融資詐欺：「完璧な申込者」こそが危険信号

Welcome back to the Fraudology podcast. Well, today I have a fan favorite, uh, one of my favorites as well, Matt Vega. Uh, he's been on the podcast several times, uh, representing I mean, because we've had this podcast for six years, I think you've been here representing at least four different companies that I can count. Um, which is all good stuff because everybody wants you to work for them. Uh, because you're so brilliant and know a lot of things that a lot of people don't. Well, it's true. Um, so now Matt works with Frank McKenna as the chief fraud strategist for Point Predictive. I'm almost jealous because at the same time that Frank hired Matt, he also hired Jen. And uh it's I just I can't I'm sure you guys just have so much fun talking about fraud all the time.

We do. It's either fraud or we're laughing hysterically at something. That's usually the the combination. Yeah. You like all three of us together. It's it's definitely fun fun vibes for sure.

Yes. Yes. So I wanted you on to talk you've learned you've had like a massive crash course. It's not that you didn't already know about synthetics and everything else, but you know, now that you're on the lending side of fintech, right? Like, so maybe first explain what Point Predictive does because I don't think I've ever had Frank do that and it'll give context to what we're going to talk about today.

Yeah, totally. And obviously, thanks for having me on as always. It's uh, you know, all the compliments right back at you. What Point Predictive is is the best way to think of us is we we offer a variety of products. But the core uh the core value prop for Point Predictive is a data a very large data consortium model. Um and it's specifically for lending um we originally started in kind of like let's just say subprime high-risk lending. We have a lot of like auto lenders on the network um but we work with I mean you know hundreds and hundreds and hundreds of credit unions and financial institutions and fintech. Anytime from you personal credit cards to auto loans to I mean anytime that there's some sort of loan application we can sit into the flow. And um basically we are currently the largest lending data consortium model in the world, which is very cool. Little known fact, um specific to lending. Um and so I mean we have billions and billions of data points and basically the argument is is it's like a it's a wheel and hubspoke model, right? Where um we both we basically give out signals and collect signals back from a huge network. So if a let's just say a synthetic identity or a fraudster attacks you know uh Karisse's credit union down the street and you all take a loss from that individual or that identity and you're on our consortium, the entire network learns from that and becomes immune to that attack vector. Right? So we now can track and trace and warn the network that this identity is associated with an early payment default, a bust out, some sort of fraud attack, a synthetic identity. And that allows us to protect all of the lenders on the entire network from that individual defrauding them as well. So it it's basically this you know and we also do of course you know kind kind of traditional neural network modeling. Where we're risk scoring applications and we're doing some pretty sophisticated stuff on on income uh variance. And we're looking at employment variance. Yeah. So like stated income um right. So, that's a big one where people they they apply for one loan and they say they make $100,000 a year, but they only get approved for $8,000 and they needed 30,000. So, they go to the credit union down the street and they claim they make 300,000 a year. Um, and it's really hard to authenticate that because lenders do not want to apply friction through stipulations to verify income. So, but but it because you're a part of our consortium, we can see those deviations in stated income and employment and how are those employers associated with fraud or with synthetic identities and all of these other network signals. So, at a high level, that's what Point Predictive does.

That's great. Yeah, I I always associate it with car lending, but you're absolutely right. I know over the last several years, it's expanded into all lending. And that gives you a really unique viewpoint, right? Because there's so many different I was just writing out this on LinkedIn today about e-commerce. And how you know I think in banking most you can go from one bank to another and guess as long as they have the same products you can know what type of fraud they're seeing. But in e-commerce it really varies depending on the company the business model the you know AOV all the different things. Um I think that lending is similar because there's so many different types of fraud vectors, right? So many different types of attacks.

That's right.

Um because and there's some it's a it's a spectrum, too, because they're not all third party fraud attacks. They're not all um you know, fraud that is malicious. Yep. It. Some of it is I mean if if a lender takes a loss, they're going to count it as fraud because the person lied on their application, said they made 300,000 a year when they only made a 100,000 a year or, you know, washed their credit or, you know, all the different things that they can do that technically isn't illegal, but still counts as a loss for the bank because it usually ends up in, you know, default.

Yep, that's exactly right. Um, and yeah, you're you're spot on. And not not to mention a huge majority of what we see is more friendly first party fraud, right? Yeah. It's abuse, it's credit washing, all these things that you were describing. Um, so it it's both sides of the spectrum for sure.

Can you um explain what credit washing is? You actually do a really good job of it, so I'm going to make you do it.

Yeah. No, no, no problem. Um, so there's a couple methods that are used, but the simplest way to describe it is anyone that has a derogatory or some sort of uh, let's just say like a misrepresentation on your real credit report. So, let's just pretend like um, someone flags my uh, my credit report, you know, my, you know, my Experian credit report for a collections, right? But it actually wasn't me. It was my roommate from five years ago that I borrowed an apartment, you know, I shared a room with, whatever. Okay. And like maybe because my my name was tied to the apartment, they're trying the collections agency is trying to tie it to me so that they could collect from me. They will hit a derogatory against my credit. Um what you can do is you can basically dispute that with the credit bureaus. I can go to the credit bureaus and say this was not me. Uh you need to remove this collection off my report and here's why. And uh that process exists for a variety of reasons, including the one that I just described, so that you are not negatively punished for other people's credit activity. If you're a victim of fraud and someone defaults on a loan and it's not you, you want to be able to make sure that you're not your credit score isn't held responsible for something that you're not involved in. Unfortunately, that can be abused. And that's what credit washing is. So credit washing is let's just say I have a 580 credit score because I have multiple collections. I have multiple late payments. I can go into the bureaus in some cases and I can just file disputes on all of it. And say for example this collection wasn't me. Someone stole my identity. I can claim fraud. I can say this isn't true. I can say I have evidence to prove that I actually made those payments on time. And what they will do is a lot of times they will temporarily remove those negative hits off of your credit report pending this investigation, right? Because like let's just say you need a mortgage and like someone stole your identity. Uh like hey, like that's not fair for you to now be like homeless or not be able to buy buy a house because someone stole your identity. So they there's a reason why the these mechanisms exist. So you can you can temporarily remove these credit uh these negative hits derogatories off your report. Then what happens is you go then and apply instead of a 580 I'm now a 790 or an 800 right. So now I'm a super prime from a subprime to a superprime and I can I can get my loan. And then 18 days later all of those derogatories hit back onto my credit report and the lender is sometimes you know none the wiser. So that's what credit washing is.

And sometimes I would imagine that the banks don't default on those. Maybe, you know, the person wanted a fresh start and got the fresh start and was able to pay, you know, the the fees and the, you know, repayments back. But a a majority of the time their, you know, their history is is now prologue or their past is now prologue, right? And it's now, you know, it's they're repeating history. Um,

You're spot on. Yeah. And that's the part that's so tough is that a lot like that's the part that it's really an art within lending because it's not really just about fraud. It's also about like what is the likelihood that someone's going to default and and fraud is a part of that likelihood, but it's like there's tons of reasons where like someone will credit wash, but like they will pay their loan off. There's tons of reasons why synthetic identities that don't even exist will pay their loans back. So if you're a lender, in some cases, you may still want to fund them, right? And that's where you have to have a lot of network intelligence to say, how has this identity individual performed at other institutions across the United States? Because if you know, hey, even though they've got a 200 credit score, whatever the bottom bottom is, and you're able to call the consortium and say, well, this person's never defaulted, uh, right? Like maybe they had a bunch of collections because they didn't pay their utility bills or whatever it may be. But they never defaulted on their car payments. Like maybe you're you want to actually, you know, you and you can price that out too. So you can issue a higher, you know, basically think of it as applying a high risk tax to the loan to at a higher interest rate to where even if they default at 9 months in. In general, when you combine all of those higher risk loans together, you'll make money still instead of taking a loss on on those individual applications.

So we've acknowledged that there's a lot of first-party fraud going on and and misuse and abuse, however we want to term it. I mean, there's a lot of infighting in the industry of like, no, it's a it's first party abuse or first party misuse. It's not first-party fraud, whatever. Anyway, you know, friendly fraud, whatever. But let's talk about some of the malicious fraud, some of the, you know, attack factors that are targeting it. One of the things that you have mentioned to me that really pique my interest is that there's a whole new generation of synthetic IDs out there. So, you know, when I first learned about synthetic IDs, it was, you know, oftentimes taking children's, you know, people under 18's social security number, mixing it with a fake name and building somebody's credit for, you know, sometimes years.

Mhm.

To then go on almost a bust out where, you know, they then rack up all their credit cards and disappear. And when the bank goes after them, they realize they never that person never existed.

Yep.

Um it used to be very labor intensive. It used to take a lot of time. Like people would basically tend to their you know fraudsters would tend to their synthetic identities the way that like I don't know people tend to their marijuana plants like you know like it just very like very intense. You know, every every seven days they would, you know, make a little payment or every like it was just very like labor intensive and time intensive. But they could get away with a lot and so it was still worth it to them to do.

That's right.

So that's what synthetic used to be. What are you seeing now?

Yeah, it's a great question. So they still exist. So you still have traditional synthetics exactly the way you described. They're just far less common, but they still are the foundation of the new class of synthetics. And I'll explain what I mean in just a minute.

Okay.

So, basically, um, a lot of the synthetics, and there's a a wide range of them, but we're going to talk about the ones that are really interesting, obviously, and the really interesting ones are the rapidly created synthetic identities that outperform real identities. Okay? So, what that is is think about creating a net new identity. Um building out a pretty robust credit profile that actually is considered a super prime uh synthetic identity. Which means that if you're using FICO and different types of scores related to creditworthiness, this synthetic identity is actually going to outperform someone's real identity because they're going to have perfect lending history. They're going to have pay everything back. Everything is going to look squeaky clean. Um and basically what we're seeing is we're seeing a couple things. Um, and this is a fairly new trend. There's this really started to scale up. Um, and the the real interesting indicator that we started seeing that it was scaling up is on the dark web when you buy synthetic identities. When you buy an identity that is a really mature, long 10-year identity that someone has been working on, you're looking at serious money to buy that identity. It's not it's not like a dollar identity. You're talking about it can be it could be in the thousands for a really effective long long tailed one that's been working for 10 years. And so when we started seeing rapid price decreases in those longtailed identities, it starts making you think like why are they being devalued by the market. Um the dark market I should say, right? And what was happening is a couple of things. So one, there's new large language models uh that are jailbroken on the dark web that will now that don't require any money. They're totally free. They don't even require logins. And I showed you one for example screen recording. And you can in real time uh use large language models to spin up new net new synthetic identities and it'll help you with identifying the right address and the right date of birth and the right age range. It'll even help you create an image profile of someone with that name. So if you see their face you kind of associate it with someone that's named Sarah, right? It's uh you know like there's characteristics that people have seen throughout their lives of like you know there's like Kevin's and there's the you know there's different facial expressions.

Imagine like nationalities with last names too, right? Like somebody has an Italian last name and their blonde hair, blue eyes and you're like

That's exactly how they're that's exactly what they look at. No, you're spot on is it looks at um you know like what is the likely genetic makeup of someone based on uh based on you know a family name, right? Based on last. So you can spin up these initial identities, which I showed you literally in seconds, you can have a fully functioning synthetic identity, including new social security numbers. Sometimes they're rotating them. Sometimes they're they're finding uh uh uh social security numbers that are associated with someone that has recently died but is not on the death list yet, uh the death files. So there's someone there there's some good ones in there that we find. Um sometimes they're net new from kids that have no credit history, so it's a net new identity. Um, sometimes it's someone's real social security number and it's mixed like what you described, right, where it's just mixing new data points and then they create new files on it. Um, and then the other thing that they do is you can do these credit repair companies that basically at a high level issue you quote unquote a new uh social security number. Actually, what they're doing is they're really issuing you a synthetic identity as crazy as that sounds. Um, so there's a whole thing on that. But to to get back onto what these super prime identities are doing. So now let's just say you've developed this identity. Um then what they do is there's uh basically two to three ways that they'll start. But uh the most common way that I'm seeing right now is exactly the identities that you described, Karisse, the ones that have spent the last decade building up and you've been monitoring it and you've been putting in little payments and making it real. Those have really strong credit histories now because they're worth a lot of money. Either someone has spent a lot of time and energy on it, right? And it's going to be for a big hit, uh, is what they're going to use it for. What they'll do now is they'll take these new identities and add them to their trade lines. So, they'll add them to the other synthetic identity as an authorized user. And when you add someone as an authorized card holder, for example, on a credit card line, they actually get to capture that good positive payment uh uh credit history. So now you can have an identity that's only 90 days old, but they've got five years of good payment history because they've been a added as authorized users, authorized card holders to that trade line. So they'll start off with a really strong payment history. So now they've got some preliminary history, they're authorized users. Then they'll usually go out and they'll do buy now pay laters. Um, and the buy now pay laters, um, you're going out and you're getting quick rapid payments. Sometimes it's even 30 days, sometimes it's 3 months. It's not always buying buy now and pay in 3 months. They all those companies that offer variety. Um the vast majority of them also now report to the credit bureaus. Um yeah so so you could go to you know the clarinos of the worlds and the affirms and all them. Uh like a firm I believe reports to Experian now and all these other things. Okay. So they'll get these uh they'll buy do these buy now uh pay laters and a lot of times they're even using it with another synthetic identity credit card. Um, and then they will actually pay it back. So, they'll do the buy now, pay later, and you'll do it. Uh, you can even do larger purchases where you're borrowing three or $4,000 because you've got all of those trade lines and you're paying it back in full. And you have multiple running simultaneously because you applied all at the exact same time, which is what they do. So, it doesn't overlap on the credit history. And then you pay it all back. So, now you're only 90 days in. You've got years of good payment history because now you're an authorized user. You have access to a ton of credit, by the way, because you're on a trade line. Let's just say that's a $30,000 credit card that only has a 5% debt to income ratio because you're only using $500 or $100 of the 30,000. So, it's like, oh, wait a minute. This synthetic identity is now trying to buy a $20,000 car, right? And they have access to credit available today that could basically pay off the asset of the car. And and then additionally, we have history of good credit profiling, of good paybacks, all of these things that you would want and it's only been 90 days. And then the other the other thing with lenders that um like comes kind of on the lower level from the dealer side up um is the auto in the auto industry, they're tied to a physical asset. Um so your your risk as a think of it as a financial institution. Your risk as a uh issuing an auto loan and issuing a mortgage is slightly reduced because of the fact that you have a physical asset that you could claw back. So right I can actually like if I if I get issue a loan on a $100,000 Jaguar uh like yes it may be worth 70,000 but like I can re uh repo it, right? Um in a house I can I can I I can foreclose on the house and the bank can basically take back take back the the mortgage and sell it. Right? So so that because they're tying it some of them are going to be there's not all lenders of course. But some lenders are going to be a little bit more aggressive and be willing to take on those risks. And then um so there there you go. So within 90 days you can build a pretty pretty successful super prime synthetic identity that scores up in the high sevens to low eights and the credit FICO FICO ranges. Um that's able to very easily get access to loans. The goal is is that's why um that's why the consortiums are so important because of the fact that in those scenarios, all of the signals that that you'll get, there's only a couple companies that actually can that can do this, but especially on like the synthetic identity side. Um but in general, the vast majority of the preliminary initial signals will still be all low risk. Credit will be low risk, identity documents will be low risk. It's a net new identity. There's a lot of like signals and they there I showed you I can spin up new identity documents. I can spin up new passports, new driver's licenses. All of those are authentic. Um, and so what you look for is you look for how did this person can uh perform on the network. And if like they call Point Predictive for example, we have never seen this person ever. And they're 50 years old and they've never applied for a loan ever and they have a they have an 800 credit score. And we are the largest lending consortium in the world. Now now that is actually the signal. So good good behavior and the lack of risk is actually now a tell that it's a synthetic identity.

So that's what I was just going to ask you is if they're looking if the new synthetic identities are looking even better than you know real people and real identities, how do you identify them and stop them from you know getting into your lending portfolio?

Yeah, that's a great question.

Yeah, I mean it sounds like you kind of partially answered that, but is there anything else that you know can be done to identify them?

Yeah, it's a great question. So, um, a couple of things. So, one, the one of the tells is what I just described is the fact that it's a perfect identity. Um, and a lot of times they're new trade lines that have been recently added. That's a big red flag. If a lot of the trade lines on the identity are um are authorized users, right, authorized card holders, right? That's a big red flag, right? Because they're borrowing the trade lines from from another identity. Um the the fact that they have low actual lending, they're tied to low lending applications. So like on our consortium, it's a lot easier for us to see them and detect them. Because of the fact that we have all of those other lenders that say, "Wait a minute, we've never even heard of this person before and they're 50 years old with an 800 credit score. Like, how did they achieve that without ever taking a loan?" Right? Um without ever applying for credit. Um they're using employers and income ratios that don't make sense, right? So, they're claiming they work for this one employer. Well, on our consortium, like the chances of us seeing that employer before is like almost 100%. Uh right. Yeah. Because someone somewhere, even if you're uh a small business owner and you own the business and you have no employees, at some point you've applied for some sort of credit in your life. Even if it's a soft, right? Even if it's even if it's a small at some point someone in the consortium has seen you before, right? It could be a small mom and pop shop that is applying for a store card. It could be a credit union. It could be a large bank. So, because someone has seen you, the consortium will have seen you and that allows us to identify it. And then lastly, um I would say the other big indicator is that you look at past trade lines, which you can't do unless you're on a consortium, but you say, has the network basically um what was the outcome of this person uh and their past borrowing? And if they have active trade lines on their credit report, right? It would be very interesting to say like, hey, did they default on any of these? Right? Or are they tied to these loans? Right? And if you're tied to a completely different identity, which like we can see, those are the easy no-brainer tells that that they're there. Um, without those networks, so and without being able to see it, these identities are getting through all of the traditional synthetic identity controls.

Yeah, I'd imagine. And this is an example of where consortium data can really come in handy because

Yeah,

If it is, you know, fraud, they're not going to stop it. One, and they're creatures of habit. And so, you know, as long as they're applying to a different lender, they're going to think that they can use the same employer they did last time or the same address they did last time or whatever else and nobody's going to catch them. So, I think that's I think that's really interesting and a smart way of doing it.

Yeah, that's exactly right is that that's where you have to take especially in modern attack vectors the rapid speed of large language models helping you develop these attack vectors. You have to take a consortium approach or be a part of some sort of network, right? Um and we work with all sorts of different technologies and vendors. It's not just us alone as well and tons of lenders. But you know we're big fans of other technologies and vendors in the space like especially synthetic side. You know the one the more point solutions right especially that that specialized in this are really strong because you know someone is always the first. And honestly you just hope that you're not the first because if you're the first it's really hard to detect you. It's really easy to detect you once when you've done it once if you're a part of a network or a consortium. If you're part of a consortium and someone and you go and you hit, you know, Karisse's Credit Union in San Diego, for example, wherever it may be in Seattle in this case, right? Then and you defraud or it's a or you bust out of a of a loan, the entire United States that's on the consortium is now protected from that synthetic identity ever using it again.

So, switching gears a little bit, one of the reasons why I've had you on, you know, so many times is that because of your your past life in the military and in military intelligence, signal intelligence. Um as well as working for, you know, a three letter um agency um in threat intel. You really have your finger on the pulse of what's going on in the dark web. Mhm. And one of the things that you showed me as well beyond the jailbreak or jailbroken um LLM that was, you know, first it gave you like a tutorial on how to do it and then it just did it for you. Um was you were able to go to a different uh service within um the dark web. And select existing credit cards for your made up person that matched the city and the zip code that she lived in which you know online merchants would be very interested in obviously um because it's card fraud and so they're going to get those chargebacks. Um, can you tell me a little bit about what that system is and how it works? Because that's that was scary to me from like a ecom perspective.

Yeah. Yeah. Yeah. From a merchant perspective. So, um, the there are now well over probably four or 5,000 marketplaces that I know of, just top of mind, and I'm sure there's way more than that on the dark web that sell basically precleaned um, uh, Fullz, which are basically full identity details. But you can also now buy um, cards by geolocation, region, and zip. And so what I did for this identity that I was showing you that I was building live right with you is I went and said hey the LLM the identity produced for you know Rose Thompson right. Uh they the identity said that this person is going to be in Belleview Washington okay. This particular synthetic and the zip code was 98004 I believe. And so um let's just say that I now need it's a it's a fake identity and I need money to be able to start actually executing on this, make purchases, whatever it may be. Or I want to start I want to start committing fraud with it. I can go onto certain marketplaces, especially on the dark web, very easily for just, you know, a few cents. I can get access and um I can now now actually target specifically the type of car brand that I want, the geolocation I want, the zip code, the billing zip code that I want. It comes with the street address and all those other things. And then the final cherry on top, which just always boggles my mind, is that like name is not a field that's really passed in or verified in any of the payment rails. And so like if I have now this identity that's actually tied to the 98004 zip code and I purchased this cloned card, which is what I did is I purchased a real clone card, but they basically print a new piece of plastic for you with the new name on it. And I So I've got now the name matches my synthetic. The billing zip code matches the identity, everything matches. Unless you're verifying that the card holder matches the exact physical name as the entity that's actually inputting it, right? The identity matches the card. Uh at the name level, it's going to be authorized. And that's what happens is, right, they're doing, you know, even in ABS and you're doing, you know, ZIP, uh CVV, those are really easy to get through. I mean, it's incredibly easy, right? Almost all the cards that I see now that are compromised, the vast majority of them have all the three-digit codes, have CVVS, have, you know, have anything that you need. Um, a lot of them now even have EMV chip um tokens. They have a lot of like interesting decryption. You can reprint now, um, EMV chips, which is kind of cool. Um, so like, you know, pretty pretty slow, pretty easy to do. Um, you can reprogram a lot of those that are really interesting. There's a software now that you can buy. And it's you have to buy a little device that comes with it that allows you to like walk within three or 400 feet of someone and be able to capture their credit card details off EMVs. Uh so it's looking for that. It basically creates a false terminal like you're going to pay. Um and it's just such a powerful signal that it tricks your cards into sending the token sending the signals to say yeah and say it's just starting to starting to ping your system. So um there's all sorts of cool attack vectors that are happening on that side that are really interesting. But yeah, that's basically what I was doing is I can now uh very easily within the dark web, the way that these identities and these cards are being spot and sold now instead of just buying like a batch of like a bunch of compromised cards, I can now say I only want cards that are issued by Visa that have a billing zip code of 98004 that are uh you know don't expire for at least another 18 months for example and that are issued from these financial institutions by the. So, I can also target financial institutions. So, that large language model that I showed you, that that jailbroken large language model, that will tell you it's been trained on all of the dark web exploits that um basically uh that financial institutions have faced, including breaches and including hacks and compromises and and known fraud attack vectors. So, you can ask it what financial institutions have the weakest card controls that don't verify name matching logic, right? Don't have internal one, right? It'll tell me and I can actually go and buy their cards, their compromised cards with issued at that zip code and then I can just get it reprinted with my name and I'm off to the races. And it'll almost guaranteed work.

That's crazy. Um, so there's a few things I wanted to touch on from that. So, first of all, when you were saying that, you know, the majority of the cards that you see have positive CVV and positive AS, I wanted you to say that like louder for the merchants in the back. Because I especially merchants that are utilizing their PSP's fraud tool that really only can look at payment method and transaction, not uh upstream or downstream and that behavior or device or anything else. They are locking down ABS and CVV and I keep trying to tell them no. The bad guys have that information. The good guys usually fat finger it or they just moved or you know whatever else. And so it's not you know it does no good it does no good to stop fraud but it does stop a lot of good sales. And so you then end up with high decline rates you know high false positives and high chargebacks. And uh that happens a lot especially like I said with the merchants that are using just a PSP as a fraud tool. Um and not looking at device and behavior and all the other things they should be looking at. Yeah. Um, additionally, the fact that um, I mean, this is something I've mentioned on the podcast I don't even know how many times, but I spent a good 18 months of my life trying to working on a project to try to get uh, merchants to be able to verify card holder name on Visa, Mastercard.

Yeah,

They can do it on Amx. You know, but there was a whole project with an API between merchants and issuers, you know, where the issuers were going to provide name match. All I had to do is tell, you know, the largest merchants in the world, hey, wouldn't you want card holder name? And they were like, yeah, what do they want? And I would say, well, they'd want to know if they were ever moved from the number one position in your uh in your stored, you know, wallet, right? So, like Amazon, um, if I change it from my Alaska Airlines credit card to my Chase credit card, Alaska Airlines wants to know that they're no longer in the one spot. So, they can then say, "Hey, if you add your airline, you know, your Alaska card to your um,

Sure,

You know, your cart and put it in the number one spot, we'll give you extra points or whatever, extra miles." Um, and so I worked very hard on that. And then the startup that I was working on it with uh was miraculously and just happened to be purchased by Mastercard and then that project was shelved.

Yeah.

Um it was just so coincidental how that happened.

That's the story of the industry

And this was like 2017 so almost 10 years ago when I was begging for this. Um, you know, the rails for Visa, Mastercard are so old that they can't verify anything alpha numeric. It's just numerals only. And so that's why they can't verify name and fraudsters take advantage of it all the damn time,

Of course. Well, just like street address, right? This you're not actually verifying the street address. You're verifying the numbers of the street, right? Not the actual street.

Yes. Yeah. Yeah. So you can have 1 123 Main Street and 1 2 3 Third Street.

It doesn't matter.

It'll say yes, it's a match. Well,

That's right. It depends.

It got delivered two blocks away, not in

A lot of them have fuzzy match logic built in, which means as long as it's close enough, it'll still work. And that's another argument. And then so CVV especially, um, what has changed is CVV was like, you know, call it your, you know, there's two ways to fight fraud that, you know, that and you have to use both. One of them is the sledgehammer approach. One of them is the surgeon scalpel, right? Um yeah, more surgical. The sledgehammer though, anyone that says they don't use it is just not correct because when there's a major attack, when you're taking bleeding, you have to bring out the sledgehammer to fight the bigger bigger attacks. Um and using CVV and uh zip and ABS and all these kind of like let's just say traditional friction controls, it will apply friction. You will see drop off. There will well be things that you can do that that you'll see directly. A lot of them are like it's worth it to us because we'll see a 1.3% drop off rate and like our fraud rate was like 1.5. So like we're actually net positive you know it's like not not a big deal. So, so there there's that that you know there is that argument there now. But um about 2 years ago um people this was happening across the industry that some people picked up on some most of them didn't, is when you know that like CVV and some of these other controls are no longer as effective as they used to be, is when a lot of the technology companies start allowing you to store and access CVV. And I'll give you an example like Apple Pay. You can now store when you store your card on Apple Pay, you also store your CVV. And if you click the card icon now, it'll show you your CVV within your Apple Wallet. Um, and before you couldn't get access to CVV. Um, and there are tons of tools. I'm and I'm not calling Apple out at all because I love that product. Um, uh, but there are tons of tools out there that are, um, you'll see now that CVV is no longer like a redacted field. It is now a very easily accessible field and there's a lot of research that just has shown. And if you look at the compromises today um a huge majority of the compromises are coming from somewhere in the chain where where CVV is captured. There's skimmers. They're usually a lot of times like honestly the vast majority of the cards that I've been seeing recently show up are people knowingly giving their card information out but not knowing that it's for fraud, right? So they're like they're kind it's fished Yeah, it's fished out, right? And like send me a picture of your card to verify that, you know, you're actually physically present. So, like you buy a purchase from something, we say, "Hey, you know, we got some, you know, risk signals. We just want to make sure that you physically have possession of the card that you're buying a purchase for. You send me a picture of your card. And I now take that and sell it on the dark web. And I, or I use it to defraud someone else and blah blah blah blah. So, CVV, it still it still works as like a you know, but it definitely shouldn't be your strategy. Uh, it shouldn't be your strategy. It should be it it should that should be the sledgehammer that you pull out in an emergency. But if you're using that as your strategy, you should consider re-evaluating.

I couldn't agree more. I couldn't agree more. I uh heard from a merchant the other day that was relying on their PSP fraud tool. And they were declining up to 30% of orders. And this is a retailer with physical goods.

Yeah.

Like it's a pretty big brand like you know they're pretty well known. And they're not even high-risk. It's not like it's electronics or anything, but they're declining they're personally declining, you know, for reason of fraud 30% of orders. But yet their chargebacks are like, you know, point well they're like, you know, 2% or whatever it is. Like, you know, um, instead of 1.5, it's, you know, 2%. Um, and they're just getting killed because and they're like, "Well, we, you know, we uh declined anything that uh AVS Street and Zip and CVV doesn't match." And I'm like, "Oh my gosh." Well, you're declining a lot of good orders and then the bad guys are just getting through all day long. Because if you think that that's a good enough strategy, it's it's not.

No.

Um, and one of the things I'm going to be talking about at MFA this next week is, and I guess it's the week that this episode's coming out. Um, is how, you know, we we can't just assume that they, you know, that they don't know things, right? Like they have all they have our playbooks. And you can't just, you know. One of the things I'm going to talk about at MFA is how fraud is moving to the left and the right of the payment transaction, right? We used to only see it at first Sardine, you came on the podcast and you were trying to explain, you know, why Sardine was different. And the analogy you used was it's the difference between taking a still photo of someone robbing your house and having a video play the whole time. Right? If you just have API calls at login, you just have API calls at checkout, you're missing so much of the puzzle of the fraudulent activity and you're missing all of that. And you know, three, four, maybe it was five years ago, like later that couldn't be more true. Where you know, now everyone needs to be able to have that video camera watching the entire time.

Yeah.

You know, whether it's through the CDN or whatever it's through like the some kind of, you know, tool to be able to help them recognize those things and apply device and behavior biometrics. Because otherwise you're just you're getting, you know, you're missing out. You're you're the person that you're the company that's slower than the bear.

Yeah, you're spot on. And you know the other thing is is that what we're seeing is because of the attacks are also becoming far more sophisticated and they continue to adapt and uh be polymorphic and being able to adapt in real time. The best way now I think that like if someone were to say like what is the one thing that I could give you to like be a really effective? And when you're building out a new strategy to to like mitigate for your fraud risk. Is instead of spending time looking and trying to mitigate fraud actually spin it around you should spend more energy mapping what good user behavior is.

Yes.

Um because if you can map what your entire good user journey is, that that video camera that you're talking about, right? The second that they think about your your platform to the time that they check out. Having an extremely strong analytical understanding of the user journey the mapping the friction points where the step up points are where do good users actually fumble where is the drop off rates all of those things. It's really easy to start seeing when the bad actors are in there. It's really easy to start seeing the anomalies. If you're only focusing on the anomalies, right? On the fraud, right, which could be a small percentage of your traffic. Um, and that's the thing that sometimes as fraud fighters we get caught up in. Because like, oh, it's like a million dollars in fraud this month, right? Well, like that sounds like a lot until you like you realize that you probably did a hundred million in revenue.

Yes.

Right. And so it's a tiny tiny portion of your actual traffic. Um, right. And so understanding what good user behavior looks like and understanding what being able to map that and being able to like analytically uh identify it will actually make you much stronger on the on the um fraud fighting side. Um and that continues to be more and more true as the emulators are now able to mimic device behavior. Right? So there's all sorts of automation that's happening on the behavior side. So, it's just one thing after the other and that's where like the Sardines of the world are are constantly having to re rebuild their behavioral biometrics to stay one step ahead and continue. It's always the cat and mouse game, right? But we've seen this crazy stuff where like, you know, they they will tape phones, duct tape huge rows of phones to like PVC pipes and then they will roll the PVC pipe back and forth using a remote controlled cars tire. Um, so it looks like someone is like moving their phone instead of flat on a desk. So yeah, all sorts of like clever ways to get through it, you know.

Yeah. No, that's that's not

Yeah. Isn't that wild.

That doesn't surprise, Like the telemetry of the phone. Yeah. And trying to

Angle the phone and is it laying flat? All those things like Yeah. They they there was I'll send you a video, but it's basically like Yeah. It's a room and it's got these big huge PVC pipes going down. And uh they literally are duct taping phones on and they're using like a remote control toy children's car. And they're just like and it's just like moving the phone, you know, the whole row is rolling the PVC bike and and it's it's causing enough movement to trick like is the phone actually being physically held by someone in use.

Maybe they're going down a bumpy road. You don't know.

Or they're just it's in use, right? It's in your, you know this how it's it's a part of a human not laying flat on a desk. Right.

Right. Which was one of the signals that that were was being detected. So uh one of the things that I wanted to just circle back on was when you go through the user journey the way that you suggested and you look at what does what do good users do, right? And you map it all out. And you assign data to it all and metrics to it all. Like okay we get a drop off point here we get a, you know those type of things. That's the stuff that CEOs and executives eat up. Growth teams love it. You know customer success loves it. Those are the thing we're constantly as fraud fighters trying to figure out like how do I get them to listen to me? And it's like, that's how. And you know then as you said, you can also then spot the bad users so much easier. And I know when I first started in fraud, it was, well, what are the bad what do bad users look like? Okay, let me, you know, identify them and then only look for that. But you're so right that that was just very. And that worked back in 2006. But it doesn't work now.

It even worked in 2017. Yeah. Yeah.

Right. Right. It worked for a long time. But the last few years, man, they are catching up. And you know, we always say that our goal as you know, people in fraud prevention isn't to stop all fraud because we know that's just not, you know, realistic, but that it's to slow them down and make them, you know, have to spend more money and time on each type of fraud. And unfortunately AI and all of these other tools available on dark web. And you know the clear web too. Like they're allowing them to do things faster and cheaper and it's making our job harder.

It's pretty funny actually if you think about um and like all the vast majority of fraud is our friends, right? We all sometimes cross paths. We all know each other. We all we all like everyone's kind of in a similar circle. We all, you know, somehow we all work together. And all of us have a similar mission and goal. But it's actually funny if you actually take a step back and think about it is like your hope as a fraud fighter, is that you're going to apply enough friction to that the fraudster goes to your buddy's company or your your girlfriend's company down the street and hits them instead. Uh, right. And so, and that's honestly in the industry, right. It's the path of least resistance. So, like you want to be the one that knows how to apply tactical friction to where the fraudsters are like, "This is not worth my time. I'm going to move to the shop down the street." Which also happens to be your friend that's managing fraud. And then they're same game. And it just goes around and around and around and like that's just the the nature of the that's the economy of fraud, right? Uh it's just a friction game at the end of the day at the end of the day. But to your point, if you can validate good customer uh user behavior and journeys, it allows you to make really fine-tune adjustments on friction, and it also allows you to justify friction. Because you can say, for example, I'm going to apply friction and we're going to have a 1.3% checkout dropout rate, you know, drop drop off rate here. But I'm going to reduce friction up here where there's good user behavior that's not catching fraud. And so you can kind of I start playing with that with the entire journey to be more tactical and then that will help sell it substantially better with your executive teams and growth teams.

That's why I said to attach data and metrics to it. 100%. Yeah. Back to you talking about, you know, how we're kind of just sending it all back to each other. Um, one of the things that I found to be really useful to counteract that, is I, and you've known this for years. But um, ever since 2020, I've been hosting uh, it was by monthly or bi-weekly, but now it's um, monthly merchant call. And I don't know how many times there will be merchants that are like, "Hey, we're starting to see this." And another merchant go, "Oh, yeah, we had that two months ago. It's this type of card. It's this this this and this is exactly what they're doing. Here's how you stop it." And you know, sometimes it's because the two companies are competitors with each other. You know, maybe they are two retailers that sell the same products. And you know, other times they have nothing to do with each other. I once, there was a ticketing company like a event uh entertainment company like tickets. That was seeing a specific type of fraud. And it was like a very specific type of email um pattern like on the um on the email name.

Sure.

And they had mentioned one other thing. Like the payment method or something. And then a retailer that sold shoes was seeing the same thing. And I was like oh you need to talk to these guys. And like got them together. And it's kind of the, it's not the quantitative it's the qualitative version of what Point Predictive does, right. You guys do the quantitative version. The data, the automated, the you know, the very like micro, okay this this account has been linked, this name, this address, this email has been linked to lending fraud before. We're going to kick them out. We're doing it on like this 10,000 foot view of like, okay, this is the pattern that we're seeing across lots of different orders, you know, how do we stop them? So, I think that both are critical.

Oh, yeah.

Um both are important. And um it's I think you and I both have danced around this all day all night. But at the same time it's all about a layered approach, right, everybody says that and it's a buzz word buzzwords. But you need to have different points of tactical friction or information that you're gathering data gathering that you're you know gathering and assessing and analyzing at different points throughout the journey. To be able to identify different part types of fraud.

Yep.

You can't just rely on one thing.

No. And like not only can you not rely on one thing, um, and like again that's where being a part of a network like your merchant network that you were talking about of just connecting via phone calls, right? Be a part of a network, be a part of a consortium, share information and knowledge is like that's the best way to defend against these modern attacks. But the I want to like just last little touch on on something that you said earlier on the podcast. Which is when you're thinking about you know when you're talking about a layered approach, right. It's there is no silver bullet. Which means that you have to build in multiple layers multiple technologies into your tech stack. But think about when you're selecting a technology vendor etc. Always think about like what is their primary goal as a as a company, right? What are they going to spend a lot of their resources doing? And if you're a payments company, right, that offers a fraud product, for example. Are they going to be dedicating their engineering team, product teams, machine learning teams into building out their fraud capabilities and staying ahead of it? Maybe

Those tools have to keep getting reiterated. They have to keep you can't just build it once and walk away. We have adversaries. That works in marketing tech, but that doesn't work in fraud tech.

100%.

You need to keep reiterating and improving and adapting and growing. And you're absolutely right. Payment companies going to be investing in payment authorization and optimization.

Yep.

And now orchestration is their big buzzword. So now it's, you know, optimization or orchestration, whatever, um, they're working on. You're absolutely right. That's where they're going to be spending their money. I think another thing I'd add too is where is that company in their own life cycle

Of course

In their own like funding cycle. Where they are, you know and there's benefits and um disadvantages to working with you know companies at all stages, right. Whether it's pre-seed it's A it's C whatever it is.

Oh, 100%

But that's important to note too if you're working with an earlier stage startup they're more likely to build custom things for you. But you don't know if they're going to be around forever

And you don't know if their technologies tried and true. I usually try to when I'm building a tech stack, I usually will do both. I will use core fundamental technologies that were tried and true. They might not be the Ferraris, but they're the Toyota Corollas that always show up, right? Always get you across the line. They're very reliable. They're stable. I'll use those as kind of a foundation layer. And then I will I'm definitely willing to take higher risk vendors that are net new technologies and stress test them and really build out and see see what we can do. And that's why I was like Sardine's first customer, righ, as is new technologies. And uh sometimes that can play out really well. Sometimes it doesn't, but you're not really risking anything with them because a lot of them will just be happy to work with you in many cases. And a lot of times it's free. They just want you a part of a design partnership. If you ever offered to be a part of a design partnership, I tend to tell people to just do it. Um, you'll probably learn something and you don't you're not forced to buy anything. But like a lot of times you can learn as well to learn how the technology is built from behind the closed doors and see under the hood

You can have influence on it too.

Oh, for sure.

Quite a bit of influence.

Absolutely. Absolutely. So, it's really critical. So, yeah, when you're selecting a vendor, always look at those key signals of like where are they in their journey? Where are they going to be investing resources and time, right? And by the way, there I'm not going to call them out, but there are payment companies that have amazing fraud tech. So they do exist. But they also spend a unreal amount of money on building that technology. And by the way, like 70% of their engineering team is just dedicated to fraud. So like but but just to be very clear that is not the norm. Uh the norm is you have one single product manager and two engineers out of a company of a thousand. And that their job is fraud and the rest is is payment orchestration.

No, you're right. Yeah. I mean I would say look at the age of the payment

That's right. Uh that's right

The payment company, the networks.

The processors. The payfacs.

Yeah. The newer PSPs have definitely built in fraud and prioritized it. Some better than others and for some situations more than others. Like I wouldn't, there's some merchants I would put on that and there's others that I wouldn't depending on various things. But um but the payment processor the PSPs that have been around for a long time, they will sell it to you hardcore and tell you it's exactly the same as a third party vendor. Because they want those, you know that line item and they want that extra sale

Of course

But it will be detrimental to your approval rates and your chargeback rates. I can't say that enough.

I may, would have to agree. Uh in many many cases. Especially if it's like a third party and they're piping it through. And then you have all

Yeah, there's that too. Yeah. Yeah.

So yeah, I think that but the there are some new kids on the block that are like, and this is happening in all all ecosystems. So like in the phone space as well. Like um I tell everyone to like check out Cape. The company's called Cape. I have nothing to do with them. I don't know anyone that works there. C-A-P-E. They are a security fraud and privacy first uh telecom basically. Um, basically, uh, it allows you to get a SIM card and use their network and the E SIMs, the IMEI, the IMSI, um, always rotating so you can't be tracked on their network. And it's like they lock down your geolocation so that the networks can't track you. And so like they are building out technology that is like protection first. And there are payment rails that are doing something similar. So it's really nice to see that the this pressure on increasing speed and sophistication of attack vectors is also causing innovation in the market. And that innovation is leading to these types of companies that are really interesting.

Huh, that's really cool. Well, not surprising we have blown through an hour. Um, this is what we do and that's after an hour and a half of personally catching up with each other.

That's true.

Um, I have often joked that Matt is the male version of me. And we just we think so similar. And uh whenever we do catch up, it's really fun. And uh we challenge each other, which I think is really important. Iron sharpens iron, as they say. Um, but I really appreciate you joining me today. I just wanted, I knew that you had learned a lot in your last few months at Point Predictive and I wanted you to share some of it which you totally did. Um I'm going to put a link to your LinkedIn in the show notes so people can connect with you. And you know have, you're always you're always open to conversations I know. So

Absolutely. Yeah. Thanks for having me. It's a pleasure as always. And uh yeah feel free to reach out say hi. Anyone wants to dream team together and hang out and talk fraud. Always open.

Well, thanks again and I will talk to everyone soon next week.