How to Combat the Emergence of Automated and AI-Generated Fraud

0:00
Right. Hello everyone.
0:10
As usual, we want to give people a minute or two to be able to join us
0:15
today before we kick off on our discussion about fraud and AI. While we
0:21
wait, so you don’t just have to stare at our faces waiting to be able to talk,
0:25
we’ve got a poll going, which we’d love to get your feedback on. Before we dive
0:30
into the topics of AI, we want to know how many of you here today have
0:36
experimented with it. So the question is, have you used an AI tool such as
0:41
chat GPT? And this could be something even within the past year if you’ve
0:47
taken the time to experiment and use any of those available AI tools.
0:54
Getting some answers rolling in. Also keeping an eye on participants giving a
0:59
little bit more time so that we can get everyone’s answer. And I know as people
1:03
roll in they don’t know what we’re doing. So, take a look at that poll on
1:06
your screen and give us a a kickstart with your feedback on whether or not
1:12
you’ve used an AI tool such as chat GPT. If you say you’ve used fraud GPT, get
1:20
out. No, that’s fine. You can experiment with that. That’s okay.
1:27
All right. So, of everybody who’s in the room,
1:33
almost everybody has participated. We’re two minutes past.
1:39
Oh, I see a few more coming in. Let’s let those people click.
1:44
All right, I think we’ve got a pretty good indicator now.
1:49
If we could show the results of that poll, please.
1:57
All right. So, a majority of you have spent some time playing around with an
2:03
AI tool, potentially chat GPT. That’s great to hear because then that means
2:08
you have, you know, some sort of exposure as to how these tools work, how
2:12
easily accessible they are, and what they can potentially do. So, we are
2:18
looking at right here 78% said yes, 22% said no. Uh before I kick it off and
2:24
explain who I am and who our panelists are, I just want to get a quick chime in
2:28
from Cassandra and Kenneth. Did either of you say yes or no for having used
2:33
these tools? So it was a yes from Cassandra and a yes from Okay, great. So
2:38
we’ve all been using it. That’s great. Well, with that, let’s dive in. Thank
2:43
you so much for taking the time to join us today. Uh my name is Britney Allen.
2:48
I’m a trust and safety architect at SIFT. And what that means is I’ve spent
2:52
a majority of my career as a merchant. I’ve worked for companies like Etsy and
2:57
Airbnb fighting fraud, building trust and safety teams, handling chargebacks,
3:03
all of that fun stuff for the past 13 years or so. And Sift is a leader in
3:09
digital trust and safety. And we empower both digital disruptors all the way up
3:14
to Fortune 500 companies to unlock new revenue without risk. Now, what that
3:19
means is we’re a fraud prevention solution that enables merchants to
3:22
protect themselves from multiple vectors of fraud and abuse. Whether that’s
3:27
payment via stolen credit cards or something with account takeover as the
3:32
result of compromised customer data or spam and scams, which is uh something
3:37
that we’re going to talk about today, such as those social engineering scams
3:41
that we hear so much connected to AI. Now joining me today is uh Cassandra
3:47
Gort, the senior manager of payments risk at MindBody and also Kenneth Laauo,
3:53
the head of trust and safety at Zipcar. Now why are we so lucky to have these
4:00
two together with us today discussing AI? Well, it’s because it’s a very
4:04
timely topic. The democratization of fraud has become more automated and with
4:10
AI it can be easier for anyone to become a fraudster and scale attacks with speed
4:16
even with minimal experience. Now generative AI is under intense scrutiny
4:22
for the serious risk that it poses which creates potentially a flood of
4:26
disinformation scams more that we’ll get into detail when we start having our
4:30
discussion but I want to call out some sort of key facts to level set up front.
4:36
One is that these AI tools can be used to do things like write and improve
4:41
code, which can allow for fraudsters to have more successful malware and remove
4:46
the telltel signs of bot activity. There’s also the ability to create
4:51
conversational language free of spelling, grammatical, any other kind of
4:55
errors like that and make it difficult for the average person to distinguish
4:59
that synthetic media is not necessarily authentic.
5:04
Then I want to point out that it’s up to companies to set their standards on
5:07
their own platforms in order to keep their business and customers safe from
5:11
the downstream effects of AI generated fraud attacks, which means that we’re
5:15
not going to be able to point to, you know, some concrete global regulations,
5:21
but we can maybe talk about some recommendations per specific businesses.
5:26
And then lastly, that AI is fastm moving. So, you may have heard in the
5:32
news about the tool worm GPT. You know, it was one where the founders claimed
5:38
that it was a tool not meant necessarily for fraud, but meant to be an uncensored
5:44
version of chat GPT that could allow for some potentially something fraudulent,
5:49
but also for, let’s say, cyber security researchers to be able to learn what
5:54
could be done via AI if it was unfettered. I actually saw that they
6:00
shut down yesterday making a pretty lengthy announcement on their Telegram
6:05
channel and they announced their decision was due in part due to their
6:09
portrayal by the media even after they had started layering in restrictions on
6:14
their previously uncensored tool. So, in the matter of, you know, a few months or
6:20
weeks as far as it being on most people’s consciousness, we’ve gone from
6:23
talking about Worm GPT, worried about how it can be used, seeing restrictions
6:28
added to it that made it more similar to chat GPT, and finally seeing it shut
6:32
down yesterday. If you go to their website, uh, the tool will not load. So,
6:37
it seems like it’s gone. But, of course, we know there are likely others that
6:40
will pop up in its place. So with that, I want to kick off our first discussion
6:47
point focusing on customer sentiment. Uh some stats from CIF’s recent digital
6:54
trust and safety index report actually found that 78% of consumers are
7:00
concerned about AI being used to defraud them. And in 2022, consumers reported
7:07
losing $2.6 6 billion to impostor scams with those executed over social media
7:14
and phone calls leading to the highest losses. So for this question, I’m going
7:20
to turn first to Cassandra and ask, what concerns have you heard from your
7:26
customers about AI being used to defraud them? And also, what concerns do you
7:32
yourself have as a consumer?
7:35
>> Yeah, absolutely. Thank you, Britney. So, uh, with our merchants, we haven’t
7:40
particularly received a lot of sentiment from our customers. But one thing that I
7:45
see being a concern particular to our vertical is just the ability for
7:49
fraudsters to create those realistic emails. Um, creating, you know, since
7:54
chat GPT does give that ability to make it much easier to create those
7:58
conversational emails, um, it’s going to be a lot easier. you know, we always
8:02
gave tips that, you know, look for bad grammar, look for poor poorly written
8:08
emails um as a way of telling that it’s fraud or a scam. And now it’s going to
8:14
make it that much more difficult. Um I also like myself personally as a
8:19
consumer, the voice cloning just terrifies me. So um that one’s really
8:26
scary but we also have heard um in the industry as well just uh the fake images
8:31
and like how that can uh portray into like forging uh sensitive documentation
8:36
and providing that uh for merchant accounts or credit cards etc. So
8:44
>> absolutely. Uh and then we also have, you know, heard reports of people who
8:49
are just trying to get information to help them understand if something’s a
8:52
scam or not, like becoming less willing to trust certain emails or less willing
8:57
to uh engage with someone on social media and click a link, which is good.
9:02
We do want people to be able to protect themselves, but then at the same time,
9:06
we want to be able to give them the ability to actually determine if some
9:12
kind of contact is legit and not just be, you know, too nervous or too afraid
9:15
to engage with anything. Um, we’re going to talk about it in a little bit more
9:19
detail as we go through these scams, but I know that I think all of us here have
9:24
probably received one of those gift card SMS scams, the ones that pretend to be
9:29
your boss and, you know, pretend to be somebody in your life who is at a
9:33
conference and needs gift cards, etc. And we’ve gotten pretty good, I hope,
9:38
with not falling for that scam. Although I do know some people who unfortunately
9:42
did send the gift cards along because they were, you know, successfully
9:47
tricked. I know one person in particular uh I interact with who has a pretty
9:52
volatile boss who actually does make lastm minute out of nowhere requests
9:56
like that. And so for them, they thought it was really their boss asking for $300
10:01
in gift cards. That’s an edge case, but that’s also not one nearly as
10:05
sophisticated as what we’re talking about for that potential for AI. So what
10:09
you called out with voices or with images or with other sort of more
10:14
convincing applications of technology that is definitely something that you
10:19
know fuels that concern that consumers have.
10:24
All right. Well, I want to be able to bring Kenneth into the conversation
10:28
here. So let’s uh shift slightly and we’re going to have a discussion about
10:33
the hype cycle. we can’t hold off talking about that topic, you know,
10:38
because here we are bringing up all of the things AI can do, but maybe we’re
10:43
not actually seeing that happen in real life. Uh, so a stat from that report
10:50
found that nearly half of consumers admit it’s become more difficult to
10:54
identify scams in the past six months. That kind of leads uh from what I was
10:59
saying earlier about people maybe not having enough information to kind of
11:03
decide if they should trust something or not, but it can also just lead into
11:09
what’s being brought up within that hype cycle. So Kenneth, I want to ask you,
11:13
what misconceptions do you see regarding the use of AI by fraudsters or just
11:19
about AI in general?
11:22
>> Sure. First of all, thanks so much for having me, Britney. Um, you know, I
11:25
would say and uh nice to see everybody on the on the on the webinar. So, thanks
11:30
for coming on. I think the first thing that kind of comes to mind is that
11:33
there’s this constant talk that AI is going to take over jobs and a lot of
11:38
folks are going to be obsolete in terms of what they do on a regular basis. Um,
11:43
from a risk perspective, uh, all of us here are fraud fighters. We tackle
11:47
different areas within fraud and risk and payments. And you know, I would say
11:52
that everybody’s experts at what they do. And one of the big things is that I
11:56
don’t really see those vectors changing too dramatically. Rather, I’d see them
12:01
being more refined over time. Um, so I think that’s kind of uh that’s what
12:06
jumps out to me right now.
12:09
>> How about you, Cassandra?
12:11
>> Yeah. Um, definitely on the jobs part. Um, but also I think you know it’s just
12:16
so trendy right now. um AI chat GPT and all these image generators you see them
12:23
all over Tik Tok um on social media. So I think uh there’s this common
12:28
misconception that it’s like recently developed but the actual like concept of
12:33
ei AI has just been around for so long many decades and whenever I get into
12:40
conversations with anybody about AI they always are like oh yeah it’s it’s so new
12:44
it’s sketchy but I think it’s it’s trending right um and so I think there’s
12:49
this um it’s it’s cool to get into right now because of the hype about
12:56
Yeah, it’s definitely a trending term, you know, because here at SIFT, we use
13:00
machine learning models in our fraud prevention work. And you know, machine
13:04
learning is a practical application of the overall concept or science of
13:09
artificial intelligence, and we’ve been around for quite a while, too. So,
13:13
you’re right that that word has become pretty buzzy. Uh, I wanted to call out
13:18
something that I’ve seen in some of the research I’ve done and get both of your
13:21
takes on it. And that is that some of my work is to monitor deep and dark web
13:27
forums. And I was really curious to see what fraudsters were talking about when
13:33
it came to the advances in AI. And I saw this really interesting discussion in a
13:40
fraud forum where they were talking about the ability to leverage social
13:45
engineering attacks against victims. In this specific case, they were talking
13:49
about being able to do OTP attacks or getting somebody’s one-time password,
13:56
which might be the code that your bank sends to your phone via SMS to verify a
14:01
login or you, you know, otherwise receive because you’ve opted into or
14:06
required to undertake that higher level of authentication. They want that code
14:10
because they’ve got your credentials ready to go to log in to your account
14:15
and they just need to clear that extra step. Well, they were talking in that
14:19
forum about using some of these AI tools such as the, you know, deep fake
14:26
technology or voice emulation to be more successful in those scams. And one of
14:33
the fraudsters spoke up and said, “Yeah, but it works so well the way we do it
14:39
now. You know, we do a rooc call. People are used to that electronic voice
14:44
pretending or saying that they’re your bank and they’re calling for a code.
14:49
Please enter it now.” People are comfortable with that. No one’s
14:51
suspicious about that. Why would I take the extra step and the extra work to
14:57
complicate it and make it seem like a real person when this robot voice works
15:01
just fine? And so that particular fraudster was dismissive and was like eh
15:06
don’t you know don’t fix what’s not broken. So I would love to hear uh the
15:10
take from both of you on on that particular point.
15:16
Whoever wants to go first.
15:20
>> Um I’m happy to go first. Um, you know, it’s it’s funny because um, you know,
15:26
for for myself, I I think about, you know, when when I might get phone calls,
15:31
you know, what am I saying at the beginning or what am I saying during
15:34
those phone calls? You know, do I say things like yes or no or give some sort
15:38
of affirmation um when uh when I’m answering calls that I’m not too
15:43
familiar with. So, it might be like, hey, am I am I speaking to Kenneth?
15:47
Right? And I’m I’m not going to say yes in that situation. I’m going to be a
15:51
little bit more creative about it. But I think that um I think that kind of goes
15:56
back to my point earlier around um I don’t see this being drastically too
16:02
different in the sense where folks are going fraudsters are going to use what
16:06
works. They’re going to use what um what applies and every every single merchant
16:10
is different in many ways, right? So for example, I do think about uh voice
16:15
recognition in situations where some merchants might be leveraging that,
16:19
right? And um and those are some things that
16:23
those merchants might have to be a little bit more u mindful of when they
16:27
think about those things. Um but for us it might be a little bit different. You
16:31
know, if that’s not a if that’s not a concern for us, we would be looking at
16:34
other areas where um we might be and I’ll touch on this a little bit later. I
16:39
think um as uh you know, for maybe for some other topics, but um I think that’s
16:43
kind of what comes to mind. It’s it’s on a day-to-day basis. What are some things
16:47
that we can just be a little bit more mindful of on a regular basis to kind of
16:50
prevent the the more simple attacks if you will?
16:54
>> Yeah. And Cassandra, what do you think? Is that fraud surge being lazy or they
16:57
being realism?
16:59
>> Yeah, I definitely I think it’s a little combination of both. You know, like you
17:03
said, it’s that don’t fix what’s broken. It’s worked for several years and
17:07
unfortunately may continue to work. Um, you know, I had a close uh family friend
17:12
that did fall victim to one of those. And so I just like constantly like go
17:16
back to that situation and like what this friend experienced and like always
17:20
put my fraud cap on and just don’t trust anybody, don’t trust anything. So if I
17:24
do get a phone call, I just go straight to voicemail. Um, and then I use my
17:28
better judgment. If I need to return the call or if um I I I’ll always select um,
17:33
you know, if I’m doing like a bank verification or something, I’ll always
17:36
select to text me a code. don’t call me because that freaks me out. But um I
17:42
need to get better about trusting and maybe looking at some of those things.
17:45
But right now, like just with that close family friend, having that experience,
17:50
it just kind of and then of course being in the field that we’re in just this
17:54
constant state of mistrust.
17:56
>> Oh yeah. We all feel that extra pressure. We don’t want to be the ones
17:59
like I have nightmares. Oh my gosh. If I say this and a fraudster is listening,
18:02
then I guess I’ve just shot myself in the foot. But I would have nightmares
18:05
about like having my LinkedIn account taken over and posting some kind of
18:09
nonsense and it was like, “Oh, even Britney Allen can’t keep her account
18:12
safe.” So, let’s put that into the universe that that won’t happen. But
18:16
that is an oddest discussion of some of those worries. All right. So, kind of
18:21
acknowledging then the hype cycle and at least saying that that is something that
18:25
we should keep in mind. We’re still saying that fraud prevention must
18:30
evolve. We know that fraud changes year overyear. While we do see repeated
18:36
evergreen trends such as the use of stolen credit cards, the use of social
18:41
engineering, the methods that are employed to either get that information
18:47
or to then use it do have to change on the fraudster side because we keep
18:52
taking action to hold them back. So, I wanted to take a moment and pause here
18:58
as three people who have a pretty decently long or robust career within
19:05
trust and safety to set the stage for our audience to get us all thinking
19:09
about where we’ve come from. Uh, I’d like each of us to talk about a time
19:13
from early in our career when we encountered a new fraud pattern, but had
19:17
to take a manual approach to identifying and mitigating it. And I I promise that
19:22
there is a payoff to this. And I will kick it off with my example uh going all
19:27
the way back to 2010. That would be the first time that I ever saw a
19:33
moneyaundering ring in action. It was a large group on the marketplace of
19:39
sellers that had high volume sales that all got glowing positive reviews, no
19:46
issues whatsoever. And then every now and then some orders to those sellers
19:51
would be placed that resulted in a completely negative experience. Not a
19:56
varying not a variance of negative experiences though. Not I didn’t receive
20:00
my item. My item wasn’t described. My item arrived late etc. But always just I
20:06
never received this and the seller never communicated. So even though it was a
20:10
smaller volume of their sales, it still stuck out to us and we tried to figure
20:14
out what was going on. I ended up having to map out the connections of the seller
20:19
to all of their buyers via paper because we didn’t have any sort of network
20:25
visualization or tool available to us that would have allowed me to see these
20:30
connections. And when I did map out some of them on paper, that’s when I realized
20:35
all of the buyers who purchased from these sellers and never had a negative
20:39
experience only purchased from those sellers. And a 100% of the time any
20:44
buyer who purchased from them and had a negative experience purchased somewhere
20:48
else, had other activity, did other things. And so we can see here there was
20:52
a closed loop that they were using for moneyaundering, which is why we never
20:55
got chargebacks or disputes. And then the occasional legitimate customer that
21:00
stumbled upon a listing and made a purchase invariably couldn’t get
21:05
anything and there was nothing real to ship. um the fraudster hadn’t thought
21:09
far enough ahead to actually have a product to ship in those instances. So,
21:12
they would just, you know, cancel those orders and move on. But I had to mark
21:16
that out on pen and paper. So, that is a flashback to 13 years ago in a very
21:22
manual process. Uh who would like to share next? Cassandra Kenneth, please
21:26
feel free.
21:28
>> Um yeah, I can go ahead. Uh this was actually not terribly long ago.
21:34
definitely not on paper notepad. Um but it was about 4 years ago I believe um
21:40
shortly after I started my employment with MindBody and there had been uh you
21:46
know we’re used to the fishing attempts where they’re trying to get information
21:50
from employees, get information from our merchants but um we came across one of
21:54
our customers that reached out to us and they said well I got this really weird
21:59
email and our consumer said their customer had reached out to MindBody um
22:06
spoke with the support representative and told
22:10
the the consumer, “Oh, yeah, you’re right. We can’t issue a refund to this
22:15
card.” So, what the fraudster did was they made a false domain. They emailed
22:20
themselves, made it appear that the email was coming from MindBody, and what
22:24
they were doing was they were claiming that they were using a one-time
22:28
purchasing card or they lost the card, now the account’s closed. Um and our
22:35
system only allows you know refunds to the same card of course we don’t want to
22:39
do blind credits and uh so they were requesting to of course like wire the
22:45
funds or give them a check and so then they reached out to their our merchant
22:49
with this email and so one of them contacted us and we’re like well I’m
22:53
very confused why would you like you have all these articles don’t issue
22:56
payments outside of uh the original payment and uh we said oh that’s not us.
23:02
So when we found all these false domains, um it actually turned out like
23:06
there was probably over a hundred of our customers that were contacted from
23:10
several different domains. So we had to work with like our cyber security
23:14
engineers and the very manual process in all this was we had to actually get like
23:20
copies of the original email. So when the email was forwarded to us or a copy
23:26
of the email was provided to us, all of those sensitive details were lost that
23:30
our cyber security engineers needed to take down these false domains. Um and so
23:36
that was very manual. We had to create like one pagers um howto’s on how a
23:41
merchant can actually like obtain the original email,
23:45
>> provide us that text file and then send it off to our cyber security engineers.
23:49
It resulted in uh a mass email that was sent to our AMIA customers. Um and we
23:55
ended up getting probably 150 200 plus emails and very time consuming. Um and
24:02
these weren’t large purchases by any means. So they didn’t break like any of
24:05
those normal transaction
24:08
>> alerts. There was nothing odd about the transactions that they were initially
24:11
making. they were um purchasing maybe $300 transactions for
24:17
um a class package and telling the merchant, “Oh, my son accidentally
24:21
bought it. My three-year-old got a hold of the phone and now I need to be paid
24:26
back.” So, just making, you know, these kind of crazy excuses to get refunded
24:30
and had that backup essentially. And unfortunately, a lot of our merchants
24:35
did fall victim to it. Oh man, that’s that is a lot of manual work that
24:41
unexpectedly falls on our lap, but that is the nature of working in trust and
24:44
safety. I’m really happy to hear that some user education worked though with
24:48
that first merchant who wrote in saying, “I don’t think this is right. You’ve
24:51
told us not to do this.” Uh otherwise, it might have taken longer for you to be
24:55
tipped off.
24:56
>> Exactly.
24:57
>> Kenneth, can you top that while the audience is also thinking of their sort
25:01
of, you know, manual uh activity that is a throwback memory? What do you have to
25:07
share with us?
25:08
>> I will try, but I think Cassandra set the bar pretty high. Um, I’m going to
25:13
date myself quite a bit uh first of all for the audience, but I would say one of
25:17
my first roles in fraud was working for an omni omni channel merchant and we
25:22
were we were relatively new to the to the concept of shipping mules. Um, and
25:28
so for anybody that’s not familiar, um it’s a situation where frauds are using
25:33
uh stolen card information. um they’re shipping physical goods to a third party
25:38
that is someone other than the card holder. And in those situations, the uh
25:44
the card the person who’s receiving those uh those items may be shipping
25:48
those uh those stolen goods to the uh the fraudster in question, right? Um so
25:54
we found out about it because at the time in some cases we were actually
25:58
getting some really confused folks who are actually receiving these goods. So
26:02
they may not have been in on the the scam. if you will, but they were calling
26:06
us and they would say, “Well, I I received these packages. I don’t know
26:10
why.” Or we would actually find out that packages were being sent to um to vacant
26:15
homes. So, it might have, you know, I might have a home with an open house
26:19
sign or things like that. Or we would actually get tipped off by people who
26:23
are actually getting incentivized by saying, “So and so asked me to ship
26:27
these uh ship these items to them and they were so nice that they sent me some
26:32
money in return or something along those lines.” And at the time the tools were
26:36
not what they are today certainly. And so we were essentially living uh I was
26:41
on a very small team. It was myself and and two other analysts at the time. And
26:46
we were essentially living in in Excel spreadsheets all day trying to to log
26:51
these things. And we’re saying things like, well, what kind of items did they
26:54
purchase, how fast was the shipping speed, and what was the order amount?
26:59
We’re looking for things like average order value. um and things like that.
27:04
And you know, at the time, I would say rules engines were still a fairly new
27:09
concept and in in many ways very binary, right? Um so you might set some sort of
27:14
criteria at the time to say if there are x number of orders within a short time
27:20
frame, then you might flag this order and something might happen to it, right?
27:25
you might you might put it into manual review and then the team would go into
27:29
and look at it but that was very time consuming and also it was um you don’t
27:35
really have that kind of um that spiderweb effect that you can have today
27:40
in terms of understanding all the different link counts and things like
27:43
that. So again we’re kind of jotting all these addresses down. We’re kind of
27:46
looking around and saying okay this might be this this might be connected to
27:50
that. This is a completely different shipping mule scheme.
27:54
So um it was uh it was timeconuming but it was it’s also very rewarding and I’m
27:59
I’m really happy to see how the different tools have evolved today and
28:03
how we’ve we’ve challenged ourselves whether it be internal tools or kind of
28:07
looking for the right partners like Ze to uh to improve that uh to kind of
28:11
improve those those uh those tools in our tool belt if you will. Oh yeah, I
28:15
have lived the nightmare of being in the Excel spreadsheets constantly and my
28:19
biggest worry was always user error that I would copy and paste something wrong,
28:22
that I would delete something that someone else did, that I would write my
28:25
formulas incorrectly and get the wrong metrics. That’s another layer of stress
28:31
that I would not be happy to revisit. But I’m thankful we were all able to
28:36
sort of share those manual activities because I am now going to share my
28:42
screen and we’re going to look at two photos and then try to take a manual
28:49
approach to distinguishing whether or not the faces we’re about to see were
28:55
created by AI. Let me make this full screen for you.
29:02
All right, we’ll have a poll pop up in just a second, but first let me set this
29:05
up. So, I have been getting fake accounts requesting me on LinkedIn for
29:12
years. Not quite sure what their end goal would be because I absolutely do
29:18
not accept any of these requests, but I have found that the ones that I receive
29:23
nowadays in past six months or so are invariably using AI generated photos for
29:30
their profile pictures. So, that doesn’t mean they’ve always
29:33
done that, though. And I’d like for you to look at these two photos, and we’ll
29:38
have a poll pop up right about now that asks, which of these photos is AI
29:45
generated? Only A, only B, both, or is Britney just filling up time and talking
29:52
about nothing and it’s neither? So, hopefully I haven’t given too much
29:57
away. And we are going to break these photos down when we’re done with the
30:02
poll, but I want everyone to be able to take enough time to really think about
30:07
it. Only A, only B,
30:14
both, or neither. All right, we have about 70% of people
30:22
who have submitted their vote. So, we’ll wait just a bit longer for the rest to
30:27
be able to get in. Don’t feel too much pressure to
30:31
overthink it. Uh, all the results are anonymous. Can’t see what you picked.
30:40
And it’s been up for just about a minute. So, let’s give 10 more seconds.
30:45
Go ahead and let us know image A, image B, both, or neither.
30:56
All right, I think we’re done. Okay, can we see the results of the poll, please?
31:10
Can everybody see that? Okay, great. So, we’ve got a pretty good split between
31:15
just image A and just image B, but we have about half of the audience saying
31:21
both images and then a few who are saying neither image. So, I know we
31:27
don’t have time to be able to break down why you and the audience made certain
31:32
decisions, but I can tell you what the actual answer is, and I can give you
31:37
some like takeaways about how to identify these photos on your own. So,
31:42
the answer is both images. The one on the right, B, actually sent me a
31:50
LinkedIn request earlier this year. Uh, and I’ve already used this image in some
31:54
training. uh documentation for the MRC. So, if you saw it pop up there, I know
31:59
that’s a small group of people who saw it, so I figured I was safe today, but a
32:03
actually just sent me a request this past week. All right, so before I dive
32:09
into some of the tailtale signs, I did want to give a chance because we talked
32:12
about these photos yesterday and had a good time with them. Uh Kenneth or
32:15
Cassandra, do either of you want to point out some of the tailtale giveaways
32:20
so that people can get a a slight break from my voice?
32:27
Yeah, I could start. Um, yeah, both of these images were pretty like I mean
32:33
they’re good. Um, and uh, Britney, your educa or your background in education
32:40
definitely came out yesterday. So, um, in image B, the first thing that I
32:45
noticed was like the teeth. Um, there’s like that strange
32:51
something in like that front tooth. Um, and then the shadow in the back. Um,
32:57
>> yeah. So, it just like it doesn’t quite match um how he’s posing. Um, so that
33:05
one is uh really good. The ears are different shaped, a little lopsided,
33:11
sideburns are different lengths.
33:14
>> Yes, that’s the biggest giveaway for me. So AI when it’s putting together, at
33:19
least in the way that these images were generated, when it’s putting together
33:23
this composite image of a person who doesn’t really exist in the world, it is
33:27
still trying to nail attributes that it thinks would be, you know,
33:31
representative of such a composite face. And it does tend to mess up with
33:35
symmetry or things that are on the periphery of the of the image. So, some
33:42
call outs for that being some of the ones that Cassandra just said, uh, the
33:45
sideburn length on the man being very different and the size of his ears being
33:50
different. That’s mimicked over here with the picture of the woman where
33:53
she’s wearing two completely different earrings. One that’s shorter and one
33:57
that’s a thinner, longer loop that actually kind of disappears as it goes
34:01
into her ear. And we also see issues with hair and the hairline. So you
34:07
always have to think back on what is the story of this image like what would be
34:12
realistic and not just give it a cursory glance. And when you look into it a bit
34:17
deeper the woman’s picture is a much more you know representative uh image of
34:22
this but the hairline in the front doesn’t make any sense. If she has some
34:26
flyaways or some baby hairs, they should all be coming from a particular
34:30
direction uh at her hairline instead of and I apologize that we can’t zoom in
34:34
this format, but growing literally out of her forehead in multiple different
34:38
directions as these hairs down here are. And there’s commonly going to be a lot
34:42
of flyaways on the edge. Now, Cassandra also mentioned the shadow in the
34:46
background. Um you’ll find that that’s pretty much always blurred when the AI
34:51
generates images like this. These are two particularly good examples, but they
34:54
still don’t really fit that story. So, let’s use this guy as an example. By the
34:59
way, when I got the LinkedIn request, his name was Harry Potter, which was a
35:03
big enough indicator. Like, keep trying not to call him Harry Potter. We’ll just
35:06
call him the guy in picture B. So, he has a solid white background, which is
35:12
sort of indicative of him being like how I am up against a wall, quite close to
35:16
something so that he can get that neutral background. And it’s likely not
35:20
something that was photoshopped in because then why would it have a shadow
35:24
that doesn’t fit the shape of his head? Which then also bears the question, if
35:29
he’s got a flash reflection in his eye, why doesn’t he have a sharper shadow
35:34
behind him? Because if this was a professional photograph and they were
35:38
able to blur a background, let’s just say they did that for sake of argument,
35:43
they would remove the flash from his eye because that’s not something you would
35:46
find in professional photos. So, a lot of the way that he’s staged and the way
35:50
that the image looks doesn’t match up. Uh, and then to the point of the teeth,
35:54
again, I apologize we can’t zoom in. Maybe we can share these later and you
35:58
can zoom to your heart’s content, but yes, he does have a very awkward crease
36:01
on the front of his tooth. And she actually has some bubbles or artifacts
36:05
in the corner of her teeth that look like almost like a piercing, but
36:10
couldn’t possibly be on her tooth. And these are great examples. And
36:16
unfortunately, at least in the case of a I actually do know some people who
36:20
accepted her request because she spammed basically everybody who’s attending
36:25
money 2020 in a few months. Uh so I think before I share any of this on
36:29
LinkedIn, I’ll probably reach out to those people directly and give them a
36:32
chance to remove that connection because I’m not here to publicly shame my
36:37
friends. But these are two very good examples and they support the point that
36:42
we’re trying to make about how if we keep doing things in the manual way that
36:48
we used to whether that’s me doing money laundering on pencil and paper uh
36:52
Kenneth identifying those shipping rings via Excel spreadsheet or Cassandra
36:58
trying to go through all of those different emails and reports by having
37:02
them individually forwarded in and you trying to set a process there. we won’t
37:06
be able to stay ahead of the automation and scalability that the fraudsters are
37:11
easily able to employ. I think the URL where you can get these images is this
37:16
person does notexist.com. It’s very very similar to that. Definitely play with
37:20
that later if you have time, especially if you are one of the people who has not
37:24
played with an AI tool yet. So, I’ll stop sharing. I’ll bring back our three
37:30
very real faces. Although I made a joke a few weeks ago that I would love there
37:34
to be a deep fake Britney who could do some work for me and uh split my time.
37:38
But let’s move on to preventing fraud loss. Let’s like really get into sort of
37:43
the nuts and bolts of what we’re doing right now and what can be done. So I
37:48
want to kick off with a few more stats from the DTNS report that CIF put out.
37:54
And one of those is that we found 43% of consumers would abandon a brand if their
38:00
account was compromised on that site or app. And we don’t like to think about
38:05
that as merchants, but if you’re in a line of business where there are viable
38:11
competitors or you sell a physical good that your customers can also get on
38:16
other platforms from various stores, then you know that holding on to your
38:22
customer base is extremely important. And that brand abandonment can really
38:26
hurt your bottom line. And so when fraudsters or sorry when customers see
38:30
that their account has been compromised, 43% of them are sort of happy to walk
38:34
away. We also found that more than half of consumers believe that they shouldn’t
38:39
be held responsible in the event they unintentionally provided their payment
38:44
information to a scammer that was later used to make a fraudulent purchase. Of
38:50
that 54%, 30% believe their bank or financial
38:55
institution should be responsible for for preventing the fraudulent
39:00
transaction, but 24% believe it should be on the business where the attempted
39:04
purchase was made. That just goes to show you consumers aren’t really sure
39:08
where that liability does lie, but they feel like if they were defrauded, if
39:13
they were a victim, then they should not be the one responsible for that payment.
39:19
And I actually do have one anecdote before I I kick it off to our panel with
39:23
a question. And that is that I have seen some forums pop up like let’s say on
39:29
Reddit where consumers who were victimized by these scams, most commonly
39:34
the one where the person who messages you pretending to be your boss asks for
39:39
gift cards are sharing tips and tricks on how to ensure they get their money
39:43
back with each other. And I saw one very plainly say, “Never tell your bank or
39:49
your credit card company that it was fraud.” Never tell them you fell for
39:53
fraud. Say something else. Say that your credit card was stolen and the purchase
39:59
was made, but do not identify yourself as a victim of a scam because then
40:03
there’s the likelihood that you won’t be refunded. But if you just report it as a
40:08
stolen card, a lost card, whatever else, then you will get your money back. And
40:13
so with that lack of clarity on whether or not consumers will be protected from
40:18
these scams, we’re actually seeing some, you know, consumers teaching each other
40:24
to lie to their banks to give that bad data and that bad information to the
40:29
banks that then is passed along to the merchants, which you know, I I think
40:33
it’s unfortunate. I do sympathize with them, but that’s not a sustainable
40:39
approach to making these victims whole or to taking care of that kind of fraud
40:45
loss. So, with that, with with my spiel over, I will turn it over to Kenneth to
40:52
ask the question, in the mindset of constant evolution and improvement, how
40:57
is your business defending against increasingly sophisticated fraud methods
41:02
and tools? Yeah. So I think first of all as fraud
41:06
fighters we we have to uh we have to vocalize the uh the concerns that we see
41:13
on a regular basis. Um and so uh maybe I’ll start off as kind of my role as a
41:20
manager and then kind of jump into a few quick examples. that um one of the
41:24
things that um that I want to do as manager is I want to check in with my
41:28
team on a regular basis and ask them to be vocal in providing feedback on the
41:31
different types of issues that they see, right? Um so uh for example if uh if
41:37
you’re an individual contributor you’re going to be very close to those things
41:42
that they as they first happen and they first develop and you’re going to be
41:45
able to give that level of granularity that your manager or uh or someone else
41:52
uh or maybe your skip level may not have that level of depth right so uh be very
41:56
clear and kind of vocalize what you’re seeing on a regular basis I think is
42:00
very important and then uh working with uh working with management on really
42:04
coming up with a plan on how to to address those issues. Um, and then I
42:10
would say that on a on a general basis, I personally I would say that I I hate
42:16
ever having to sign up on a new website or you know checking out because every
42:20
single time I’m asked to create this really really long password in most
42:24
cases, right? really long password with these often numeric characters and
42:28
things like that and you’re kind of scratching your head and thinking where
42:30
am I gonna how am I going to remember this password and where am I going to
42:33
store it? Um but at the same time like that’s that’s a sign of a company that’s
42:38
really doing going to great lengths to to protect your information. Um, and so,
42:44
um, you know, I think most merchants can really think about what are we doing on
42:50
a regular basis to, uh, to think about things like password strength and, you
42:55
know, at the same time, what if you come on from a different device? Do you do
42:59
that OTP where you send a send a notice to um, uh, a cell phone number or maybe
43:05
you’re sending a push notification for those verifications. So, I think those
43:08
are things that we can all relate to. Um but you know for us here at Zipcar it’s
43:13
going to be around uh reassessing our tools on a regular basis right what are
43:17
we using internally on a regular basis and then what are we also using
43:20
externally with thirdparty partners and I would say that when you think about
43:25
things such as um you know uh what are you you know these new risks or these
43:31
new vectors that you’re seeing are you kind of being told ah is this a
43:35
workaround is this temporary how how difficult it is and so those are things
43:40
that you really want to keep in mind. But um more specifically here at Zipcar,
43:45
whenever we we go through great lengths to make sure that when a member signs up
43:48
and we’re a membership based platform, uh we want to make sure that uh people
43:53
have a great experience when they drive one of our cars. We do things such as
43:56
our IDB process includes taking a driver’s license uh image from the from
44:01
the applicant and then also asking them for a picture themselves so that we can
44:05
do a facial comparison. So those are things, you know, with with the with AI
44:10
being so new, those are things that we also want to consistently evaluate and
44:14
determine how do we make sure that we’re getting ahead of those issues and
44:18
thinking like those fraudsters, right? Because, you know, as they’re going to
44:21
be tweaking things, we want to be able to get ahead of that and adjust for
44:24
those um for those new changes as well.
44:28
>> Definitely. And you’re also making me me think then of just some of the efforts
44:33
that we’ve already brought up like we had talked about user education being
44:36
beneficial. So as far as that being something that must involve and be
44:40
improved. We can’t just expect people to proactively seek that information for
44:45
example. Maybe there’s ways that we can put those tips or put those warnings and
44:51
recommendations within a user flow. I’ve actually done uh a lot of work on doing
44:55
sort of AB testing or comparing of whether or not banners or notifications
45:01
to users within a let’s say on platform conversation are actually seen by them
45:06
or taken seriously or affect whether or not they fall for a scam. So that is
45:11
also something that comes to mind for me. and then being able to look at any
45:15
indicators of fraud pre-transaction because I remember a time when we didn’t
45:20
start looking for fraud until there was a payment being held or a payment
45:24
already approved and an order on the way out that we had a small window to stop.
45:28
But knowing all that we can look at before that moment, uh I really think
45:34
that this could be a good time to grab one question from the QA and tease it up
45:40
before we go to our final step which is going to be about thinking towards the
45:43
future. But we’ve got a question in the Q&A that says, “So besides SIFT as a
45:47
fraud prevention solution, what additional AI tools would a fraud
45:52
prevention team utilize?” And I think this could be also a good time since
45:56
we’re talking about what we do right now to maybe discuss some of those other
45:59
tools. Uh because whatever is in your toolbox depending on the budget of your
46:04
team and a lot of trust and safety teams do not have the largest budget within a
46:09
company then you might be you know have to be a little bit scrappy. I know for
46:15
example these might not necessarily be AI tools so I apologize for that but I
46:20
have used a lot of tools that our marketing team would use like we had one
46:24
that would monitor the user signup flow and it was meant for in that case it was
46:29
meant for QA but we would do it to see if people copied and pasted their
46:34
information in because there’s simply no reason for you to go copy paste Kenneth
46:38
copy paste Lao copy you know your name you’ll type it in or it’ll autofill from
46:43
your browser, but you will never copy and paste it in from somewhere else. And
46:47
that was a tool that we could use to monitor, you know, that behavior. Um, we
46:52
would also look at some Splunk logs to see where people were directed to the
46:55
site from. Uh, but as far as some other solutions that involve AI, I do think
47:01
we’re seeing a lot of advancements with ID verification as well. I think I
47:07
apologize that I can’t remember the name right now off the top of my head since I
47:10
have so much else I’m thinking about in this short window we’ve got to talk, but
47:13
I think IBM has a tool that they’ve launched for deep fake videos. And so
47:18
those are things that we can look into using and applying to fraud prevention.
47:23
Uh but before we get to our final question, Kenneth or Cassandra, do
47:27
either of you have any tools that you just really enjoy using or have been
47:31
really helpful in your trust and safety career that you’d also love to get a
47:34
shout out to? They didn’t know this question was
47:40
coming. Thank you, Jennifer, for putting it in the Q&A. Now we’re Now we’re
47:44
really seeing what everyone’s going to bring.
47:47
>> Um, th this is a hard one. I I think that um there uh there’s a vendor that
47:54
uh that I’ve uh that I’ve used in the past that have been has been very
48:00
effective in terms of helping us with uh with IDV and um uh that vendor was
48:06
actually recently acquired so probably not a good idea to re recommend them
48:10
anymore but uh um
48:12
>> but still leaning towards identity like still being able to look at that side of
48:15
the Yeah.
48:17
>> Right. And so that was um that was really effective because it helped us so
48:21
much at the time with um with reviewing the manual processes that happen
48:25
whenever you don’t have um uh the right tooling in place.
48:30
>> Um and so that was uh that was certainly a great experience.
48:37
>> You know, there’s not really anything um that I can call out specifically. I
48:42
think uh a lot of our a lot of our approach is heavily manual and so like
48:47
even just like currently we’re in a stage of evaluating a vendor for some of
48:51
the things that you know we can automate hopefully to reduce some of those manual
48:56
efforts.
48:57
>> Well, reaching out and talking to other merchants and getting their opinions and
49:00
takes is a is a really great way to be able to vet that process and get some
49:04
feedback. So hopefully you’ve got some contacts and some people can also reach
49:08
out here. All right. Well, before we turn fully to Q&A, let’s finish off with
49:12
the last question that I had I had had ready for us and that is to focus on
49:17
forward thinking. So, across the CIF network, we saw that blocked content and
49:23
blocked payments. So, one would be let’s say a social media post and the other
49:27
would be a purchase from the same fraudster increased 66%
49:33
from Q4 2022. uh when compared to you know Q sorry
49:38
from Q4 2022 through Q1 2023 as compared to Q2 and Q3 2022 so the prior periods
49:47
we saw a large more recent increase which just shows fraudsters maybe not
49:52
being as siloed in their actions not just committing content fraud or just
49:56
committing payment fraud but being willing to do both which could then be
50:02
because they’re using tools like AI to scale their efforts in one attack,
50:06
giving them time to do both of those. So, with that in mind, how would you
50:12
like to see AI benefit your fraud prevention strategy in the future? You
50:17
can call this the waving the magic wand question, however you’d like to approach
50:21
it, but what would you like to see? Uh, and let’s start with Cassandra.
50:28
>> Yeah, I mean, uh, you know, as I alluded earlier, a lot of our approach here at
50:31
MindBody is heavily manual. um lots of manual agent reviews. So, Sift um and
50:37
other vendors already do a really good job at reducing those manual review
50:41
hours and um but I would also like to see, you know, on top of fraud risk and
50:47
mitigating that, mitigating credit risk losses. Um some more like predictive
50:53
modeling about like when a business could be closing or when they could uh
50:57
potentially be victimized by fraud. Um something like that. I think it would be
51:02
really unique to try to predict when someone could um get hit by a scam or
51:10
fraudster. Um that would also help us a lot so we don’t have any losses. Um, but
51:15
I think that would be really waving the wand like you said
51:21
>> kind of.
51:22
>> Yeah,
51:23
>> for me I would really really love to uh reduce the amount of time that the team
51:28
spends manually um looking for issues. Um I would say that really that’s part
51:34
of the I would say the fraud landscape. I would say that hasn’t really changed
51:38
as much um in terms of there’s always still some element of man review
51:42
depending on what industry you’re in and a lot of times the teams are like our
51:48
teams are very motivated to go look at other issues um but they still have to
51:53
focus on things that are maybe a little bit more uh timeconuming a little bit
51:57
more arduous and mundane uh over the course of a day and that’s really
52:02
something that I’m excited about of helping addressing because it can help
52:06
challenge the team to go and further their careers. Um, and I would say the
52:11
other thing I would really love to see improve also is um, you know, how we can
52:15
use AI to uh, to kind of marry the relationship between like an infosc team
52:21
with a you know, an account takeover focus within a fraud team a little bit
52:25
better because in many ways those um, there’s a little bit of there’s quite a
52:30
bit of a silo in effect where an infosc team might be using a very different
52:34
tool. we might be using a a second tool, right? And the things that we’re looking
52:39
at might be slightly different. And so I I would think if we can marry that a
52:44
little bit better, we can help um we can help protect our our customers uh more
52:49
effectively on a regular basis. If I could wave my wand, I al I want to
52:54
take this time. I definitely plus one to both what Kenneth and Cassandra said,
52:59
but I also have a background as having been a policy manager. And so I would
53:04
love to see, if I could wave my magic wand, some additional AI tooling that
53:09
helps those teams, especially the ones that have to remove uh obscene content,
53:15
illegal content, content that we don’t have, you know, we won’t be getting into
53:18
today, but what can actually be really damaging on an agent to have to review
53:23
day in and day out. I would love to see those improvements made to be able to
53:27
keep that harmful content offline without needing as much, you know,
53:32
manual interaction from humans and then just as much as we could be doing to
53:37
decrease, you know, friction on good users and really really further hone in
53:42
on what fraudsters are up to. But yeah, I have that uh I wanted to add in that
53:48
extra detail of the policy side of things because not only do we see in you
53:54
know the past few years that sort of the lines between fraud and payments have
53:58
been blurring within companies of those you know teams more often coming
54:01
together or people becoming crossunctionally trained between the
54:05
two. But I also do think that we’re continuing to see at least in the
54:09
companies that have the need for policy that continued blurring between the
54:13
fraud prevention and the policy team of them also sharing their skills and their
54:19
teams as well. So with that, let’s dive into QA. And in this case, I will just
54:26
read the question and then if you would like to answer uh after I speak, Kenneth
54:31
or Cassandra, please feel free to to speak up. But there’s one in here about
54:34
3DS and so I’m going to jump on that first and the question is from Wizwan
54:39
and says what happens when transactions are 3DS authenticated.
54:44
I do actually have some information about that where I have seen a presenter
54:50
at a conference talk about that card networks are really becoming aware that
54:57
fraudsters are able to successfully socially engineer people into providing
55:03
their one-time password or otherwise allowing that fraudster to complete 3DS
55:08
and go through the SCA flow and successfully make a purchase. uh I don’t
55:13
want to say it off the top of my head because I think I will have forgotten
55:15
the percentage but it was somewhere around maybe 5% or maybe a little bit
55:20
lower where they were saying that that percentage of 3DS authenticated
55:25
transactions were actually authenticated via social engineering. So I know the
55:29
card networks are aware and uh what happens is that in this case the
55:35
liability shift still goes to the card network not the merchant. However, one
55:40
must assume that if this kind of success on the fraudster side increases that
55:45
that will be revisited by the card networks and that they may require more
55:51
hoops to be jumped through by the merchant or other steps to be taken
55:54
because they don’t want to take on all of that liability. I don’t know if
55:57
either of you want to chime in, but I saw Cassandra nodding her head, so I at
56:00
least felt some validation there.
56:04
>> Yeah. No, it’s really interesting. I would love to see that study or that uh
56:09
study about the percentage of transactions that have been socially
56:14
engineered with 3DS. That’s interesting. So
56:18
>> I think I think I’ve seen two two presentations on it. I will forward it
56:22
to you after this. I will share that with you.
56:25
>> All right. And we have a question directly for Kenneth from Terry. So,
56:30
Kenneth, does Zipar compare the user’s driver’s license and photo image
56:34
manually or is it an automated process? If it’s automated, what products do you
56:40
use? So, this is, you know, you don’t just let anybody walk away with a
56:45
$20,000 item. You have to verify their ID. You have to verify that they can
56:50
actually drive before you let them have the car. So, what can you do to speak to
56:54
this process being manual, automated, maybe how it involves AI, etc.? Sure.
57:00
It’s it’s actually rare for a merchant to hand over such an expensive item in
57:04
return just after an IDV check, right? Um and so that’s why we really make sure
57:08
that we feel great about what we’re doing on a regular basis. Um we do uh we
57:13
do do comparisons between a document, in this case a driver’s license, to make
57:18
sure that someone is properly licensed uh within uh within the country that
57:22
they’re in. um as well as the um as well as a live picture that we take um uh
57:27
right after asking for that document. Um there depending so there are there are
57:34
so many different vendors that will focus on and provide these types of
57:37
services and depending on um what your criteria is uh and what your thresholds
57:42
are, you can alter that to determine what you might be wanting to look at
57:46
manually. And so for us um in the car sharing space, we might want to we might
57:51
want to look at some things that are different than others. But if you have
57:54
some more if you wanted more information about maybe some vendors to look into,
57:58
feel free to reach out to me uh offline and happy to happy to uh discuss it with
58:03
you a little bit further as well.
58:08
>> All right. Well, with that, we have one more topic that I want to make sure we
58:13
jump on and it is a question about dealing with potential bias in AI. Yes.
58:19
So, that’s an important call out because AI is artificial intelligence. It has to
58:26
be trained on something when you make a machine learning model. And in that
58:30
case, the data set can include bias and that can then, you know, unfortunately
58:36
stop people from being able to make purchases, to go on trips, to being able
58:39
to live their life as more and more of our daily lives go online. Now, for
58:45
that, I I’ve actually taken a course that’s available for free on LinkedIn
58:49
now called Ethics and Law in Data Analytics, and it dives really heavily
58:54
into bias. So, I would recommend anyone who wants to look that title up. is
58:57
totally free on LinkedIn Learning and it’s a course that was created by IBM
59:03
and that’s one that talks about proxies for bias and so if you have any concern
59:08
about sort of letting those automated decisions go or you know having a bit of
59:11
an unsupervised approach towards fraud prevention I think that’s a good
59:15
resource to look at but I want to make sure to call that out.
59:20
All right and then the last question was will a recording of this be made
59:24
available? Absolutely. Everybody who registered for this webinar is going to
59:28
receive an email in the next few days that has a link to the recording and
59:34
you’ll be able to see our faces again and watch it and share it as you want.
59:39
So with that, thank you everybody for attending. Thank you so much to our
59:44
speakers Kenneth and Cassandra for giving their time and their knowledge to
59:48
us today. And we hope you have uh learned something and we hope you
59:53
enjoyed it. So thank you very much.