58 min
Fraudology
Industrialized Fraud: How AI Is Reshaping the Fraud Attack Landscape
49 min
Welcome back to Fraudology.
I’m sharing the presentation I gave to open the Merchant Fraud Alliance conference in Chicago. It was a “where are we right now” look at the fraud attack landscape, and it grew out of a question I heard from merchants all through the conference. What is actually different about fraud today, and how much of it comes down to AI?
If you work in e-commerce fraud, you have probably felt the shift in your own numbers. Generative AI has changed who can attack, how quickly they can do it, and how well the attacks blend in with good customers. I walk through how AI fraud looks from the ten thousand foot view I get from talking with so many merchants, and I pair it with fraud prevention ideas you can take back to your own team and your own leadership.
What you’ll hear in this episode:
- Why fraud has been industrialized, and how AI lowers the cost, skill, and time needed to attack e-commerce at scale
- The headline numbers, including fraud pressure up 33% year over year, account takeover up 78%, card testing up 175%, and BOPIS fraud up 65%
- How the EMV chip shift in 2015 and the rise of account takeover compare with what AI is doing to the fraud attack landscape today
- Why AI-powered account takeover keeps climbing, and how generative AI makes phishing cheap to personalize
- How AI card testing attacks differ from old scripts, including how agents sort cards and adapt to your controls
- How one campaign can move from identity to checkout to customer support to disputes, and why event-based controls miss it
- Why evidence is now cheap to fake, from fake receipts and identity documents to fake damage photos and deepfakes
- What a dark web card marketplace demo shows about how easy it is to buy the pieces of an attack
- How to fight AI with AI fraud detection using session-level data, telemetry, device ID, and behavioral biometrics
You should listen to this episode if you:
- Need to explain fraud increases to leadership and want current numbers to bring with you
- Have seen a sudden rise in account takeover or card testing, or heard from your processor about the Visa enumeration program
- Deal with refund fraud or chargebacks involving photos, receipts, or item not received claims
- Are evaluating fraud prevention tools and wondering why snapshot-based controls keep missing attacks
- Want to hear how merchants are using generative AI to spot AI-written scams
- Couldn’t attend the Merchant Fraud Alliance and want to hear how the conference opened
Episode notes
Two earlier shifts in fraud, and why AI is the third
The first was the move to EMV chip cards. Before the chip, US cards used a magnetic stripe that was easy to counterfeit, and fraud was split about evenly between in person and online. Other markets, like the UK, had already shown what happens when chips arrive. In person fraud falls and online fraud climbs. I started warning merchants about this in 2013, and when the liability shift took effect in October 2015, online fraud rose just as those markets had predicted.
The second shift came soon after. As merchants got card fraud under control, criminals turned to customer accounts. Account takeover meant the fight now included the login page and not only the payment page.
AI is the third shift. I could see the first one coming because other markets had already lived it.
Industrialized fraud, by the numbers
The headline numbers are hard to ignore. Fraud pressure is up an estimated 33% year over year, account takeover is up 78%, card testing is up 175%, and buy online pickup in store (BOPIS) fraud is up 65%. Interpol estimates that AI-powered schemes return about 4.5 times what traditional attacks do, and an estimated three in ten retail fraud attempts are now AI-generated. I expect that share to be higher next year. Our goal has never been to end fraud completely. It’s to make your site harder, slower, and more expensive to attack than the next one, which is the old idea that you only have to outrun the slowest person running from the bear. AI trims every one of those advantages by making attacks faster, cheaper, and easier to run.
AI powered account takeover and card testing attacks
A script repeats the same action over and over, and you can catch it. An AI agent adapts. It notices what your site will and won’t allow and adjusts. That is a big reason account takeover keeps rising. Generative AI makes phishing easy to personalize, and many messages look ordinary because they claim to come from a shipping company, a large retailer, or a payment brand most people already have an account with. Card testing follows the same logic. Someone can feed thousands of rows of card data into an AI tool, sort the cards by BIN, authorization response, and address, and test them with low dollar transactions. Attackers can test on other sites first. That means you may not see a pile of declines when those cards reach yours. It breaks a pattern many of us relied on for years.
One campaign across the whole customer lifecycle
Fraud used to be divided among specialists. One group handled identity, another handled card testing, another cashed out, another worked customer service, and another filed chargebacks, and sometimes they sold their services to each other through fraud as a service. With AI agents, one campaign can do all of it. It can use a stolen or synthetic identity, check out, contact support to claim the item never arrived, and then open a dispute with flawless documentation, because that documentation is fake too. Account takeover often ends with drained loyalty points or stored value, or with a changed payee on a marketplace seller’s account. Event-based controls miss this, because approvals, logins, and identities each look valid in isolation. The loss shows up later, after many successful transactions, which means you may not know you’re under attack until it’s over.
Cheap evidence, cheap storefronts
Fake receipts, order details, damage photos, dispute narratives, voice calls, and identity documents can all be produced on demand now. A large food delivery company told one MFA deep dive that damage photos are among the biggest drivers of refund abuse. Someone can ask a chatbot to add mold to a photo or crack five eggs in a dozen, and retailers see the same thing with a hole added to a piece of clothing. I also believe deepfakes are close to impossible to detect now, which puts identity verification at risk from deepfake identity verification fraud. Fake storefronts are just as cheap. As Matt Vega has shown, you can build a lifelike copy of a merchant’s site in about ten minutes for under $50 and point social media ads at it with a URL that’s off by one letter, which is ad fraud working hand in hand with phishing. One campaign this year compromised more than a hundred retail sites at once with online card skimmers and took over 600,000 card records. I also played a demo Matt recorded of a dark web card marketplace, where a buyer can filter by country, state, zip code, card brand, and BIN. AI isn’t inventing new methods. It’s helping the old ones blend in with legitimate customers.
Reading the whole session, and every fraudster’s tell
The teams catching AI attacks connect identity, intent, and context from discovery through post purchase. They read patterns across sessions and not only individual events. I use a security camera analogy. A snapshot at login or checkout is like a still photo of someone breaking into your house, and you know it happened but not how they got in or what they took. Session-level data for fraud detection works like cameras inside and outside the house. Soups Ranjan said in a session I moderated that every fraudster has a tell, and telemetry helps you find it, such as a phone held in an unusual way or lying face down. The leaders I see with low chargebacks and few false positives use device ID and behavioral biometrics together, and they ingest the right fraud signals, since one missed signal can become a loss, a chargeback, or a false positive.
Explaining it to leadership, and getting scrappy
If you have to explain a spike to your leadership team, use the industry numbers. Several merchants I know have had to account for sudden jumps in account takeover and card testing since the spring, and some have heard from their processor about the Visa enumeration program. The Merchant Risk Council reports that 80% of merchants name technology infrastructure as their biggest fraud challenge, which tells me the real hurdle is getting the right tools approved. Journey data can help, because marketing loves to see what customers do on the site and that gives you an ally when you ask for budget. Leaders are also asking teams to do more with less, and some merchants are getting scrappy. One marketplace team loaded real buyer and seller chats and suspected phishing chats into a generative AI tool and asked what the AI-written messages had in common. It found a pattern of an opening greeting, a run of open-ended questions, and then a prompt to click a link. AI can often spot AI, and some vendors now offer AI agents that screen manual review cases and propose new rules. We can fight AI with AI, and sharing what works is how we keep up.
Key takeaways
- AI has lowered the cost, skill, and time needed to attack e-commerce, which is why I describe fraud as industrialized.
- Fraud pressure, account takeover, card testing, and BOPIS fraud are all rising sharply, and AI is a major reason.
- Interpol estimates AI-powered schemes return about 4.5 times more than traditional attacks, and about three in ten retail fraud attempts may already be AI-generated.
- Scripts repeat and AI adapts, which makes AI card testing attacks and AI-powered account takeover harder to catch with old rules.
- A single AI-driven campaign can span identity, checkout, support, and disputes. Controls that only watch single events will miss it.
- Fake receipts, identity documents, and damage photos are cheap to produce, which makes refund abuse and chargebacks harder to judge on evidence alone.
- Deepfakes are close to impossible to detect by eye. Identity checks need support from behavioral and device signals.
- Session-level data, telemetry, device ID, and behavioral biometrics let you see the whole journey and not just a snapshot.
- Industry numbers give you a credible way to explain increases to leadership and to ask for better tooling.
- Merchants and vendors are already using AI to fight AI, and sharing what works makes every team harder to attack.
Final takeaway
If there’s one thing I hope you take from this episode, it’s that the fraud we are fighting isn’t new. It’s familiar fraud running faster, cheaper, and at greater scale. That means the answer is not to chase every new trick. It’s to see more of the customer journey, ingest the right signals, and bring leadership along with real numbers. That gives your tooling a chance to keep pace. Your fraud rate rising may simply mean you’re on par with the industry. What you do next is what sets you apart.
Episode resources & links
Connect with Karisse Hendrick | LinkedIn
Host of the Fraudology Podcast
Award-Winning Cyberfraud Expert
Ecommerce Fraud Prevention Consultant
Startup Advisor, Keynote Speaker, and
Consultant to Fortune 500 merchants
Episode transcript
Karisse Hendrick
00:07
Welcome back to the Fraudology podcast. I'm Karisse Hendrick. Well, we had a guest need to reschedule this week, so you get another solo episode with me. Last week, we talked about the Merchant Fraud Alliance and how just amazing the first uh conference was. Uh we are already talking about next year. Um I will give you more details on that when I have them. But I decided that maybe what I would do today is share a bit or share all of the uh presentation that I did to kick off MFA. Um I didn't want to call it a keynote because I didn't think that's what it was. It was more of just like a here's where we are and fraud presentation. Um talking about the fraud landscape and you can't talk about the fraud landscape right now without talking about AI and specifically how AI is attacking and changing fraud. It reminds me of back in 2015 uh actually even before that starting in 2013 I started to talk a lot about EMV in my presentations. I worked for the trade association in our industry at the time. I did a lot of presentations at other conferences as well as our own and uh I was talking a lot about EMV and how that was going to change online fraud forever. Um essentially in the US we were using cards with the magnetic stripe which was very easy to counterfeit back then. So the breakdown of fraud between card present fraud and card not present fraud was about 50/50. But we had seen in the UK as well as in Africa and other markets that when the banks changed their cards to include an EMV chip uh chip and pin or just chip that online fraud went up significantly and in-person fraud went down quite a bit. And you know there's cons some conspiracy theorists that were saying hm isn't that interesting that banks are doing something to reduce in-person fraud because per the credit card rules issuing banks take the hit they take the liability on card present transactions. But because the chips made it much more difficult to counterfeit cards, we saw we knew we were going to see online fraud go up. And that's exactly what happened in October of 2015 when that law changed the rule the law that required banks to include chips on their cards. So I went around preaching this for about 2 years like, "Hey, online fraud is going to go up. Here's what happened in other markets. Here's why it's going to happen. Here's what it's going to look like.” And it really did go way up during that time. And we saw fraud shift very drastically online. Um there was more fraud, there were a few more sophisticated attacks, but a lot of it was about volume. Um, and then shortly after that time or right around that time was when we started to see account takeovers which also dramatically changed the way that we fight fraud cuz then it was no longer just at the payment uh acceptance point but also at the, you know, the account login page. And that's where, you know, merchants and online companies were getting hit, you know, most. After they kind of got their cards under their card fraud under control and were able to identify that, then they'd see their accounts be hacked as what, you know, that's kind of the colloquial term. We say, account takeover. Um, so those are two examples of times when fraud changed in our world. This is another and that is when AI takes you know is starting to be developed. I so much has happened in the world of AI and their capabilities just in the last six months but I don't know what's going to happen in the next year the next time I'm presenting at MFA like I I just I can't even imagine. So I'm going to try something new and I'm going to share my screen and those of you on YouTube will be able to see my slides. Uh those of you not on YouTube, I will do my best to talk through them. That will be not so much of a challenge for me, but something just for you to be aware of.
Karisse Hendrick
04:46
If you're listening, you know, on Spotify or Apple Podcasts or whatever podcast app you use, feel free to switch over to YouTube. You can just search Fraudology. Uh you should find me right away. Um it might say the Fraudology podcast or Fraudology with Karisse Hendrick. I'm not exactly sure how my editor set it up. Um, but you'll find me. So, uh, that this is your opportunity to change that if you want to. Otherwise, we're just going to cruise right along. And I even have a video clip from the dark web that I'm going to try to show as well. So, might be a little clunky, so bear with me. Uh, but I did test this out earlier and it worked. So, I'm thinking it's going to work now. All right. Here I go. Sharing my screen. All right. So, here I go. Uh, really the takeaway from this session was that fraud has been industrialized. The title of the session was the fraud attack landscape. But, uh, really, you know, fraud has been industrialized. AI has lowered the cost, skill, and time required to attack e-commerce systems at scale. So fraud activity is accelerating. We have early indicators that point to faster growth across several e-commerce attack types such as uh I think it was from a signified state of fraud report in 2026 that fraud pressure has gone up 33% year-over-year from uh I think it was from 24 to 25 but I could be wrong. Um account takeover is up 78%. Card testing is up 175%. And by online pickup and store fraud is up 65%. Uh all of those things are because of AI. They're able to do things faster and cheaper than ever. And I think anyone that's been in fraud for a little while knows that it's impossible to have the goal of eradicating fraud on your website 100%. But the goal of you know most online merchants as well as banks and you know other online uh entities you know lenders crypto anything like that. Uh their goal in the fraud department isn't to make fraud go away 100%. They know that's not possible but it's to make it harder, make it slower, and make it more expensive to commit fraud than at other places. It's kind of like, you know, that saying, your job isn't to outrun the bear, it's to outrun the, you know, slowest person, uh, running from the bear. Um, and that's really what it is about fraud, right? You want to be more expensive and harder to penetrate and commit fraud on your site than other other websites, so that they don't attack you, they unfortunately attack them. Um, that's why I'm such a big believer in collaboration and why I worked so hard on the merchant fraud alliance conference, why I do Fraudology, why I host merchant calls for free. Um, it's all because, you know, if we work together, then we'll all be able to outrun that bear, right? Um, that's the goal. So AI is making it. So while that's our goal is to be, you know, more expensive, slower, harder to, you know, commit fraud on your website, AI just cuts all that down. It makes it faster. It makes it cheaper. It makes it easier to commit. No longer is it just one person at a screen or writing a script where you know every 10 20 seconds maybe you know a couple of transactions go through here and there but scripts are different than AI because AI is actually adapting to your website. It's determining, oh, it won't let me do this. Will it Will it let me do that? And so, it's constantly adapting to the things that you put in place to stop fraud. That's different than a script that's just going to continually do the same thing over and over again. And you can catch those, right? It's much more difficult to catch AI.
Karisse Hendrick
09:23
One of the reasons why account takeover is higher is because humans, your consumers are much easier to fish. And when they fish, your consumers, they get their login and their account details. So they can then log into your website. Um, fishing attacks using AI are so sophisticated now. They can even be customized. I don't know if you saw the episode or listened to the episode uh with Cy Khormaee who used to work for Google Recapture, but he was talking about just how you know easy it is to tailor a phishing message to a person. All you have to do is ask Chat GPT to do a little research for you. You know, you can find out where their kids go to school. You can find out, you know, where they work, what conference they're going to go to next. You can find out all kinds of things. And so you can tailor your phishing message to them. Lots of times you don't have to. A lot of the phishing messages these days are, you know, coming from what they say are large companies that everyone does business with or that most everyone does business with. So it doesn't look too out of the ordinary. If you were to get an email from some, you know, ABC, you know, cybershop.com or whatever, something really small, and said, "Hey, you need to log into your account." You'd be like, "What? I don't have an account with them." But you get it from a shipping partner or from, you know, Amazon or Walmart or PayPal or, you know, any big brand. Chances are you have an account with them. And so, you know, if it says you need to log in for security reasons or whatever they're telling you, you're going to give up your username and password. And that's why ATO's are up 78%. Card testing, again, same kind of thing. Instead of running a script, you can just feed hundreds if not thousands of rows of data of full card numbers into um ChatGPT or Claude or anything else.
Karisse Hendrick
11:25
I mean, I certainly wouldn't recommend doing that as a merchant, as a good guy. But the fraudsters don't seem to care. Um, and they can have them, you know, run transactions for a low dollar on a site very quickly and they'll always find ways to circumvent your fraud tools. I thought this was an interesting stat from Interpol. Um they estimate that the return from AI powered schemes versus traditional attacks to cyber criminals is four and a half times. So, if the average cyber criminal, you know, was able to obtain $1,000 from your website or your bank or whatever it is, in the average attack, in the traditional attack, they're now able to get, you know, $4500 worth of product or money or whatever else because AI is constantly learning. It's constantly adapting. It's going to get through. The next slide uh talks about how fraud operates as a connected system. When you're using uh AI, it's going to act as a connected system with everything else. So it's it's no longer just one attack. It's all the way across all attack surfaces. So identity abuse, payment fraud, support manipulation, and disputes all reinforce one another across the channels. So AI compresses the timelines um the time from research to attack. It allows coordination. Agents link tasks that once needed separate people and tools. And then it removes friction. Automation removes the trial and error that slowed traditional campaigns. The same campaign campaign can move from identity to checkout to customer support and dispute claims all within one campaign. So they can, you know, spoof an identity. They can successfully check out. Then they can go to your customer support and claim that the item wasn't received or claim that there was an issue or they were double build or whatever they claim, right? And then they can go to a dispute and either file a dispute internally with your company or with their bank all in one attack. It used to be that you know each thing was specialized by someone different within a cyber crime ring. You know, you had the hacker and the coder. You had the person that was good at identity, the person that was good at account compromise, the person or the group that was good at card testing, and then the group that was good at cashing out, as they say, or carding, you know, the checkout piece. Then they had another person or group that was good at manipulating and social engineering customer service. And then they'd have another group that would maybe file a chargeback or two if it was a fake card or something like that. Um, it'd all be different groups within maybe maybe it would be the s a single crime ring or it could be different crime rings and they're selling their services to each other through fraud as a service. But now using AI, it's just seamless. It the same agent, the same campaign can manipulate every single part of your business. Um, and that's really something that I, you know, wanted to highlight in this in this session. So, evidence is now cheap to fake. Um, if you're watching this on uh YouTube, just ignore that black box cuz I'm going to show you a video. I wasn't able to embed it because of the way that the um presentation was done through the AV system at MFA. A little behind the scenes there. Um, but I just put like a, you know, a a box there to in input that or insert that video, but I ended up not needing it.
Karisse Hendrick
15:34
Um, so evidence is now cheap to fake in a lot of different ways, right? They can fake receipts or order details or damaged photos. They can fake dispute narratives or voice calls or identity documents. Can all be produced on demand. So, no longer is a receipt from your company good enough for a return, right? If for an in person transaction, uh, no longer is are order details available, right? Like, they're all fakeable. They can fake damage photos. There was one of the largest uh food delivery companies uh in the US uh and they also have a pretty strong European channel as well. Um at MFA who ran a deep dive. I explained what deep dives were on the last episode, but basically it's a merchantonly uh session for 20 people for an hour where the facilitator shares a little bit of what's going on in their world um on a specific subject and then merchants get to talk and share ideas and share frustrations and all of that with each other for the rest of the time. And in his, you know, in his world, one of the biggest things to impact refund fraud is is damage photos, right? People can ask chat GPT to, you know, like they'll take a picture of something and then they'll say, um, add mold to this picture and it'll look really lifelike or, you know, add, um, you know, open the package or something like that. Or like, you know, if they if it was groceries, right? Crack all the eggs in this 12-pack or crack five of these eggs in this 12-pack and make it look like they're cracked. Oh, they can do that very easily, right? So, um that has really impacted the food delivery industry. It's also impacting uh refund fraud for retailers where you know you buy a piece of clothing, you can ask ChatGPT or Claude or you know, Anthropic, whoever you're using um to insert a hole in the in the product, right? So that you can contact customer service. You can have your AI agent contact customer service say there was a hole in the item that you shipped to me.
Karisse Hendrick
18:05
I'll send you a picture. It'll look lifelike. Um, you know, there was a lot of talk at uh in the session right after mine at MFA about faking identity docs. So, I kind of left that alone. I mean, I mentioned it, but I didn't dive into what deep fakes look like and how sophisticated they are. Uh, one of the slides that the next speaker shared was uh about just showing the difference between a deep fake video a year and a half or two years ago to last year to this year. And like two and a half or you know, one and a half to two years ago, the video was glitchy. You could usually tell, you know, they only had four fingers or like, you know, just weird things. The lighting was off, like you could tell things, right? And then last year it was a little little glitchy still, you know, not as glitchy as before, a little more seamless. Um, and the lighting was, you know, a little detectable, but not really. It was difficult to detect. Now, it's almost impossible to detect deep fakes. It's almost impossible to detect selfie videos or uh if a driver's license or passport has been forged. It's just not possible. Um so, three in 10 retail fraud attempts are estimated to be AI generated. That's probably going to be six or seven and 10 next year. Um, I'm going to go through the rest of this slide and then I'm going to do my best to play this video. Um there was a 20 there was a campaign done by AI that was done this year in 2026 where a 100 plus retail sites were compromised all at once with basically online skimmers card skimmers and six over 600,000 card records were stolen and they pocketed about $25 per attempt.
Karisse Hendrick
20:14
So do the math right? That's going to be over around $250,000 that they were able to get very quickly by implementing an AI attack across over a hundred merchants without the merchants being aware. Okay, we're going to play this video and basically it's Matt Vega created or created this video and it shows him going to this site on the dark web. Looks just like a regular site. It has rules of how to use it. Um, and then you can search any cards you want by the country, any country that you want. Uh, then you can search by um if it's credit or debit, what branded card it is, if you have a specific bin, but you can also pick the state that it's in. Uh, in this case, Matt picked Washington. Um, he put in the zip code. So, it can be very specific, right, to where he wants the item shipped. He can buy a card that has a high limit, doesn't have verified by Visa. Like, it has all of these details that you can see on here. Um, and then he went into the Russian market on the dark web and uh entered his pin and then he was able to um do even more things as far as um creating a FOSS, you know, that's what fraudsters call it when they have a full portfolio. Um, you can pause here and and read all of that text if you want. Um but it a gave them access to Imperial market where you could buy more clone cards, you could buy prepaid cards, you could buy Western Union, Skril, Crypto, etc. So, uh you can even buy Revolute transfers, uh which were um quite popular at the time. Um, and it would only be I think I saw a transfer for let's see $2,000. Oh, I wasn't able to see how much it was, but I mean it's pretty if it transfers for 2,000, it's probably going to be like $100 to purchase.
Karisse Hendrick
22:35
Um, so you know, this just shows that it's cheaper and easier than ever to commit fraud and to fake information um, more than ever. I mean, you can pick here. He's picking the bin. He's picking the, you know, the quantity of cards, how he's going to pay, etc. So, AI scales familiar fraud methods, right? So, we're not talking about new fraud methods. We're not talking about, oh, there's these new fraud methods. No, they just make it they make the current fraud methods that we have harder to identify as fraud. They make them blend in more with legitimate cards and legitimate transactions, legitimate account logins, legitimate account creations. They make it look better, right? So the um as I just said, the techniques existed before generative AI. AI just makes them cheaper to produce, test, and adapt. So, you know, there's under identity, there's stolen stolen data and deep fakes that create convincing identity replicas. Um, for ad traffic for fraud, for ad fraud, um, automated ad campaigns can send consumers to fraudulent storefronts. So, um, I've mentioned this before, Matt Vega has mentioned this before on my podcast as well, but you can make a very, very lifelike website for un under 10 within under 10 minutes for like under $50 online using AI. You can literally ask one of the chats to create a replica website for you of X do or not X.com because that's Twitter now, but company X.com. Um, you can replicate their storefront but have their credit card transactions not go through. Instead, whenever anyone enters their credit card data, you just harvest that and then they don't ever get their product. But you get their credit card numbers. Um, or you can try to get a merchant processing account uh fraudulently of course and probably using AI because it's easier now and link that to your fake website so that whenever someone places an order, you are processing their card for that amount, but they'll never get the merchandise back. So then with this ad traffic, you can then create hundreds or thousands of ads on social media pointing to your fake website. So when you do that, they don't usually see the URL. So you could have the URL be spelled wrong with just one letter or something like that. And if they're clicking on an ad from social media about the website that they think it is, they're not going to notice that you're that it's not the real website. So that has been greatly impacting online companies, including banks. Um phishing, as I mentioned, you can target research and polish messages um making them uh a lot more convincing.
Karisse Hendrick
26:04
You can Oh, this is what I just talked about. Copycat shops can be built quickly to collect payment data or sell counterfeit goods. Just like I said, card testing, the authorization results help sort cards, bins, and address matches. So, when a card tester uses AI, it doesn't just tell them if the transaction has been authorized or not. It'll sort them based on BIN. It'll sort them based on what the authorization, you know, response was. It can sort them by the address so that you can, you know, add add cards that are close to your mules address or, you know, purchase digital goods that don't need a shipping address. And then the biggest thing is that it adapts to everything. So agents map friction and controls and then they adjust their approach. So if they hit a brick wall, if they hit, you know, a fraud tool or fraud screening, they then make note of that and try to figure out how to get around that. And you're not seeing as many trial and errors in your data, right? Especially if they're using card testing on another site, you're not seeing, you know, 2700 declines and 3,000 authorizations or or 300 authorizations, right? That would tip you off the other card testing problem. But now they're card testing somewhere else so seamlessly that when they go to use the card number at your website, it's really difficult if not almost impossible to solve for or at least it's not impossible but we need to be thinking about it in a different way and that's that's really what a lot of this is about. Um so the losses surface across the life cycle right I basically said that but to capitalize on it you know a campaign can run across controls before a team sees the pattern right so um the discovery is the fake stores and ads and then they use stolen or synthetic ID to commit card testing and checkout. Um, the account can be used for takeover or misuse. Um, often times they're taking over an account to drain all the loyalty points or the stored value dollars that you have on the account. If you're a seller for a marketplace and they get a handle a hold of your account details, they're going to go in and instantly change the payee or who the money is deposited to so that they can then get that money instead of you. Um they will, you know, manipulate support with fraudulent refund claims and then they'll go to this dispute process if they need to and issue a chargeback uh with the bank and they can provide flawless card holder documentation because it's all fake.
Karisse Hendrick
29:13
Um there's a reason why eventbased controls miss it, right? And this is what I was just hinting towards a minute ago. Approvals, login, and authentic identities can all look valid in isolation. The loss emerges later after all after many successful transactions. So often times you won't realize that you're under attack until after you've already been attacked. Whereas with previous fraud attacks without AI, you'd have a pretty good idea you were being attacked before you get a chargeback or before you get a card holder calling your customer service to tell you that their card was used on your site. Talked a little bit about refund abuse already, but I'll talk about it again. Um, 60% of Well, wait. So, AI can generate uh damaged photos and polished claims. Uh, deep fake refund bots can probe call centers around the clock. So that's another thing. They have deep bake refund bots that will continually reach out to customer service to get a refund. And if it's a 24-hour call center, which a lot of them in the US aren't anymore, but if it is, they're going to catch someone at 2:00 in the morning that's absolutely exhausted. Or they're going to look on LinkedIn. You know, AI can look on LinkedIn for everyone that works that has the title customer service rep at X company or XBank and then, you know, Crofts reference that with their Facebook accounts to see who most recently had a baby. So, if you're calling them at 2:00 in the morning and they're on the call center, probably they're probably exhausted. So, that's a great time to call customer service and fake, you know, a refund claim. Um, Europe and the UK said that, um, account takeover attempts have gone up 67%. And items not received have gone up 49%.
Karisse Hendrick
31:19
And items not as described have gone up 35%. That's just in the last like year. That that's looking behind. Looking forward, it's going to be going up so much more. Um, this is what So, what can you do about it? Right? I'm never going to present a problem without some kind of a solution. And the teams that are doing a really good job at catching AI attacks are the ones that are connecting identity, intent, and context from discovery through post purchase. So, they're able to read patterns across sessions and transactions from the moment a user enters their website all the way through checkout and then maybe even after checkout. Um, they're looking at early signals, right? They'll they're able to spot misuse or disputes or account compromise before the losses get too high. So, back to what I was saying there. So, what I've noticed is a lot of the crypto companies did this about two to three years ago where they now look at the user journey. They're not just looking at events, right? Account creation, account login, payment p or purchase or transfer or withdrawal. They're not just looking at those things. That's kind of like taking a snapshot at the time like a still picture of someone breaking into your house, right? You can know that someone broke into your house, but you don't know what they took. They don't you don't know where they went in your house. You may not even know how they got into your house if it's just a still picture. But if you have security cameras outside and in, you can then see how they got into your house in the first place. Did they break a window? Did they find an open window? Did they find an open door? Did they find Did they clone your garage door opener? Whatever it is, right? If you have 247 security cameras inside and out, then you're better off being able to um not only identify how they broke in so no one can break in again, but also what they took, what where they went first, what their actions were, how they were able to get past your safe or whatever else you have. Um that's the difference between using point solutions that are measuring things at specific times and and you know taking that snapshot at the time of purchase, the time of login, the time of account create, whatever it is. Um the time of transfers or cash outs or things like that. Um newer services that allow insight into the customer journey um that provide session data rather than just transactional data um and are looking at the sessions all the way through are then able to pick up on those patterns that fraudsters don't realize that they leave or as Soups Ranjan said in a session that I moderated with him every fraudster has a tell. And when you're able to monitor all the way through from the beginning of when they enter your website all the way through to the end when they check out or when they withdraw money or whatever they their action is, they will leave a tell. They will have their phone upside down. They will, you know, and if you're able to look at telemetry through your device, you know, your digital um fingerprint or your device ID service, then you're able to know, hm, it's impossible to shop on my website when their phone is face down. Or, you know, you can know how they hold the phone or even one vendor was talking about apartment number location number uh precise like location. Um, I think they do that using telemetry of the phone and how many feet or meters it is in the air. Um, but and so they'd be able to tell you what floor uh someone is on when they're making a purchase or making a withdrawal. Um, and if that matches the apartment number. So, if they, you know, live at 1206, apartment 1206, you could know that they were on the 12th floor when they made the purchase. Will that make sense? That type of thing. There's all different data signals that different providers will provide. Sorry, that was a bit redundant. Uh different providers will give you, but the important thing is is that you are ingesting all of those and that you're looking at those patterns.
Karisse Hendrick
36:15
You're looking for those tells. Um then one of the things I wanted to leave I wanted to give kind of a note to the solution providers that are in the room the sponsors. This stat came from the Merchant Risk Council's uh fraud survey and it says that 80% of merchants name technological infrastructure as their biggest fraud challenge. So their biggest fraud challenge is an account takeover. It's not card testing. It's not, you know, getting budget for operations or anything like that. It's getting the right technological infrastructure. That's what their biggest fraud problem is. And that's a hurdle you have to help, you know, the decision maker or the influencer, you know, get across the finish line with their leadership because, you know, you're not going to see it all the time. You're not going to know it exists. Um but yeah, so that's, you know, that's the biggest hurdle and I think that's really good. Um, speaking of signals, you know, looking at for those early signals, looking for those common signals across multiple uh transactions or actions done by fraudsters. Um, the last thing that it says on this page is that a missed signal can become a fraud loss, a chargeback, or a false positive. And that is 100% true. You know, just one missed signal. So, you need to ensure that you're ingesting the right signals. You need to ensure that you're using the right products because not all products are looking at session level data yet. They're not looking at device ID and behavior biometrics in combination. Uh those are the things that seem to work for the top leaders in fraud. The groups that you know continuously have very impressive authorization and decline rates, very impressive chargeback rates that are low. Um very little false positives. So, you know, that's how you get there. I thought that that would be helpful for me to walk through and explain where we're at when it comes to AI and technology and why it's changing so much. So, if you're having to present to your leadership or you whether it's executive leadership or your, you know, direct leadership about why fraud has increased so drastically. Uh, I know of several merchants that since April or May have had to be had to explain to their leadership why their account takeovers just went skyhigh all of a sudden or why their card testing just went through the roof and their credit card processor is now contacting them and talking about the enumeration program from Visa or, you know, why they have such high refund rates or chargeback rates. Due to item not described or not delivered. Um all of these things, you know, are when you're in the room presenting those things, remember this presentation. Remember the fact that AI is is the use of AI by fraudsters is going up very rapidly. It's increasing very rapidly. Therefore, fraud instances are increasing very rapidly. I hope that that for you that doesn't translate into fraud losses going up significantly, but it could. And the best solution is more tooling, you know, more visibility into the entire customer life cycle, the entire customer journey. And by the way, if you have user journey data, you know what department really loves that journey data? Marketing. Marketing loves to know where they're, you know, what their customers are clicking on, what they're doing. So you can provide some you know really good intel to marketing or your C suite from those products because you know mapping it all out is one thing but being able to translate it to leadership to hopefully get increased budget to increase the capabilities of your tools. That's where things are going to change.
Karisse Hendrick
40:59
That's where we're going to see. Yeah, attempts are high, but the losses aren't because we were ready because we were covering more attack surfaces than we ever have before. So, that is my presentation. Um, just almost exactly 45 minutes. Uh, on stage it was about 30, but I had a countdown clock. I didn't have a countdown clock this time. Um, but maybe I need that to work that into my podcast. I don't know. But uh let me know what you think. Let me know if you disagree with me. Let me know if you agree and have an example. Um this is what I'm seeing from a 10,000 foot view of fraud. Uh when I talk to lots of companies and that is that fraud is getting cheaper and easier for fraudsters to commit. Therefore, fraud attacks are going up. You know, a 33% increase in fraud pressure is not insignificant. Um, and feel free to use any of these stats that I compiled. I compiled them from various studies uh that have been available in the last six months. Um, feel free to use them to present to your leadership and say, "Hey, this is what's happening at the industry level. Fraud is going up." So the fact that our fraud is going up shows that we're on par with the industry, but it also shows us that we need to change our tooling because our current tools AI is able to figure out where the vulnerabilities are and exploit the hell out of them. So that is my public service announcement of the day. Let me know what you thought of the presentation. If you like seeing me have slides, if you like the visual, uh, other than just watching me talk and stare into my laptop, um, let me know what you think about the presentation and the data. Um, if you disagree with it, I would be curious to know why. Uh, but I can tell you in talking with all of the merchants that I do, and I mean, it was literally hundreds just last week at the conference, everyone's feeling the pressure. And on the flip side, when I attended the AI boot camp that I talked about on last week's episode, the general consensus was that because of AI, leadership is expecting you to do more with less.
Karisse Hendrick
43:22
They're expecting higher sales and bigger growth and all of that, but they're expecting you to figure it out and figure out how to do more with less. So, you know, I do I am a big proponent on getting the right technology in, but there are people that are being really scrappy right now. There's one merchant that was having an issue with phishing messages in their chat. So, they allow their buyers and sellers to chat with each other about the product and that type of thing. And they were finding these fraudsters taking over legitimate accounts and then going into chats with um as a prospective buyer with sellers to say, "Hey, uh I'm really interested in what you're selling, but I need to have you, you know, click this link to contact me or whatever it is." Somehow they get them to click the link. Once they click the link, they provide their information and then they can take over their account and steal the stored value that's in it. What this one of the merchants, they've been doing a lot of different creative things using AI trying to identify these, but one of their analysts who is one of the smartest analysts I've I've met in a very long time and they may be looking for a new job. So if you have something remote in the US, let me know. But very just so smart and thinks so out of the box. They've been able to use chat GPT to say so they've loaded in all of these messages like the you know the way that the message flows you know and all that into a chat GPT or Claude or whoever they use along with good message you know back and forth between buyers and sellers and say hey which ones of these look like they were done by AI or and then they say okay of the ones that were done by AI. How can I identify these in the future? And one of the things they found was that every uh chatbot starts with they make the first move right in the chat and they say like, "Hi, how are you?" And then you know the person they ask an open-ended question, right? And then or maybe it's about the product or whatever. And then the, you know, good seller, the legitimate, the real person, the seller, it answers back. And then they ask another open-ended question. And then the seller answers back and then they prompt for the link. So there's like a very specific they've also looked at the words they use. They've looked at the syntax that they use. And interestingly enough, AI can identify AI. It could identify when AI is is, you know, writing out sentences. So, that's just one example of things that merchants are doing to be scrappy to try to stop this stuff. And it's working. There's lots of really interesting things that merchants are doing with AI to try to stop this generative AI or LLMs or, you know, if they have internal AI with that's paired up with their data internally, you know, like a private account that's paired up with their and a private model that is paired up with their data um that they're able to play around with. They can do all kinds of analysis that they may not have thought about before. So, there are some hidden silver linings, but if you're expected to do more with less, and fraud is going to be just increasing at an all-time high over the next several quarters, you're in for a busy time. Um, and that is why we did the AI boot camp because we know people are being expected to use AI in specific ways um or in in specific ways where they don't tell you how to use it. They just say, "Well, you need to reduce your human time by 25% or whatever." So, we're living in very interesting times, but we can fight AI with AI.
Karisse Hendrick
47:39
There are um providers out there that have AI agents that will screen, you know, manual review for you or that will look at all of your rules and see which ones fired and propose new rules to write or new things for the model to ingest. So, we we have a few tricks up our sleeve, too. But there's more of them than there are of us. So, it's really good for us to share information and that's ultimately why I wanted to share this presentation and why I do this podcast. So, on that note, I am going to go for the day. I hope I gave you a few things to think about, a few nuggets of information to ponder over. And don't forget to reach out to me if there was anything significant in this uh I was going to say session, but this episode I at the conference I was calling them episodes and now on the podcast I'm calling them sessions. I just my brain gets mixed up because I really enjoy creating content. But you know, if it gave you fuel for thought, if you have more questions, I'd love to hear from you. It might turn into a second, you know, a follow-up podcast episode or I might just write you back. Uh, LinkedIn is preferred over my email. Um, I don't get as much spam in my LinkedIn as I do in my email. Um, and especially with the political season and the midterms happening in the US, I don't know who I donated to and when, but man, am I getting a lot of those emails now. And I stupidly used my work email address. So things are getting lost, but that's another story. Uh, I'm going to let you go for the rest of the day. I hope I gave you some things to think about, and I will talk to you more next week.
View full transcript
