51 min
Fraudology
Riesgo de fraude con stablecoins, comercio agéntico y la brecha de responsabilidad en contracargos que nadie ha logrado resolver
51 min
Bienvenido de nuevo a Fraudology.
Esta semana me acompaña Dave G., quien pasó años investigando el lavado de dinero, el fraude electrónico y las estafas antes de pasar al comercio electrónico y, finalmente, directamente al mundo cripto. Dave estuvo en la base del desarrollo de Bitcoin cuando recién salió el white paper, y aporta una perspectiva poco común sobre el riesgo de fraude con stablecoins, como alguien que ha visto cómo una tecnología de pagos evolucionó de ser una curiosidad de nicho a convertirse en la columna vertebral de una conversación real sobre comercio agéntico.
Comenzamos con una historia que marca el tono de toda la conversación. Muestra lo impredecible que siempre ha sido este espacio y lo fácil que es pasar por alto dónde terminan realmente el valor y el riesgo. A partir de ahí, entramos en el meollo de lo que realmente es una stablecoin y por qué la economía unitaria de las stablecoins cambia por completo la conversación sobre el fraude en pagos. Funcionan menos como una nueva moneda y más como una mejora de la infraestructura.
Esa capacidad suena abstracta hasta que la llevas a su conclusión lógica: el comercio electrónico agentivo. Todo el mundo quiere hablar de agentes de IA comprando chaquetas, entradas para conciertos o artículos de colección, esas compras de alta consideración y cargadas de emoción que la gente realmente disfruta hacer. Pero Dave sostiene que el verdadero volumen, y la verdadera exposición al fraude, va a aparecer en las cosas aburridas. Pan, leche y huevos. Las cosas en las que nadie quiere invertir tiempo para descubrir, solo recibirlas. Y cuando esas transacciones valen centavos en lugar de dólares, el fraude en transacciones de bajo importe deja de parecer una simple molestia y empieza a verse como un modelo de negocio escalable para delincuentes dispuestos a llevarse un centavo por vez en lugar de cientos de dólares de una sola vez.
Ese cambio deja al descubierto una brecha de responsabilidad por contracargos que ya tiene víctimas reales. Es un recordatorio de que la adopción del fraude en nuevas tecnologías de pago siempre sigue el mismo patrón: todo lo que se construye, alguien intenta explotarlo antes de que existan las protecciones necesarias.
Lo que escucharás en este episodio:
- Cómo Dave pasó de investigar el lavado de dinero y el fraude electrónico a trabajar directamente en el mundo cripto, y la historia de cómo terminó regalando por accidente alrededor de 1,5 millones de dólares en Bitcoin en conferencias del sector.
- Por qué el riesgo de fraude con stablecoins debe entenderse por separado del historial de fraude de Bitcoin y cómo las stablecoins funcionan más como una mejora de la infraestructura que como una nueva moneda.
- Cómo la economía unitaria de las stablecoins hace que la economía del fraude en micropagos sea viable a una escala que las redes tradicionales de tarjetas y ACH nunca fueron diseñadas para soportar.
- Por qué la conversación sobre comercio electrónico agente lo está enfocando al revés, centrándose en compras de alta consideración como chaquetas y entradas para conciertos en lugar del riesgo de fraude en transacciones de bajo valor que se esconde en compras cotidianas como pan, leche y huevos.
- Un ejemplo real de responsabilidad por contracargos en el que un titular de tarjeta admitió que una IA agente realizó la compra, y aun así el comercio no contaba con pruebas contundentes ni reglas de contracargo para impugnarla.
- Por qué la verificación de identidad basada en dispositivos es una base más débil de lo que la industria considera, y un primer vistazo a un protocolo emergente para verificar identidades de agentes de IA.
- Cómo el intercambio de datos de fraude en un consorcio puede generar un riesgo real, a veces irreversible, de inclusión en listas negras de fraude cuando se asigna una etiqueta a la entidad equivocada.
- Una historia de contracargos por suscripción que involucra a una empresa de antivirus que cobró a sus clientes por un software que no hacía absolutamente nada.
- Por qué toda nueva tecnología de pagos, desde ACH hasta las stablecoins, sigue el mismo patrón: el fraude llega antes que las medidas de protección.
Deberías escuchar este episodio si:
- Trabajas en pagos, gestión de riesgo de fraude o de contracargos y quieres entender en qué punto se cruzan realmente el riesgo de fraude con stablecoins y el comercio agente.
- Son responsables de las relaciones con las redes de tarjetas o de la estrategia de disputas y quieren entender la brecha de responsabilidad por contracargos en las compras iniciadas por agentes.
- Están evaluando estrategias de verificación de identidad y desean una crítica real de la identidad basada en dispositivos como solución a largo plazo.
- Participan en un consorcio contra el fraude y quieren comprender mejor el riesgo y la responsabilidad que conlleva etiquetar datos.
- Están intentando adelantarse a la adopción de fraudes con nuevas tecnologías de pago en lugar de reaccionar solo después de que aparezcan las pérdidas.
- Quieren una conversación sólida y práctica sobre el fraude con criptomonedas y el fraude en pagos que vaya más allá del ciclo de exageración mediática.
Notas del episodio
Las stablecoins son una mejora de la infraestructura, no solo una nueva moneda.
Dave explica por qué el riesgo de fraude con stablecoins debe entenderse por separado del historial de fraude de Bitcoin. Mientras que Bitcoin funciona como una reserva de valor volátil, las stablecoins están vinculadas al dólar y se comportan más como una capa de liquidación, una que hace que la economía unitaria de las stablecoins sea viable a una escala que las redes tradicionales de tarjetas y ACH no pueden igualar.
- Las transacciones con stablecoins pueden liquidarse por una fracción de centavo, en comparación con los costos de intercambio y procesamiento que hoy hacen imposibles los micropagos en las redes de tarjetas.
- Esto habilita una economía de fraude con micropagos que antes no estaba disponible ni para las empresas legítimas ni para los actores malintencionados.
- El riesgo de fraude en la liquidación ACH sigue siendo un factor en las transacciones de mayor importe, ya que los plazos de liquidación de varios días dejan a los comercios expuestos a disputas mucho después de que los fondos se hayan transferido.
El riesgo del comercio agéntico se encuentra en las transacciones que nadie está vigilando
En lugar de centrarse en las compras de comercio electrónico agentico de alto valor, Dave sostiene que la verdadera exposición al fraude está en el fraude de transacciones de bajo importe: esas compras repetitivas y de poca consideración que la gente quiere automatizar por completo.
- Las compras de alta consideración implican descubrimiento y disfrute, lo que limita hasta qué punto los agentes llegarán realmente a reemplazar la toma de decisiones humana.
- Las compras de bajo valor y repetitivas son donde es más probable que el comercio con agentes escale más rápido, y donde las pérdidas por fraude en cada transacción se vuelven demasiado pequeñas para investigarlas de forma individual.
- A gran escala, miles de pequeñas transacciones fraudulentas pueden sumar más pérdidas que un número menor de operaciones de alto valor, mientras generan mucha menos atención.
La responsabilidad por contracargos no cuenta con un marco para las compras iniciadas por agentes
Uno de los ejemplos más concretos de este episodio es un contracargo en el que el titular de la tarjeta admitió que una agente de IA realizó la compra, y aun así el comercio no tenía forma de impugnarlo.
- Actualmente, ninguna red de tarjetas cuenta con normas de contracargos basadas en pruebas contundentes diseñadas para transacciones iniciadas por agentes.
- La responsabilidad sigue recayendo por defecto en el comercio, siguiendo el mismo marco establecido para los pedidos por correo y teléfono hace décadas.
- Sin un marco claro de responsabilidad, es probable que esta brecha se amplíe a medida que crece la adopción del comercio electrónico agente.
Tanto los datos de identidad como los datos de consorcio conllevan consecuencias que aún no se comprenden del todo
La verificación de identidad basada en dispositivos sigue siendo el estándar de la industria, pero Dave señala sus límites y el riesgo real que supone el intercambio de datos de fraude en consorcios cuando una etiqueta se asocia a la persona o entidad equivocada.
- Las señales de los dispositivos son cada vez más fáciles de falsificar o reutilizar por los delincuentes.
- Un protocolo emergente basado en Ethereum busca otorgar a los agentes de IA sus propios identificadores verificables, aunque este ámbito aún se encuentra en una etapa temprana.
- Una sola etiqueta de fraude compartida en un consorcio puede activar un riesgo de lista negra de fraude del consorcio que es casi imposible de revertir, incluso cuando la etiqueta era incorrecta.
Conclusiones clave
- El riesgo de fraude con stablecoins es fundamentalmente diferente del historial de fraude tradicional de Bitcoin, ya que las stablecoins funcionan menos como un activo especulativo y más como una mejora de la infraestructura tecnológica financiera existente.
- La economía unitaria de las stablecoins hace posible procesar transacciones por una fracción de centavo, abriendo la puerta a modelos de fraude mediante micropagos que las redes de tarjetas y los rieles ACH actuales nunca fueron diseñados para manejar.
- El comercio electrónico agéntico suele presentarse en el contexto de compras de alta consideración, como chaquetas o entradas para conciertos, pero la verdadera exposición se encuentra en el fraude de transacciones de bajo valor: el pan, la leche y los huevos del comercio cotidiano.
- Ya existen brechas de responsabilidad por contracargos cuando un agente de IA realiza una compra que el titular de la tarjeta posteriormente disputa, y actualmente ninguna red de tarjetas cuenta con reglas de contracargo basadas en evidencia sólida diseñadas para transacciones iniciadas por agentes.
- La verificación de identidad en el comercio agéntico sigue dependiendo en gran medida de las señales del dispositivo, que los delincuentes ya han aprendido a burlar, lo que plantea serias dudas sobre cómo trasladar la confianza del mundo físico a transacciones digitales impulsadas por agentes.
- El intercambio de datos de fraude en consorcios conlleva consecuencias reales. Una sola etiqueta de fraude puede activar el riesgo de inclusión en listas negras de fraude a nivel de consorcio, que persigue a una entidad en todo un ecosistema, a veces de forma permanente y a veces de manera incorrecta.
Conclusión final
Cada nueva tecnología de pago atrae fraudes antes de que existan las medidas de protección, y las stablecoins y el comercio agéntico no son la excepción. Las instituciones que se adelanten al riesgo de fraude con stablecoins no serán las que reaccionen cuando las pérdidas ya aparezcan. Serán las que se pregunten, desde ahora, cómo se verán realmente la identidad, la responsabilidad y las consecuencias en un mundo donde una transacción podría no involucrar a ningún ser humano.
Recursos y enlaces del episodio:
Conecta con Dave G | LinkedIn
Líder sénior de riesgos
Ex agente especial del Departamento del Tesoro de EE. UU.
Conecta con Karisse Hendrick | LinkedIn
Presentadora del pódcast Fraudology
Experta galardonada en ciberfraude
Consultora en prevención de fraude en comercio electrónico
Asesora de startups, conferencista principal y
consultora de empresas Fortune 500
Episode transcript
Karisse Hendrick
00:07
Welcome back to Fraudology. Well, I am still getting used to this YouTube thing. But I have a guest today that I've already spent a little over an hour just really fascinated in everything he has to say and and his work history. So I know you guys are really gonna enjoy this episode. I'm joined by Dave. He is a former special agent at the Department of Treasury. He's worked in e-commerce for several years since then, and now works in the crypto space and we're gonna talk crypto and agentic AI in a way that I don't think you've heard anyone talk about it before from the fraud and risk lens but also just in general. So I'm excited about that. Welcome Dave Dave G. (00:49): Thank you for having me on.
Karisse Hendrick
00:51
Yeah. No, this is this has been fun so far. So I'm excited. Well, everyone who listens to Fraudology or now watches it, they know that I asked the same question to every guest because the answer is always different. How did you get started in the fraud and risk space? Dave G. (01:10): Yeah. So it's back in, you know, two thousand six or so I started with the federal government. Or, Treasury Department. In working money laundering investigations, scams, wire fraud, and a whole bunch of other, you know, things that go along with it. Part of that also was that early on I got involved in cryptocurrency when the Bitcoin white paper came out. And so spent most of my career tangential to crypto and as you mentioned now, you know, working directly in the space. But so, you know, as we talked about, you know, early years, like, I mean, a lot of crypto was primarily illicit finance and a couple of enthusiasts. And, you know, thankfully that's changed a lot over the last, what's it been fifteen plus years, almost twenty years. But you know, it's it's come a long way. But yeah, that's that's kinda how I got wrangled into it. Was just, you know, it was my job coming out of college. And was something that is fascinating to me and has kept my interest. Because of the ways that it just constantly evolves and, you know, there's never a dull moment. And it's constantly keeping up with everything, technology and finance and whatnot. Because if you don't understand those things, you won't be able to understand how to defraud them.
Karisse Hendrick
02:31
Uh-huh Dave G. (02:33): Or using them to commit fraud. And so it's a space of constant learning and I enjoy that.
Karisse Hendrick
02:38
I can very much agree with that. Just in the risk and fraud space, even not even in crypto, but just the constant learning. I think those of us that have made this our career. Have really, we have a strong sense of justice, we have curiosity, you know, for days. We love to learn. Those are all very consistent attributes that we have that we all share. Dave G. (03:06): Yeah, absolutely. I mean the the curiosity I think is the biggest one, right? You just constantly wanna know how does that thing work? And once you understand how that thing works, you know how to break it. And then that's our job is to protect against people breaking it.
Karisse Hendrick
03:22
Yeah, we have to think like them first, right? Dave G. (03:25): Yeah, yeah, exactly.
Karisse Hendrick
03:27
So, you know, you had told me a fun story about when you were in, you know, at the Department of, the Treasury. I don't know why I was gonna say justice. At the Department of Treasury. You, it was really, you worked there before the the Bitcoin paper came out, right? And there were, you know, there were kind of crypto, but it was all over the place. Not centralized. Not based on math. And then when crypto, you know, when the Bitcoin paper came out, part of your job was to educate other people within the government about Bitcoin and what it was, right? Dave G. (04:04): Yeah. Yeah, I mean, so yeah. I was on the speaking circuit a lot. Educating you know, private industry, the government and whatnot at a variety of areas. I helped write some of the legislation and regulation around it. And yeah, kind of the like story that we were talking about was so I used to be on the speaking circuit and I would start my talks with: Does anybody know what a bitcoin is? Right? A handful of people that would raise their hand in the audience. And I had bought these minted bitcoins. You can still find them on eBay. They're pretty pricey. But on the back of it it had a piece of folded up paper that had the private key. 'Cause this was days before seed phrases and everything else. And so it had the private key on there. It like laminated onto it. And I would take these and I would flick them out to the audience. And, you know, at that time they were worth you know, twenty to you know, fifty dollars. It wasn't, you know, that much. But you know, at the height of it, I've calculated out that like at $125,000 valuation, I've given away or lost the private keys to about $1.5 million worth of Bitcoin.
Karisse Hendrick
05:20
Ouch. Dave G. (05:21): Yeah, yeah. It's yeah, I'd probably I'd probably wouldn't be saying I work in crypto, I'd probably be saying I'm retired from all of it. If I had been a little bit more diligent about that. But my government position prevented me from, you know, really having much crypto. And I mean I remember talking to a buddy of mine who, you know, I told him like, Hey man, I I need to buy like five more Bitcoin from you. And he's like, I'm gonna have to charge you twenty five bucks each 'cause like these are hard to come by, 'cause there were no exchanges.
Karisse Hendrick
05:50
Right, and to mine them. Dave G. (05:55): Yeah. You either minted you you know, mined it yourself, right? Or you went on like local bitcoins and found somebody who was willing to sell it to you. But there was no real like efficient market for it. And so yeah, it was kinda, you know, wild back in the day. But yeah, I never really held too much of it, but apparently I've given away quite a bit.
Karisse Hendrick
06:18
Yeah, I and I would imagine that most of the people that you gave it away to, probably threw it away or put it somewhere. I mean, you know, they didn't think it was gonna be worth anything. Dave G. (06:28): Yeah. No I've talked to several of them years later. And ended up working with one of them. And I asked him like, you know, Hey, you remember that Bitcoin that I tossed you? And he's like, yeah, yeah, yeah. I was like, You still have it? He's like, No, I probably stuck that in a drawer and it got thrown out in the trash, so. I don't know. Maybe it makes me feel a little bit better that those people don't have the money too. I don't know.
Karisse Hendrick
06:51
That's true, yeah, yeah. It would be worse if he's like, Yeah, and I've been able to buy a boat and a house and whatever else. Dave G. (06:58): Yeah, yeah, yeah. Sorry, I'm not giving it back.
Karisse Hendrick
07:00
I know, I know, but I tell you I I definitely kicked myself. Because when I learned about Bitcoin, it was, you know, from the fraud perspective. That's what, you know, fraudsters were using on the dark web and you know, for money laundering and and scams and, you know, purchasing foals and everything else. And so you know, somebody asked me if I would ever buy it. And I was like, no, that's for fraudsters. That's not for us. Like that's not and it's never gonna be legitimate, was kind of my thought. I take that back now. But, you know, at the time we only knew what we knew. And we didn't have, you know, there were a couple of, you know, exchanges that popped up over, you know, early on. But they were, they had a lot of fraud and risk problems too. And so, you know, you just didn't think it was legit. Dave G. (07:58): Yeah. I I mean and I tried to dispel a lot of that early on too as I gave these trainings to the government and private industry and whatnot. 'Cause one of the things, you know, I'd mentioned is that like, well, you know. Hey look, when the radio came out, people would go and commit fraud with the radio by trying to sell you stink oil. And stuff like that.
Karisse Hendrick
08:18
Yeah. Dave G. (08:19): And when TV came out. And when every subsequent technology we get. Some of the earliest adopters are the people who are trying to exploit it before the controls are in place. Which is, you know, what we're putting in place. But we're not always ahead of the technology. We're often behind the technology. And so every subsequent technology that, you know, comes out often has a group of probably people if they applied themselves would do a lot of good to society,
Karisse Hendrick
08:49
They could cure cancer and solve world peace at the same time. Dave G. (08:53): Right, exactly. But instead, you know, they're going and figuring out how to get rich quick by using this new technology to defraud. That's unfortunate. But at the same time, like
Karisse Hendrick
09:05
Keeps us employed. Dave G. (09:07): Yeah, it keeps yeah, keeps us employed and everything else. But it's it's not anything unique to anything. I mean the dollar bill was counterfeited and still is, right?
Karisse Hendrick
09:17
Mm-hmm. Mm-hmm. Dave G. (09:18): At some point metal coinage was counterfeited, right? Like like any technology, and depending on how you want to define it, is going to have somebody who's gonna try to exploit it. And you know, I mean you know, as we talked about, like agentic commerce.
Karisse Hendrick
09:35
Mm-hmm. Dave G. (09:36): We're going to get into the era of agentic commerce. And we're going to get into the era of some argue we're already there, into agentic fraud.
Karisse Hendrick
09:45
Uh-huh. Dave G. (09:47): And, you know, I think it is prudent for us to start thinking about those things and what we're going to do about them before this industry truly does take off. And I I don't think it's a question whether it will take off. I think it will and, you know, we should be ready for it or be ready to suffer the consequences if we're not.
Karisse Hendrick
10:06
Yeah, and I think there's, it's become the buzzword in the fraud and risk industry over the last year, you know, agentic commerce. And there's been a lot of pontificating and a lot of theorizing about what it's gonna look like. and there are people out there that are using, you know, Chat GPT or Anthropic or whichever whatever they're using to do research for shopping. And in some cases do the buying. But how do you see, I mean, so what I kind of had a light bulb moment when we were just talking off air. When you really aligned crypto and stable coins with agentic commerce. I hadn't ever thought of the two being going hand in hand in the way that you explained. So first I'd love for you to explain like what a stable coin is, you know. And how that discovery, or creation, is kind of opening up the doors for change in the ecosystem. Dave G. (11:22): Yeah, sure. So use it as kind of a story to, you know, vehicle to tell it. Like a a friend of mine had actually asked me about a year and a half ago, why don't you work in crypto? And and my answer was is like, well, I've never really seen Bitcoin and most of the other, you know, tokens that exist as an actual form of currency, right? They're volatile and whatnot. Great store of wealth, right? Great speculation vehicle, great for a lot of things. Things we're still not even using, like asset tagging and everything else. But they're not really great for something like a fiat currency. Or the equivalent of like a fiat currency, because people want stability. They, they don't want the large fluctuations. But with stable coins, which are pegged to the US dollar or basket of funds or what have you, right? And more or less maintain that, you know, one to one pegging. You now have less of a new currency and more of an upgrade to the financial technology stack. Now that you have that and you have the ability to you know, one of the things when I was at Google, one of the things we constantly talked about was like how do we do a one rupee payment? When it costs more than one rupee to process said payment.
Karisse Hendrick
12:46
Mm-hmm. Mm-hmm. Dave G. (12:47): Right? The unit economics don't work out. But with stable coins, the unit economics can work out. It costs less than a penny to process a transaction. And so now those one cent transactions can drive commerce that historically has either been underserved. You know, you gotta you can do these one cent transactions, but we won't pay you out until you earn a hundred dollars, right? The the you know, GitHub forks and stuff, you know, commits and paying you 15. Right? Or it's just ignored, right? I mean, you take the again, you know, the the get commits and everything else, and a lot of times all that work is just done for free under the you header of open source, right? But now, you can literally pay somebody fifteen cents via some smart contract. And be able to process it for, you know, a tenth of a penny. And get that person their fifteen cents. I mean, you probably still would want to batch things and whatnot. But point being is that like, in my mind, and a lot of people that I talk to, like agentic commerce really is bread, milk, and eggs. It's not about, you know, buying a jacket or something like that. And and a lot of times we forget that like, the retail therapy. Or the act of discovery. Or what I call agentic discovery. Often is as important or more important than the end state of the thing. Shopping for those shoes. Take collectibles, right?
Karisse Hendrick
14:18
Yeah. Dave G. (14:19): If all you wanted was a collectible, you would just go buy whatever common collectible was available, right? But people will spend hours and days and go on trips,
Karisse Hendrick
14:26
The thrill of the hunt. Dave G. (14:27): Yes, to you know, go find that one rare thing that they really want. And it's not about necessarily acquiring it. It's about the journey to get there. There's entire YouTube channels that are built off of just finding the thing. And once they get it, they kinda don't really care about it anymore. Right? And so you know, a lot of that, you know, goes towards the like what in my mind agentic commerce really is is the bread, milk and eggs. Nobody I mean, I'm sure there's some super egg enthusiasts who are like, my gosh, you know, let me go research, figure out what egg I want to buy. But I think for the vast majority of people, they're out of eggs. They want their agent to go buy eggs and have them delivered to the house. They're not there's no discovery aspect of what they really want. And it's not to say that like agentic commerce isn't in larger style things. I've heard arguments for, you know, hey, I want Taylor Swift tickets in section, you know, one thirty five. And I want them to be below three hundred dollars. You know, on this date. And if all of those parameters line up, you know, go ahead and execute the transaction. But at the end of the day, those things already exist. You don't really need an agent to do that. Like
Karisse Hendrick
15:46
Yeah, there's bots and scripts that do those things already. Dave G. (15:50): Right. And so maybe the agent helps you write the script a little bit easier. You know, allows for some of those things. But I mean you had mentioned too, like what happens when you buy the ticket from a scams we a scammy website. Right? Like there's so many other parameters that are going in. And the thing with bread milk and eggs is that like you kind of get you kind of get away from some of those scenarios. If you if you go and you buy eggs from a scammy website, well, okay, maybe it costs you I don't know, eggs are kind of expensive these days. But, you know,
Karisse Hendrick
16:23
Depends on the quality of the eggs and your location. But yeah, you know, five, ten bucks max, right? Dave G. (16:28): Right. And so you're out five, ten bucks. Or you know, you do something like pay dot sh, which allows you to set up payments for things like API calls, right? And you're paying one cent to like get the weather forecast for today, right? Sure, there could be fraud with those things, but a lot of people will probably just ignore it, right? It's one cent. And I, but that's something that you know we as a fraud industry need to be aware of too. Like, do we go into this whole like Superman three environment? Where our, the bad actors are no longer trying to maximize their output on a single account. They might be trying to minimize it now and just pull off one cent a day where nobody ever actually notices. You know? And those are things we need to think about. Because you're also not going to dispute a one cent transaction. It's not worth your time to do so. You know, and a merchant.
Karisse Hendrick
17:21
Right. No. Dave G. (17:21): And a merchant, they're probably not gonna dispute a chargeback if it does come in for a five dollar carton of eggs. And so I think that's really where we need to be thinking about. Is less so about the the jackets and stuff like that that people really do wanna be involved in because they're hyper personal to them. And we need to start thinking about the bread, milk and eggs scenarios where it also the economics might be viable that everybody just writes those things off and that becomes again an exploit that people will take advantage of.
Karisse Hendrick
17:59
Mm-hmm. Sorry, I heard you say eggs plete and I was laughing in my head. Dave G. (18:05): Yes. Yeah, so you get dinner and a show, you know.
Karisse Hendrick
18:07
I know you were trying. I blame it on my husband. He's extremely punny. And I was like, that was kind of funny. But exploit, yes, I know what you said. I just, if you if you caught my facial expression laughing a little bit. It wasn't a, it wasn't at the you know, at the meat of what you were saying. I absolutely agreed with that. But yeah, I think I think you're absolutely right. I hadn't put you know, two and two together with stable coins and you know agentic AI. So many people are using currently the examples of those high ticket items. Whether it's travel, whether it's you know a yeah a a jacket, shoes, a collectible, whatever it is. That is the use case that people are talking about. And you poked good holes in that. Like it doesn't make sense. A lot of times it's the thrill of the hunt or the thrill of the deal. You know, I, you know, track down this, you know, site where I was able to get it for you know, whatever percent off or whatever it is. it's not as good as you know, but but the things in your life that don't give you that joy. The things in your life that you just want to have. Another example you had made when we were talking earlier was you know, maybe you don't want to pay $120 a year to subscribe to the New York Times, but you're willing to spend like 15 cents to read the article, right? I thought that was a good example too. Dave G. (19:43): Yeah. Yeah. I I mean that was, that that one is something that one of my old VPs had. Wasn't my original original idea. It was one of the things that he really wanted to push back at Google. And being able to, you know, push into this internet that was more free of ads. And more, you know, you could, you know, pay the creators or wherever you wanted to, right? And some of these things have spun out of that concept, right? The the you know, the buttons like tip jar buttons and stuff like that.
Karisse Hendrick
20:19
Yeah. Going live on yeah. Dave G. (20:20): Whole industries and like Patreon. Right. But like the Google at one point I don't think it ever got out of beta, but one of the things that they had was a thing called contributor. Which there's another Google product called Contributor Two that gets confused with. But it gave you the ability to put, you know, a certain dollar amount into your wallet, right? And you could say like I wanna spend up to ten dollars this month removing ads. Right. And so what it would be is like if that website had like Google ads on it or something like that, you could literally pay, you know, three cents to the owner of the website. And they normally would have got say one cent, you know, for the ad. So they made more money, right, by you, you know, volunteering to pay to not have the ads cluttered on the page. But again, unit economics, right? It just it wasn't really truly paying out that three cents right then and there. It was again something that was ledgers and everything else that eventually settled and whatnot. And I think that's like one of the things that, you know, will be fascinating with stable coins is that, you know, you you take like ACH, right? Like ACH has typically a multi-day window in order to settle.
Karisse Hendrick
21:38
Mm-hmm. Dave G. (21:39): Right. And, you know, look, banks love it 'cause they get float, you know, on the over the repo and everything else, right? You know, but if you truly do need those funds to settle instantly, you know. You now have capabilities, yes, we have like Fed Now and you know, stuff like that that are, you know, doing those more instantaneous settlements. But it also doesn't have to just be for large dollar transactions, right? You can make things a lot more instantaneous with the settlement. You you also have nonreversible settlements, right?
Karisse Hendrick
22:12
I was gonna mention that. Dave G. (22:15): So you have and so you have, you know, something where you probably want to establish a higher level of trust between the merchant and the customer. Because these thing you know, like a lot of people don't realize is that like they put the you know, the onus on the merchant of like, you know. Well I should be able to charge back like if it's bad. But a lot of people lose sight of the merchant view of like, well I can't charge back that phone I just shipped you. Right? So if you go and defraud me, this really only exists on one side. Like sure digital goods are slightly different, right? But but the reality is,
Karisse Hendrick
22:50
Yeah. Depends on if they've been, you know, spent or not. Dave G. (22:52): Right, if they can be consumed instantly and whatnot. You know, and so like that non reversibility function. You know, adds some I think value, you know, to some of these transactions. So that you can, a merchant can proceed with a transaction without having to be worried that the consumer is intentionally gonna do some first party fraud against them.
Karisse Hendrick
23:16
Hmm. Because it's irreversible. Dave G. (23:20): It's it's irreversible. And they, you know, you you now have to look at, you know, different schemes in order to actually, you know, do those reversals. Cause I'm not saying that every merchant is good and the merchants aren't scamming people. I've certainly dealt with my fair share and I'm sure you have as well.
Karisse Hendrick
23:34
Yeah. Dave G. (23:35): You know, and so like, you know, you do need some protection measures in there. But you know, on the whole I do think being able to close some of the exploits that do exist. That we see people taking advantage of these days with settlement times or, you know, reversibility with no real recourse. Right, I'll pick on, you know, ACH a little bit here. Like there's not a lot you can do within that sixty day window.
Karisse Hendrick
24:05
Right. Dave G. (24:06): If somebody says, I didn't do this, I didn’t authorize this. You don't have a lot of options other than to litigate. And, you know, we talk about charge offs that, you know, below ten dollars for your eggs or whatever. Charge offs and litigation are in the thousands. You know, so and and maybe higher depending on, you know, what company, you know, you're at. So I I do think that, you know, stable coins, yeah, I mean, are are a big upgrade to the financial technology stack. And they will enable, they will enable a lot of these like nano transactions at the one cent scale. That we just have never truly had the infrastructure to do in the past.
Karisse Hendrick
25:04
One part, one reason for that is that currently the infrastructure is credit cards, right? I mean, primarily in the US. Obviously, there are other payment methods and mechanisms in other countries. But primarily in the US it's credit cards. And those processing fees add up. And that's why you wouldn't be able to have a one rupee transaction. Because you had to pay the interchange and the discount to your acquirer, as well as you would have to, you know, the let you, like you said. You'd have to, you know, pay the accountant to keep track of it. And all the other things that you'd have to do for, you know, to track the money. And so that's a big reason why you can't have microtransactions in the current system. Dave G. (25:58): Yeah. And I think that's you know, that's where the trade offs come in, right? You you have those microtransactions that are essentially non reversible, right? But you're okay to walk away if there is fraud, right? It wasn't so voluminous or costly to you that, you know, you do want to put in the effort to try to right the wrong. Or whatever you want to call it. Or you know, defending, you know, the credit cards a little bit. You know, like they do offer arbitration services and disputes and representment and everything else. And that's the, you know, if I if I get defrauded for a dollar, yeah, like I'm I'm not gonna deal with that, right? But like if I get defrauded for a hundred dollars, like, yeah, I'm gonna I like I want somebody that I can go to. To go and back up, you know, me provide evidence to show and be able to pull that money back and give me my money back. Like I don't want a zero trust system at, you know, that level. Where at, you know, again, if I'm making an API call and I get the weather. And it tells me the weather that is rainy and, you know, 14 degrees. And I look outside and it's sunny and 65, well I probably won't call that service anymore. But I probably am not gonna worry about disputing my one cent. But again, as as a fraud ecosystem, we need to be prepared for that. Because if you go and you you get a million people to call that API. And then maybe some of those people don't even bother to check whether the weather is actually, you know, matching up their return. And they're just returning garbage. Right? You're gonna be able to make a lot of money with essentially scamming people. I I don't remember, and I also wouldn't call out who it was. But I distinctly remember there was a case where there was an antivirus software company that literally all it was doing was reading your files and showing a nice little like moving image about how it was, you know, scanning for viruses. But the reality is there was no database behind any of it or anything. It was just a little fancy little graphic. And they were charging people whatever, like twenty nine ninety nine or whatever a month. And people were paying it because they didn't actually even understand that it wasn't doing anything.
Karisse Hendrick
28:31
Yeah Dave G. (28:33): And I'm sure they made millions before that report came out.
Karisse Hendrick
28:38
Right. Right. Yeah. And I mean I, I'm sure they also had a high number of chargebacks, right? Because they were a subscription. And so cardholders could charge back the last three months and not just the last one month. And you know, all the other things. But they, not only that, but because of their price point, they probably had a lot of issuers that were declining future transactions. Because a lot of times what ends up happening in that dollar, like in that under fifty dollar range is that the issuer just says, it's not worth it. Like we're we're just gonna eat it and Pay back our cardholder. But if they do that enough times, they say, yeah, we're not gonna authorize any more transactions for that merchant ID. And, or even that full MCC code. If they look at it and they say, all of the, you know, all of the antivirus software is getting high chargebacks and we're having to eat them. So we're just gonna, you know, block that out. So there's always, I think that's another reason why I like this industry, is there's always a cause and effect to everything. Whether it's, you know, what I just explained, or you know, a new business model that has never been tested for fraud before. And the fraudsters are always the early adapters to new business models in addition to new technologies. And so, you know, all of those things are if you do this, then this is gonna happen. And I think it's predictable in a lot of ways. You know, the the longer you've been in this industry the more you can predict. I don't know how many times I've been called well, especially my consulting clients, a fraud psychic. And I'm like, there's nothing psychic about it. I've just know what's gonna happen. Because I've seen it a million times. Like I can tell you exactly. If you do this, this is what's gonna happen. If you do that, that's what's gonna happen. You know, it's just it's, it feels like common sense, you know, when you've been in our industry as long as we have. Dave G. (30:42): Oh yeah. I I mean hey everything old is new again. I mean it's it's all like people are all worried. I remember you know, at one of the conferences people bringing up the like, you know, the the the new trends, the new trends, the new trends. And it's like, they're not new trends. They're the same trends at scale. Right? We were able to use, you know, an LLM to make the cost of this go down and the throughput go up. But it's still at the end of the day a social engineering attack. Or an ACH attack or a stolen card attack. They're the same things just at scale.
Karisse Hendrick
31:23
At scale and utilizing technology so that it it can be less detected as well. Right? Like they can do it, you know, do it faster and do it more. But then they can also you know, be able to use AI to identify your vulnerabilities and your flow. And you know, just bypass the ones that they don't like. So it it enables the different ways, but you're absolutely right. It's the s there's the same core, like five or six different fraud tactics or you know, typologies. That's why I made such a big deal about refund fraud when it started to have, like when we realized it was systematic. And organized. And it wasn't just you know a random person here or there saying, it didn't come. Or it was broken. Or whatever it was. I realized, wow, we just uncovered a new typography, like typology of fraud. Like that's so different than just an offshoot of account takeover. Or an offshoot of, you know, card testing. Or whatever it is. Dave G. (32:41): Yeah. Yeah. And and and I mean the unit economics too, right? I I think back, I think it was in one of the like freakonomics books, right? They they talked about why scammers you know, this is about ten years ago and spoilers but you know, the book's twenty years old or whatever at this point.
Karisse Hendrick
33:01
Yeah. Dave G. (33:03): But scammers, right? You you used to see the emails, right? And it had misspelled words, broken grammar, right? Everything else, right? And the reason for that was that that was very intentional, right? It was done because if the person still responded to it, they were filtering out the people that weren't going they weren't going to hook. Right, but if you responded to that broken grammar misspellings, everything else, there was a better chance that you were going to get hooked, you know, into the scam. But now you look at it, right? Those emails are polished. Right? They look really legitimate. They look really good on their impersonation. Why? Because you don't have to filter anymore. Now you can blast those things out and customize them for extremely cheap. So don't filter your, you know, potential population anymore. You go after everybody and you go after them with, you know, polished, tailored emails to them. And so it's it's again all about that unit economics. It used to cost money to create that email and send that email and everything else, and now it doesn't. A a friend of mine was actually telling me on Telegram he was getting so many scam messages that he actually had to turn to the paid version where people actually have to pay to be able to contact him. And that was the only way to get rid of all of the scam messages because the cost of the scam went up.
Karisse Hendrick
34:40
Mm-hmm. Dave G. (34:41): And so, you know, that that's one thing that we need to be conscious of, you know, going forward is that, you know, the cost here is severely reduced. And so we should expect to see more and more scale. But as you mentioned, like we really have kind of a set of core typologies that don't really change other than that they adapt to the technology to deliver them.
Karisse Hendrick
35:09
Absolutely. Yeah, I think that's you know, part of it. And I think The other piece I was gonna mention is, you know, speaking of at scale, in talking with a couple of leading fraud providers. There's several that have identified that instead of seeing a hundred, you know, a hundred fraud transactions for two hundred dollars a piece, they're seeing thousands of transactions for five dollars a piece. They're already seeing that. And it's a greater loss to the merchants than the higher dollar. And they're getting unnoticed, right? They're they're not being paid attention to because they aren't, they aren't deemed risky because they're so low dollar. So that really backs up what you were saying earlier about, you know, with stable coin and everything else. If agentic AI does go that route where it's, you know, being able to process a penny. Being able to process, you know, 15 cents or whatever that is. We’d absolutely need to be aware of the fact that it's gonna scale and we're no longer gonna say that, you know, the average fraud transaction is five hundred dollars. It's gonna be thousands of five-dollar transactions that are much harder to identify. Dave G. (36:37): Yeah, yeah. I I mean I I think a lot of this is gonna have to come down to, you know, strong authorization and strong identity. Like you you, we we've spent, you know, the last two decades or whatever building out a lot of e-commerce and global transactions and things that, you know, aren't face to face, right? And we've kind of been less concerned about the identity aspect of it. But I think like that's now gonna come to pass where we do need to start actually understanding who we're doing business with from the sense of you know, just am I doing business with a real person who legitimately is wanting to buy this product and legitimately can't afford this product and everything else.
Karisse Hendrick
37:28
Mm-hmm. Dave G. (37:29): Yeah, you don't really have those concerns going to the local grocery store. You're swiping your credit card and you're getting the authorization and you're probably not getting a charge back because the network's gonna be like, what are you talking about? Like you swiped a physical card.
Karisse Hendrick
37:46
Yeah, you y you sweeped it or you tapped it. Yeah. Dave G. (38:48): Right. And so, you know, like I think we need to figure out how to bring that, for lack of a better term, bring that physicality into the digital world. And I think whoever figures that out, you know, has an entire like will be able to really, you know, settle a lot of the open questions that exist in this industry.
Karisse Hendrick
38:08
Do you feel like anyone has answered that question yet? Please, you don't have to say names or anything, but like, you know, you do a good job of knowing who's out there and what they have. Like, have you seen anything recently that you're like. Huh, maybe you've settled that? Or do you think it's still, you know, not settled? Dave G. (38:28): I I certainly don't think it's settled 'cause I don't I don't think we actually know what it means, right? A a lot of the industry has equated identity to devices. Right. And sure, pretty decent. But I mean, then we've just seen people who are fishing the devices out of the, you know, device recycle bin at your local Target or, you know, what have you. Right. And they're just using those to then go be able to scale identities, right? The I'd say the closest thing I've seen to you know, especially on like the agentic front is I'm gonna get the protocol number wrong. I wanna say that it's eight thousand and two, but that doesn't sound right. But Ethereum has put out a protocol to be able to essentially identify agents and you know, who they are, right? And build kind of a centralized database so that you can do things like say, this agent defrauded me or this agent, you know, filed a charge back or, you know, what have you/ So that you do have some type of registration process. But I don't know that we know the full shape of the problem, right? Just knowing who somebody is or who you think they are doesn't necessarily mean that they're not going to commit fraud, right? At the end of the day, like I often know who committed the fraud. Where it really comes down to is like, is there the wherewithal to push consequences to that party? And a lot of times the answer is no. And so the thing is, is that if there's no consequence to the action, the identity is not actually resolving anything. Sure, you can see about blacklisting somebody from the entire ecosystem and not allowing to buy. But that comes with a whole host of problems too. I mean, it's the same thing that why people are reticent to like in a consortium thing really label somebody as fraudulent.
Karisse Hendrick
40:35
Yeah. Dave G. (40:36): Dealt with this with, you know, picks. And, you know, having this, you know, set of consortium data where literally if you labeled somebody as being fraudulent, they potentially lost their access to the banking ecosystem in Brazil.
Karisse Hendrick
40:50
Wow. Dave G. (40:51): And like nobody wants to accidentally do that to somebody. And so, and then I'm sure there's other people out there that are like, whatever, it doesn't matter, you know. Like it's bad on both sides, right?
Karisse Hendrick
41:04
Right. Yeah. And trying to like untangle that web to resolve it is also a major pain and sometimes impossible. It's a bell that can't always be unrung because you don't know who within the consortium marked them as fraud. And you know, all these other things that you can't undo it. So they're just blacklisted from, you know, any website that uses, you know, XYZ vendor. Dave G. (41:33): Right. And what is your definition of fraud? I mean I'll I'll I'll give an allegory of like
Karisse Hendrick
41:38
I'm laughing because I have said that so many times. It varies by company, you know, company to company. Dave G. (41:44): Right. But I mean think about where you go into your email, right? And you get an email that, you know, you've hit unsubscribe four or five times now. They didn't unsubscribe to you, so what do you do? You click Mark as Spam. Well, it's not technically spam.
Karisse Hendrick
41:59
Yeah. No. Dave G. (42:00): Right? And so I always kinda like, you know, like at what line do you you know, at when do you like draw that line of like we've had enough people report it as spam that it actually is spam and we're gonna, you know, do it? And like the reality is is the people's definition of spam can be anything from it's legitimate spam to I don't wanna see this email to I've tried to unsubscribe but they're not respecting my wishes to whatever. And, you know, especially if you have emails that are not mass communications, right? Then you have a smaller population of people who are even receiving it and reporting on it. So now you don't even, you know, potentially don't hit a critical mass or the critical mass number is a lot lower. And so these you know, these are things where yeah, a a very long way of answering your question. No, I don't think anybody has solved it because I don't think we fully know the shape of the problem.
Karisse Hendrick
42:53
Hmm. Yeah, no, I think I think that's a fair answer. Just as you were talking about the unsubscribe you know, the kind of the example of unsubscribing, I I was thinking about the chargeback process as well. Same thing, right? Like it's you know. It you can't, you know, what when someone doesn't want to charge on their credit card. They can say all kinds of things, you know, to get that you know, to get that charge reversed. And almost always it falls on the merchant. And, you know, I was telling you earlier that my big thing is, you know, if agentic commerce is going to be high dollar transactions and if it's going to involve a card brand, because we know that, you know, both major card brands have made some plays in the crypto space recently. Crypto and also agentic AI. You know, right now, there's no additional party for liability of agentic, you know, errors, right? So you can't say, well, this was the error of an agent and chat GPT is responsible for, you know, reimbursing the cardholder. That doesn't exist, nor will it probably ever. So now it's just we'll just, you know push it on to the merchant the way we always have with this framework for mail order telephone orders, you know, from nineteen seventy-six or whatever it was. And then, you know, this you and I both know someone who had received a chargeback. The cardholder in the documentation, you know, acknowledged that they used an agent, acknowledged that they changed their mind. But because there was no recourse, there's no compelling evidence for documented by the card brands for the merchant to say, no, I you know, I have verified that that card holder authorized that agent to make that purchase. Well it's an automatic loss to the merchant. So not only are you getting more chargebacks for things that aren't your fault, but you also can't get your money back in the process as well. And so I think that that's also gotta be a problem that needs to be solved before going too far down the rabbit hole. Dave G. (45:23): I think that's where we need to be very careful about how we intertwine these things, right? Agentic discovery, right? I think on its own stands on its own. I don't need we we kinda talked about this, right? COVID was the best thing to happen to tap and pay on phones.
Karisse Hendrick
45:43
Yeah. Yeah, the technology was there for a while. Dave G. (45:46): Right. But like there's just not enough of a compelling reason for me to take out my phone, select the card I wanna use, put in my PIN number, tap on the terminal. Versus pulling my wallet out of my pocket and pulling out the relevant card and tapping on the terminal. Right? Why why COVID like made all of that go away is because like there was like you can only tap. Right. And so people are like, well just have a phone. I have everything there. I don't have to dig into my pocket with my gloves on and everything else. Right? Tap my phone, I'm done. Right. Same same way. Like agentic discovery, I think, is is a wonderful technology upgrade. You can put in hyper specific parameters. And assuming that I mean there's a whole nother probably podcast topic, but assuming that, you know, the merchants have gotten their inventory set up properly to be read by an MCP and everything else. You can find that needle in a haystack. But really at the end of the day, we already have one click shopping. We have our Google button and our Apple Pay button and our Pay Shop Shopify button and everything else. I don't really need an agent to replace the one step button click for me.
Karisse Hendrick
47:03
It'll probably take longer to give parameters to the agent than just to go to the website and one click pay. Dave G. (47:18.626): Right. Dave G. (47:10): Exactly. And so, like, you know, outside of some of the things we talked about, you know, concert tickets with hyper-specific parameters, trying to get a great deal, and you know, the retail therapy aspect of things. And I think agentic discovery really does stand on its own. And then you have your traditional commerce, which is gonna come from that one click pay button. And some of that can be the traditional rails. Some of that I think will get, you know, taken by some of the stablecoin rails. But I think there'll be, you know, a pretty good balance there of you know, you have your merchant networks and everything else and you have and I think a lot of the material commerce will still be driven by that, most of what we see today. And I think you have a new segment, right? Where we talked about it the the underserved or not served at all. You know, GitHub commit for eight cents. Right. And that's where I I don't think that this is a cannibalistic thing. I think that this is the pie gets bigger thing. Because we're not doing charging for those things today. Nobody's really doing charging for those things today. And that is a thing that we can grow into an area of commerce and like I think we need to be careful to not overly intertwine things when we don't need to, right? We don't need agentic discovery to be paired with agentic commerce. Like we we can have those things be separate and sometimes they will make sense, like the Taylor Swift ticket, you know, in section 185 type of thing for a certain dollar value. But a lot of times we need to make sure that we're not trying to put a square peg in a round hole just because we have the technology to do so.
Karisse Hendrick
48:57
That is an excellent point and a really good spot to end this conversation on, although I have no doubt that we could keep going. I want to be respectful of your time. Is there anything else that you want to share on this topic? I mean, I feel like that's a really like exclamation point. But if there's anything else you wanted to add from, you know, your experience and just from, you know, observing the industry, I'd love to hear it. Dave G. (49:24): No, I think that probably was, you know, my kind of big wrap up takeaway type of thing. I mean, like you said, we could talk about this for hours and hours and hours, and I hope people do. Like, don't get afraid of it. Like, go towards it and understand. I mean, we were talking about, you know, people's complaint was like, all of this seems theoretical. Because it is theoretical. It doesn't exist yet. We need people to push on that and not react to the fraud that occurs. But to also, you know, w what it what did you call it? Like fraud psychic. Right?
Karisse Hendrick
49:59
Yes. Be a fraud psychic. Dave G. (50:01): Like think about where it's going and what we need to be able to do so that we're not at the whims of where things just go. But we're actually building towards the future we want.
Karisse Hendrick
50:12
Hmm, yeah, I like that. You're right. We can't just wait for it to occur and then say, okay, well, where are the holes? Let's plug them. We need to be thinking about where, you know, and I think also advising leadership internally of what is possible. What is possible now versus what may be possible in a couple years. You know, what was possible you know, what what's possible now wasn't even possible six or seven, eight months ago in agentic commerce. Like it is growing that fast. So staying on top of it is also equally important. Dave G. (50:53): Absolutely.
Karisse Hendrick
50:54
Well, Dave, thank you so much. This has been a lot of fun. I'm not surprised that our mutual friend said you need to have Dave on the podcast. And I hope that you'll you know come back again sometime and chat more. You have a lot of great insights and a lot of really good experiences as well at some pretty cool companies. And I will look forward to talking with you again next time. Dave G. (51:21): Yeah, likewise, thank you so much for having me. I really appreciate it. This is a lot of fun.
Karisse Hendrick
51:25
Yeah, same.
View full transcript
