#11042 min
FRAUDFORWARD
#100Payment Fraud Prevention and the Future of Trust
60 min
What’s up, fraud fighters, and welcome back to Fraud Forward!
I wanted to do something different for our 100th episode. I didn’t want a victory lap. I wanted an honest conversation about payment fraud prevention, where our systems feel fragile, and whether we are building financial infrastructure worthy of public trust.
I brought together Karisse Hendrick, Becky Reed, David Maimon, and Jeff Taylor to talk about what fraud fighters are seeing across banking, payments, e-commerce, digital assets, and fraud research. Fraud is moving fast. Payments are moving faster. AI fraud detection and AI fraud prevention are becoming more important every day. Institutions are trying to balance innovation, regulation, speed, and protection all at once.
This conversation is not just about payment fraud detection or payment risk management. Behind every account takeover fraud event, business email compromise attack, wire fraud case, ACH fraud prevention gap, or social engineering fraud scheme is a real person, a real business, and a real loss of trust.
What you’ll hear in this episode:
- How faster payments are changing real-time payment fraud prevention
- Why payment fraud detection must move beyond isolated incidents
- How AI fraud prevention, AI fraud detection, behavioral biometrics, and device intelligence are changing fraud strategy
- Why business email compromise, check fraud, wire fraud prevention, ACH fraud prevention, and account takeover fraud remain major concerns
- How digital payment fraud is evolving across banks, merchants, marketplaces, and digital asset rails
- Why social engineering fraud continues to exploit trust, emotion, and human behavior
- What collaboration, fraud education, and payment risk management need to look like moving forward
Who should listen:
- Fraud fighters across banking, fintech, payments, and e-commerce
- Financial institution leaders and fraud professionals
- Risk, compliance, cybersecurity, and payment operations teams
- Teams focused on real-time payment fraud prevention
- Professionals working on ACH fraud prevention, wire fraud prevention, and account takeover fraud
- Leaders evaluating AI fraud prevention, behavioral biometrics, device intelligence, and fraud orchestration
- Anyone who cares about protecting trust in financial services
Episode notes & key takeaways:
The broader context
Fraud is no longer isolated or opportunistic in the way many institutions still treat it. It is organized, scalable, emotional, and increasingly powered by AI, automation, and faster payment rails.
What’s working
There is real progress happening. Institutions are investing in payment fraud detection, fraud education, device intelligence, behavioral biometrics, AI fraud detection, and stronger controls.
Where gaps remain
Legacy systems, outdated regulations, weak collaboration, and fragmented data create room for digital payment fraud, account takeover fraud, business email compromise, and social engineering fraud to keep growing.
The human impact
Fraud is not just a transaction problem. It is a trust problem. Social engineering fraud works because criminals understand fear, urgency, confusion, and human behavior. We have to protect victims without blaming them for being manipulated by professionals.
Ethical responsibility
It’s one thing to make payments faster. It’s another to make sure real-time payment fraud prevention keeps up.
The path forward
What needs to change by 2029: stronger payment risk management, better fraud education, more collaboration, smarter AI fraud prevention, modernized regulations, stronger ACH fraud prevention and wire fraud prevention, and systems that can respond before damage spreads.
Key takeaways
- Payment fraud prevention must evolve as payments accelerate.
- AI fraud detection and AI fraud prevention are now critical parts of fraud strategy.
- Device intelligence and behavioral biometrics help institutions detect risk earlier.
- Business email compromise, social engineering fraud, and account takeover fraud are still major trust threats.
- ACH fraud prevention and wire fraud prevention require stronger operational controls.
- Payment risk management must become more proactive and collaborative.
- Fraud prevention must protect people, not just transactions.
This episode reminded me why this work matters. Payment fraud prevention is not just about stopping losses. It is about protecting the trust that holds the financial system together.
As fraud evolves, we cannot rely on outdated assumptions, fragmented systems, or reactive thinking. We need stronger collaboration, smarter technology, better education, and a deeper commitment to accountability.
Stay vigilant, stay informed, and keep moving Fraud Forward.
Guests
Episode transcript
Hailey Windham
00:05
All right, so what is up, fraud fighters? Today's episode is a little different. We are obviously going to be doing the episode for our 100th, right? It's our 100th episode, and I don't know how I really feel about it. I'm kind of freaking out in the best possible way, obviously, because this is just one of those almost dream moments, I'll say. So I'm very excited that we're here. I'm very excited for the crowd that is with me. I say crowd because I've got four panelists with me. I've spent a lot of time thinking about what this episode should be, at least in my mind, because I didn't want this to feel like a victory lap. I didn't want another surface-level panel conversation, and I definitely didn't want to spend an hour recycling the same debates this industry has heard over and over again. But I wanted this conversation to feel useful, strategic, honest, and worthy of the people listening, because fraud is changing faster than most institutions were designed to adapt to. Payments are accelerating. Consumers are more confused than ever. Organizations are under pressure. Regulators are reacting in real time. And somewhere in the middle of all that, trust is thinning. And honestly, this conversation became even more relevant yesterday when the White House released new guidance around integrating financial technology innovation into regulatory frameworks. Thank you so much for doing that the day before my podcast. So I've read it enough to know it matters. I haven't read it enough to pretend I fully understand all of the downstream implications yet. But I think that alone says something important about where this industry is right now. Innovation is accelerating. Regulation is reacting. Fraud is evolving. And institutions are trying to keep up with all three at the same time.
Hailey Windham
01:58
So today isn't about defending positions. It's about asking whether we're designing a financial system worthy of public trust. Welcome to the Fraud Accountability Summit. Today I'm joined again by four incredible leaders from across the fraud and payments ecosystem. Karisse Hendrick, my own fairy fraud mother, chargeback and fraud consultant, host of the Fraudology podcast, and one of the most respected voices in e-commerce and payments fraud. Becky Reed, financial services executive, collaborative strategist, and thought leader focused on the future of cooperative finance, payments innovation, digital assets, and shared financial infrastructure. David Maimon, a fraud researcher and cybercrime expert whose work focuses on criminal ecosystems, fraud operations, and the industrialization of cyber-enabled crime. And then joining us with the enterprise banking perspective is Jeff Taylor, Senior Vice President within the Corporate Banking Group at Regions Bank, where he leads strategies focused on fraud prevention, commercial account security, payment risk, and client education. Thank you all so much for being here.
Hailey Windham
03:05
Okay, so today's conversation is broken into four quick segments: what's actually breaking, speed versus control, the trust gap, and finally, what must change over the next three years. We're keeping this fast-moving because we only have an hour together, and I went over my five minutes, so by a minute. So I'm going to start with the difficult question. Where do you believe the system is most fragile right now? David, I'll start with you. From the perspective of criminal operations and cyber-enabled fraud, where do you believe the fraud ecosystem is most fragile right now?
David Maimon
03:40
Thank you so much for having me, Hailey, on this 100th episode, and congratulations. This is a great achievement. We're all proud of you, and this is amazing. In terms of where the system is most fragile, I think verification and know your customers, this is where essentially we're experiencing most of the issues right now. I draw heavily on this answer by simply looking at FinCEN data that are being published out there, the SARs data that are made available. If you look at the volume of stolen cards and debit cards that are reported in FinCEN, you see those are increasing dramatically. If you're seeing the volume of account takeover, you will see those are increasing dramatically. If you look at check fraud, we see a decrease from 2023, like a 30% decrease, but still very high in comparison to what we've seen in 2020. And then, of course, suspicious wire transfer. So to me, all that speaks volumes to the fact that we are having issues with verification, like knowing our customers, knowing who they are. We have those issues in the context of onboarding. We have those issues in the context of maintaining the customers. One of the major issues that we are experiencing right now across the industry, in my mind, and that I see more and more organizations paying attention to, is identifying businesses, small and medium-sized businesses. This is a major issue that we are experiencing right now. We haven't even seen most of what we will see in the next couple of years or so. We just see the tip of the iceberg at this point. To me, this is where we're most fragile. This is where we're most fragile at this point.
Hailey Windham
05:28
I agree. I want to have one follow-up question for you, David. Do you think institutions are still treating fraud like isolated incidents instead of coordinated systems?
David Maimon
05:38
It depends on the institutions. If we're looking at large organizations, large financial institutions, I think their state of mind is getting more and more into understanding that we're looking at fraud rings at this point. So we are trying to connect the dots. But when we look at small institutions, small credit unions, they don't have the resources to look at the problem the way it should be looked at. Unfortunately, in the context of their operation, we're seeing them looking at isolated cases and not necessarily connecting the dots. So it depends.
Hailey Windham
06:11
David, one thing your work consistently highlights is that fraud is no longer opportunistic in that traditional sense. It's structured. It's scalable. So Karisse, I'm going to bring you in on this one. From the perspective of e-commerce and payments fraud, where do you believe the system feels most fragile today?
Karisse Hendrick
06:28
Similar to David, I think it's upstream. I think that e-commerce companies and marketplaces have done a really good job of securing the payment side for credit card fraud, card testing, et cetera. But really, when it comes to customer onboarding, when it comes to account takeovers, loyalty fraud, refund fraud, the places that don't result in a chargeback but still result in a loss are really fragile, for sure. And then I would also say that, I just lost my train of thought. Sorry about that. I just left the station. But I would say too that it's mostly upstream, though there are still card testing and enumeration attacks. They're not as bad as what's happening at the beginning.
Hailey Windham
07:13
I agree. Jeff, I'd like to bring in the enterprise banking perspective. So from that perspective, and even commercial fraud prevention, where do you believe organizations are most vulnerable right now?
Jeff Taylor
07:24
I think, Hailey, near and dear to David's heart is check fraud. We still see a huge amount of check fraud, even though it has declined according to most surveys. We're still seeing it, and we're seeing businesses who are actually denying moving to any digital payment channels. They say that, you know, I will continue to write checks, and I'm going to have to continue to write checks. I think there's a lot of reasons for that, but primarily it's the ease at which they are able to use that payment channel and not have to make any changes or adjustments to the way that they reconcile, to the way that they are originating payments. So I think that's a vulnerability we're going to continue to see. We've seen it with the assaults on postal service workers and all the different things that are happening that enable these fraud rings to go into a geographic area, steal these checks out of the mail, and then negotiate them, either altering them somehow, creating a counterfeit check, or just the ease at which they alter the signature and forge the endorsement on the back of the check.
Hailey Windham
08:43
So agree. Are there any operational gaps that concern you most?
Jeff Taylor
08:48
On the business side?
Hailey Windham
08:50
Yeah.
Jeff Taylor
08:51
Business side.Right. I preach this all the time, Hailey. It's so important that businesses understand their responsibilities on their side of the payment transaction. The ability to create just a simple process, a simple callback control to help remediate business email compromise, I promise it would literally probably put me out of a job. Because if I could get businesses to do that 100% of the time, we wouldn't have business email compromise. They'd be calling their trusted partner at numbers that they know, and they would be able to confirm that those requests are not legitimate when they're not, but legitimate when they are. And I think it's just an important thing. I always say it's a five-minute phone call, and it's a whole lot easier to explain why I'm calling than it is to go back and explain a half-a-million-dollar loss.
Hailey Windham
09:45
So true. Okay, so now, Becky, I want to bring this to the future-state infrastructure side of the conversation. From the perspective of cooperative finance and emerging financial infrastructure, where do you believe the system feels most fragile today?
Becky Reed
10:00
The legacy antiquated systems we're all forced to use. I think that being 30 years in the credit union space, I understand firsthand how painful it is to deal with the fragmented, batch-focused processes that are reactive as opposed to being proactive. What I am privy to now, coming over on the emerging technology side, and payments are being disrupted first. We have digital asset rails. We have stablecoins. We have Bitcoin. We have all kinds of cryptocurrency happening, and consumers are using these things today. People are buying cryptocurrency. They have digital wallets, and they have had them for quite some time. That's not new. Integrating that into traditional financial systems is new. And then you layer on AI. AI is just looking at data, and the bad guys have a ton of data. Now they are using AI in order to infiltrate financial institutions from account takeover. They're creating fake identities that are coming into the financial institution. They're using mules, and they're using digital asset rails to move money cross-border in an attempt to thwart the existing systems that are in financial institutions today. And today, I have to say, they're winning more than they're losing. Because on the financial institution side, the TradFi side, we are slow to adopt emerging technologies. Because look, you just talked about regulations we have to comply with, right? There are all kinds of things that we have to do. There are emerging fintech partners that we have to vet, and some of them are new, and we're not really sure if we can trust them. And all the while, our members are getting scammed. David just brought up some information about merchants and what's happening there. Jeff just brought up how email fraud and phishing attempts are decimating our business customers, tricking them into sending wires. AI is right in the middle of all this. So I feel like where things are fragile today in TradFi is the lack of understanding and slow adoption of newer technologies that can help us be more proactive.
Hailey Windham
12:25
I so agree. I had follow-up questions, but you answered them, so I'm so grateful for that. It was that legacy financial models are preventing us from innovating safely, right? And then the concerns, obviously, are those legacy systems that just really can't keep up. I really appreciate your perspective. I think what stands out already is that every layer of the ecosystem is feeling pressure differently, but everyone is still feeling pressure, and that pressure only increases as payments move faster. So we'll move on to the next segment, which is speed versus control. We've built speed, but have we built safety? Because right now, payments are moving faster than ever before, and fraud teams are being asked to make decisions in seconds. Jeff, I'll start with you on this one. As payments accelerate, how do organizations balance speed with operational discipline and fraud prevention?
Jeff Taylor
13:18
I think from the bank side, the understanding that introducing a little friction is not a bad thing. I think we've got to come to that realization that in order to help protect a client, we've got to put a little friction into the process. But I think on the client side too, as I mentioned a moment ago, it's important that clients continue to educate, and that they continue to push that education, not only at the C-suite level. Because CFOs and treasurers, they understand all of this, and business owners understand. But to get to that accounts payable department, or the vendor management department, or even payroll, and helping them understand how vulnerable they are. We see the use of social engineering so much. These fraudsters are out every day trolling social media, looking for vulnerabilities. They're looking for vulnerable victims. They're looking for people they think they can recruit. All of those ways that they're able to conspire with someone within that organization. And so we've got to continue to push that education to those levels to help those folks understand that they're vulnerable when they post different things on social media, and whatever they do in the positions that they're in, that they can be compromised if they're not careful.
Hailey Windham
14:42
So true. So how important are concepts like dual controls and staff training today, do you think?
Jeff Taylor
14:48
It's huge. I think having dual control, you're starting out with multifactor authentication. Obviously, any time you can use facial recognition, you want to use it. Any opportunity for other levels of multifactor authentication. I love dual control. I think when you have a second set of eyes looking at a payment transaction, then there's got to be some sense of control there to say, you know, we may need to look at this a little deeper. And you don't have to do it on every transaction. You set what your risk tolerances are as a business, and maybe you're only going to do it for a certain transaction above a dollar amount. I always suggest every transaction, but if you feel like that's too much, then set a dollar amount and only do dual control on those above it.
Hailey Windham
15:38
I love that. And I did want to make sure that I call out, you mentioned friction. I'm going to quote one of my very good friends in this industry, Karen Boyer, who says that fraud is the new friction and fraud prevention is the new customer service. So I just had to make sure I called that out before she comes for me later. While enterprise organizations may have larger infrastructures, many smaller institutions are navigating these same risks with far fewer resources. Becky, I'd like to bring you back in. As payments accelerate and new financial technologies emerge, how should cooperative institutions think about balancing innovation with resilience?
Becky Reed
16:18
One of the things I say about financial cooperatives is that cooperation is our superpower, right? Collaboration is our superpower because ultimately our end goal is not to be a for-profit entity, right? It's for service, right? Not for profit, but for service. Making sure that our members are using payments in a way that protects them and provides consumer protection and provides the financial institution, because at the end of the day, it's our members' money, right? If we have a loss, the members together, cooperatively, are experiencing that loss. Now we have to charge higher interest rates, or we can't pay as high of dividends, or whatever the case may be. We can't open the branch across the street that they wanted. So I think that smaller institutions have got to really double down on that collaborative superpower. Necessity is the mother of invention. So what can they do to cooperate and collaborate and share things? I use this example all the time. The credit union, or even the community bank across the street, is absolutely experiencing fraud. I am too, but I don't know what they're experiencing, and they don't know what I'm experiencing. It might be the exact same thing. And if we knew about each other's, we could stop it a lot faster. Are there collaborative models where we can have some anonymized data that AIs can take a look at? Of course, I'm an emerging technology payments person, right? This is not something that isn't possible today. Can we have a pool of data that helps financial institutions, especially ones that are local and are together, pool their information and their data to help stop fraud in its tracks? I think that for smaller institutions, working together is going to be the best way to win.
Hailey Windham
18:12
I love that. There was one question in particular that I wanted to make sure I asked you, because I'll never forget when you and I met forever ago in Ohio, and I walked up to you, you know, hi, I'm from a credit union. What's your asset size? And you're like, I hate when people ask me that. So I want to ask, can smaller institutions realistically modernize at the speed consumers now expect?
Becky Reed
18:36
I'm going to say they can do it better and faster than larger institutions can. A lot of times at a smaller institution, other than cost sometimes being a barrier, right? If it's too high of a cost, then they're not going to be able to afford it. But then they could look at maybe three or four institutions implementing something at the same time and spreading the cost out for that particular product or service over that. A small institution might have one decision maker, and that's it. That decision maker presents it to the board and puts it in the budget, and they run with it. So I think smaller institutions, in some ways, have advantages because they can be faster to market. They can try newer technologies. And in fact, small institutions in the credit union market have a history of being the first to do things. They were the first ones, oftentimes, to offer an ATM card instant issue, right? The banks weren't doing that. To offer digital banking, that was one of the first things credit unions did. To offer a debit card, that was one of the first things credit unions did. It's not uncommon for small institutions to innovate faster. So I think we need to take advantage of our size and the fact we don't have too much red tape. [Ad Break (19:56): Finally, I’m so happy to share with you all that the Saturday Fraud Strategist is now a podcast. What? Yeah. On top of my weekly newsletter, you could now listen to watch me talk about my, and hopefully your, favorite topic. Fraud strategy. And from time to time I’ll be hosting operators and founders to discuss where the industry is headed and what we fraud fighters should pay attention to. I must say, I’m super excited. And if I’m being honest, a bit nervous about all of this. I’ve been debating with myself whether to start a podcast for ages, but kept putting it off. But now, this teaser is out. So I guess, there is no turning back. So if you want to join me for the ride, head over to Sardine’s website and subscribe now. Are you ready? Am I ready? We’ll find out next Saturday.]
Hailey Windham
20:55
Okay, David, now I'm going to bring you back from the criminal side of the equation. How are fraud actors exploiting the speed of modern payment systems?
David Maimon
21:03
It depends. The cool thing about fraud is that it's just so bad and cool for me as a fraud researcher, right? I don't want people to think that I like fraud. I like understanding it, right? So it really depends. It really depends on the type of fraud you're looking at. For example, when you look at account takeover, folks will take over an account, bypassing dual-factor authentication, unfortunately, at this point. I mean, we know that they know how to do that. And they will simply sit on the account for a period of time, trying to understand the patterns there, trying to understand the spending pattern. They will not drain the account right away, right? Then they will try to slip in charges that will be in line with what the legitimate account holder would have in mind, in order to evade detection, in order to make sure that they do not raise any red flags. So that's one example. The other example, in the context of check fraud, we actually had a white paper recently talking about the different types of mule accounts that the criminals are using. So we know that at this point, the financial institutions out there are aware of the fact that the criminals are creating those bank accounts and sitting on them for a long period of time before they actually deposit a check and run away with the money. So in that sense, the criminals take a longer period of time to groom the account, to have all those transactions that need to look legitimate, so to speak. It will depend on the financial institution and their scrutiny on those accounts, but usually we're talking about maybe between a six-month to 12-month period of time. They will deposit the checks and run away with it, if they know what they're doing. And then obviously, we have the issue of stolen debit cards and credit cards. Once you have a stolen debit card or credit card, usually what folks will do is right away try to spend the money. So it really depends on the type of fraud that the fraudsters are engaging in, and we need to be aware of it when we are trying to think about different controls, different solutions, which will help us prevent and potentially mitigate that issue.
Hailey Windham
23:29
For sure. So I love that you brought up the debit and credit cards because I'm going to transition to Karisse. I think this is where customer expectations become incredibly important. So Karisse, as payments become faster and more invisible to consumers, are we creating convenience that outpaces understanding?
Karisse Hendrick
23:49
From a merchant perspective, sometimes I think that there's the issue of competition amongst e-commerce merchants and marketplaces with each other, especially those that are competing with the Amazons of the world. Amazon is approving and has so much data on consumers that they're able to approve so many more transactions than maybe a smaller merchant that doesn't. And smaller could be a $4 billion company. They still are large, but they're still approving as many and not declining because they think it's fraudulent. So they have less information than an Amazon or a Walmart may have, but they have to make fast decisions, or else they're going to lose that customer, not just for that one transaction, but for the lifetime value of the customer. So that's definitely something that's always top of mind. Balancing out fraud rate with approval rate is really the important piece there. Additionally, looking at your chargeback rate, how much are you actually losing compared to how much you're stopping in the upfront? Those are counterbalance metrics that can help you really focus. I think over the last 10 years, merchants have done a good job of not just looking at fraud rate and chargeback rate, but looking at approvals and trying to balance that out and make sure that they're in the game as far as competitive markets go. Additionally, there are a few different sectors of e-commerce merchants and marketplaces. That's one reason why I love the merchant side, just because they're all so different. A travel agency is going to have completely different fraud than a sneaker retailer. They're going to have completely different consumer behavior as well. When it comes to speed of payments, digital goods merchants consistently have a lot more pressure than retail goods. If you think of it, when you buy something from a retailer and they're shipping it to you, they, in a sense, have maybe two to three days where they can call that back through UPS and get their merchandise back. If all of a sudden the fraudster gets greedy and starts to place a whole bunch of orders, it's like, okay, we can pull our merchandise back, and we can get that back and then resell it to someone else. But when you're talking digital goods, like event ticketing, travel, any kind of gift card purchases, food delivery, any of those things, they have to make decisions very, very quickly. So the more data they can have access to, the better. The more information that they can have, as well as upstream, not just at the point of purchase, is really important. And then the last thing I'd say, and actually what I was going to mention previously, is we have also seen seller fraud go up quite a bit, and account takeovers on the marketplace side for sellers. So two-sided marketplaces, they're not just accepting purchases. They're also paying out. So you think of the Airbnbs of the world, the Etsys of the world, eBay, et cetera. They're starting to see a lot more account takeovers on those sides, and fraudsters changing the payee information. Historically, that hasn't been a place that they've really been very secure. I mean, they've had some security around that, but not as much. That's really a part of evolving fraud when it comes to faster payments. Airbnb and Vrbo are competing against each other. They both want to be able to pay out their hosts as quickly as possible. But if you have fraudsters going in and changing the payee information and having those funds go to a fraud account, then they're going to have to put more controls in place. So that's something that we've seen emerging over the last year or so that I think deserves a call out, and that's specific to marketplace merchants.
Hailey Windham
28:06
And David, it kind of looked like you were wanting to say something. So I want to ask, if you guys, and feel free to speak up anytime, but it looked like maybe you had a little more you wanted to give to us. David?
David Maimon
28:16
It's really interesting on the retail side. This is just an anecdote. We're seeing that in terms of agentic AI. We're seeing a lot of agentic AI being directed to the retailers and the banks at this point. That goes in line, of course, with the speed of transferring payments. They actually want to take advantage of the fact that payments will run quite quickly if they have those accounts with them. And so we're seeing an increased interest in the fraud ecosystem in using AI tools to create those accounts on a very large scale. We actually showed how easy it is to do that, and it's just something to keep in mind. I just want to make sure that folks are aware of it because in the context of, again, merchant fraud, the speed is very important. And yeah, folks are creating those accounts on a very large scale, unfortunately.
Karisse Hendrick
29:07
I'm so glad you brought that up. That was something that I meant to bring up earlier too. We are definitely seeing agentic AI being used, as well as AI in general, not just agentic AI, but AI in general being used for fraud attacks. I think one concern that merchants are starting to highlight to the card brands, Visa specifically, is that they do not currently have any verbiage in the chargeback regulations for merchants to fight back on chargebacks when agentic AI is used. So there have been some merchants that have had really high-dollar purchases, including one that was $36,000 that I know about. The cardholder said, I told my agent to do this. I flat out admitted it was agentic commerce, but it was a mistake, or I didn't want it. And because there are no stipulations in Visa guidelines right now, the merchant threw everything they could at that chargeback saying, we're not just proving the person's identity now. We're trying to prove intent. They threw everything they had as far as compelling evidence. But because there is no stipulation there right now, it's a wide, gaping hole where even good customers that aren't stealing credit cards or payment methods in general can issue chargebacks and essentially have the merchant pay for it, and they keep the merchandise.
David Maimon
30:35
Yeah.
Hailey Windham
30:37
That's so scary. It's something I hadn't heard yet, but man, just... Jeff, what do you think?
Becky Reed
30:43
Well, to me, that...
Karisse Hendrick
30:46
Yeah, I'm basically telling people how to get a free big-screen TV or a free trip, and I'm not trying to, but that's...
Hailey Windham
30:48
Exactly.
Becky Reed
30:53
Well, I think, you know, I'm on the digital asset side of the house, right? Emerging payment side of the house. Everybody's spending a lot of time talking about the CLARITY Act and all this stuff, and I'm like, can we modernize Reg E?
Hailey Windham
31:06
Please?
Karisse Hendrick
31:09
Please. We would love that on our side.
Becky Reed
31:10
And can we say that digital assets, if they're used as a payment, should fall under Reg E? So along with all of these things that you're talking about, I think maybe we don't need new legislation or new regulations, but we need to modernize what we already have to fit into the landscape that we're facing today.
Karisse Hendrick
31:32
That is one of the biggest things that the merchants I work with have complained about. I'm doing a webinar with Visa coming up soon on VAMP, and I asked a large group of merchants that I work with what they wanted to ask Visa. Continually, it was, how do we get Reg E and Reg Z updated so that we can tackle friendly fraud, tackle the people who are using their own payment method but are taking advantage of the chargeback rules in their favor? And I think I've also heard from issuers I've talked to saying they're just as frustrated. They can see the abuse and the manipulation happening on their end, but they can't do anything either because they're required to file chargebacks. So that's a really good point, Becky, that you bring up, and I would very much agree with you on that.
Jeff Taylor
32:22
Hailey, I keep waiting to see a chargeback for three gallons of milk because someone's refrigerator ordered a case instead of a single gallon.
Hailey Windham
32:31
Yeah, that would be my use case for sure.
Karisse Hendrick
32:35
Or the wrong flight. Yeah, go ahead. Sorry, Jeff.
Jeff Taylor
32:38
Can I go back to something Becky said a few minutes ago? She's talking about collaboration. I think that speaks to the value of podcasts like yours, number one. Thank you for being the host.
Hailey Windham
32:49
We'll toot the horn.
Jeff Taylor
32:50
But secondly, just the consortium opportunities, the ability for banks and credit unions to come together and talk about what's happening. It's not a competitive issue. I always say, you can guarantee that the fraudsters are talking. David can speak to this. They're on Telegram and WhatsApp, and they're talking all day long, and even YouTube, where they're telling each other how to do things, how to defraud, how to do first-party fraud, all these different things that they're teaching each other what to do. But we're not talking amongst ourselves to talk about how can we help protect it. So kudos to you, Hailey, for leading the podcast and for the lead that you take in the education industry.
Hailey Windham
33:34
And thank you, Karisse, for the nudge to make me do it. So I appreciate that. And thank you, Jeff. I agree. I was going to say, what is it, where nobody wants to be first in fraud? So yeah, we all need to share.
Hailey Windham
33:52
So okay, I'll move us on to the next segment. We've talked about what's breaking. We've talked about how speed is outpacing that safety. So now I want to ask that harder question. Where is the erosion of trust we're seeing a design failure or an execution failure? Are we designing payments with fraud prevention embedded or bolted on afterward? And what are we pretending works that actually doesn't? David, I want to start with you on this one. What part of the system was built for convenience instead of resilience?
David Maimon
34:27
It's a really great question, right? I spent some time thinking about this, and I think the way the question is framed, we need to change it a little bit because I don't know if convenience is the way we're looking at it. I think it's risk tolerance. I think the system is built for risk tolerance. Each organization has their own risk tolerance, and they're willing to invest as much as they can, making sure that they do not lose as much as they don't want to lose. And so systems are built, an organization builds those fraud prevention, fraud detection controls around the risk that they envision. Whether that's good or not, that's just a reality. And so I guess that's the best I can do in the context of this specific answer.
Hailey Windham
35:16
Yeah, no, I appreciate that. So I will ask though, as a follow-up, what do criminals understand about human behavior that institutions still underestimate?
David Maimon
35:30
Criminals understand that once the risk tolerance is high, they should just keep going, right? And again, I don't want to be too political on this issue and talk about things that sometimes the industry does not want to hear. But the fact that we're writing off fraud is, in a way, us fueling fraud. That's just the bottom line. And so the criminals understand that. They will try to find the path of least resistance where organizations are essentially willing to take losses. They will go and hit those. Criminals are very rational individuals, and they know exactly what they're doing. Yeah, I think that's the best way I can address this question.
Hailey Windham
36:20
Yeah, no, I agree completely. I think that we've allowed the criminals to surpass us just because they don't have to follow the same rules and regs. They are considering the human aspect in the sense of that manipulation, that social engineering, whereas we're following policy that was created 20 years ago. I was trying to explain it to my husband last night whenever we were talking about, what exactly is my 100th episode? I was like, well, whenever you send your Zelle and you think it's instant, it's really not. It's not settled yet. We're talking about different things. So anyways, that was one of the things that we talked about too, just the fact that we are having to follow these old antiquated policy systems dealing with old legacy infrastructure. But the criminals, they get to switch on a dime. They literally can just pivot. If something's not working, they pivot. They go to the next one, or they try the next thing. And what's the punishment if they get caught? I'm sorry. You know, don't do that again. That's bad. So anyways, I digress. But Karisse, from your perspective, is the trust gap happening because fraud controls were added onto payment systems later rather than designed into them from the beginning?
Karisse Hendrick
37:39
I guess I could take this question two ways. I could say, what's going on at the merchant level? Are they bolted on at the end, or are they integrated in the beginning? It really depends on when the company came to fruition and the technology that they had and what they knew about fraud when they started. There are almost 100-year-old companies that are trying to catch up in infrastructure because their main systems are still in DOS. But then you've got companies that have been around for less than 20 years that knew fraud needed to be baked into the system. The other piece I would say is on the credit card system as a whole and the payment process and ecosystem as a whole. There are some fundamental frustrations that we have on a regular basis. We still can't get cardholder name, for example. We can't verify cardholder name. We can't verify their email address or their phone number. All we can verify is the street letters of their address and their ZIP code and hope that that's going to tell us that the cardholder is making the purchase. So those are things within the system that it would be great if card brands could do more because that does impact trust, right? Because we're dealing with so little information through the payment system that we have to go on other things, such as device ID and device intelligence and behavioral biometrics and things like that. So I think that's the two-part answer there. I do think that there are some companies, and they're often the largest tech companies, that see risk as a competitive advantage. I've always said that whenever I hear anyone say that there's an acceptable level of loss in their company, similar to what David just said, that usually means they're letting in fraud. I think all of us work toward 0% fraud. We know that that's never attainable, but that's what we should work toward. As soon as a company says, well, we're fine with 2%, 3%, then they're letting stuff in that maybe they shouldn't. And they're fueling criminal enterprises and giving away their merchandise in fraud scenarios.
David Maimon
40:17
And think about what that does to the ecosystem. You and I talked a lot about PPP loans and the SBA loans in 2020. Everybody was flagging that to the government, saying this is happening, and nobody cared.
Karisse Hendrick
40:37
They didn't care.
David Maimon
40:38
And so by the government or no one really caring about that, we fueled this tremendous wave of fraud we're seeing in the last five years or so.
Karisse Hendrick
40:51
It's basically like giving them venture capital for their enterprises, right?
David Maimon
40:56
Yeah, right. I mean, why wouldn't you do that? It's easy money, so why wouldn't you do that?
Karisse Hendrick
41:00
And then they invest in AI, and they invest that money in other systems, in addition to all of the other criminal acts that they're doing.
David Maimon
41:11
So Karisse, at this point in the context of AI, for sure, the investment is not that high, right? You can get clean AI to bring your videos to life for $10 a month.
Karisse Hendrick
41:24
That's a good point. That's a very good point. It's not expensive, but they are using some of that to invest in it. The rest is going often to other crimes, human trafficking, drugs, et cetera.
Hailey Windham
41:37
I love that you guys brought that up with the SBA loans because it's like, I get that we had to do something fast, but that was done in 9/11. It was done fast, and then there were issues, and they were exploited, and we had a lot of fraud. So why didn't we fix it before COVID? What was that? It was already built. We just let it sit there with all the flaws. Becky, you look like you wanted to answer that question too that I asked Karisse, so I was just going to point it back to you. What do you think?
Becky Reed
42:06
Well, so in 2024, there's $20 billion in fraud, and $11 billion of that was using digital assets. And so that is increasing. I say a lot of times, look, BankSocial, we embed a digital asset platform into a digital banking process. I promise you that if your financial institution has sleepers within your ecosystem, which they all do, we all do, right? The minute they see that they can buy Bitcoin and send it out, that's what they do right away. Because it's faster than an ACH, and they think that they've got the mechanisms on the back end to obfuscate where it is going. Now, of course, all that stuff is traceable and transparent on-chain. Doesn't mean you can always get it back, but it's a vastly different world than ACH. And I feel like when financial institutions and really TradFi in general start to really see the capability and the functionality of being proactive. For example, that bad guy, right? We can use AI, and we can look at the history of that account. This could be an account takeover, or more likely it's going to be a scam, some sort of romance scam or something, saying, I need you to send me Bitcoin because of whatever. And so let me walk you through how to do that. Well, we can take a look at the activity on the account and we can say, this is not normal behavior for this person. The person is 85 years old, and they're buying Bitcoin. That's probably a red flag. So we can adjudicate, have somebody take a look at that transaction proactively before we send it out. Also, the wallet address that they put in there, this is something that is not available on the ACH side or the FedNow side right now, or any of that, where I can actually vet an account before I send money, right? Can I look at that account and go, hmm, what's been going on with that account? Did it just get opened yesterday? Has it had $500,000 worth of transactions come through at $50 increments in the last 10 minutes? As soon as the money hits that account, is it all going out to 25 different wallets? So we can see all of that proactively when you're using a digital asset payment on blockchain that you can't do with other analog, traditional payments that we have today. And so I really have a positive view and outlook for the future as we move into these newer technologies. And AI is a part of all of that. AI is being used by the bad guys prolifically everywhere, and we need to start taking advantage of those technologies too. To your point, David, for a financial institution, now you probably need a technology partner to help you, but for a financial institution to have an AI look at the data and spit out things proactively, so these look funny, you might want to look into it, not that expensive.
Hailey Windham
45:15
I agree. So Jeff, I want to make sure that you get the opportunity to speak on this too. When you think about rebuilding trust in payments, do you believe the bigger challenge is technology, like we've been talking about, or is it human behavior?
Jeff Taylor
45:31
I think it's a combination of both. So often, under the guise of efficiency, we will put things in place. Think about your car, cruise control, lane assist. I rented a car the other day that had lane assist turned on, and I was like, I don't want this. How do I turn this off? Because it bothered me. I must have been swerving, so I guess I will...
Hailey Windham
45:57
The first time it scared me at a drive-through, it vibrated my seats, and I was like, oh my gosh, what is happening?
Jeff Taylor
46:03
I probably needed it, but I didn't want it. I'll put it that way. But I think it has to be a combination of both. We've got to have the technology in place to help recognize, as Becky said, that these look a little strange. These situations look strange. But then also enabling the human behavior to evaluate those situations and make that determination. Because if we allow AI to cancel the transactions, if I think about the volume of false positives that we see on a regular basis, we're going to be canceling some good business transactions that are going to result in issues for those companies. It's going to be a real estate closing somewhere that we're going to cancel that wire because it looks suspicious, and it's going to end up costing that company money. So I think we've got to have that balance, a good balance of that, and then be able to have those kinds of controls in place to help recognize, not only recognize, but to prevent the transactions before they ever occur and they're ever originated.
Hailey Windham
47:20
I so agree. Then Becky, I know I made you talk a minute ago, but I still wanted to ask this one question of you since we're talking about trust. When you think about rebuilding trust in financial services, do you believe the future depends more on technology or collaboration?
Becky Reed
47:34
Well, just like everybody has kind of said, it's certainly both. But I think that human behavior and the bad guys taking advantage of human behavior, they're really taking advantage of trust, right? So they are getting somebody to trust them, whether it's through an email from somebody you trust or from an organization that you feel like you trust. I think especially younger generations now are very wary of technology and understand that this might not be real. Think about deepfakes and all kinds of stuff that's happening now, right? That makes you, I can't even trust what I see anymore. So I think that it's going to take all of us, like Jeff said, working together, doing things like this, talking about things to keep the public's trust. And we're going to have to use emerging technologies and newer technologies in order to be able to maintain that trust.
Hailey Windham
48:41
Oh, I like the way you said that. Okay, we have a little less than 10 minutes, so I'm going to move us on. But I honestly think that this has just been one of these incredibly honest conversations that lets us see the different perspectives and also just have this kind of, let's just hash it out. Where do we think we're at? Where do we think we got it wrong? And what do we think we need to change? So we'll do a quick lightning round. If we fast forward to 2029, what has to look different for trust in the financial system to be stronger? Karisse, I'd love to start with you. What must change by 2029?
Karisse Hendrick
49:22
I think on the merchant side specifically, we need to be moving more upstream with data signals rather than just at the time of payment. Things like device intelligence and behavioral biometrics to be able to identify agentic commerce as well as AI tools. I think in the payment ecosystem, we need to update Reg E. It would be nice if that's on my Christmas wish list. But also, I think updating chargeback documentation, regulations, and all of that to include AI and agentic AI. I think we just need to be more nimble. I would also add the collaboration piece. I know Jeff talked about it earlier, but I think merchants are pretty good at collaborating with each other these days, and banks are pretty good at collaborating with each other these days, whether it's at conferences or on group calls. But I think what I'm really striving toward, and it's something I have a conference, the Merchant Fraud Alliance, coming up in October, where we are leading with this, we need to have more issuer-merchant collaboration as well as card brand collaboration. Because I think there's just not enough understanding there of both sides and where they're coming from. More and more online companies are kind of turning into PayFacs and things like that. They're starting to accept payments and pay them out. So I think just that collaboration piece is always really helpful. That's one reason why I enjoy being on these types of conversations and getting to attend things like Fraud Fight Club, where I get to learn from issuers and banks and get to pass that down onto the merchants that I work with.
Hailey Windham
51:15
All right, David, what about for you? What must change by 2029?
David Maimon
51:19
I think collaboration, as Karisse mentioned, is key. Karisse and Jeff mentioned that. I think, to me, the thing that needs to change is the approach we take. We need to make sure that we engage in evidence-based online fraud prevention. This is something that I've been preaching a lot in my former life as a cybersecurity scholar, trying to talk about evidence-based cybersecurity, test what works and what doesn't in the context of crime prevention. We should try and do the same thing in the context of online fraud. Rely on evidence that tells us what works and what doesn't in the context of online crime prevention, in the context of online fraud prevention. I think we need to see more and more organizations embrace this approach in order to prevent and mitigate more effectively. I think we need to recognize that the fraudsters are the real fraud experts, and we just learn from them. Be more humble about our approaches. Once we are humble, once we are embracing this evidence-based approach, I think that we'll be in a better position to defend, protect, and mitigate.
Hailey Windham
52:36
I love that. I literally had to get a Post-it note to write down some of the things you said. I loved it. I love the evidence-based investigations and having those outcomes literally shown, like this is how we know what you did. I mean, I used to love bringing OSINT into my Reg E investigations when I knew friendly fraud was happening. I was like, I'm sorry, you didn't conduct this transaction at the Miami hotel? Well, here's your Facebook that says it was your birthday and that you really enjoyed living it up. So I love that. But then also, humbling ourselves. We're not the fraud experts. I used to hate the phrase bad actors because I was like, they're doing a damn good job. I mean, why are we calling them bad? Is it bad just because what they're doing is bad? But in reality, I mean, they're pretty good at what they do. So I appreciate you saying that. All right, Jeff, what do you think needs to change before 2029?
Jeff Taylor
53:29
I think, and we're taking some of this approach, Hailey, we've got to become more proactive around education. I love when I see financial institutions using social media for fraud education, as well as brand protection and brand education, because we've got to be able to use every channel available to us to try to reach our clients and all of our customers, both consumer and commercial. Leveraging the news media, leveraging social media, leveraging every opportunity that we have to get that message in front of them. Because when we're proactive, when we push that messaging out, it creates more awareness and it creates a ripple effect. You get families talking about this at the dinner table. They're saying, hey, be careful about your passwords. Don't use the same password across multiple platforms. Just simple things that help create cyber awareness or just good cyber hygiene. I think trying to avoid those emotional triggers, because fraudsters love to do that. We've talked about how they use chaos and fear and greed and all those different things to try to reach an individual and compromise an individual. If we're talking about that, then we've got a better opportunity to recognize those red flags when they pop up.
Hailey Windham
54:58
And I'll tell you, one of my favorite fraud education campaigns I've ever seen was on TikTok from a credit union, where they have Fraud Busters, and they have these Ghostbuster outfits, and they do these whole fraud education campaigns. They are my favorite. I shouted them out probably about a year ago on my LinkedIn, so I'll find them and tag them so that you can see it. Becky, of course, we're going to end it with you. What do you think must change by 2029?
Becky Reed
55:26
No pressure.
Hailey Windham
55:27
Yeah, no pressure at all.
Becky Reed
55:29
The payments landscape is the most rapidly changing thing that we're experiencing right now in the finance world. Whether it's on the merchant side, whether it's on the financial institution side, whether it's on the decentralized finance side of the house, there is a lot of disruption that is happening. The existing business models, including Visa and Mastercard, are being disrupted by emerging payment rails that are coming online that have capabilities and functionalities that we're not familiar with. And we haven't even really tapped into the potential of them because they're still emerging and still being built out. I think that, unfortunately, the bad guys tend to take advantage of that potential quicker than we all do. Merchant services takes a little bit longer to adopt these things, and then merchants take a little while to understand what these new things are. Financial institutions have to understand what it means to accept these new technologies and utilize this new potential that we have using these new rails. I think all of that change causes chaos and disruption and loopholes and misunderstandings and all of those things. Over the next four years, we're going to be going through a major transition. It's going to be really important for us to try to stay on top of what is happening and not get left behind. Because if we stick our head in the sand, we don't understand what this new technology means. We don't understand how the bad actors, or the good actors, as it were, are using them, then we are going to be victims of circumstance by allowing the future to pass us by. So one of the things you're going to start hearing a lot about is orchestration. I think that as we're looking at AI and what you were talking about, Jeff, with all of these things, all of this information, all of this data that we need to be looking at, right? Social media we need to be looking at. OSINT we need to be looking at. What's going on at other financial institutions. We need to be aggregating this data and looking at it and orchestrating a response based on all of that data. The same thing is happening in the payments world. We need to orchestrate the appropriate payment rail for whatever the consumer is trying to do or the business is trying to do. All of that should happen in a single platform, not 25 different vendors trying to bolt on to a system that's 50 years old. And so we're going to start seeing a massive change happening in the payments ecosystem. It's already starting, and it's only going to accelerate.
Hailey Windham
58:25
I love that. I can't thank you all enough for joining me today. Truly, I don't want to go over time. I want to make sure that I'm respectful of each of your times, but I just want to give the opportunity that if any of you want to say anything else again, just as we close out. Becky, I'll let it go to you because I know you have another call, so if you have anything else you want to add, feel free. Thank you so much for being here. David, Jeff, Karisse, if there's anything you guys want to add just to the conversation, again, from the bottom of my heart, it means so much that you all decided to join me. I really appreciate it.
Becky Reed
59:01
One hundred episodes.
Hailey Windham
59:03
Woohoo!
Karisse Hendrick
59:05
Thanks so much, Hailey. Congratulations.
Becky Reed
59:06
That's a wrap, guys!
Hailey Windham
59:07
That's right. That's right. So just to close out the episode, again, what stood out to me today is that while every institution experiences fraud pressure differently, there were a few things everyone agreed on. The system's under strain. Speed is changing risk. And trust can't be treated as an assumption anymore. Fraud is evolving. Payments are accelerating. But trust remains the currency that holds the system together. So thank you all for helping us mark 100 episodes of Fraud Forward in such a meaningful way. And to everyone listening, thank you for being a part of this community. Stay vigilant. Stay informed. And keep moving Fraud Forward.
Hailey Windham
59:47
Thanks for listening to Fraud Forward. Remember, every conversation, every connection, and every insight moves our industry one step closer to stronger fraud defenses. If today's episode sparked an idea, share it with your team or tag me on LinkedIn. I love hearing how you are moving fraud forward in your own organization. Until next time, stay curious, stay resilient, and keep moving fraud forward.
View full transcript
