0:04
Hello everyone. Thank you for attending our webinar. We’ll be discussing
0:08
fighting AI with AI. My name is Michael Bunard and I’m with WSO2 and I’m happy
0:13
to be hosting this discussion with fraud and identity experts from both SIFT and
0:17
WSO2. We’ll be diving into how AI is being used by bad actors to attempt
0:22
fraudulent transactions and how fraud detection and identity can come together
0:26
and be used to combat those attempts. With me today from Sift is
0:33
uh Jeremy Cannon. Jeremy, can you go ahead and introduce yourself?
0:37
>> Yep. Hi, I’m Jeremy. I’m one of the trust and safety architects here at
0:40
Sift. And day in and day out, I’m working with our customers and our
0:43
prospects to sort of understand their fraud problems and how to orchestrate
0:47
their fraud strategy using SIFT and other tools like WSO2 to have a holistic
0:52
fraud strategy.
0:54
>> Awesome. Nice uh nice to have you here, Jeremy. And we also have Godwin Amila
0:58
from WSO2. Godwin, introduce yourself.
1:01
>> Yeah, hi. Um, Godwin Amila, enterprise architect at WSO2. I work primarily with
1:09
the customers and the partners across the UK and EU. Uh, primarily focus on
1:13
the ID 10 access management and happy to be here with you.
1:17
>> Yeah, it’s great. We have two real world practitioners here. So, um, you can tell
1:22
us what’s really going on and and keep this grounded and and down to earth.
1:26
From an agenda standpoint, we’ll start out with some examples of fraud attempts
1:29
that that are driven by AI. So, what’s really happening out there? Um,
1:34
secondly, we’ll we’ll talk about using AI to detect uh those fraud attempts.
1:39
And we’ll we’ll close out with um using identity and access management as a
1:43
control point uh when these uh transactions look risky or potentially
1:47
fraudulent. We will have Q&A a time at the end, but what I would encourage you
1:52
to do is just ceue up your questions in the Q&A uh feature on your screen so
1:56
that we can uh address those at the end. So, you know, AI is certainly having a
2:04
profound impact on our daily lives, you know, both as individuals and of course
2:08
organizations. like any powerful technology, you know,
2:11
it can do great things uh in the right hands, but it can also do nefarious
2:15
things if um they’re in the hands of of bad actors. So, wanted to to start our
2:20
chat today just discussing examples of what’s really going on, what you guys
2:25
are seeing out in the field in terms of real world uh fraud attempts. Um so,
2:31
we’ll go through a couple of of examples. Uh, first one I’d like, you
2:36
know, Jeremy to give us an overview of Operation Datebait. What’s that all
2:40
about?
2:41
>> Yeah. So, Operation Datebait, I really like this one as an example because it’s
2:45
going to be one of the themes that we talk about throughout this that the
2:48
fraud itself hasn’t drastically changed. They’re doing the same things. They’re
2:52
trying to accomplish the same things, but now they’re doing it at scale with
2:55
the ability of AI. So, in February of this year, um, OpenAI’s own team
3:02
realized that someone was using J Chat GBT to run a big large romance scam/pig
3:08
butchering scam um, using their profile. What was using their tools? So, what was
3:13
really interesting about this is they were using GPT to build profiles on
3:18
dating apps. There were no deep fakes, no videos. They were just building
3:23
profiles on dating sites using chat GPT. And one of the thing that’s really
3:28
interesting is it took out a lot of the things that we often look for when we’re
3:32
looking for fake sites. Things not looking real, misspelling words, the
3:36
language bottleneck that they realized this was being ran out of Cambodia and
3:40
they were running it like a true um office. They had people doing lead
3:45
gen a supervisor and they were spinning up these profiles running these things
3:51
at scale with the power of AI. We’ve seen stuff like this, you know, in the
3:57
we see this all the time with dating apps and stuff with scams, but the
4:02
ability to use something like AI to soften the edges on some of those things
4:07
that we would normally look for and then create multiple sites over and over and
4:12
really automate a fraud process is is really scary. And I think it it
4:19
shows that what really is happening with AI and what we’re seeing a lot today is
4:24
the barrier to entry and doing massive fraud. The floor has rose and more and
4:29
more people can partake of this with less savvy, less skill with GPT doing
4:34
the work. The other thing interesting about this before we move on is they
4:38
were using chat GPT. This was a an available thing that any of us can use.
4:44
They weren’t using some model that they built. They weren’t using some more
4:50
open-source AI. They were using chat GPT to commit these frauds.
4:56
>> And chat GPT is really good at helping you write and uh make it look
5:01
professional, which sounds like uh worked and overcame the typos and
5:07
language issues that we’ve classically seen with Nigerian scams and other
5:11
things like that in the past. So I I get it. Interesting.
5:16
Another one uh that I wanted you to talk about, Jeremy, is the is the Singapore
5:21
deep fake.
5:23
>> Yeah. Yeah. So, I really like this one because it talks
5:27
it’s more what people think when they think AI fraud, which is using these
5:31
deep fakes, using voice, you know, changers with AI to sort of have a live
5:38
call in front of someone and try to pass yourself off as someone else. So, for
5:43
this particular case, it was May of this year, um over WhatsApp, someone was um
5:49
impersoning the prime minister of Singapore.
5:53
It’s estimated that they got about 4.9 million Singapore dollars from people,
5:58
which is about almost four million US dollars. Um,
6:04
and they were saying that this is all about the straight of Harm moves. So,
6:08
they were raising money to do something, you know, for this time that we’re
6:13
living in to help the Singapore economy. And people, one businessman and a few
6:18
others fell for this. And so it’s interesting because the Singapore police
6:22
did release the actual footage of these calls and you could see that there’s
6:28
like mismatch and lip movement audio inconsistencies. But just the fact that
6:33
the face is there and someone a face that you recognize and know and a voice
6:37
that you recognize and know someone like a prime minister who’s on the news
6:41
regular even those things weren’t enough for them to pick up on it because
6:47
there they were seeing enough things that felt real and true. So this was a
6:52
super high-profile case but we see these same sort of things in all sorts of
6:57
other AI fraud. I’ve talking to people that have had fake candidates applying
7:02
for jobs using these exact same techniques. They’re trying to look like
7:06
somebody else. They’re trying to make their voice sound like someone else.
7:10
Pre-scripted things are fed in. So when they have a question, they’re answering
7:13
it succinctly. And this can go into any other facet of
7:19
your life where the thing that we once used to trust or used to even say to
7:24
going back to even like date the date bait when we used to say to people you
7:28
if you’re dating someone you haven’t seen their face jump on a video call
7:31
with them. That’s the best way to verify that someone’s who they are. IT teams
7:36
have used this as like a process to jump in and say like I can’t get in my
7:40
computer. Well the only way that I can let you in you got to jump on a call
7:43
with me. I have to see you. So this is touching while here it was to defraud
7:47
people this sort of AI attack is touching us in our corporate lives as
7:51
well and it’s really important to be more vigilant and look out for things
7:56
like the lip moving mismatch the lags when someone’s head moves those sorts of
8:00
things are really important and they were present here and they were still
8:04
overlooked because enough things made them think this was someone they knew
8:08
and trusted.
8:10
>> Very interesting. Yeah. From a corporate perspective, these deep fakes often come
8:14
in the form of the CEO leaving a voicemail with something super urgent
8:20
that needs to be done. And um again, people have fallen for that um rather
8:25
than pick up the phone and call them back. Um so it’s a common technique.
8:30
It’s very interesting how that’s progressed.
8:34
Pilates, that’s an interesting topic for fraud. Tell us about that one, Jeremy.
8:40
Yeah, this is my absolute favorite one of all of these. Um because in some ways
8:45
it was not someone setting out to do fraud. So um just last month it was
8:52
reported that uh someone in Australia using an open claw running on claude
8:57
asked if they could help them get into a Pilates class, a class that was full
9:02
booked up. the agent actually went out and found
9:07
that the um booking agents API had zero checks in place. Now, you think about
9:14
this, it’s probably like, who’s going to hack the the booking of the Pilates
9:19
studio? Well, the answer is your AI agent might because they managed to kick
9:24
everyone else out of the class and move the owner from the weight list into the
9:30
actually into the actual class and they got in.
9:34
The thing about this is this person to the best of our knowledge didn’t tell it
9:38
to do anything nefarious. It didn’t say hack into this thing. It just said, “Is
9:43
there a way you can get me into this Pilates class?”
9:47
And they did. And so the one thing we need to be thinking about is our AI
9:53
agents that we’re using every day to do mundane things like go to our Pilates
9:58
class. They might be committing fraud on our behalf. And I think that’s that’s
10:04
something that we as practitioners of fraud need to start thinking about. And
10:07
we have to like program our mindsets to not only think about bad actors like
10:13
people with bad intentions, but where are weak points for something like this
10:18
to happen? because all this cloud agent did was what it was asked to do. And
10:23
like most agents, it finds the path of least resistance to do that thing and
10:28
the easiest and most direct path. And in this case, that was just tapping into
10:32
their API, removing people from the list, moving the weight list people up.
10:37
So I think this is a really really good example of
10:42
you know we talked about all these three together and some of them were fraud
10:45
that was being committed before ramped up deep fakes but some is just fraud by
10:52
accident and the more and more that AI permeates our study and we use it for
10:57
these mundane tasks the more and more we’re going to see stuff like this and
11:01
we’re going to need to be prepared to you know to stop this I think about this
11:07
when we think about, you know, things like sneaker drops, our buying things,
11:12
things that have like a a bit of a a wait list or a line, jumping cues for
11:18
tickets, things like this are going to be really important when we start.
11:23
>> Yeah. And definitely from an individual standpoint, but I think the lesson to be
11:28
learned there is is for corporations, right? when when they’re deploying AI
11:32
agents um to act on their behalf, uh it’s super important that there’s the
11:38
right AI governance and guard rails in place. At W2, we talk about an aenic
11:44
enterprise fabric where uh the agent is given an identity and um very strict uh
11:51
boundaries about what it can access and what it can’t. um and you know having a
11:56
human in the loop that’s in charge of that identity in order to oversee um
12:02
what it’s doing because uh it’s a great example of a a AI agents are very
12:08
resourceful and they want to do they want to get the result right and they’ll
12:12
cross boundaries that you don’t even know about to get it done and that
12:15
becomes a big problem if it’s at a corporate level so yeah lot of lessons
12:20
be learned there
12:22
>> great and um So, you know, Jeremy’s uh in this uh in the fraud world day in day
12:28
out seeing lots of interesting things. Uh Godwin, you know, you’re focused on
12:33
identity and access management. So, it’s not necessarily an everyday thing, but
12:37
you know, what kinds of trends are you seeing happen uh in Europe where you’re
12:42
primarily focused uh in terms of real world AI attacks?
12:48
>> Yeah. So I I think Jeremy mentioned really good specific examples and the
12:52
use cases. Let me let me explain like the based on
12:56
the my conversations with the you know the customers and the prospects in this
13:01
particular region. So the fraud is a bigger term right. So if if you talk
13:06
about fraud there can be like a financial fraud like the credit card
13:10
stolen card refund return frauds there can be different fraud but if you focus
13:16
on the the IM side of the fraud what I have seen is the level of fraud can
13:23
happen in this area can be differ based on the industry. Yeah, I was I was uh
13:29
working with a customer recently which is more like a food and delivery related
13:34
customer leading customer in the Europe like they have in the e-commerce
13:38
website. They are having a bigger problem with the fake accounts like you
13:42
know the to to get the false first order promo codes or referral abuses etc.
13:48
Right? So this this is a common situation in a in a in a retail
13:53
businesses like but if if you look at the fraud which can happens in the
13:59
financial or or maybe a regulatory industry these things are not the same
14:06
case like because if if you take the on boarding processes has been hardening
14:09
with the KYC processes etc. In the those industries we can see the different kind
14:16
of you know the fraud like account takeovers, credentials stuffing etc.
14:20
Right? So the the the amount of like the level of
14:25
frauds that we can see can differ based on the industry and the important thing
14:30
is um we have seen these things in the past as well. These are not not the new
14:36
things. The the difference is the threat landscape has expanded significantly
14:42
with the because now attackers use AI to look more legitimate than before. So
14:49
they they use the AI tools and the agents etc to look more legitimate and
14:54
also the scale that they’re working is pretty much higher as well along with
14:58
this. So, so the the what we have seen is the the the traditional um the static
15:05
controls that we are putting in the IM which no longer valid along with this AI
15:11
threats and the you know the the frauds that we are getting. Yeah.
15:16
>> Yeah. I remember you know way back in my career where fraud detection was pretty
15:21
much focused just on the banking and finance industry. Um but over time as
15:28
you said retailers and other um other vertical solutions have forms of money
15:35
in the terms of credits or gift cards or other things that that people will go
15:39
after. And so um it’s kind of bad that it’s bad that this fraud is happening
15:44
across all these verticals, but it’s also good to see that it’s not just a
15:48
banking and finance issue anymore. That there’s solutions that can be provided
15:52
across different verticals. So great, thanks for that.
15:56
>> Yep. I mean, I think too for like one of the things Calwin said that’s, you know,
16:00
kind of the theme of all this is none of this is new. It’s just it scale and so
16:05
we have to think about it differently.
16:08
>> Absolutely. All right. So we have a poll question here uh for the audience. Um
16:14
essentially in the last 12 months, do you think you’ve um been a target of AI
16:18
enabled fraud at your organization? Um, this can be successful fraud,
16:24
unsuccessful, it can be, as we’ve been discussing,
16:28
uh, AI maybe fueled it to make it more effective or more powerful or have more
16:34
scale, but just interested to see what the results are there.
16:39
>> Yeah, I imagine we’re going to see a pretty high percentage in the yes
16:42
column, but I’ll be I’ll be curious as well to sort of see where this shakes
16:46
out.
16:48
>> Absolutely. you kind of sometime you might have to
16:54
guess at whether it was AI enabled or not, but sometimes the it’s fairly
16:59
obvious just due to the scale and some of the examples that you gave us.
17:08
All right, we got the results in. Uh looks like it’s more split. What’s the
17:17
percentage there?
17:18
>> It’s 62%. yes and 38 um% no, which to be honest surprises me a little bit. I
17:26
would expect the yeses to be slightly higher, but there’s also a chance that
17:30
in those nos there’s some AI enabled fraud that slip through.
17:35
>> Yeah, that’s right.
17:38
>> And I think that’s why detection is is kind of key. And I think we’re going to
17:41
talk a little bit about that as we we move on.
17:46
>> That’s a good segue actually. Uh so we’ll get into the the next part of this
17:51
now that we’ve uh given examples of the type of of fraud that’s being happening.
17:55
Um how can we use AI in our hands uh to detect that fraud? So Jeremy, why don’t
18:02
you uh talk to us about the SIFT solution and the types of signals that
18:06
you look for?
18:08
>> Yeah. So when using a tool like SIFT, you know, it’s we’re we’re an AI tool.
18:13
We’ve been an AI tool since before it was cool. Um, and I think, you know,
18:19
we’ve talked a lot about in that past session about some of the things that to
18:22
your naked eye look better, look easy, they’re harder to detect than they were
18:29
before. But there’s a lot of things that are happening behind the scenes that can
18:33
that can feed into helping you make educated decisions about if something is
18:38
or isn’t fraud or is or isn’t AI fraud. Um, looking at this graph here, you’ll
18:43
see a handful of signals. Some of them are not surprising at all. Device
18:47
fingerprint, email, you know, what we’re thinking
18:50
about when we think about something like device fingerprint is someone running
18:54
all of this off the same device. So, while it all looks good and great, we’re
18:58
getting just massive amounts of signups or referrals or to use Godwin’s example,
19:05
promo abuse all coming from the same device. Um, event velocity is a huge
19:12
one, right? these AI models, they try to go fast and accomplish
19:18
what um you know what they what they’ve been
19:22
asked to do swiftly. So things like moving through a page really fast,
19:28
ordering really fast, adding these things are becoming more and more
19:31
important as we move into this AI world. And you see that down there with site
19:35
navigation as well. But we’re also collecting on the Sith end, you know,
19:40
16,000 and more other signals. Everything from,
19:45
you know, location stuff to the tiniest little metadata to things
19:51
that kind of help us build a full picture that, hey, this does not look
19:54
like a real person. And at the end of the day, you know, the concept is still
20:01
similar. It’s like when we think about a fraudster, they’re doing things that are
20:04
out of the ordinary for a normal user. And in this case, it’s out of the
20:08
ordinary for a normal person. A thing that would be just too fast or too you
20:14
are too similar even in some cases to be a normal person.
20:21
>> Yeah. So the speed kind of is the tell there in that case.
20:26
>> And but I think you know speed will change because people will get better
20:29
with the AI. They’ll prompt it to go low and slow, but there’s still going to be
20:33
little things hidden hidden in the way that they navigate the site that they
20:37
move around. And when you combine all of these signals together, all 16,000 plus,
20:43
you can start to make a compelling argument one way or the other, whether
20:47
this seems like legitimate or fraudulent behavior
20:51
that is becoming harder and harder to see with just your eyes and
20:55
investigating the way that we maybe did when I first started in the fraud
20:59
industry.
21:02
>> So, how do how do you tune your models here? um you know based do you do you
21:07
work with individual customers and and go through reviews of what was a false
21:11
positive and what wasn’t and um make the model smarter and smarter over time
21:16
using that feedback. How’s that work?
21:18
>> Yeah. So sit is a supervised model which means we we rely on our customers to
21:23
provide us feedback whether something is truly fraud or not. Sometimes that can
21:27
come via a chargeback API. Sometimes that can come via that manual or reviews
21:32
or someone writing in and asking why they were blocked and you somehow
21:36
verifying that they’re a legitimate person. And then we also use an ensemble
21:40
model here which I think is something that’s really helpful. We’re not while
21:44
you do have your own model, we’re also have our global model where we’re
21:48
collecting these same signals for all of our customers and trying to help you
21:53
make informed decisions across with sometimes data that you might not have
21:58
but we get from another customer. Um, and then most a lot of our customers are
22:03
also on a cohort model or a vertical specific model. And with so because what
22:11
matters to an eye gaming company might not be the same as this food delivery
22:14
company that goal about right there’s going to be different signals different
22:17
types of fraud but when you put all these things together with what I like
22:21
to call the magic of data science they wait don’t they figure out what’s going
22:24
to be the best for you really start to have just this really really powerful
22:29
tool of many many signals across many industries countries
22:35
customers to really inform the decision ision that you get to make whether you
22:40
want to accept or decline this transaction post or login event.
22:47
>> That’s very cool. So there’s models at the individual organization level at
22:52
kind of a vertical level if you will and then the global level where you can
22:57
learn so much from other regions and other industries and apply that down to
23:02
the individual corporation. That’s very powerful.
23:05
>> Yeah. And it’s it’s really nice because with with a customer base the size of
23:09
ours, we’ve probably seen this person before somewhere else, right? So we have
23:14
whether it’s via their email, their phone number, their device ID, many of
23:18
these other things that we talked about here, we’ve seen them somewhere in our
23:21
ecosystem before, which means you get a better informed decision versus if you
23:27
had a closed system, which is only about your business, you only see them the
23:31
first time they enter your ecosystem. We’re seeing them the first time they
23:33
enter CIF’s ecosystem. That was great. Awesome. Well, thanks
23:38
for that. Um, now we’re going to shift into, you know, identity as a control
23:44
point. There’s been a lot of synergy um for some time between identity and and
23:51
fraud detection because, you know, I what’s identity supposed to do? It’s
23:56
supposed to let the good guys in and make that as seamless as possible and
24:00
supposed to keep the bad guys out. and you know fraud detection’s the most
24:04
powerful way to do that. So, um it makes sense that these technologies need to
24:10
work together. Um so, Godwin, you know, talk about in our case how we’re
24:16
integrated into SIFT, um as we, you know, handle customers that are trying
24:21
to log in or register and how that all works.
24:26
>> Yeah. So the I think I I as previously mentioned there are there are different
24:30
type of static controls are already available in the IM platform like MFAS
24:35
there are there are secret but but it’s not enough that’s the problem. So we
24:39
that that’s why we are connecting with the fraud detections as as you correctly
24:42
mentioned it’s tightly coupled and we we basically it’s a need now right so in
24:48
the as a as a central point in the identity platform there are different
24:53
life cycle in the user journey which fraud signal comes into the product. So
24:57
as example starting from the user registration on boarding point of view
25:02
and then user authenticating then do the maybe step up authentication and do the
25:07
other account recoveries etc. What we are doing from the identity platform is
25:12
basically publishing all the events different type of events into the SI.
25:16
Yeah. So when we are publishing events we capture different security postures
25:21
like device locations and and uh whatever the operations they are
25:26
performing etc. We publish all these events into the SIP. Then the SI side we
25:33
have a a nice way of creating workflows for different journeys as example for
25:41
user creations or account takeovers. We can create the workflows with the rules
25:47
which when we’re creating the workflows we can use different type of things like
25:52
sift has a way of like a getting the scores inside based on the internal AI
25:57
models and also the other things like travel velocities users behaviors etc.
26:03
So we create the workflows in the sip sites. So when we whenever we are
26:08
publishing the as example in this particular you know the screen that you
26:12
you’re you’re showing the sift is returning um a decision uh based on the
26:19
workflow decision and and then by evaluating all the rules finally this
26:24
decision is basically showing the risk whether this is a a low risk or a medium
26:29
risk or a higher risk etc. So based on that the identity component can decide
26:35
whether we need to give a like a frictionless experience or a give a like
26:39
a multiffactor authentication for the end user or or then we can maybe block
26:44
the user etc. So that’s what we have done in the in the in the IM platform
26:50
from our side. Yeah. And then so the assuming assume that the identity
26:56
administrator can decide you know their level of
27:00
tolerance for low, medium and high risk and what actions they want to take based
27:04
on that always balancing of convenience experience against fraud mitigation.
27:12
>> Absolutely. So based on the decisions that we are getting from the sift side.
27:15
So this decision actually tied into some sort of a risk uh as I me mentioned
27:21
previously whether it is a low medium etc. based on based on that we can
27:25
control the login uh behavior of the induced end and decide what need to be
27:30
done. Yeah
27:31
>> that’s great. So how we are doing that is um basically
27:39
from the identity platform provide orchestration um basically login
27:44
orchestration where we can intercept different
27:49
experience of the login like as example when you use a first time login or use a
27:54
doing a doing a multiffactor authentication we can basically
27:58
intercept using this orchestration engine then we can take the decision in
28:03
the orchestration engine itself. If if you are getting in a higher risk
28:06
situation, we can stop the login journey or or do the step up authentication etc.
28:11
which has the flexibility to basically call the fraud engine and take the you
28:15
know the control the login u flow uh from the identity control point of view.
28:20
>> Yeah.
28:20
>> Right. So this is more like automated real time detection and corrective
28:26
action versus like a a fraud case review officer
28:31
reviewing a case and deciding over time what what actions they want to take. So
28:37
both are needed and both are powerful.
28:40
>> Absolutely. Absolutely.
28:43
>> Okay. And brings us to our next poll question. um you know what signals does
28:49
your current identity and access management use to control access? We we
28:54
basically broke this down into two categories more like basic signals or
28:59
super advanced signals. So example of basic would be something like this is
29:05
coming in from a strange or new IP address or there’s uh been a number of
29:11
failed login attempts. Um so kind of simple things that that you can be
29:15
doing. Um and then more advanced is where you would be bringing in things
29:20
like what sift provides where it’s it’s very advanced in terms of behaviors and
29:25
browser and velocity the speed factor that we were talking about before. So
29:30
just interested in what level of controls are in place uh with those that
29:36
are attending the webinar. we doing basic things? Do we feel like we’re
29:39
doing advanced or are we not there yet? Be interested to see what these results
29:45
show. Any predictions, guys?
29:52
>> I imagine this one’s going to be a little bit 50/50. We’ll see what the
29:56
results are, but I imagine that there are going to be people that are doing
29:59
really advanced things, using really sophisticated tools, and others that are
30:03
still sort of on what we thought of as legacy. And I I think that’s fine. You
30:07
know, there’s a lot of different approaches, but with AI and things
30:11
moving fast, you know, it’s it’s probably time to revisit those
30:14
strategies. And that’s what I hope we get out of the results today is that
30:18
people are interested in in revisiting those. So, we got the results in um I
30:23
was wrong again, which it doesn’t surprise me. Um 75% said that they are
30:28
using advanced strategies and 25% says that they’re still using more basic
30:34
basic strategies like IP um address location, number of login, etc.
30:40
>> Well, you have to consider that our audience today is obviously very
30:44
advanced and sophisticated, which is why they’re tuning in to the webinar itself.
30:48
So that probably skewed our results from the general population.
30:54
Awesome. All right. So, asked you to kind of um
30:59
come up with any questions that are that are on your mind. Um now’s the time
31:03
where we can ask Jeremy and and Godwin um to answer any specific questions you
31:09
have. Take a look here.
31:16
Uh so I one question this probably best for Jeremy is you know in addition to
31:22
like account takeover um or new account fraud what other types
31:27
of fraud attempts can SIP detect like things like payment fraud where um
31:33
>> yeah our our core product is a payment um payment product for fraud payment
31:40
fraud I think you know it’s very helpful to have both account takeover and
31:47
payment fraud. The thing we know about account takeover is the signals are
31:51
going to look a little bit different and that’s why you want a dedicated model
31:54
and a dedicated solution for the two things. We also have things like content
31:58
integrity that we can help with. Um I find that to be
32:03
um it’s going to be more and more needed in this new world. We were talking about
32:07
the kind of things you think about from a content standpoint when someone’s
32:11
posting something online. some of the things you used to could look for is
32:14
this fake is this spam they’re getting those edges are getting softened with
32:18
AI. So you really want to have this holistic solution and have multiple
32:22
problems at multiple phases of the user journey. And then one thing cool about
32:27
SIS as on the payment side especially is you know we can do checks at all parts
32:32
of the order or transaction flow depending on an individual business. So
32:37
for some businesses we might want to do it right at checkout but some we might
32:39
want to do it sooner and something like CIF can look at all those different
32:43
steps in the journey.
32:45
>> Yeah. And that’s you know in the context of identity and fraud um identity kind
32:50
of is covers part of that journey from the initial registration and log to kind
32:56
of in that account takeover phase. But um you know your solution is flexible
33:01
enough to come in at several different points control points uh in the process.
33:07
So that’s great. Just got another question. Uh how do we balance AI
33:12
shopping agents with AI fraudsters?
33:17
>> Yeah. So I think this is a good I think this is a good question and like we
33:20
talked about earlier we’re all moving more towards using AI to do our midane
33:25
pass for us, right? So people are using AI agents to go shopping. They’re using
33:30
them to, you know, book appointments. All of these these sorts of things,
33:35
right? And this sort of goes back to what we were talking about before at
33:39
scale and like starting to learn the difference between what is normal
33:44
behavior for your user base and what’s not. But if you’re if I’m using an AI
33:49
agent to help me shop for shoes,
33:53
>> I’m still a single individual entity buying a pair or two of shoes. My
33:58
shopping habit should still mirror those of a normal user. When someone’s using
34:04
an AI tool to do retail fraud, to stick in this example, they’re buying
34:10
multiples. Maybe they’re spinning up multiple accounts that are all doing the
34:13
same things. So, you know, one of the things we talked about was velocity and
34:19
the I think the crux of what the person that asked this question was is like
34:23
they’re also going to move fast through the flow, right? Because they’re an AI
34:26
agent. They know what they’re going to do. Maybe they’re enabled on that
34:29
specific site. And that’s fine. That’s just one signal in the story, but what
34:34
is also happening around that? Are they then are multiple agents doing the same
34:38
thing in parallel? Is the are they ordering many things on mass? Are they
34:43
rotating through cards? So, taking those sort of all those signals together and
34:49
and telling a compelling story of is this an agent or is this a fraudster,
34:55
that’s when all these signals become more compelling. And I I do think too
35:00
going forward, we’re going to start having trusted agents. We’re going to
35:03
know their agents and hopefully we’ll be able to have flags that say you’re using
35:06
the authorized agent on the website to do your shopping. And you know, we can
35:10
have less we can have less controls on something where like they’re coming in
35:14
with an outside agent. We’re gonna we’re gonna scrutinize that a little bit more.
35:19
>> Yeah. Great. and and and and one more thing is I
35:23
think um we have to think about the other the agent security and the
35:28
guardrails around this area as well because uh we have to we have to have
35:32
the correct guard rails around to make sure that these agents are performing
35:37
well and and and make sure and we are monitoring evaluating etc. So we have to
35:42
we have to define the correct security posture for the uh agents and and and
35:47
monitor and audit as well. So that’s also important part. Yeah.
35:52
>> Got another question here. We’ll shoot this over to Godwin. Um question is
35:57
basically does does SIFT work with other AM products and does W2 work with other
36:06
fraud detection products? In other words, are these things bound to each
36:10
other or are they more open and flexible?
36:15
>> It’s open and flexible. Um the the only thing is we so we have done a first
36:21
class integration uh with the SI um so we have the flexibility to connect with
36:26
the different the architecturally in the product etc. We have the flexibility to
36:31
connect with the other fraud detection systems but we have a first class
36:36
integration with the SIP where developers can easily integrate and and
36:41
get the job done easily in my opinion. Yeah.
36:44
>> Right. And same thing for the SIFT side. Of course, SIFT can work with other
36:48
identity providers. Um, not just WSO2, but again, we’ve got very tight
36:54
integration and companies closely aligned.
36:57
>> Yeah, I think I mean we will we will work you can feed us signals from any
37:01
other identity providers, but what we what we know is that engineering
37:06
resources are tight these days, right? And people want like a one-stop shop in
37:11
some ways. So having having a first class
37:15
um integration already mapping out all the things that are going to be
37:19
important for SIFT and important for WSO2 together in that integration it’s
37:23
going to make someone’s life easier. It’s going to make the onboarding easier
37:27
the time to value sooner. So, you know, while we’re happy to work with any of
37:32
the other providers you’re using, if you’re if you’re building a whole new
37:36
fraud program or ripping and replacing, having something you’re going to have so
37:40
much engineering work to do already. Having a good first class integration,
37:44
gold standard that you can just plug into, uh, it’s just going to make your
37:48
life easier. And because we have a good relationship, as you can tell, because
37:52
we’re all here, you know, it’s it means the integration is going to stay strong
37:55
and we’re going to continue to collaborate.
37:58
>> Yeah. Yeah, I mean that’s my experience as well is dealing with customers. It’s
38:03
they don’t really want to hear, oh, we can integrate with any fraud detection
38:07
engine. Just get whichever one you want, we’ll integrate with it. They they need
38:11
us as vendors to be more thought leaders. And as you said, we’ve already
38:16
gone through the integration. We’ve already proven the the concept. We’ve
38:20
made it better and improved it over time is a much better answer than than we’re
38:24
just open by default. So good. I got two more questions that we have time for.
38:30
Um, so this one’s about deep fakes. Like what’s the best practice for detecting
38:36
deep fakes? Godwin, why don’t you answer that for us?
38:42
>> Yeah. So the it’s it’s an interesting question. So the defect in in the in in
38:49
the real IM domain what I have seen is mainly
38:53
regarding the KYC processes, right? Uh so think about like when your user on
38:59
boarding or or the do the KYC processes after after after the onboarding in a
39:05
different uh high high critical transactions doing the people are using
39:10
the the fake things like uh you know the documents or deep fake etc which in my
39:17
opinion needs to handle through the KYC processes uh which identity verification
39:23
solutions are providing and and they have internal way of detecting those
39:28
defects. So that’s that’s the mainly in the in the how it works in the identity
39:33
domain. I don’t know Jeremy, do do you have any any other uh idea on that one?
39:39
No, I I think that I think you’re absolutely right. Using, you know, this
39:43
is where a SIF tool is not going to be, you know, we can help for some of the
39:47
things that happen around the deep fake, but identifying a deep fake is not is
39:51
not something we do. But there are great, you know, know your customer
39:56
identity verification solutions that can help with that. And obviously, if that’s
40:00
something you’re struggling with, I think any of us on this call are happy
40:04
to help point you in the right direction for something like that. Um and it you
40:09
know this is a thing that people are concerned about and and we paired with
40:13
something like that can then help if the deep fake gets through what happens
40:17
downstream is where a solution like R2 can sort of help.
40:22
>> Yeah absolutely. All right and the final question uh you
40:27
mentioned referral fraud. Can you provide more details on how that can be
40:30
identified and improved?
40:35
>> Yeah, I can I can take that one. Um, yeah. So, if you have any sort of
40:41
referral program where, you know, if I refer Michael, he gets $10 off his first
40:45
order. You’ve seen referral fraud. It’s nothing new. It, you know, often it’s,
40:52
you know, well, I have a work email and a personal email and maybe like a third
40:56
an iCloud email. I want to just refer myself a few times, right? And that’s
40:59
like that’s pretty low low stakes. Whatever. I got if I got $10 off three
41:04
times, that’s fine. But where what we’re seeing with AI is it’s escalated, right?
41:10
Not only can I spin up infinite email accounts, especially now with all these
41:13
disposable email accounts that exist, I can spin up infinite of those. I can
41:17
refer myself and before we would often see almost like a Genesis account that
41:24
kept referring everyone. Now with AI, it’s much easier to have this one
41:30
referred, this one, the next one referred, the next one to to what they
41:34
think is offiscating this whole like chain of referral abuse. But what a tool
41:39
like CIF can do to help with that is there are going to be things that are
41:42
consistent throughout those transactions. And
41:46
looking at the the whole of that chain in a snapshot will help you understand
41:51
if Michael really does have just 400 friends that he keeps referring to your
41:56
takaria or if he or if there is actually Michael’s just trying to scam free tacos
42:01
from you. And that’s where these other ancillary signals come in. Like are they
42:06
all originating from the same area? Are they all coming from the same device?
42:11
Are they all coming from a handful of devices? just really, you know, a real
42:15
sophisticated probo abuse person can rotate a lot of stuff and it might take
42:20
you a little longer to catch them, but if you’re doing this at scale, there is
42:24
and you have a tool like a sift using AI to like identify these signals and score
42:30
these signals, you know, there’s always something that you can help kind of tie
42:34
that together and make that compelling story. on your own with AI, it’s going
42:39
to be much harder because like I said, they’re going to be jumping around a
42:42
little bit more. They’re going to it it’s just it goes back to the same thing
42:47
that Godwin and I have been saying over and over again. The floor doing this has
42:52
raised and a lot of people are becoming for stuff like promo abuse when they
42:57
were like, “Oh, there’s no harm in me referring myself four times.” They’re
43:01
keeping that same mentality but using a tool to game the system.
43:08
>> That makes sense. Good answers. Good questions. Uh thanks to the audience for
43:14
uh such good uh good questions to allow us to elaborate on. Um Eric, why don’t
43:20
you introduce yourself um as a point of contact if people want to have follow-up
43:25
conversations?
43:27
>> Yeah, thanks Michael. My name is Eric Nishki. I’m a senior account executive
43:32
here at Sift and I work handinhand with the the WSO team. So if anybody on the
43:37
call has questions about how Sift works, how we can integrate with your current
43:43
fraud strategy, happy to have a deeper conversation with you and our product
43:48
team to go deeper. You know, you can connect with me over email, over
43:51
LinkedIn. Uh even if you just have a question that you know, a lot of times
43:55
when you’re on a call, you you know, you don’t think of the question till you’re
43:58
off. If you if a question hits, just shoot me a shoot me a note. Happy to
44:02
help.
44:03
>> Awesome. And same from our side. If you if you uh have any questions, you prefer
44:08
to reach out to WSO2. There’s my contact information. So, wanted to thank
44:13
everybody for attending the webinar today. I think it was very insightful.
44:17
Uh so, thanks for your questions and your time and good luck out there.
44:21
Thanks to the panelists.
44:23
>> Cheers all.
