist will pay their loans back. So if you're a lender, in some cases, you may still want to fund them, right? And that's where you have to have a lot of network intelligence to say, how has this identity individual performed at other institutions across the United States? Because if you know, hey, even though they've got a 200 credit score, whatever the bottom bottom is, and you're able to call the consortium and say, well, this person's never defaulted, uh, right? Like maybe they had a bunch of collections because they didn't pay their utility bills or whatever it may be. But they never defaulted on their car payments. Like maybe you're you want to actually, you know, you and you can price that out too. So you can issue a higher, you know, basically think of it as applying a high risk tax to the loan to at a higher interest rate to where even if they default at 9 months in. In general, when you combine all of those higher risk loans together, you'll make money still instead of taking a loss on on those individual applications.
Karisse Hendrick
10:24
So we've acknowledged that there's a lot of first-party fraud going on and and misuse and abuse, however we want to term it. I mean, there's a lot of infighting in the industry of like, no, it's a it's first party abuse or first party misuse. It's not first-party fraud, whatever. Anyway, you know, friendly fraud, whatever. But let's talk about some of the malicious fraud, some of the, you know, attack factors that are targeting it. One of the things that you have mentioned to me that really pique my interest is that there's a whole new generation of synthetic IDs out there. So, you know, when I first learned about synthetic IDs, it was, you know, oftentimes taking children's, you know, people under 18's social security number, mixing it with a fake name and building somebody's credit for, you know, sometimes years.
Matt Vega
11:17
Mhm.
Karisse Hendrick
11:17
To then go on almost a bust out where, you know, they then rack up all their credit cards and disappear. And when the bank goes after them, they realize they never that person never existed.
Matt Vega
11:28
Yep.
Karisse Hendrick
11:29
Um it used to be very labor intensive. It used to take a lot of time. Like people would basically tend to their you know fraudsters would tend to their synthetic identities the way that like I don't know people tend to their marijuana plants like you know like it just very like very intense. You know, every every seven days they would, you know, make a little payment or every like it was just very like labor intensive and time intensive. But they could get away with a lot and so it was still worth it to them to do.
Matt Vega
12:02
That's right.
Karisse Hendrick
12:03
So that's what synthetic used to be. What are you seeing now?
Matt Vega
12:08
Yeah, it's a great question. So they still exist. So you still have traditional synthetics exactly the way you described. They're just far less common, but they still are the foundation of the new class of synthetics. And I'll explain what I mean in just a minute.
Karisse Hendrick
12:23
Okay.
Matt Vega
12:24
So, basically, um, a lot of the synthetics, and there's a a wide range of them, but we're going to talk about the ones that are really interesting, obviously, and the really interesting ones are the rapidly created synthetic identities that outperform real identities. Okay? So, what that is is think about creating a net new identity. Um building out a pretty robust credit profile that actually is considered a super prime uh synthetic identity. Which means that if you're using FICO and different types of scores related to creditworthiness, this synthetic identity is actually going to outperform someone's real identity because they're going to have perfect lending history. They're going to have pay everything back. Everything is going to look squeaky clean. Um and basically what we're seeing is we're seeing a couple things. Um, and this is a fairly new trend. There's this really started to scale up. Um, and the the real interesting indicator that we started seeing that it was scaling up is on the dark web when you buy synthetic identities. When you buy an identity that is a really mature, long 10-year identity that someone has been working on, you're looking at serious money to buy that identity. It's not it's not like a dollar identity. You're talking about it can be it could be in the thousands for a really effective long long tailed one that's been working for 10 years. And so when we started seeing rapid price decreases in those longtailed identities, it starts making you think like why are they being devalued by the market. Um the dark market I should say, right? And what was happening is a couple of things. So one, there's new large language models uh that are jailbroken on the dark web that will now that don't require any money. They're totally free. They don't even require logins. And I showed you one for example screen recording. And you can in real time uh use large language models to spin up new net new synthetic identities and it'll help you with identifying the right address and the right date of birth and the right age range. It'll even help you create an image profile of someone with that name. So if you see their face you kind of associate it with someone that's named Sarah, right? It's uh you know like there's characteristics that people have seen throughout their lives of like you know there's like Kevin's and there's the you know there's different facial expressions.
Karisse Hendrick
14:38
Imagine like nationalities with last names too, right? Like somebody has an Italian last name and their blonde hair, blue eyes and you're like
Matt Vega
14:46
That's exactly how they're that's exactly what they look at. No, you're spot on is it looks at um you know like what is the likely genetic makeup of someone based on uh based on you know a family name, right? Based on last. So you can spin up these initial identities, which I showed you literally in seconds, you can have a fully functioning synthetic identity, including new social security numbers. Sometimes they're rotating them. Sometimes they're they're finding uh uh uh social security numbers that are associated with someone that has recently died but is not on the death list yet, uh the death files. So there's someone there there's some good ones in there that we find. Um sometimes they're net new from kids that have no credit history, so it's a net new identity. Um, sometimes it's someone's real social security number and it's mixed like what you described, right, where it's just mixing new data points and then they create new files on it. Um, and then the other thing that they do is you can do these credit repair companies that basically at a high level issue you quote unquote a new uh social security number. Actually, what they're doing is they're really issuing you a synthetic identity as crazy as that sounds. Um, so there's a whole thing on that. But to to get back onto what these super prime identities are doing. So now let's just say you've developed this identity. Um then what they do is there's uh basically two to three ways that they'll start. But uh the most common way that I'm seeing right now is exactly the identities that you described, Karisse, the ones that have spent the last decade building up and you've been monitoring it and you've been putting in little payments and making it real. Those have really strong credit histories now because they're worth a lot of money. Either someone has spent a lot of time and energy on it, right? And it's going to be for a big hit, uh, is what they're going to use it for. What they'll do now is they'll take these new identities and add them to their trade lines. So, they'll add them to the other synthetic identity as an authorized user. And when you add someone as an authorized card holder, for example, on a credit card line, they actually get to capture that good positive payment uh uh credit history. So now you can have an identity that's only 90 days old, but they've got five years of good payment history because they've been a added as authorized users, authorized card holders to that trade line. So they'll start off with a really strong payment history. So now they've got some preliminary history, they're authorized users. Then they'll usually go out and they'll do buy now pay laters. Um, and the buy now pay laters, um, you're going out and you're getting quick rapid payments. Sometimes it's even 30 days, sometimes it's 3 months. It's not always buying buy now and pay in 3 months. They all those companies that offer variety. Um the vast majority of them also now report to the credit bureaus. Um yeah so so you could go to you know the clarinos of the worlds and the affirms and all them. Uh like a firm I believe reports to Experian now and all these other things. Okay. So they'll get these uh they'll buy do these buy now uh pay laters and a lot of times they're even using it with another synthetic identity credit card. Um, and then they will actually pay it back. So, they'll do the buy now, pay later, and you'll do it. Uh, you can even do larger purchases where you're borrowing three or $4,000 because you've got all of those trade lines and you're paying it back in full. And you have multiple running simultaneously because you applied all at the exact same time, which is what they do. So, it doesn't overlap on the credit history. And then you pay it all back. So, now you're only 90 days in. You've got years of good payment history because now you're an authorized user. You have access to a ton of credit, by the way, because you're on a trade line. Let's just say that's a $30,000 credit card that only has a 5% debt to income ratio because you're only using $500 or $100 of the 30,000. So, it's like, oh, wait a minute. This synthetic identity is now trying to buy a $20,000 car, right? And they have access to credit available today that could basically pay off the asset of the car. And and then additionally, we have history of good credit profiling, of good paybacks, all of these things that you would want and it's only been 90 days. And then the other the other thing with lenders that um like comes kind of on the lower level from the dealer side up um is the auto in the auto industry, they're tied to a physical asset. Um so your your risk as a think of it as a financial institution. Your risk as a uh issuing an auto loan and issuing a mortgage is slightly reduced because of the fact that you have a physical asset that you could claw back. So right I can actually like if I if I get issue a loan on a $100,000 Jaguar uh like yes it may be worth 70,000 but like I can re uh repo it, right? Um in a house I can I can I I can foreclose on the house and the bank can basically take back take back the the mortgage and sell it. Right? So so that because they're tying it some of them are going to be there's not all lenders of course. But some lenders are going to be a little bit more aggressive and be willing to take on those risks. And then um so there there you go. So within 90 days you can build a pretty pretty successful super prime synthetic identity that scores up in the high sevens to low eights and the credit FICO FICO ranges. Um that's able to very easily get access to loans. The goal is is that's why um that's why the consortiums are so important because of the fact that in those scenarios, all of the signals that that you'll get, there's only a couple companies that actually can that can do this, but especially on like the synthetic identity side. Um but in general, the vast majority of the preliminary initial signals will still be all low risk. Credit will be low risk, identity documents will be low risk. It's a net new identity. There's a lot of like signals and they there I showed you I can spin up new identity documents. I can spin up new passports, new driver's licenses. All of those are authentic. Um, and so what you look for is you look for how did this person can uh perform on the network. And if like they call Point Predictive for example, we have never seen this person ever. And they're 50 years old and they've never applied for a loan ever and they have a they have an 800 credit score. And we are the largest lending consortium in the world. Now now that is actually the signal. So good good behavior and the lack of risk is actually now a tell that it's a synthetic identity.
Karisse Hendrick
21:00
So that's what I was just going to ask you is if they're looking if the new synthetic identities are looking even better than you know real people and real identities, how do you identify them and stop them from you know getting into your lending portfolio?
Matt Vega
21:18
Yeah, that's a great question.
Karisse Hendrick
21:20
Yeah, I mean it sounds like you kind of partially answered that, but is there anything else that you know can be done to identify them?
Matt Vega
21:27
Yeah, it's a great question. So, um, a couple of things. So, one, the one of the tells is what I just described is the fact that it's a perfect identity. Um, and a lot of times they're new trade lines that have been recently added. That's a big red flag. If a lot of the trade lines on the identity are um are authorized users, right, authorized card holders, right? That's a big red flag, right? Because they're borrowing the trade lines from from another identity. Um the the fact that they have low actual lending, they're tied to low lending applications. So like on our consortium, it's a lot easier for us to see them and detect them. Because of the fact that we have all of those other lenders that say, "Wait a minute, we've never even heard of this person before and they're 50 years old with an 800 credit score. Like, how did they achieve that without ever taking a loan?" Right? Um without ever applying for credit. Um they're using employers and income ratios that don't make sense, right? So, they're claiming they work for this one employer. Well, on our consortium, like the chances of us seeing that employer before is like almost 100%. Uh right. Yeah. Because someone somewhere, even if you're uh a small business owner and you own the business and you have no employees, at some point you've applied for some sort of credit in your life. Even if it's a soft, right? Even if it's even if it's a small at some point someone in the consortium has seen you before, right? It could be a small mom and pop shop that is applying for a store card. It could be a credit union. It could be a large bank. So, because someone has seen you, the consortium will have seen you and that allows us to identify it. And then lastly, um I would say the other big indicator is that you look at past trade lines, which you can't do unless you're on a consortium, but you say, has the network basically um what was the outcome of this person uh and their past borrowing? And if they have active trade lines on their credit report, right? It would be very interesting to say like, hey, did they default on any of these? Right? Or are they tied to these loans? Right? And if you're tied to a completely different identity, which like we can see, those are the easy no-brainer tells that that they're there. Um, without those networks, so and without being able to see it, these identities are getting through all of the traditional synthetic identity controls.
Karisse Hendrick
23:43
Yeah, I'd imagine. And this is an example of where consortium data can really come in handy because
Matt Vega
23:50
Yeah,
Karisse Hendrick
23:51
If it is, you know, fraud, they're not going to stop it. One, and they're creatures of habit. And so, you know, as long as they're applying to a different lender, they're going to think that they can use the same employer they did last time or the same address they did last time or whatever else and nobody's going to catch them. So, I think that's I think that's really interesting and a smart way of doing it.
Matt Vega
24:15
Yeah, that's exactly right is that that's where you have to take especially in modern attack vectors the rapid speed of large language models helping you develop these attack vectors. You have to take a consortium approach or be a part of some sort of network, right? Um and we work with all sorts of different technologies and vendors. It's not just us alone as well and tons of lenders. But you know we're big fans of other technologies and vendors in the space like especially synthetic side. You know the one the more point solutions right especially that that specialized in this are really strong because you know someone is always the first. And honestly you just hope that you're not the first because if you're the first it's really hard to detect you. It's really easy to detect you once when you've done it once if you're a part of a network or a consortium. If you're part of a consortium and someone and you go and you hit, you know, Karisse's Credit Union in San Diego, for example, wherever it may be in Seattle in this case, right? Then and you defraud or it's a or you bust out of a of a loan, the entire United States that's on the consortium is now protected from that synthetic identity ever using it again.
Karisse Hendrick
25:19
So, switching gears a little bit, one of the reasons why I've had you on, you know, so many times is that because of your your past life in the military and in military intelligence, signal intelligence. Um as well as working for, you know, a three letter um agency um in threat intel. You really have your finger on the pulse of what's going on in the dark web. Mhm. And one of the things that you showed me as well beyond the jailbreak or jailbroken um LLM that was, you know, first it gave you like a tutorial on how to do it and then it just did it for you. Um was you were able to go to a different uh service within um the dark web. And select existing credit cards for your made up person that matched the city and the zip code that she lived in which you know online merchants would be very interested in obviously um because it's card fraud and so they're going to get those chargebacks. Um, can you tell me a little bit about what that system is and how it works? Because that's that was scary to me from like a ecom perspective.
Matt Vega
26:37
Yeah. Yeah. Yeah. From a merchant perspective. So, um, the there are now well over probably four or 5,000 marketplaces that I know of, just top of mind, and I'm sure there's way more than that on the dark web that sell basically precleaned um, uh, Fullz, which are basically full identity details. But you can also now buy um, cards by geolocation, region, and zip. And so what I did for this identity that I was showing you that I was building live right with you is I went and said hey the LLM the identity produced for you know Rose Thompson right. Uh they the identity said that this person is going to be in Belleview Washington okay. This particular synthetic and the zip code was 98004 I believe. And so um let's just say that I now need it's a it's a fake identity and I need money to be able to start actually executing on this, make purchases, whatever it may be. Or I want to start I want to start committing fraud with it. I can go onto certain marketplaces, especially on the dark web, very easily for just, you know, a few cents. I can get access and um I can now now actually target specifically the type of car brand that I want, the geolocation I want, the zip code, the billing zip code that I want. It comes with the street address and all those other things. And then the final cherry on top, which just always boggles my mind, is that like name is not a field that's really passed in or verified in any of the payment rails. And so like if I have now this identity that's actually tied to the 98004 zip code and I purchased this cloned card, which is what I did is I purchased a real clone card, but they basically print a new piece of plastic for you with the new name on it. And I So I've got now the name matches my synthetic. The billing zip code matches the identity, everything matches. Unless you're verifying that the card holder matches the exact physical name as the entity that's actually inputting it, right? The identity matches the card. Uh at the name level, it's going to be authorized. And that's what happens is, right, they're doing, you know, even in ABS and you're doing, you know, ZIP, uh CVV, those are really easy to get through. I mean, it's incredibly easy, right? Almost all the cards that I see now that are compromised, the vast majority of them have all the three-digit codes, have CVVS, have, you know, have anything that you need. Um, a lot of them now even have EMV chip um tokens. They have a lot of like interesting decryption. You can reprint now, um, EMV chips, which is kind of cool. Um, so like, you know, pretty pretty slow, pretty easy to do. Um, you can reprogram a lot of those that are really interesting. There's a software now that you can buy. And it's you have to buy a little device that comes with it that allows you to like walk within three or 400 feet of someone and be able to capture their credit card details off EMVs. Uh so it's looking for that. It basically creates a false terminal like you're going to pay. Um and it's just such a powerful signal that it tricks your cards into sending the token sending the signals to say yeah and say it's just starting to starting to ping your system. So um there's all sorts of cool attack vectors that are happening on that side that are really interesting. But yeah, that's basically what I was doing is I can now uh very easily within the dark web, the way that these identities and these cards are being spot and sold now instead of just buying like a batch of like a bunch of compromised cards, I can now say I only want cards that are issued by Visa that have a billing zip code of 98004 that are uh you know don't expire for at least another 18 months for example and that are issued from these financial institutions by the. So, I can also target financial institutions. So, that large language model that I showed you, that that jailbroken large language model, that will tell you it's been trained on all of the dark web exploits that um basically uh that financial institutions have faced, including breaches and including hacks and compromises and and known fraud attack vectors. So, you can ask it what financial institutions have the weakest card controls that don't verify name matching logic, right? Don't have internal one, right? It'll tell me and I can actually go and buy their cards, their compromised cards with issued at that zip code and then I can just get it reprinted with my name and I'm off to the races. And it'll almost guaranteed work.
Karisse Hendrick
30:59
That's crazy. Um, so there's a few things I wanted to touch on from that. So, first of all, when you were saying that, you know, the majority of the cards that you see have positive CVV and positive AS, I wanted you to say that like louder for the merchants in the back. Because I especially merchants that are utilizing their PSP's fraud tool that really only can look at payment method and transaction, not uh upstream or downstream and that behavior or device or anything else. They are locking down ABS and CVV and I keep trying to tell them no. The bad guys have that information. The good guys usually fat finger it or they just moved or you know whatever else. And so it's not you know it does no good it does no good to stop fraud but it does stop a lot of good sales. And so you then end up with high decline rates you know high false positives and high chargebacks. And uh that happens a lot especially like I said with the merchants that are using just a PSP as a fraud tool. Um and not looking at device and behavior and all the other things they should be looking at. Yeah. Um, additionally, the fact that um, I mean, this is something I've mentioned on the podcast I don't even know how many times, but I spent a good 18 months of my life trying to working on a project to try to get uh, merchants to be able to verify card holder name on Visa, Mastercard.
Matt Vega
32:37
Yeah,
Karisse Hendrick
32:37
They can do it on Amx. You know, but there was a whole project with an API between merchants and issuers, you know, where the issuers were going to provide name match. All I had to do is tell, you know, the largest merchants in the world, hey, wouldn't you want card holder name? And they were like, yeah, what do they want? And I would say, well, they'd want to know if they were ever moved from the number one position in your uh in your stored, you know, wallet, right? So, like Amazon, um, if I change it from my Alaska Airlines credit card to my Chase credit card, Alaska Airlines wants to know that they're no longer in the one spot. So, they can then say, "Hey, if you add your airline, you know, your Alaska card to your um,
Matt Vega
33:19
Sure,
Karisse Hendrick
33:20
You know, your cart and put it in the number one spot, we'll give you extra points or whatever, extra miles." Um, and so I worked very hard on that. And then the startup that I was working on it with uh was miraculously and just happened to be purchased by Mastercard and then that project was shelved.
Matt Vega
33:41
Yeah.
Karisse Hendrick
33:41
Um it was just so coincidental how that happened.
Matt Vega
33:46
That's the story of the industry
Karisse Hendrick
33:49
And this was like 2017 so almost 10 years ago when I was begging for this. Um, you know, the rails for Visa, Mastercard are so old that they can't verify anything alpha numeric. It's just numerals only. And so that's why they can't verify name and fraudsters take advantage of it all the damn time,
Matt Vega
34:13
Of course. Well, just like street address, right? This you're not actually verifying the street address. You're verifying the numbers of the street, right? Not the actual street.
Karisse Hendrick
34:20
Yes. Yeah. Yeah. So you can have 1 123 Main Street and 1 2 3 Third Street.
Matt Vega
34:26
It doesn't matter.
Karisse Hendrick
34:27
It'll say yes, it's a match. Well,
Matt Vega
34:29
That's right. It depends.
Karisse Hendrick
34:30
It got delivered two blocks away, not in
Matt Vega
34:33
A lot of them have fuzzy match logic built in, which means as long as it's close enough, it'll still work. And that's another argument. And then so CVV especially, um, what has changed is CVV was like, you know, call it your, you know, there's two ways to fight fraud that, you know, that and you have to use both. One of them is the sledgehammer approach. One of them is the surgeon scalpel, right? Um yeah, more surgical. The sledgehammer though, anyone that says they don't use it is just not correct because when there's a major attack, when you're taking bleeding, you have to bring out the sledgehammer to fight the bigger bigger attacks. Um and using CVV and uh zip and ABS and all these kind of like let's just say traditional friction controls, it will apply friction. You will see drop off. There will well be things that you can do that that you'll see directly. A lot of them are like it's worth it to us because we'll see a 1.3% drop off rate and like our fraud rate was like 1.5. So like we're actually net positive you know it's like not not a big deal. So, so there there's that that you know there is that argument there now. But um about 2 years ago um people this was happening across the industry that some people picked up on some most of them didn't, is when you know that like CVV and some of these other controls are no longer as effective as they used to be, is when a lot of the technology companies start allowing you to store and access CVV. And I'll give you an example like Apple Pay. You can now store when you store your card on Apple Pay, you also store your CVV. And if you click the card icon now, it'll show you your CVV within your Apple Wallet. Um, and before you couldn't get access to CVV. Um, and there are tons of tools. I'm and I'm not calling Apple out at all because I love that product. Um, uh, but there are tons of tools out there that are, um, you'll see now that CVV is no longer like a redacted field. It is now a very easily accessible field and there's a lot of research that just has shown. And if you look at the compromises today um a huge majority of the compromises are coming from somewhere in the chain where where CVV is captured. There's skimmers. They're usually a lot of times like honestly the vast majority of the cards that I've been seeing recently show up are people knowingly giving their card information out but not knowing that it's for fraud, right? So they're like they're kind it's fished Yeah, it's fished out, right? And like send me a picture of your card to verify that, you know, you're actually physically present. So, like you buy a purchase from something, we say, "Hey, you know, we got some, you know, risk signals. We just want to make sure that you physically have possession of the card that you're buying a purchase for. You send me a picture of your card. And I now take that and sell it on the dark web. And I, or I use it to defraud someone else and blah blah blah blah. So, CVV, it still it still works as like a you know, but it definitely shouldn't be your strategy. Uh, it shouldn't be your strategy. It should be it it should that should be the sledgehammer that you pull out in an emergency. But if you're using that as your strategy, you should consider re-evaluating.
Karisse Hendrick
37:36
I couldn't agree more. I couldn't agree more. I uh heard from a merchant the other day that was relying on their PSP fraud tool. And they were declining up to 30% of orders. And this is a retailer with physical goods.
Matt Vega
37:51
Yeah.
Karisse Hendrick
37:52
Like it's a pretty big brand like you know they're pretty well known. And they're not even high-risk. It's not like it's electronics or anything, but they're declining they're personally declining, you know, for reason of fraud 30% of orders. But yet their chargebacks are like, you know, point well they're like, you know, 2% or whatever it is. Like, you know, um, instead of 1.5, it's, you know, 2%. Um, and they're just getting killed because and they're like, "Well, we, you know, we uh declined anything that uh AVS Street and Zip and CVV doesn't match." And I'm like, "Oh my gosh." Well, you're declining a lot of good orders and then the bad guys are just getting through all day long. Because if you think that that's a good enough strategy, it's it's not.
Matt Vega
38:45
No.
Karisse Hendrick
38:46
Um, and one of the things I'm going to be talking about at MFA this next week is, and I guess it's the week that this episode's coming out. Um, is how, you know, we we can't just assume that they, you know, that they don't know things, right? Like they have all they have our playbooks. And you can't just, you know. One of the things I'm going to talk about at MFA is how fraud is moving to the left and the right of the payment transaction, right? We used to only see it at first Sardine, you came on the podcast and you were trying to explain, you know, why Sardine was different. And the analogy you used was it's the difference between taking a still photo of someone robbing your house and having a video play the whole time. Right? If you just have API calls at login, you just have API calls at checkout, you're missing so much of the puzzle of the fraudulent activity and you're missing all of that. And you know, three, four, maybe it was five years ago, like later that couldn't be more true. Where you know, now everyone needs to be able to have that video camera watching the entire time.
Matt Vega
40:03
Yeah.
Karisse Hendrick
40:04
You know, whether it's through the CDN or whatever it's through like the some kind of, you know, tool to be able to help them recognize those things and apply device and behavior biometrics. Because otherwise you're just you're getting, you know, you're missing out. You're you're the person that you're the company that's slower than the bear.
Matt Vega
40:26
Yeah, you're spot on. And you know the other thing is is that what we're seeing is because of the attacks are also becoming far more sophisticated and they continue to adapt and uh be polymorphic and being able to adapt in real time. The best way now I think that like if someone were to say like what is the one thing that I could give you to like be a really effective? And when you're building out a new strategy to to like mitigate for your fraud risk. Is instead of spending time looking and trying to mitigate fraud actually spin it around you should spend more energy mapping what good user behavior is.
Karisse Hendrick
41:03
Yes.
Matt Vega
41:04
Um because if you can map what your entire good user journey is, that that video camera that you're talking about, right? The second that they think about your your platform to the time that they check out. Having an extremely strong analytical understanding of the user journey the mapping the friction points where the step up points are where do good users actually fumble where is the drop off rates all of those things. It's really easy to start seeing when the bad actors are in there. It's really easy to start seeing the anomalies. If you're only focusing on the anomalies, right? On the fraud, right, which could be a small percentage of your traffic. Um, and that's the thing that sometimes as fraud fighters we get caught up in. Because like, oh, it's like a million dollars in fraud this month, right? Well, like that sounds like a lot until you like you realize that you probably did a hundred million in revenue.
Karisse Hendrick
41:51
Yes.
Matt Vega
41:52
Right. And so it's a tiny tiny portion of your actual traffic. Um, right. And so understanding what good user behavior looks like and understanding what being able to map that and being able to like analytically uh identify it will actually make you much stronger on the on the um fraud fighting side. Um and that continues to be more and more true as the emulators are now able to mimic device behavior. Right? So there's all sorts of automation that's happening on the behavior side. So, it's just one thing after the other and that's where like the Sardines of the world are are constantly having to re rebuild their behavioral biometrics to stay one step ahead and continue. It's always the cat and mouse game, right? But we've seen this crazy stuff where like, you know, they they will tape phones, duct tape huge rows of phones to like PVC pipes and then they will roll the PVC pipe back and forth using a remote controlled cars tire. Um, so it looks like someone is like moving their phone instead of flat on a desk. So yeah, all sorts of like clever ways to get through it, you know.
Karisse Hendrick
42:58
Yeah. No, that's that's not
Matt Vega
43:00
Yeah. Isn't that wild.
Karisse Hendrick
43:01
That doesn't surprise, Like the telemetry of the phone. Yeah. And trying to
Matt Vega
43:05
Angle the phone and is it laying flat? All those things like Yeah. They they there was I'll send you a video, but it's basically like Yeah. It's a room and it's got these big huge PVC pipes going down. And uh they literally are duct taping phones on and they're using like a remote control toy children's car. And they're just like and it's just like moving the phone, you know, the whole row is rolling the PVC bike and and it's it's causing enough movement to trick like is the phone actually being physically held by someone in use.
Karisse Hendrick
43:38
Maybe they're going down a bumpy road. You don't know.
Matt Vega
43:40
Or they're just it's in use, right? It's in your, you know this how it's it's a part of a human not laying flat on a desk. Right.
Karisse Hendrick
43:47
Right. Which was one of the signals that that were was being detected. So uh one of the things that I wanted to just circle back on was when you go through the user journey the way that you suggested and you look at what does what do good users do, right? And you map it all out. And you assign data to it all and metrics to it all. Like okay we get a drop off point here we get a, you know those type of things. That's the stuff that CEOs and executives eat up. Growth teams love it. You know customer success loves it. Those are the thing we're constantly as fraud fighters trying to figure out like how do I get them to listen to me? And it's like, that's how. And you know then as you said, you can also then spot the bad users so much easier. And I know when I first started in fraud, it was, well, what are the bad what do bad users look like? Okay, let me, you know, identify them and then only look for that. But you're so right that that was just very. And that worked back in 2006. But it doesn't work now.
Matt Vega
44:56
It even worked in 2017. Yeah. Yeah.
Karisse Hendrick
44:59
Right. Right. It worked for a long time. But the last few years, man, they are catching up. And you know, we always say that our goal as you know, people in fraud prevention isn't to stop all fraud because we know that's just not, you know, realistic, but that it's to slow them down and make them, you know, have to spend more money and time on each type of fraud. And unfortunately AI and all of these other tools available on dark web. And you know the clear web too. Like they're allowing them to do things faster and cheaper and it's making our job harder.
Matt Vega
45:34
It's pretty funny actually if you think about um and like all the vast majority of fraud is our friends, right? We all sometimes cross paths. We all know each other. We all we all like everyone's kind of in a similar circle. We all, you know, somehow we all work together. And all of us have a similar mission and goal. But it's actually funny if you actually take a step back and think about it is like your hope as a fraud fighter, is that you're going to apply enough friction to that the fraudster goes to your buddy's company or your your girlfriend's company down the street and hits them instead. Uh, right. And so, and that's honestly in the industry, right. It's the path of least resistance. So, like you want to be the one that knows how to apply tactical friction to where the fraudsters are like, "This is not worth my time. I'm going to move to the shop down the street." Which also happens to be your friend that's managing fraud. And then they're same game. And it just goes around and around and around and like that's just the the nature of the that's the economy of fraud, right? Uh it's just a friction game at the end of the day at the end of the day. But to your point, if you can validate good customer uh user behavior and journeys, it allows you to make really fine-tune adjustments on friction, and it also allows you to justify friction. Because you can say, for example, I'm going to apply friction and we're going to have a 1.3% checkout dropout rate, you know, drop drop off rate here. But I'm going to reduce friction up here where there's good user behavior that's not catching fraud. And so you can kind of I start playing with that with the entire journey to be more tactical and then that will help sell it substantially better with your executive teams and growth teams.
Karisse Hendrick
47:11
That's why I said to attach data and metrics to it. 100%. Yeah. Back to you talking about, you know, how we're kind of just sending it all back to each other. Um, one of the things that I found to be really useful to counteract that, is I, and you've known this for years. But um, ever since 2020, I've been hosting uh, it was by monthly or bi-weekly, but now it's um, monthly merchant call. And I don't know how many times there will be merchants that are like, "Hey, we're starting to see this." And another merchant go, "Oh, yeah, we had that two months ago. It's this type of card. It's this this this and this is exactly what they're doing. Here's how you stop it." And you know, sometimes it's because the two companies are competitors with each other. You know, maybe they are two retailers that sell the same products. And you know, other times they have nothing to do with each other. I once, there was a ticketing company like a event uh entertainment company like tickets. That was seeing a specific type of fraud. And it was like a very specific type of email um pattern like on the um on the email name.
Matt Vega
48:26
Sure.
Karisse Hendrick
48:27
And they had mentioned one other thing. Like the payment method or something. And then a retailer that sold shoes was seeing the same thing. And I was like oh you need to talk to these guys. And like got them together. And it's kind of the, it's not the quantitative it's the qualitative version of what Point Predictive does, right. You guys do the quantitative version. The data, the automated, the you know, the very like micro, okay this this account has been linked, this name, this address, this email has been linked to lending fraud before. We're going to kick them out. We're doing it on like this 10,000 foot view of like, okay, this is the pattern that we're seeing across lots of different orders, you know, how do we stop them? So, I think that both are critical.
Matt Vega
49:18
Oh, yeah.
Karisse Hendrick
49:19
Um both are important. And um it's I think you and I both have danced around this all day all night. But at the same time it's all about a layered approach, right, everybody says that and it's a buzz word buzzwords. But you need to have different points of tactical friction or information that you're gathering data gathering that you're you know gathering and assessing and analyzing at different points throughout the journey. To be able to identify different part types of fraud.
Matt Vega
49:52
Yep.
Karisse Hendrick
49:52
You can't just rely on one thing.
Matt Vega
49:55
No. And like not only can you not rely on one thing, um, and like again that's where being a part of a network like your merchant network that you were talking about of just connecting via phone calls, right? Be a part of a network, be a part of a consortium, share information and knowledge is like that's the best way to defend against these modern attacks. But the I want to like just last little touch on on something that you said earlier on the podcast. Which is when you're thinking about you know when you're talking about a layered approach, right. It's there is no silver bullet. Which means that you have to build in multiple layers multiple technologies into your tech stack. But think about when you're selecting a technology vendor etc. Always think about like what is their primary goal as a as a company, right? What are they going to spend a lot of their resources doing? And if you're a payments company, right, that offers a fraud product, for example. Are they going to be dedicating their engineering team, product teams, machine learning teams into building out their fraud capabilities and staying ahead of it? Maybe
Karisse Hendrick
50:59
Those tools have to keep getting reiterated. They have to keep you can't just build it once and walk away. We have adversaries. That works in marketing tech, but that doesn't work in fraud tech.
Matt Vega
51:10
100%.
Karisse Hendrick
51:11
You need to keep reiterating and improving and adapting and growing. And you're absolutely right. Payment companies going to be investing in payment authorization and optimization.
Matt Vega
51:21
Yep.
Karisse Hendrick
51:21
And now orchestration is their big buzzword. So now it's, you know, optimization or orchestration, whatever, um, they're working on. You're absolutely right. That's where they're going to be spending their money. I think another thing I'd add too is where is that company in their own life cycle
Matt Vega
51:38
Of course
Karisse Hendrick
51:38
In their own like funding cycle. Where they are, you know and there's benefits and um disadvantages to working with you know companies at all stages, right. Whether it's pre-seed it's A it's C whatever it is.
Matt Vega
51:50
Oh, 100%
Karisse Hendrick
51:52
But that's important to note too if you're working with an earlier stage startup they're more likely to build custom things for you. But you don't know if they're going to be around forever
Matt Vega
52:02
And you don't know if their technologies tried and true. I usually try to when I'm building a tech stack, I usually will do both. I will use core fundamental technologies that were tried and true. They might not be the Ferraris, but they're the Toyota Corollas that always show up, right? Always get you across the line. They're very reliable. They're stable. I'll use those as kind of a foundation layer. And then I will I'm definitely willing to take higher risk vendors that are net new technologies and stress test them and really build out and see see what we can do. And that's why I was like Sardine's first customer, righ, as is new technologies. And uh sometimes that can play out really well. Sometimes it doesn't, but you're not really risking anything with them because a lot of them will just be happy to work with you in many cases. And a lot of times it's free. They just want you a part of a design partnership. If you ever offered to be a part of a design partnership, I tend to tell people to just do it. Um, you'll probably learn something and you don't you're not forced to buy anything. But like a lot of times you can learn as well to learn how the technology is built from behind the closed doors and see under the hood
Karisse Hendrick
53:06
You can have influence on it too.
Matt Vega
53:08
Oh, for sure.
Karisse Hendrick
53:09
Quite a bit of influence.
Matt Vega
53:10
Absolutely. Absolutely. So, it's really critical. So, yeah, when you're selecting a vendor, always look at those key signals of like where are they in their journey? Where are they going to be investing resources and time, right? And by the way, there I'm not going to call them out, but there are payment companies that have amazing fraud tech. So they do exist. But they also spend a unreal amount of money on building that technology. And by the way, like 70% of their engineering team is just dedicated to fraud. So like but but just to be very clear that is not the norm. Uh the norm is you have one single product manager and two engineers out of a company of a thousand. And that their job is fraud and the rest is is payment orchestration.
Karisse Hendrick
53:54
No, you're right. Yeah. I mean I would say look at the age of the payment
Matt Vega
53:59
That's right. Uh that's right
Karisse Hendrick
54:01
The payment company, the networks.
Matt Vega
54:04
The processors. The payfacs.
Karisse Hendrick
54:05
Yeah. The newer PSPs have definitely built in fraud and prioritized it. Some better than others and for some situations more than others. Like I wouldn't, there's some merchants I would put on that and there's others that I wouldn't depending on various things. But um but the payment processor the PSPs that have been around for a long time, they will sell it to you hardcore and tell you it's exactly the same as a third party vendor. Because they want those, you know that line item and they want that extra sale
Matt Vega
54:34
Of course
Karisse Hendrick
54:35
But it will be detrimental to your approval rates and your chargeback rates. I can't say that enough.
Matt Vega
54:43
I may, would have to agree. Uh in many many cases. Especially if it's like a third party and they're piping it through. And then you have all
Karisse Hendrick
54:52
Yeah, there's that too. Yeah. Yeah.
Matt Vega
54:54
So yeah, I think that but the there are some new kids on the block that are like, and this is happening in all all ecosystems. So like in the phone space as well. Like um I tell everyone to like check out Cape. The company's called Cape. I have nothing to do with them. I don't know anyone that works there. C-A-P-E. They are a security fraud and privacy first uh telecom basically. Um, basically, uh, it allows you to get a SIM card and use their network and the E SIMs, the IMEI, the IMSI, um, always rotating so you can't be tracked on their network. And it's like they lock down your geolocation so that the networks can't track you. And so like they are building out technology that is like protection first. And there are payment rails that are doing something similar. So it's really nice to see that the this pressure on increasing speed and sophistication of attack vectors is also causing innovation in the market. And that innovation is leading to these types of companies that are really interesting.
Karisse Hendrick
55:58
Huh, that's really cool. Well, not surprising we have blown through an hour. Um, this is what we do and that's after an hour and a half of personally catching up with each other.
Matt Vega
56:09
That's true.
Karisse Hendrick
56:10
Um, I have often joked that Matt is the male version of me. And we just we think so similar. And uh whenever we do catch up, it's really fun. And uh we challenge each other, which I think is really important. Iron sharpens iron, as they say. Um, but I really appreciate you joining me today. I just wanted, I knew that you had learned a lot in your last few months at Point Predictive and I wanted you to share some of it which you totally did. Um I'm going to put a link to your LinkedIn in the show notes so people can connect with you. And you know have, you're always you're always open to conversations I know. So
Matt Vega
56:51
Absolutely. Yeah. Thanks for having me. It's a pleasure as always. And uh yeah feel free to reach out say hi. Anyone wants to dream team together and hang out and talk fraud. Always open.
Karisse Hendrick
57:02
Well, thanks again and I will talk to everyone soon next week.
View full transcript
