49 min
Fraudology
Fraude industrializada: como a IA está remodelando o cenário dos ataques fraudulentos
49 min
Bem-vindos de volta ao Fraudology.
Estou a partilhar a apresentação que fiz na abertura da conferência Merchant Fraud Alliance, em Chicago. Foi uma análise do ponto em que nos encontramos atualmente no panorama dos ataques de fraude e surgiu de uma pergunta que ouvi dos comerciantes ao longo de toda a conferência: o que é realmente diferente na fraude hoje em dia e até que ponto isso se deve à IA?
Se trabalha na área da fraude no comércio eletrónico, provavelmente já sentiu essa mudança nos seus próprios números. A IA generativa alterou quem pode lançar ataques, a rapidez com que o pode fazer e a facilidade com que esses ataques se confundem com clientes legítimos. Apresento uma visão abrangente da fraude com recurso à IA, baseada nas conversas que tenho com tantos comerciantes, e complemento-a com ideias de prevenção da fraude que poderá partilhar com a sua equipa e com a sua liderança.
O que você vai ouvir neste episódio:
- Por que a fraude foi industrializada e como a IA reduz o custo, o nível de habilidade e o tempo necessários para atacar o comércio eletrônico em larga escala
- Os principais números, incluindo o aumento de 33% na pressão de fraudes em relação ao ano anterior, de 78% nas invasões de contas, de 175% nos testes de cartões e de 65% nas fraudes em compras online com retirada na loja (BOPIS)
- Como a transição para o chip EMV em 2015 e o aumento das invasões de contas se comparam ao impacto atual da IA no cenário dos ataques de fraude
- Por que a invasão de contas impulsionada por IA continua crescendo e como a IA generativa torna barata a personalização de ataques de phishing
- Como os ataques de teste de cartões com IA diferem dos scripts antigos, incluindo a forma como os agentes classificam os cartões e se adaptam aos seus controles
- Como uma única campanha pode avançar da identidade para o checkout, o suporte ao cliente e as contestações, e por que os controles baseados em eventos não conseguem detectá-la
- Por que agora é barato falsificar evidências, desde recibos e documentos de identidade falsos até fotos falsas de danos e deepfakes
- O que uma demonstração de um mercado de cartões na dark web revela sobre como é fácil comprar os elementos necessários para um ataque
- Como combater a IA com detecção de fraudes baseada em IA, usando dados no nível da sessão, telemetria, identificação do dispositivo e biometria comportamental
Você deveria ouvir este episódio se:
- Precisa explicar à liderança o aumento das fraudes e quer ter dados atualizados para apresentar
- Percebeu um aumento repentino de invasões de contas ou testes de cartões, ou recebeu informações do seu processador de pagamentos sobre o programa de enumeração da Visa
- Lide com fraudes de reembolso ou contestações de pagamento envolvendo fotos, recibos ou alegações de que o item não foi recebido
- Estão avaliando ferramentas de prevenção a fraudes e se perguntando por que os controles baseados em snapshots continuam não detectando ataques
- Quer saber como os comerciantes estão usando IA generativa para identificar fraudes criadas por IA
- Não pôde participar da Merchant Fraud Alliance e quer saber como foi a abertura da conferência
Notas do episódio
Duas mudanças anteriores na fraude e por que a IA é a terceira
A primeira foi a migração para os cartões com chip EMV. Antes do chip, os cartões dos EUA usavam uma tarja magnética fácil de falsificar, e as fraudes se dividiam de forma quase igual entre transações presenciais e online. Outros mercados, como o Reino Unido, já haviam mostrado o que acontece com a adoção dos chips: as fraudes presenciais diminuem e as online aumentam. Comecei a alertar os comerciantes sobre isso em 2013 e, quando a transferência de responsabilidade entrou em vigor em outubro de 2015, as fraudes online aumentaram exatamente como esses mercados haviam previsto.
A segunda mudança veio logo depois. À medida que os comerciantes passaram a controlar as fraudes com cartões, os criminosos voltaram-se para as contas dos clientes. A tomada de contas fez com que o combate passasse a incluir também a página de início de sessão, e não apenas a página de pagamento.
A IA é a terceira mudança. Eu já previa a primeira, porque outros mercados já haviam passado por ela.
Fraude industrializada em números
É difícil ignorar os números mais relevantes. Estima-se que a pressão das fraudes tenha aumentado 33% em relação ao ano anterior, as invasões de contas tenham crescido 78%, os testes de cartões, 175%, e as fraudes em compras online com retirada na loja (BOPIS), 65%. A Interpol estima que os esquemas baseados em IA gerem um retorno cerca de 4,5 vezes maior do que os ataques tradicionais e que, atualmente, três em cada dez tentativas de fraude no varejo sejam geradas por IA. Acredito que essa proporção será ainda maior no próximo ano. Nosso objetivo nunca foi acabar completamente com as fraudes, mas tornar seu site mais difícil, demorado e caro de atacar do que os demais — seguindo a velha ideia de que, para escapar de um urso, basta correr mais rápido do que a pessoa mais lenta. A IA reduz cada uma dessas vantagens ao tornar os ataques mais rápidos, baratos e fáceis de executar.
Ataques de tomada de contas e testes de cartões com tecnologia de IA
Um script repete a mesma ação vezes sem conta, e é possível detetá-lo. Um agente de IA adapta-se. Percebe o que o seu site permite ou não e ajusta-se em conformidade. Esta é uma das principais razões pelas quais a apropriação de contas continua a aumentar. A IA generativa facilita a personalização de ataques de phishing, e muitas mensagens parecem normais porque alegam vir de uma transportadora, de um grande retalhista ou de uma marca de pagamentos na qual a maioria das pessoas já tem uma conta. Os testes de cartões seguem a mesma lógica. Alguém pode introduzir milhares de linhas de dados de cartões numa ferramenta de IA, ordenar os cartões por BIN, resposta de autorização e morada, e testá-los com transações de baixo valor. Os atacantes podem testá-los primeiro noutros sites. Isso significa que poderá não ver uma série de recusas quando esses cartões chegarem ao seu site. Isto quebra um padrão em que muitos de nós confiámos durante anos.
Uma única campanha ao longo de todo o ciclo de vida do cliente
Antigamente, a fraude era dividida entre especialistas. Um grupo tratava da identidade, outro testava cartões, outro convertia os ganhos em dinheiro, outro lidava com o atendimento ao cliente e outro contestava transações. Às vezes, esses grupos vendiam serviços entre si por meio do modelo de fraude como serviço. Com agentes de IA, uma única campanha pode fazer tudo isso. Ela pode usar uma identidade roubada ou sintética, concluir uma compra, entrar em contato com o suporte para alegar que o item nunca chegou e, em seguida, abrir uma contestação com documentação impecável — porque essa documentação também é falsa. A invasão de contas muitas vezes termina com o esvaziamento de pontos de fidelidade ou de valores armazenados, ou com a alteração do beneficiário na conta de um vendedor de marketplace. Os controles baseados em eventos não detectam isso, pois aprovações, logins e identidades parecem válidos quando analisados isoladamente. O prejuízo só aparece mais tarde, após muitas transações bem-sucedidas, o que significa que talvez você só perceba que está sob ataque quando tudo já tiver terminado.
Provas baratas, lojas virtuais baratas
Recibos falsos, detalhes de encomendas, fotografias de danos, relatos de litígios, chamadas de voz e documentos de identificação podem agora ser produzidos a pedido. Uma grande empresa de entrega de refeições revelou, numa análise aprofundada da MFA, que as fotografias de danos estão entre os principais fatores de abuso de reembolsos. Alguém pode pedir a um chatbot que acrescente bolor a uma fotografia ou que mostre cinco ovos partidos numa dúzia, e os retalhistas deparam-se com o mesmo problema quando é acrescentado um buraco a uma peça de roupa. Também acredito que, atualmente, os deepfakes são quase impossíveis de detetar, o que coloca a verificação de identidade em risco devido a fraudes que utilizam deepfakes nesse processo. As lojas online falsas são igualmente baratas. Como Matt Vega demonstrou, é possível criar uma cópia realista do site de um comerciante em cerca de dez minutos, por menos de 50 dólares, e direcionar para ela anúncios nas redes sociais usando um URL com apenas uma letra diferente — fraude publicitária de mãos dadas com phishing. Este ano, uma campanha comprometeu simultaneamente mais de uma centena de sites de retalho com skimmers de cartões online e apoderou-se de mais de 600 000 registos de cartões. Também apresentei uma demonstração gravada por Matt de um mercado de cartões na dark web, onde um comprador pode filtrar por país, estado, código postal, marca do cartão e BIN. A IA não está a inventar novos métodos. Está a ajudar os antigos a confundirem-se com os clientes legítimos.
Analisando toda a sessão e cada indício revelador de fraude
As equipas que detetam ataques com IA associam identidade, intenção e contexto desde a descoberta até ao pós-compra. Analisam padrões ao longo das sessões, e não apenas eventos isolados. Costumo usar a analogia das câmaras de segurança. Uma captura de imagem no início de sessão ou no checkout é como uma fotografia de alguém a invadir a sua casa: sabe que aconteceu, mas não como a pessoa entrou nem o que levou. Os dados ao nível da sessão para deteção de fraude funcionam como câmaras dentro e fora da casa. Soups Ranjan afirmou, numa sessão que moderei, que todos os autores de fraude têm um sinal que os denuncia, e a telemetria ajuda a identificá-lo, como segurar o telemóvel de uma forma invulgar ou pousá-lo com o ecrã virado para baixo. Os líderes que observo com poucos chargebacks e falsos positivos utilizam em conjunto a identificação do dispositivo e a biometria comportamental, além de integrarem os sinais de fraude certos, pois um único sinal ignorado pode resultar numa perda, num chargeback ou num falso positivo.
Explicando à liderança e improvisando com criatividade
Se você precisar explicar um aumento repentino à sua equipe de liderança, use os dados do setor. Vários lojistas que conheço tiveram de justificar aumentos súbitos de invasões de contas e testes de cartões desde o início do segundo trimestre, e alguns foram contatados por seus processadores de pagamento a respeito do programa de enumeração da Visa. O Merchant Risk Council informa que 80% dos lojistas apontam a infraestrutura tecnológica como seu maior desafio no combate a fraudes, o que indica que o verdadeiro obstáculo é conseguir a aprovação das ferramentas certas. Os dados da jornada podem ajudar, pois a equipe de marketing gosta de acompanhar o que os clientes fazem no site, e isso lhe dá um aliado na hora de solicitar orçamento. Os líderes também estão pedindo às equipes que façam mais com menos, e alguns lojistas estão buscando soluções criativas. A equipe de um marketplace inseriu conversas reais entre compradores e vendedores, além de conversas suspeitas de phishing, em uma ferramenta de IA generativa e perguntou o que as mensagens escritas por IA tinham em comum. A ferramenta identificou um padrão: uma saudação inicial, uma sequência de perguntas abertas e, em seguida, uma solicitação para clicar em um link. Muitas vezes, a IA consegue detectar IA, e alguns fornecedores já oferecem agentes de IA que analisam casos de revisão manual e propõem novas regras. Podemos combater a IA com IA, e compartilhar o que funciona é o que nos permite acompanhar essa evolução.
Principais conclusões
- A IA reduziu o custo, o nível de conhecimento e o tempo necessários para atacar o comércio eletrónico, razão pela qual descrevo a fraude como industrializada.
- A pressão das fraudes, a invasão de contas, os testes de cartões e as fraudes em compras on-line com retirada na loja (BOPIS) estão aumentando drasticamente, e a IA é um dos principais motivos.
- A Interpol estima que os esquemas impulsionados por IA geram retornos cerca de 4,5 vezes superiores aos dos ataques tradicionais e que aproximadamente três em cada dez tentativas de fraude no varejo talvez já sejam geradas por IA.
- Os scripts se repetem, enquanto a IA se adapta, o que torna os ataques de teste de cartões com IA e a invasão de contas impulsionada por IA mais difíceis de detectar com regras antigas.
- Uma única campanha impulsionada por IA pode abranger identidade, checkout, suporte e contestações. Os controles que monitoram apenas eventos isolados não conseguirão detectá-la.
- Recibos falsos, documentos de identidade e fotografias de danos são fáceis e baratos de produzir, o que torna mais difícil avaliar abusos em pedidos de reembolso e contestações de pagamentos apenas com base nas provas apresentadas.
- Deepfakes são praticamente impossíveis de detectar a olho nu. As verificações de identidade precisam ser complementadas por sinais comportamentais e do dispositivo.
- Dados no nível da sessão, telemetria, ID do dispositivo e biometria comportamental permitem visualizar toda a jornada, e não apenas um retrato pontual.
- Os dados do setor oferecem uma base confiável para explicar os aumentos à liderança e solicitar ferramentas melhores.
- Comerciantes e fornecedores já estão usando IA para combater a IA, e compartilhar o que funciona torna todas as equipes mais resistentes a ataques.
Conclusão final
Se há algo que espero que você leve deste episódio, é que a fraude que estamos combatendo não é nova. É a fraude de sempre, só que mais rápida, mais barata e em maior escala. Isso significa que a solução não é correr atrás de cada novo truque, mas ter uma visão mais ampla da jornada do cliente, incorporar os sinais certos e conquistar o apoio da liderança com números concretos. Assim, suas ferramentas terão a chance de acompanhar esse ritmo. O aumento da sua taxa de fraude pode simplesmente significar que você está no mesmo patamar do setor. O que você fizer a seguir é o que vai diferenciar você.
Recursos e links do episódio
Conecte-se com Karisse Hendrick | LinkedIn
Apresentadora do podcast Fraudology
Especialista premiada em fraudes cibernéticas
Consultora de prevenção a fraudes no comércio eletrônico
Conselheira de startups, palestrante e
consultora de empresas da Fortune 500
Episode transcript
Karisse Hendrick
00:07
Welcome back to the Fraudology podcast. I'm Karisse Hendrick. Well, we had a guest need to reschedule this week, so you get another solo episode with me. Last week, we talked about the Merchant Fraud Alliance and how just amazing the first uh conference was. Uh we are already talking about next year. Um I will give you more details on that when I have them. But I decided that maybe what I would do today is share a bit or share all of the uh presentation that I did to kick off MFA. Um I didn't want to call it a keynote because I didn't think that's what it was. It was more of just like a here's where we are and fraud presentation. Um talking about the fraud landscape and you can't talk about the fraud landscape right now without talking about AI and specifically how AI is attacking and changing fraud. It reminds me of back in 2015 uh actually even before that starting in 2013 I started to talk a lot about EMV in my presentations. I worked for the trade association in our industry at the time. I did a lot of presentations at other conferences as well as our own and uh I was talking a lot about EMV and how that was going to change online fraud forever. Um essentially in the US we were using cards with the magnetic stripe which was very easy to counterfeit back then. So the breakdown of fraud between card present fraud and card not present fraud was about 50/50. But we had seen in the UK as well as in Africa and other markets that when the banks changed their cards to include an EMV chip uh chip and pin or just chip that online fraud went up significantly and in-person fraud went down quite a bit. And you know there's cons some conspiracy theorists that were saying hm isn't that interesting that banks are doing something to reduce in-person fraud because per the credit card rules issuing banks take the hit they take the liability on card present transactions. But because the chips made it much more difficult to counterfeit cards, we saw we knew we were going to see online fraud go up. And that's exactly what happened in October of 2015 when that law changed the rule the law that required banks to include chips on their cards. So I went around preaching this for about 2 years like, "Hey, online fraud is going to go up. Here's what happened in other markets. Here's why it's going to happen. Here's what it's going to look like.” And it really did go way up during that time. And we saw fraud shift very drastically online. Um there was more fraud, there were a few more sophisticated attacks, but a lot of it was about volume. Um, and then shortly after that time or right around that time was when we started to see account takeovers which also dramatically changed the way that we fight fraud cuz then it was no longer just at the payment uh acceptance point but also at the, you know, the account login page. And that's where, you know, merchants and online companies were getting hit, you know, most. After they kind of got their cards under their card fraud under control and were able to identify that, then they'd see their accounts be hacked as what, you know, that's kind of the colloquial term. We say, account takeover. Um, so those are two examples of times when fraud changed in our world. This is another and that is when AI takes you know is starting to be developed. I so much has happened in the world of AI and their capabilities just in the last six months but I don't know what's going to happen in the next year the next time I'm presenting at MFA like I I just I can't even imagine. So I'm going to try something new and I'm going to share my screen and those of you on YouTube will be able to see my slides. Uh those of you not on YouTube, I will do my best to talk through them. That will be not so much of a challenge for me, but something just for you to be aware of.
Karisse Hendrick
04:46
If you're listening, you know, on Spotify or Apple Podcasts or whatever podcast app you use, feel free to switch over to YouTube. You can just search Fraudology. Uh you should find me right away. Um it might say the Fraudology podcast or Fraudology with Karisse Hendrick. I'm not exactly sure how my editor set it up. Um, but you'll find me. So, uh, that this is your opportunity to change that if you want to. Otherwise, we're just going to cruise right along. And I even have a video clip from the dark web that I'm going to try to show as well. So, might be a little clunky, so bear with me. Uh, but I did test this out earlier and it worked. So, I'm thinking it's going to work now. All right. Here I go. Sharing my screen. All right. So, here I go. Uh, really the takeaway from this session was that fraud has been industrialized. The title of the session was the fraud attack landscape. But, uh, really, you know, fraud has been industrialized. AI has lowered the cost, skill, and time required to attack e-commerce systems at scale. So fraud activity is accelerating. We have early indicators that point to faster growth across several e-commerce attack types such as uh I think it was from a signified state of fraud report in 2026 that fraud pressure has gone up 33% year-over-year from uh I think it was from 24 to 25 but I could be wrong. Um account takeover is up 78%. Card testing is up 175%. And by online pickup and store fraud is up 65%. Uh all of those things are because of AI. They're able to do things faster and cheaper than ever. And I think anyone that's been in fraud for a little while knows that it's impossible to have the goal of eradicating fraud on your website 100%. But the goal of you know most online merchants as well as banks and you know other online uh entities you know lenders crypto anything like that. Uh their goal in the fraud department isn't to make fraud go away 100%. They know that's not possible but it's to make it harder, make it slower, and make it more expensive to commit fraud than at other places. It's kind of like, you know, that saying, your job isn't to outrun the bear, it's to outrun the, you know, slowest person, uh, running from the bear. Um, and that's really what it is about fraud, right? You want to be more expensive and harder to penetrate and commit fraud on your site than other other websites, so that they don't attack you, they unfortunately attack them. Um, that's why I'm such a big believer in collaboration and why I worked so hard on the merchant fraud alliance conference, why I do Fraudology, why I host merchant calls for free. Um, it's all because, you know, if we work together, then we'll all be able to outrun that bear, right? Um, that's the goal. So AI is making it. So while that's our goal is to be, you know, more expensive, slower, harder to, you know, commit fraud on your website, AI just cuts all that down. It makes it faster. It makes it cheaper. It makes it easier to commit. No longer is it just one person at a screen or writing a script where you know every 10 20 seconds maybe you know a couple of transactions go through here and there but scripts are different than AI because AI is actually adapting to your website. It's determining, oh, it won't let me do this. Will it Will it let me do that? And so, it's constantly adapting to the things that you put in place to stop fraud. That's different than a script that's just going to continually do the same thing over and over again. And you can catch those, right? It's much more difficult to catch AI.
Karisse Hendrick
09:23
One of the reasons why account takeover is higher is because humans, your consumers are much easier to fish. And when they fish, your consumers, they get their login and their account details. So they can then log into your website. Um, fishing attacks using AI are so sophisticated now. They can even be customized. I don't know if you saw the episode or listened to the episode uh with Cy Khormaee who used to work for Google Recapture, but he was talking about just how you know easy it is to tailor a phishing message to a person. All you have to do is ask Chat GPT to do a little research for you. You know, you can find out where their kids go to school. You can find out, you know, where they work, what conference they're going to go to next. You can find out all kinds of things. And so you can tailor your phishing message to them. Lots of times you don't have to. A lot of the phishing messages these days are, you know, coming from what they say are large companies that everyone does business with or that most everyone does business with. So it doesn't look too out of the ordinary. If you were to get an email from some, you know, ABC, you know, cybershop.com or whatever, something really small, and said, "Hey, you need to log into your account." You'd be like, "What? I don't have an account with them." But you get it from a shipping partner or from, you know, Amazon or Walmart or PayPal or, you know, any big brand. Chances are you have an account with them. And so, you know, if it says you need to log in for security reasons or whatever they're telling you, you're going to give up your username and password. And that's why ATO's are up 78%. Card testing, again, same kind of thing. Instead of running a script, you can just feed hundreds if not thousands of rows of data of full card numbers into um ChatGPT or Claude or anything else.
Karisse Hendrick
11:25
I mean, I certainly wouldn't recommend doing that as a merchant, as a good guy. But the fraudsters don't seem to care. Um, and they can have them, you know, run transactions for a low dollar on a site very quickly and they'll always find ways to circumvent your fraud tools. I thought this was an interesting stat from Interpol. Um they estimate that the return from AI powered schemes versus traditional attacks to cyber criminals is four and a half times. So, if the average cyber criminal, you know, was able to obtain $1,000 from your website or your bank or whatever it is, in the average attack, in the traditional attack, they're now able to get, you know, $4500 worth of product or money or whatever else because AI is constantly learning. It's constantly adapting. It's going to get through. The next slide uh talks about how fraud operates as a connected system. When you're using uh AI, it's going to act as a connected system with everything else. So it's it's no longer just one attack. It's all the way across all attack surfaces. So identity abuse, payment fraud, support manipulation, and disputes all reinforce one another across the channels. So AI compresses the timelines um the time from research to attack. It allows coordination. Agents link tasks that once needed separate people and tools. And then it removes friction. Automation removes the trial and error that slowed traditional campaigns. The same campaign campaign can move from identity to checkout to customer support and dispute claims all within one campaign. So they can, you know, spoof an identity. They can successfully check out. Then they can go to your customer support and claim that the item wasn't received or claim that there was an issue or they were double build or whatever they claim, right? And then they can go to a dispute and either file a dispute internally with your company or with their bank all in one attack. It used to be that you know each thing was specialized by someone different within a cyber crime ring. You know, you had the hacker and the coder. You had the person that was good at identity, the person that was good at account compromise, the person or the group that was good at card testing, and then the group that was good at cashing out, as they say, or carding, you know, the checkout piece. Then they had another person or group that was good at manipulating and social engineering customer service. And then they'd have another group that would maybe file a chargeback or two if it was a fake card or something like that. Um, it'd all be different groups within maybe maybe it would be the s a single crime ring or it could be different crime rings and they're selling their services to each other through fraud as a service. But now using AI, it's just seamless. It the same agent, the same campaign can manipulate every single part of your business. Um, and that's really something that I, you know, wanted to highlight in this in this session. So, evidence is now cheap to fake. Um, if you're watching this on uh YouTube, just ignore that black box cuz I'm going to show you a video. I wasn't able to embed it because of the way that the um presentation was done through the AV system at MFA. A little behind the scenes there. Um, but I just put like a, you know, a a box there to in input that or insert that video, but I ended up not needing it.
Karisse Hendrick
15:34
Um, so evidence is now cheap to fake in a lot of different ways, right? They can fake receipts or order details or damaged photos. They can fake dispute narratives or voice calls or identity documents. Can all be produced on demand. So, no longer is a receipt from your company good enough for a return, right? If for an in person transaction, uh, no longer is are order details available, right? Like, they're all fakeable. They can fake damage photos. There was one of the largest uh food delivery companies uh in the US uh and they also have a pretty strong European channel as well. Um at MFA who ran a deep dive. I explained what deep dives were on the last episode, but basically it's a merchantonly uh session for 20 people for an hour where the facilitator shares a little bit of what's going on in their world um on a specific subject and then merchants get to talk and share ideas and share frustrations and all of that with each other for the rest of the time. And in his, you know, in his world, one of the biggest things to impact refund fraud is is damage photos, right? People can ask chat GPT to, you know, like they'll take a picture of something and then they'll say, um, add mold to this picture and it'll look really lifelike or, you know, add, um, you know, open the package or something like that. Or like, you know, if they if it was groceries, right? Crack all the eggs in this 12-pack or crack five of these eggs in this 12-pack and make it look like they're cracked. Oh, they can do that very easily, right? So, um that has really impacted the food delivery industry. It's also impacting uh refund fraud for retailers where you know you buy a piece of clothing, you can ask ChatGPT or Claude or you know, Anthropic, whoever you're using um to insert a hole in the in the product, right? So that you can contact customer service. You can have your AI agent contact customer service say there was a hole in the item that you shipped to me.
Karisse Hendrick
18:05
I'll send you a picture. It'll look lifelike. Um, you know, there was a lot of talk at uh in the session right after mine at MFA about faking identity docs. So, I kind of left that alone. I mean, I mentioned it, but I didn't dive into what deep fakes look like and how sophisticated they are. Uh, one of the slides that the next speaker shared was uh about just showing the difference between a deep fake video a year and a half or two years ago to last year to this year. And like two and a half or you know, one and a half to two years ago, the video was glitchy. You could usually tell, you know, they only had four fingers or like, you know, just weird things. The lighting was off, like you could tell things, right? And then last year it was a little little glitchy still, you know, not as glitchy as before, a little more seamless. Um, and the lighting was, you know, a little detectable, but not really. It was difficult to detect. Now, it's almost impossible to detect deep fakes. It's almost impossible to detect selfie videos or uh if a driver's license or passport has been forged. It's just not possible. Um so, three in 10 retail fraud attempts are estimated to be AI generated. That's probably going to be six or seven and 10 next year. Um, I'm going to go through the rest of this slide and then I'm going to do my best to play this video. Um there was a 20 there was a campaign done by AI that was done this year in 2026 where a 100 plus retail sites were compromised all at once with basically online skimmers card skimmers and six over 600,000 card records were stolen and they pocketed about $25 per attempt.
Karisse Hendrick
20:14
So do the math right? That's going to be over around $250,000 that they were able to get very quickly by implementing an AI attack across over a hundred merchants without the merchants being aware. Okay, we're going to play this video and basically it's Matt Vega created or created this video and it shows him going to this site on the dark web. Looks just like a regular site. It has rules of how to use it. Um, and then you can search any cards you want by the country, any country that you want. Uh, then you can search by um if it's credit or debit, what branded card it is, if you have a specific bin, but you can also pick the state that it's in. Uh, in this case, Matt picked Washington. Um, he put in the zip code. So, it can be very specific, right, to where he wants the item shipped. He can buy a card that has a high limit, doesn't have verified by Visa. Like, it has all of these details that you can see on here. Um, and then he went into the Russian market on the dark web and uh entered his pin and then he was able to um do even more things as far as um creating a FOSS, you know, that's what fraudsters call it when they have a full portfolio. Um, you can pause here and and read all of that text if you want. Um but it a gave them access to Imperial market where you could buy more clone cards, you could buy prepaid cards, you could buy Western Union, Skril, Crypto, etc. So, uh you can even buy Revolute transfers, uh which were um quite popular at the time. Um, and it would only be I think I saw a transfer for let's see $2,000. Oh, I wasn't able to see how much it was, but I mean it's pretty if it transfers for 2,000, it's probably going to be like $100 to purchase.
Karisse Hendrick
22:35
Um, so you know, this just shows that it's cheaper and easier than ever to commit fraud and to fake information um, more than ever. I mean, you can pick here. He's picking the bin. He's picking the, you know, the quantity of cards, how he's going to pay, etc. So, AI scales familiar fraud methods, right? So, we're not talking about new fraud methods. We're not talking about, oh, there's these new fraud methods. No, they just make it they make the current fraud methods that we have harder to identify as fraud. They make them blend in more with legitimate cards and legitimate transactions, legitimate account logins, legitimate account creations. They make it look better, right? So the um as I just said, the techniques existed before generative AI. AI just makes them cheaper to produce, test, and adapt. So, you know, there's under identity, there's stolen stolen data and deep fakes that create convincing identity replicas. Um, for ad traffic for fraud, for ad fraud, um, automated ad campaigns can send consumers to fraudulent storefronts. So, um, I've mentioned this before, Matt Vega has mentioned this before on my podcast as well, but you can make a very, very lifelike website for un under 10 within under 10 minutes for like under $50 online using AI. You can literally ask one of the chats to create a replica website for you of X do or not X.com because that's Twitter now, but company X.com. Um, you can replicate their storefront but have their credit card transactions not go through. Instead, whenever anyone enters their credit card data, you just harvest that and then they don't ever get their product. But you get their credit card numbers. Um, or you can try to get a merchant processing account uh fraudulently of course and probably using AI because it's easier now and link that to your fake website so that whenever someone places an order, you are processing their card for that amount, but they'll never get the merchandise back. So then with this ad traffic, you can then create hundreds or thousands of ads on social media pointing to your fake website. So when you do that, they don't usually see the URL. So you could have the URL be spelled wrong with just one letter or something like that. And if they're clicking on an ad from social media about the website that they think it is, they're not going to notice that you're that it's not the real website. So that has been greatly impacting online companies, including banks. Um phishing, as I mentioned, you can target research and polish messages um making them uh a lot more convincing.
Karisse Hendrick
26:04
You can Oh, this is what I just talked about. Copycat shops can be built quickly to collect payment data or sell counterfeit goods. Just like I said, card testing, the authorization results help sort cards, bins, and address matches. So, when a card tester uses AI, it doesn't just tell them if the transaction has been authorized or not. It'll sort them based on BIN. It'll sort them based on what the authorization, you know, response was. It can sort them by the address so that you can, you know, add add cards that are close to your mules address or, you know, purchase digital goods that don't need a shipping address. And then the biggest thing is that it adapts to everything. So agents map friction and controls and then they adjust their approach. So if they hit a brick wall, if they hit, you know, a fraud tool or fraud screening, they then make note of that and try to figure out how to get around that. And you're not seeing as many trial and errors in your data, right? Especially if they're using card testing on another site, you're not seeing, you know, 2700 declines and 3,000 authorizations or or 300 authorizations, right? That would tip you off the other card testing problem. But now they're card testing somewhere else so seamlessly that when they go to use the card number at your website, it's really difficult if not almost impossible to solve for or at least it's not impossible but we need to be thinking about it in a different way and that's that's really what a lot of this is about. Um so the losses surface across the life cycle right I basically said that but to capitalize on it you know a campaign can run across controls before a team sees the pattern right so um the discovery is the fake stores and ads and then they use stolen or synthetic ID to commit card testing and checkout. Um, the account can be used for takeover or misuse. Um, often times they're taking over an account to drain all the loyalty points or the stored value dollars that you have on the account. If you're a seller for a marketplace and they get a handle a hold of your account details, they're going to go in and instantly change the payee or who the money is deposited to so that they can then get that money instead of you. Um they will, you know, manipulate support with fraudulent refund claims and then they'll go to this dispute process if they need to and issue a chargeback uh with the bank and they can provide flawless card holder documentation because it's all fake.
Karisse Hendrick
29:13
Um there's a reason why eventbased controls miss it, right? And this is what I was just hinting towards a minute ago. Approvals, login, and authentic identities can all look valid in isolation. The loss emerges later after all after many successful transactions. So often times you won't realize that you're under attack until after you've already been attacked. Whereas with previous fraud attacks without AI, you'd have a pretty good idea you were being attacked before you get a chargeback or before you get a card holder calling your customer service to tell you that their card was used on your site. Talked a little bit about refund abuse already, but I'll talk about it again. Um, 60% of Well, wait. So, AI can generate uh damaged photos and polished claims. Uh, deep fake refund bots can probe call centers around the clock. So that's another thing. They have deep bake refund bots that will continually reach out to customer service to get a refund. And if it's a 24-hour call center, which a lot of them in the US aren't anymore, but if it is, they're going to catch someone at 2:00 in the morning that's absolutely exhausted. Or they're going to look on LinkedIn. You know, AI can look on LinkedIn for everyone that works that has the title customer service rep at X company or XBank and then, you know, Crofts reference that with their Facebook accounts to see who most recently had a baby. So, if you're calling them at 2:00 in the morning and they're on the call center, probably they're probably exhausted. So, that's a great time to call customer service and fake, you know, a refund claim. Um, Europe and the UK said that, um, account takeover attempts have gone up 67%. And items not received have gone up 49%.
Karisse Hendrick
31:19
And items not as described have gone up 35%. That's just in the last like year. That that's looking behind. Looking forward, it's going to be going up so much more. Um, this is what So, what can you do about it? Right? I'm never going to present a problem without some kind of a solution. And the teams that are doing a really good job at catching AI attacks are the ones that are connecting identity, intent, and context from discovery through post purchase. So, they're able to read patterns across sessions and transactions from the moment a user enters their website all the way through checkout and then maybe even after checkout. Um, they're looking at early signals, right? They'll they're able to spot misuse or disputes or account compromise before the losses get too high. So, back to what I was saying there. So, what I've noticed is a lot of the crypto companies did this about two to three years ago where they now look at the user journey. They're not just looking at events, right? Account creation, account login, payment p or purchase or transfer or withdrawal. They're not just looking at those things. That's kind of like taking a snapshot at the time like a still picture of someone breaking into your house, right? You can know that someone broke into your house, but you don't know what they took. They don't you don't know where they went in your house. You may not even know how they got into your house if it's just a still picture. But if you have security cameras outside and in, you can then see how they got into your house in the first place. Did they break a window? Did they find an open window? Did they find an open door? Did they find Did they clone your garage door opener? Whatever it is, right? If you have 247 security cameras inside and out, then you're better off being able to um not only identify how they broke in so no one can break in again, but also what they took, what where they went first, what their actions were, how they were able to get past your safe or whatever else you have. Um that's the difference between using point solutions that are measuring things at specific times and and you know taking that snapshot at the time of purchase, the time of login, the time of account create, whatever it is. Um the time of transfers or cash outs or things like that. Um newer services that allow insight into the customer journey um that provide session data rather than just transactional data um and are looking at the sessions all the way through are then able to pick up on those patterns that fraudsters don't realize that they leave or as Soups Ranjan said in a session that I moderated with him every fraudster has a tell. And when you're able to monitor all the way through from the beginning of when they enter your website all the way through to the end when they check out or when they withdraw money or whatever they their action is, they will leave a tell. They will have their phone upside down. They will, you know, and if you're able to look at telemetry through your device, you know, your digital um fingerprint or your device ID service, then you're able to know, hm, it's impossible to shop on my website when their phone is face down. Or, you know, you can know how they hold the phone or even one vendor was talking about apartment number location number uh precise like location. Um, I think they do that using telemetry of the phone and how many feet or meters it is in the air. Um, but and so they'd be able to tell you what floor uh someone is on when they're making a purchase or making a withdrawal. Um, and if that matches the apartment number. So, if they, you know, live at 1206, apartment 1206, you could know that they were on the 12th floor when they made the purchase. Will that make sense? That type of thing. There's all different data signals that different providers will provide. Sorry, that was a bit redundant. Uh different providers will give you, but the important thing is is that you are ingesting all of those and that you're looking at those patterns.
Karisse Hendrick
36:15
You're looking for those tells. Um then one of the things I wanted to leave I wanted to give kind of a note to the solution providers that are in the room the sponsors. This stat came from the Merchant Risk Council's uh fraud survey and it says that 80% of merchants name technological infrastructure as their biggest fraud challenge. So their biggest fraud challenge is an account takeover. It's not card testing. It's not, you know, getting budget for operations or anything like that. It's getting the right technological infrastructure. That's what their biggest fraud problem is. And that's a hurdle you have to help, you know, the decision maker or the influencer, you know, get across the finish line with their leadership because, you know, you're not going to see it all the time. You're not going to know it exists. Um but yeah, so that's, you know, that's the biggest hurdle and I think that's really good. Um, speaking of signals, you know, looking at for those early signals, looking for those common signals across multiple uh transactions or actions done by fraudsters. Um, the last thing that it says on this page is that a missed signal can become a fraud loss, a chargeback, or a false positive. And that is 100% true. You know, just one missed signal. So, you need to ensure that you're ingesting the right signals. You need to ensure that you're using the right products because not all products are looking at session level data yet. They're not looking at device ID and behavior biometrics in combination. Uh those are the things that seem to work for the top leaders in fraud. The groups that you know continuously have very impressive authorization and decline rates, very impressive chargeback rates that are low. Um very little false positives. So, you know, that's how you get there. I thought that that would be helpful for me to walk through and explain where we're at when it comes to AI and technology and why it's changing so much. So, if you're having to present to your leadership or you whether it's executive leadership or your, you know, direct leadership about why fraud has increased so drastically. Uh, I know of several merchants that since April or May have had to be had to explain to their leadership why their account takeovers just went skyhigh all of a sudden or why their card testing just went through the roof and their credit card processor is now contacting them and talking about the enumeration program from Visa or, you know, why they have such high refund rates or chargeback rates. Due to item not described or not delivered. Um all of these things, you know, are when you're in the room presenting those things, remember this presentation. Remember the fact that AI is is the use of AI by fraudsters is going up very rapidly. It's increasing very rapidly. Therefore, fraud instances are increasing very rapidly. I hope that that for you that doesn't translate into fraud losses going up significantly, but it could. And the best solution is more tooling, you know, more visibility into the entire customer life cycle, the entire customer journey. And by the way, if you have user journey data, you know what department really loves that journey data? Marketing. Marketing loves to know where they're, you know, what their customers are clicking on, what they're doing. So you can provide some you know really good intel to marketing or your C suite from those products because you know mapping it all out is one thing but being able to translate it to leadership to hopefully get increased budget to increase the capabilities of your tools. That's where things are going to change.
Karisse Hendrick
40:59
That's where we're going to see. Yeah, attempts are high, but the losses aren't because we were ready because we were covering more attack surfaces than we ever have before. So, that is my presentation. Um, just almost exactly 45 minutes. Uh, on stage it was about 30, but I had a countdown clock. I didn't have a countdown clock this time. Um, but maybe I need that to work that into my podcast. I don't know. But uh let me know what you think. Let me know if you disagree with me. Let me know if you agree and have an example. Um this is what I'm seeing from a 10,000 foot view of fraud. Uh when I talk to lots of companies and that is that fraud is getting cheaper and easier for fraudsters to commit. Therefore, fraud attacks are going up. You know, a 33% increase in fraud pressure is not insignificant. Um, and feel free to use any of these stats that I compiled. I compiled them from various studies uh that have been available in the last six months. Um, feel free to use them to present to your leadership and say, "Hey, this is what's happening at the industry level. Fraud is going up." So the fact that our fraud is going up shows that we're on par with the industry, but it also shows us that we need to change our tooling because our current tools AI is able to figure out where the vulnerabilities are and exploit the hell out of them. So that is my public service announcement of the day. Let me know what you thought of the presentation. If you like seeing me have slides, if you like the visual, uh, other than just watching me talk and stare into my laptop, um, let me know what you think about the presentation and the data. Um, if you disagree with it, I would be curious to know why. Uh, but I can tell you in talking with all of the merchants that I do, and I mean, it was literally hundreds just last week at the conference, everyone's feeling the pressure. And on the flip side, when I attended the AI boot camp that I talked about on last week's episode, the general consensus was that because of AI, leadership is expecting you to do more with less.
Karisse Hendrick
43:22
They're expecting higher sales and bigger growth and all of that, but they're expecting you to figure it out and figure out how to do more with less. So, you know, I do I am a big proponent on getting the right technology in, but there are people that are being really scrappy right now. There's one merchant that was having an issue with phishing messages in their chat. So, they allow their buyers and sellers to chat with each other about the product and that type of thing. And they were finding these fraudsters taking over legitimate accounts and then going into chats with um as a prospective buyer with sellers to say, "Hey, uh I'm really interested in what you're selling, but I need to have you, you know, click this link to contact me or whatever it is." Somehow they get them to click the link. Once they click the link, they provide their information and then they can take over their account and steal the stored value that's in it. What this one of the merchants, they've been doing a lot of different creative things using AI trying to identify these, but one of their analysts who is one of the smartest analysts I've I've met in a very long time and they may be looking for a new job. So if you have something remote in the US, let me know. But very just so smart and thinks so out of the box. They've been able to use chat GPT to say so they've loaded in all of these messages like the you know the way that the message flows you know and all that into a chat GPT or Claude or whoever they use along with good message you know back and forth between buyers and sellers and say hey which ones of these look like they were done by AI or and then they say okay of the ones that were done by AI. How can I identify these in the future? And one of the things they found was that every uh chatbot starts with they make the first move right in the chat and they say like, "Hi, how are you?" And then you know the person they ask an open-ended question, right? And then or maybe it's about the product or whatever. And then the, you know, good seller, the legitimate, the real person, the seller, it answers back. And then they ask another open-ended question. And then the seller answers back and then they prompt for the link. So there's like a very specific they've also looked at the words they use. They've looked at the syntax that they use. And interestingly enough, AI can identify AI. It could identify when AI is is, you know, writing out sentences. So, that's just one example of things that merchants are doing to be scrappy to try to stop this stuff. And it's working. There's lots of really interesting things that merchants are doing with AI to try to stop this generative AI or LLMs or, you know, if they have internal AI with that's paired up with their data internally, you know, like a private account that's paired up with their and a private model that is paired up with their data um that they're able to play around with. They can do all kinds of analysis that they may not have thought about before. So, there are some hidden silver linings, but if you're expected to do more with less, and fraud is going to be just increasing at an all-time high over the next several quarters, you're in for a busy time. Um, and that is why we did the AI boot camp because we know people are being expected to use AI in specific ways um or in in specific ways where they don't tell you how to use it. They just say, "Well, you need to reduce your human time by 25% or whatever." So, we're living in very interesting times, but we can fight AI with AI.
Karisse Hendrick
47:39
There are um providers out there that have AI agents that will screen, you know, manual review for you or that will look at all of your rules and see which ones fired and propose new rules to write or new things for the model to ingest. So, we we have a few tricks up our sleeve, too. But there's more of them than there are of us. So, it's really good for us to share information and that's ultimately why I wanted to share this presentation and why I do this podcast. So, on that note, I am going to go for the day. I hope I gave you a few things to think about, a few nuggets of information to ponder over. And don't forget to reach out to me if there was anything significant in this uh I was going to say session, but this episode I at the conference I was calling them episodes and now on the podcast I'm calling them sessions. I just my brain gets mixed up because I really enjoy creating content. But you know, if it gave you fuel for thought, if you have more questions, I'd love to hear from you. It might turn into a second, you know, a follow-up podcast episode or I might just write you back. Uh, LinkedIn is preferred over my email. Um, I don't get as much spam in my LinkedIn as I do in my email. Um, and especially with the political season and the midterms happening in the US, I don't know who I donated to and when, but man, am I getting a lot of those emails now. And I stupidly used my work email address. So things are getting lost, but that's another story. Uh, I'm going to let you go for the rest of the day. I hope I gave you some things to think about, and I will talk to you more next week.
View full transcript
