00:00:00Data Breach Impacting Fintech Community
00:09:40Fintech Trust Crisis Evolve Breach
ACERCA DE ESTE EPISODIO
Can a single phishing attack lead to the financial ruin of millions? Brace yourself as we uncover the catastrophic data breach at Evolve Bank, orchestrated by the infamous LockBit ransomware group. Maia and Sam dissect this digital disaster, where a simple phishing scam blew open the floodgates, exposing the personal identifiable information (PII) of millions of Americans on the dark web. This breach isn’t just a wake-up call; it's a seismic shock, revealing glaring loopholes in our current security measures. We commend Jason Mikula for his fearless reporting on this issue, even under the looming shadow of legal threats from Evolve Bank.
The breach at Evolve Bank has sent shockwaves through the fintech industry, triggering a wider trust crisis. Imagine the chaos when social security numbers and other unchangeable PII are compromised. Drawing from the notorious Equifax hack, we stress the urgent need for robust, multifaceted security measures. We discuss the ripple effects impacting services like instant payouts and buy-now-pay-later schemes and scrutinize Evolve's lackluster response compared to the proactive stance of industry leaders like Max Levchin of Affirm. Join us as we call for better handling of such existential threats to sustain consumer trust in fintech innovations.
Hosts: Sam Maule & Maia Bittner
Inglés
Estados Unidos
MOSTRAR NOTAS 🔗
TRANSCRIPCIÓN 🔗
WEBVTT
00:00:00.561 --> 00:00:08.375
Hey everybody, welcome to another episode of Artificially Intelligent.
00:00:08.375 --> 00:00:10.968
I am one of your interns, Sam Maule.
00:00:10.968 --> 00:00:15.311
I am joined by Maia in the sunny West Coast.
00:00:15.311 --> 00:00:17.164
I'm guessing, Maia, it looks sunny behind you.
00:00:17.164 --> 00:00:17.625
How are you doing?
00:00:18.006 --> 00:00:19.850
Beautiful day today, welcome back.
00:00:19.850 --> 00:00:20.652
Welcome back.
00:00:20.652 --> 00:00:24.550
I'm excited to be jumping on and learning more things with you today, Sam.
00:00:25.179 --> 00:00:27.702
Yeah, I live in Florida everybody, so you never know day to day what it'm excited to be jumping on and learning more things with you today, sam.
00:00:27.702 --> 00:00:30.294
Yeah, I live in Florida everybody, so you never know day to day what it's going to be like.
00:00:30.294 --> 00:00:32.046
We're tracking this Cat 5 hurricane.
00:00:32.046 --> 00:00:39.792
It's just another day in Florida, Maia, but we have the equivalent of a Cat 5 hurricane happening in the fintech community.
00:00:39.792 --> 00:00:41.206
How is that for a segue?
00:00:41.206 --> 00:00:55.011
I am so proud of myself with a hurricane segue Because there's this famous quote by Mr Lennon that says there are decades when nothing happens and there are weeks when decades happen.
00:00:55.011 --> 00:00:59.951
And the past few weeks have felt like decades in the fintech community, Maia.
00:01:01.261 --> 00:01:04.311
You know, and none of it is good.
00:01:04.311 --> 00:01:06.081
We have had no good news.
00:01:06.081 --> 00:01:08.846
It's not like there's all kinds of news happening.
00:01:08.846 --> 00:01:14.795
No, it's really only bad news, which I think is probably most often the situation when people pull out that quote.
00:01:27.061 --> 00:01:31.299
I mean, let's start with what's happening with this incredible data breach that took place.
00:01:31.299 --> 00:01:55.548
Initially, the news was that LockBit, this ransomware group, had hacked the Federal Reserve and had something like 33 terabytes of data, but what we've learned over this decade of the past week or so is that this is Evolve Bank that had the data breach and basically PII data is now sitting out in the dark web for a ridiculous number of people and it affects a ridiculous number of fintechs.
00:01:55.548 --> 00:02:09.086
I've basically been chugging anti-acid medicine, I think, for the past week, every time I read one of these reports.
00:02:09.086 --> 00:02:09.348
Maia.
00:02:10.060 --> 00:02:10.461
Well, sam.
00:02:10.461 --> 00:02:14.170
So first clarify some of the basics for me on this.
00:02:14.170 --> 00:02:30.668
When I hear right LockBit, the ransomware group they release the data on, I think, millions of Americans, pii, social security number, all that Basic question does that mean that they asked Evolve for a ransom and Evolve did not pay up?
00:02:30.668 --> 00:02:35.204
So this was the consequence, or what do we know about how this situation played out?
00:02:35.204 --> 00:02:39.966
I mean, of course, having the data breach happen in the first place is not ideal and that's what we want to prevent.
00:02:39.966 --> 00:02:41.368
But do we know?
00:02:41.389 --> 00:02:42.651
what happened right after.
00:02:42.651 --> 00:02:52.554
I think it's still somewhat hazy, but here's my understanding is that Evolve did determine that they had a data breach going back to May of this year.
00:02:52.554 --> 00:02:55.830
The data breach was caused by take a guess Maia.
00:02:55.830 --> 00:02:57.646
How do you think this data breach started?
00:02:57.646 --> 00:03:00.487
How does every data breach start?
00:03:01.221 --> 00:03:04.069
So it depends on what decade we're talking about.
00:03:04.069 --> 00:03:09.223
So it depends on what decade we're talking about.
00:03:09.223 --> 00:03:12.092
If it was the 90s, a data breach happened because somebody left their laptop on the bus on the way home to work.
00:03:12.092 --> 00:03:24.368
If it's the 2000s, but yeah, I mean, uh, they could have been spearfished yeah, in this case it was clicking on a link.
00:03:24.549 --> 00:03:26.252
Right, an employee clicked on a link.
00:03:26.252 --> 00:03:33.713
Those wonderful phishing attacks that opened up the gates, that allowed lock bit to get in um lock.
00:03:34.502 --> 00:03:35.165
It is interesting.
00:03:35.165 --> 00:03:37.175
So, and back up a little bit, we've talked about this.
00:03:37.175 --> 00:03:37.336
Um.
00:03:37.336 --> 00:03:40.644
So an employee clicked on the link terrible, totally.
00:03:40.644 --> 00:03:42.967
Like everybody gets trained not to do that.
00:03:42.967 --> 00:03:48.524
But how much freaking access did this employee have, you know?
00:03:48.524 --> 00:03:50.931
Like was this and was this the CEO?
00:03:50.931 --> 00:03:52.114
Like it's not.
00:03:52.114 --> 00:03:59.070
Like every lay person at a bank has access to the PII for a million.
00:03:59.070 --> 00:04:18.011
And you know, a good system, besides having layers of permissions and things like that, has a lot of rate limiting in place, so that there are some employees who are allowed to look at the social security number for any customer, but if they look at more than like 100 in an hour, right, you start to shut that system down.
00:04:18.939 --> 00:04:20.341
Yeah, I mean, it's unbelievable.
00:04:20.341 --> 00:04:23.766
I mean the unfolding drama.
00:04:23.766 --> 00:04:28.995
I guess one of the best places is to follow Jason Mikula, who we both know and love.
00:04:29.341 --> 00:04:30.285
Jason is the expert here.
00:04:30.839 --> 00:04:31.040
Man.
00:04:31.040 --> 00:04:33.627
He's done an incredible job of reporting on this.
00:04:33.627 --> 00:04:38.970
Yeah, on Twitter, so much so that he's received a cease and desist order from Evolve Bank.
00:04:38.970 --> 00:04:39.591
Bless you, jason.
00:04:39.591 --> 00:04:46.925
But yeah, I mean, it even appears that they were able to hack into a large volume of their internal emails.
00:04:46.925 --> 00:04:52.706
Something like 9.9 gigabytes of PST files, which is basically Outlook data files are sitting out there.
00:04:53.201 --> 00:04:54.904
Why do they even have like don't?
00:04:54.904 --> 00:05:01.509
I mean many companies right sort of delete all their emails every three months or six months or a year.
00:05:01.509 --> 00:05:04.247
Right, it's like why was there access to so many emails?
00:05:05.331 --> 00:05:06.836
It is just it's amazing.
00:05:06.836 --> 00:05:08.000
It's like why was there access to so many emails?
00:05:08.000 --> 00:05:11.223
It is just it's amazing.
00:05:11.223 --> 00:05:15.776
I'll tell you what we need to do a show sometime just on ransomware companies, because I went out and did a little bit of reading about LockBit and it's fascinating.
00:05:15.776 --> 00:05:20.351
They're basically, you know how you have banking as a service and software as a service.
00:05:20.351 --> 00:05:24.708
So LockBit is ransomware as a service, so is a business.
00:05:24.708 --> 00:05:32.699
Everybody, um, and and this group is flipping really, really good about good at it they're the world's most politic ransomware.
00:05:32.699 --> 00:05:36.509
Um, I guess firm, I don't know a better way of saying it group.
00:05:36.528 --> 00:05:37.591
I guess it's a ball.
00:05:37.591 --> 00:05:46.194
It is all about incentives, right, and the thing is we not want nobody wants social security numbers released on the dark web.
00:05:46.194 --> 00:05:47.964
It's not good for anybody, right?
00:05:47.964 --> 00:05:50.071
And I'm including LockBit.
00:05:50.071 --> 00:05:54.091
Lockbit isn't profiting off of having social security numbers on the dark web.
00:05:54.091 --> 00:06:00.024
Americans are obviously going to get screwed from this, and so that's what I'm saying.
00:06:00.024 --> 00:06:00.987
This is really kind of the worst case scenario.
00:06:00.987 --> 00:06:01.529
That's what I'm saying.
00:06:01.529 --> 00:06:03.637
This is really kind of the worst case scenario.
00:06:04.940 --> 00:06:05.321
Oh, it's horrible.
00:06:05.321 --> 00:06:10.033
What's interesting is, again, we believe the hack occurred toward the back end of May.
00:06:10.033 --> 00:06:24.387
In the first week of May the US government actually charged the founders of Lockpit, which is a Russian national Shocker, basically put a $10 million bounty on their head.
00:06:24.387 --> 00:06:30.581
So yeah, of all things right, I mean just we're talking weeks before this hack even happened.
00:06:30.581 --> 00:06:33.639
You know the US government basically was going out for them.
00:06:33.639 --> 00:06:39.882
So I mean, again, like we said at the beginning, there are just some weeks where you're like man, could we use a little good news?
00:06:39.882 --> 00:06:41.836
You know, just a little bit.
00:06:42.410 --> 00:06:46.149
Well, and Evolve so, really, honestly, a great target for LockBit.
00:06:46.149 --> 00:06:49.040
They're in this really interesting vulnerable position, right.
00:06:49.040 --> 00:07:00.663
So my guess Evolve is a small bank in the scheme of things, right, if you compare it up to Chase Bank of America, they are a small bank.
00:07:00.663 --> 00:07:01.425
They probably do not have the same.
00:07:01.425 --> 00:07:03.896
We know that they don't have sufficient security practices, right.
00:07:03.896 --> 00:07:07.411
They don't have the IT staff that one of these bigger banks has.
00:07:07.411 --> 00:07:13.269
But on the flip side, evolve has built their business as a partner to fintech companies.
00:07:13.269 --> 00:07:19.997
So Evolve is probably the number one biggest partner bank that supports fintech programs.
00:07:19.997 --> 00:07:24.077
They power a bunch of banking as a service software platforms, right.
00:07:24.077 --> 00:07:24.879
So those are the.
00:07:24.879 --> 00:07:31.293
Evolve is the bank behind a bunch of software platforms, including infamous Synapse.
00:07:31.293 --> 00:07:38.964
That powers a bunch of other programs as well as just working directly with really big companies like Affirm and Stripe.
00:07:40.271 --> 00:07:41.173
Yeah, I mean Evolve.
00:07:41.173 --> 00:07:42.459
I was just looking at it now.
00:07:42.459 --> 00:07:48.262
I mean, you know, when we think of the big boys, evolve is based out of Tennessee, if I remember right.
00:07:48.262 --> 00:07:56.418
You know this is sub $5 billion in assets when you talk about total assets for the bank, so a small bank, but a massive player.
00:07:56.459 --> 00:07:57.201
Durban exempt.
00:07:57.891 --> 00:08:07.475
Yeah, I mean massive player, though when it comes to fintech, I mean the number of companies that they service is I mean you're talking.
00:08:07.475 --> 00:08:09.872
Affirm Earning Marketta.
00:08:09.872 --> 00:08:12.819
Lord Alloy Bond Branch.
00:08:12.819 --> 00:08:16.702
Dave Melio, mercury Love.
00:08:16.723 --> 00:08:19.896
Mercury Mercury, I think Mercury previously, but not currently.
00:08:20.237 --> 00:08:23.637
Yeah, not currently, and I think that's a good point.
00:08:24.649 --> 00:08:26.478
Yeah, with Mercury, although I'm curious.
00:08:26.478 --> 00:08:47.966
So if Mercury customers I mean presumably if personal information was hacked, evolve still has all the personal information from Mercury customers, even though they have since switched off it, unless, as part of their switching, they I mean I honestly I don't even think you can request that data be deleted.
00:08:47.966 --> 00:08:58.241
I think the banks need to keep that data in order to comply with regulations and for future reporting, and so it stems the damage.
00:08:58.241 --> 00:09:01.734
It makes Mercury look good that they've moved off of Evolve.
00:09:01.734 --> 00:09:13.975
Anyone who's signed up super recently will not have been a victim, but it seems like most Mercury customers are still impacted by this, as well as anyone else who has moved off of Evolve.
00:09:15.198 --> 00:09:20.096
Did you get a chance to read the post by Supes over at Sardine AI?
00:09:20.096 --> 00:09:21.419
Nope, when he talked about this.
00:09:21.440 --> 00:09:21.780
What did he say?
00:09:21.801 --> 00:09:22.582
It's fascinating.
00:09:22.582 --> 00:09:23.571
He did a.
00:09:23.571 --> 00:09:28.139
Supes went on a thread rant about this a couple days ago.
00:09:28.139 --> 00:09:28.961
So everyone doesn't know.
00:09:28.961 --> 00:09:32.392
Supes is the founder of Sardine AI, which is again in this.
00:09:32.392 --> 00:09:36.899
You know the AML KYC space and fraud.
00:09:36.899 --> 00:09:39.491
Very fascinating one because he's like you.
00:09:39.491 --> 00:09:40.453
Please understand.
00:09:40.453 --> 00:09:42.942
The second your social security number is compromised.
00:09:42.942 --> 00:09:44.451
It's compromised.
00:09:44.451 --> 00:09:47.216
There's no tokenization around your social security.
00:09:47.216 --> 00:09:52.085
There's no way to go out and get a new SSN issued, right, or an EIN.
00:09:52.085 --> 00:09:54.273
I mean it's again.
00:09:54.273 --> 00:09:57.158
We are in this day and age.
00:09:57.158 --> 00:10:02.393
We talk about this in banking all the time, but this extends far beyond banking.
00:10:02.393 --> 00:10:10.475
What we rely upon for PIA data is data that can't be changed your date of birth, your social.
00:10:10.475 --> 00:10:15.499
You know I mean, let's go back to the day right, your mother's maiden name, your favorite hobby.
00:10:15.499 --> 00:10:17.037
I guess you can change your favorite hobby.
00:10:17.037 --> 00:10:18.495
You can't change your mother's maiden name.
00:10:18.495 --> 00:10:21.878
You're not changing your date of birth, you're not changing your social, you know.
00:10:21.878 --> 00:10:27.169
I mean, just like you said, when that PII data is out there, it's out there, I mean- there.
00:10:27.190 --> 00:10:27.812
I mean it's just game over.
00:10:27.812 --> 00:10:34.974
I mean, honestly, it's like after after the um equifax hack, a lot of that is out there anyway.
00:10:34.974 --> 00:10:49.879
Um, I think, frankly, this is not the first time that we've realized, like, look, we cannot depend on social security number, on knowing social security number, as proof that somebody is who they say they are and a proof of their identity.
00:10:49.879 --> 00:10:57.270
Right, we got to step up it, like has to.
00:10:57.270 --> 00:10:58.592
It's an arms race and it's got to continue to be multifaceted.
00:10:58.592 --> 00:11:05.784
I know other data that was leaked that is a little bit less sensitive, but the full 16 digit card numbers referred to as the pan.
00:11:05.784 --> 00:11:14.725
I think a firm just confirmed that their card product is totally compromised.
00:11:14.725 --> 00:11:16.676
That's kind of rough right.
00:11:16.676 --> 00:11:19.119
There's a lot of protections baked into cards.
00:11:19.119 --> 00:11:22.299
People can get those reissued, but it's a huge pain in the ass.
00:11:22.299 --> 00:11:34.836
A lot of settlement files, ach files, I think, even people who did not have an account at Evolve but who sent a transfer to somebody who has an account at Evolve.
00:11:34.836 --> 00:11:36.421
Some of their information has been compromised too.
00:11:36.929 --> 00:11:41.000
That's what makes this interesting, because that's where we've gotten in the gotten.
00:11:41.000 --> 00:11:42.692
I don't think that's great English, everybody.
00:11:42.692 --> 00:11:48.402
That's where we're at now, in 2024, with FinTech.
00:11:48.402 --> 00:11:57.477
That's part of the skin in the game level that we're at, because we're talking about banking as a service, or blank as a service.
00:11:57.477 --> 00:12:25.759
There's multiple layers of integration, right, I mean, I'm, I'm a bank, I am servicing, say this, this, this payments company, and then there's a kyc vendor that sits out there and a fraud vendor that's out there and take your pick, and so the spider webs of tracking this back to figure out the impact is the CSI for fintech and hacks like this.
00:12:25.759 --> 00:12:28.184
That's a business model.
00:12:28.184 --> 00:12:29.755
That's something I should have gone into.
00:12:29.755 --> 00:12:33.220
But again, everybody, I like what Maia referenced when you talked about Equifax.
00:12:33.220 --> 00:12:36.078
That was back in 2017, the hack that occurred there.
00:12:37.212 --> 00:12:37.476
Again.
00:12:37.476 --> 00:12:38.349
This isn't new.
00:12:38.349 --> 00:12:40.537
We already lost everybody's social security number.
00:12:40.537 --> 00:12:41.259
Let's be real.
00:12:41.590 --> 00:12:45.181
It wasn't secret, amen, it wasn't secret, we it wasn't secret.
00:12:45.250 --> 00:12:46.111
We lost it again.
00:12:46.111 --> 00:12:52.610
Um, but this is I mean it's really far reaching my well one of my biggest concerns.
00:12:52.610 --> 00:12:54.033
I mean, sam, this is our industry, right?
00:12:54.033 --> 00:13:02.438
You, you and I have kind of bet our careers on FinTech and this is a huge trust-breaking moment.
00:13:02.438 --> 00:13:13.155
Um, equifax lost a lot of trust in the breach, but people can't really decide whether they're a part of Equifax or whether they're using it or not.
00:13:13.155 --> 00:13:18.302
The credit bureaus do not have strong consumer brands, right?
00:13:18.429 --> 00:13:22.875
They are mostly, and so that was sort of a side A lot of this consumer stuff.
00:13:22.875 --> 00:13:34.158
I mean, dude, everybody who gets instant payouts from Uber I think they might have been affected because Branch, the payments provider there, was powered by Evolve.
00:13:34.158 --> 00:13:49.719
I mean FinTech, like all of the stuff that people love from FinTech, which is those instant payouts, right, which is fee-free banking, which is all that stuff that Stripe does, which is buy nowfree banking, which is, um, all you know all that stuff that stripe does, which is buy now, pay later from a firm.
00:13:49.719 --> 00:13:51.948
Like there's a ton of consumer demand for this.
00:13:51.948 --> 00:14:03.397
But this is kind of a big trust-breaking moment and I gotta say I mean, ever the social security numbers were out evolve as a small bank.
00:14:03.397 --> 00:14:04.480
They don't have the it.
00:14:04.480 --> 00:14:15.120
I can be a little bit understanding for some of the stuff with the, with the hack, but the comms has been abysmal people are getting emails, the timing, the confusion.
00:14:15.460 --> 00:14:18.192
It seems like nobody knows exactly what happened.
00:14:18.192 --> 00:14:23.754
Um, I am getting my phone is blowing up with text messages from people saying, hey, I bank with mercury.
00:14:23.754 --> 00:14:26.160
Like am, is my money at risk?
00:14:26.160 --> 00:14:29.200
Hey, like I have an Affirm card, what do I need?
00:14:29.200 --> 00:14:35.679
Like nobody is on top of this stuff and Evolve is way behind the ball.
00:14:35.679 --> 00:14:40.221
I mean, you kind of casually mentioned the cease and desist against Jason for reporting.
00:14:40.221 --> 00:14:45.461
I feel like that shows how much they've sort of lost the thread on this.
00:14:46.331 --> 00:14:47.875
Yeah, I'm with you on that one.
00:14:47.894 --> 00:14:50.160
They're out of control it's interesting.
00:14:51.452 --> 00:15:10.980
Yeah, I mean, and that was a Twitter thread that was going on when Jason was talking about this and he literally mentioned something about a firm and Max Levchin, right out in the blue, replied to Jason and said yeah, if there's anything you can do to give me more information to help with this, I give Max Levchin props for that Right.
00:15:10.980 --> 00:15:13.495
Get out in front of this Wise has done that.
00:15:13.730 --> 00:15:15.658
Max has had great comms throughout this.
00:15:16.510 --> 00:15:19.039
I'm a big everybody just so we can get past this.
00:15:19.039 --> 00:15:22.355
I'm a Max Levchin fanboy, so I like Max.
00:15:22.610 --> 00:15:24.437
I think he's brilliant One of the PayPal mafia.
00:15:24.437 --> 00:15:26.335
Everybody Very good at what he does.
00:15:27.410 --> 00:15:30.259
And proved that buy now, pay later was a real thing, because everyone yeah.
00:15:31.169 --> 00:15:34.056
Through, like it feels like Max's, like force of will.
00:15:34.777 --> 00:15:35.859
Yeah, max, come on the show.
00:15:35.859 --> 00:15:36.921
Come on, baby.
00:15:36.921 --> 00:15:38.423
Would love to interview.
00:15:38.423 --> 00:15:42.293
But yeah, I think he did a fantastic job jumping in front of this.
00:15:42.293 --> 00:15:43.974
Wise has done the same thing.
00:15:43.974 --> 00:15:48.616
You know, on the comms part, I think Mercury has done a good job, mercury has been excellent, you know.
00:15:49.717 --> 00:15:50.538
I kind of you know.
00:15:50.538 --> 00:15:51.458
I think it evolved.
00:15:51.458 --> 00:15:59.966
I think you positioned this correctly when Equifax had this you know, massive hack everyone back in 2017, and they were fined.
00:15:59.966 --> 00:16:02.086
I think it was like $1.3 billion, if I remember.
00:16:02.086 --> 00:16:03.711
It was a chunk of change.
00:16:03.711 --> 00:16:04.615
They had to pay out the door.
00:16:04.615 --> 00:16:06.419
Equifax can survive that.
00:16:06.419 --> 00:16:19.282
Evolve is not a large bank they aren't and on top of this, they had the whole Synapse debacle, which was also happening, this whole reconciliation issue that they had.
00:16:19.282 --> 00:16:21.917
They had the OCC come at them with the.
00:16:21.917 --> 00:16:32.754
You know they got nailed there and then you know just not that I think it was yesterday or the day before.
00:16:32.754 --> 00:16:35.460
You know, now you've got congressmen more or less coming after Evolve too.
00:16:35.460 --> 00:16:37.283
You know it's been reported.
00:16:37.283 --> 00:16:42.541
So some rough days in Tennessee, I think, right now.
00:16:42.701 --> 00:16:43.143
Rough days.
00:16:43.143 --> 00:16:43.595
So we have.
00:16:43.595 --> 00:16:46.977
So there's a couple of weaknesses that have been highlighted by recent events.
00:16:46.977 --> 00:16:51.556
So one we've got like a concentration risk in the fintech ecosystem.
00:16:51.556 --> 00:17:03.972
So many products were powered by Evolve on the backend, that then, right, with this one hack, it's taken down like a ton of the fintech industry including.
00:17:03.972 --> 00:17:05.518
Well, yeah, so that's one risk.
00:17:06.230 --> 00:17:16.881
A second risk, you know, having these sponsor banks, since it's so difficult to get a bank charter and to be regulated, as a bank in the US has had all these interesting things.
00:17:16.881 --> 00:17:22.442
So the sponsor banks don't really have the end customer relationship, and that's what the fintechs want.
00:17:22.442 --> 00:17:29.171
They say, hey, we want to own the customer relationship and all the communications with them and we just want to kind of rent out your bank charter.
00:17:29.171 --> 00:17:41.240
Well, we're in a weird ass position now where, like, even a bunch of the startups that were backed by Evolve have shut down, right, so they don't even exist anymore.
00:17:41.661 --> 00:17:44.535
Their customers' information was leaked in the Evolve hack.
00:17:44.535 --> 00:17:46.199
Well, who's sending out the emails?
00:17:46.199 --> 00:17:47.260
Who's sending out the notification?
00:17:47.260 --> 00:17:51.096
Is it Evolve, this company that they may not have even heard of before?
00:17:51.096 --> 00:18:02.519
Right, it's got that small print at the bottom you signed up for a Glorify account and there's this tiny print that are like banking services provided by Evolve, na, like whatever the whole thing, and then you get an email from them out of the blue.
00:18:02.519 --> 00:18:18.000
So I feel like the customer comms piece has just been done really poorly, both because we have like a little bit of incompetence, but also just as a structural weakness like this is the way that the fintech ecosystem is structured.
00:18:18.000 --> 00:18:30.634
It's a lot of benefits to separating out the customer relationship to be owned by the fintech, but this is we're kind of seeing one of the weaknesses too, particularly if the fintech is shorter lived than the bank, which is going to be the case.
00:18:30.634 --> 00:18:34.211
It's almost by design that banks are pretty hard to fail in the US.
00:18:34.932 --> 00:18:38.420
Yeah, I think there's a great quote in paymentscom today.
00:18:38.420 --> 00:18:45.651
It was from Thread CEO, jim McCarthy.
00:18:45.651 --> 00:18:46.133
Thread being T-H-R-E-D-D.
00:18:46.133 --> 00:18:46.755
Welcome to FinTech.
00:18:46.755 --> 00:18:48.402
There's so many companies named the same thing, but this is a good quote.
00:18:48.402 --> 00:18:49.566
He said the regulators are now awake.
00:18:49.566 --> 00:18:56.042
Too many people are focused on the as a service part but have minored in the banking part of it all.
00:18:56.042 --> 00:19:02.740
If you're going to play in that space, I'd argue that if you fail at the banking part, the service piece doesn't even matter.
00:19:02.740 --> 00:19:05.183
Yeah, yeah, 100%.
00:19:05.183 --> 00:19:12.763
There's a lot Like what Wade Arnold, the founder of Move Railwork, says there's a lot of fin in fintech, but there needs to be a bit more.
00:19:12.763 --> 00:19:26.112
You know, what I find really interesting about this is way back in the day, when I was on subs bouncing around under the ocean, we had what we called casualty operating procedures.
00:19:26.112 --> 00:19:37.631
They were cops, Maia, and there were these 13 manuals that basically addressed every single situation that would take our guidance system down and not allow us to launch nuclear missiles.
00:19:38.311 --> 00:19:47.185
And they were step-by-step manuals that, by the way, as the navigation supervisor where I worked, I had to have them memorized.
00:19:47.185 --> 00:19:49.217
I had 13 manuals.
00:19:49.217 --> 00:19:52.734
I knew every step, every step, and we practiced.
00:19:52.734 --> 00:19:54.119
We did drills.
00:19:54.119 --> 00:19:57.078
Practice just didn't sound like the military.
00:19:57.078 --> 00:19:59.215
We drilled on them over and over again.
00:19:59.215 --> 00:20:00.400
We'd do them in the dark.
00:20:00.400 --> 00:20:02.277
We'd do them with our air mask on.
00:20:02.277 --> 00:20:04.518
We would do them while diving deep.
00:20:04.518 --> 00:20:05.499
We'd do them with our air mask on.
00:20:05.499 --> 00:20:06.680
We would do them while diving deep.
00:20:06.680 --> 00:20:08.080
We'd do them while doing an emergency surface.
00:20:08.080 --> 00:20:14.711
We would go through every scenario and they would constantly get updated because we'd think of another terrible thing that could happen, because essentially, we could end the world.
00:20:14.711 --> 00:20:20.093
That was, the job of the submarine was to launch nuclear missiles, you wonder.
00:20:22.278 --> 00:20:30.516
Dude, it doesn't look to me like Evolve that I'm just gonna say it might be good, everybody yeah critical large data leak.
00:20:30.596 --> 00:20:31.376
What do we do?
00:20:31.376 --> 00:20:32.358
What's step one?
00:20:33.020 --> 00:20:37.455
yep, yep, yep, because right now you've got about five or six different things hitting all at the same time.
00:20:37.455 --> 00:20:45.260
I get it, I understand, I feel your pain, but man, everybody, um, let's do better.
00:20:45.651 --> 00:20:47.317
Their leadership team is going to get some ulcers.
00:20:48.049 --> 00:20:52.662
Yeah, I'll say this, Maia, and this even ties back to the Synapse debacle that was going on.
00:20:52.662 --> 00:21:06.824
When you read, we have to remember, at the end of the day, we're servicing real people, whether they're small businesses or individuals, consumers who can't access the money they put into synapse, you know, and say, hey, I'm out $30,000.
00:21:06.824 --> 00:21:09.335
I'm actually suicidal, I believe that was one of the letters.
00:21:09.355 --> 00:21:10.138
I mean it's unacceptable.
00:21:10.910 --> 00:21:12.477
That's at the end of the day.
00:21:12.477 --> 00:21:15.230
We have a fiduciary and ethical responsibility.
00:21:15.230 --> 00:21:16.836
I'm preaching everybody, but I don't care.
00:21:17.309 --> 00:21:28.156
We have a fiduciary and ethical responsibility to do better to remember who we're servicing Ethical and, frankly, regulatory responsibility to do better, to remember who we're servicing.
00:21:28.156 --> 00:21:30.143
Ethical and, frankly, regulatory responsibility yes give people access to their funds.
00:21:30.163 --> 00:21:31.226
So everybody, let's do better.
00:21:31.226 --> 00:21:32.770
Okay, how's that?
00:21:32.790 --> 00:21:41.021
let's do better let's wrap this up I know we're in the middle of this, we don't even know all the consequences exactly, yet still unfolding but excited to keep an eye on it.
00:21:41.021 --> 00:21:43.094
Hopefully it doesn't take down the whole industry.
00:21:43.094 --> 00:21:45.259
Hey, that would be nice.
00:21:46.221 --> 00:21:49.518
Please don't I like working here everybody.
00:21:49.518 --> 00:21:52.114
Hey, go out and read Jason Malika's.
00:21:52.114 --> 00:21:57.084
Oh, jason, come on, mikula, sorry, jason, I keep trying.
00:21:57.084 --> 00:21:58.934
Great Twitter feed.
00:21:58.934 --> 00:22:01.457
There's others that are reporting.
00:22:01.457 --> 00:22:03.217
Great, a lot of reporting going on right now.
00:22:03.217 --> 00:22:08.720
The story is unfolding, even some of the things that we talked about we're going to get more clarity on.
00:22:08.720 --> 00:22:13.074
But again, everybody, let's just do better.
00:22:13.074 --> 00:22:14.519
Hey, thanks for listening.
00:22:14.519 --> 00:22:17.537
Really, we really do appreciate it.
00:22:17.537 --> 00:22:18.412
We love this space.
00:22:18.412 --> 00:22:20.491
Like I said, Maia and I just keep learning, right, Maia?
00:22:20.491 --> 00:22:22.814
I mean, every week something new comes up.
00:22:22.814 --> 00:22:23.936
It's fascinating.
00:22:24.217 --> 00:22:25.882
You know it's fun when there's so much drama.
00:22:28.251 --> 00:22:31.481
Yeah, drama Drama's fun as long as it's not your drama or mine.
00:22:31.481 --> 00:22:33.978
Hey everybody, have a great week.
00:22:34.730 --> 00:22:41.503
So thanks so much for listening to another episode of Artificially Intelligent part of the Money 2020 Network.
00:22:41.503 --> 00:22:43.655
We will see you next week.
00:00:00.561 --> 00:00:08.375
Hey everybody, welcome to another episode of Artificially Intelligent.
00:00:08.375 --> 00:00:10.968
I am one of your interns, Sam Maule.
00:00:10.968 --> 00:00:15.311
I am joined by Maia in the sunny West Coast.
00:00:15.311 --> 00:00:17.164
I'm guessing, Maia, it looks sunny behind you.
00:00:17.164 --> 00:00:17.625
How are you doing?
00:00:18.006 --> 00:00:19.850
Beautiful day today, welcome back.
00:00:19.850 --> 00:00:20.652
Welcome back.
00:00:20.652 --> 00:00:24.550
I'm excited to be jumping on and learning more things with you today, Sam.
00:00:25.179 --> 00:00:27.702
Yeah, I live in Florida everybody, so you never know day to day what it'm excited to be jumping on and learning more things with you today, sam.
00:00:27.702 --> 00:00:30.294
Yeah, I live in Florida everybody, so you never know day to day what it's going to be like.
00:00:30.294 --> 00:00:32.046
We're tracking this Cat 5 hurricane.
00:00:32.046 --> 00:00:39.792
It's just another day in Florida, Maia, but we have the equivalent of a Cat 5 hurricane happening in the fintech community.
00:00:39.792 --> 00:00:41.206
How is that for a segue?
00:00:41.206 --> 00:00:55.011
I am so proud of myself with a hurricane segue Because there's this famous quote by Mr Lennon that says there are decades when nothing happens and there are weeks when decades happen.
00:00:55.011 --> 00:00:59.951
And the past few weeks have felt like decades in the fintech community, Maia.
00:01:01.261 --> 00:01:04.311
You know, and none of it is good.
00:01:04.311 --> 00:01:06.081
We have had no good news.
00:01:06.081 --> 00:01:08.846
It's not like there's all kinds of news happening.
00:01:08.846 --> 00:01:14.795
No, it's really only bad news, which I think is probably most often the situation when people pull out that quote.
00:01:27.061 --> 00:01:31.299
I mean, let's start with what's happening with this incredible data breach that took place.
00:01:31.299 --> 00:01:55.548
Initially, the news was that LockBit, this ransomware group, had hacked the Federal Reserve and had something like 33 terabytes of data, but what we've learned over this decade of the past week or so is that this is Evolve Bank that had the data breach and basically PII data is now sitting out in the dark web for a ridiculous number of people and it affects a ridiculous number of fintechs.
00:01:55.548 --> 00:02:09.086
I've basically been chugging anti-acid medicine, I think, for the past week, every time I read one of these reports.
00:02:09.086 --> 00:02:09.348
Maia.
00:02:10.060 --> 00:02:10.461
Well, sam.
00:02:10.461 --> 00:02:14.170
So first clarify some of the basics for me on this.
00:02:14.170 --> 00:02:30.668
When I hear right LockBit, the ransomware group they release the data on, I think, millions of Americans, pii, social security number, all that Basic question does that mean that they asked Evolve for a ransom and Evolve did not pay up?
00:02:30.668 --> 00:02:35.204
So this was the consequence, or what do we know about how this situation played out?
00:02:35.204 --> 00:02:39.966
I mean, of course, having the data breach happen in the first place is not ideal and that's what we want to prevent.
00:02:39.966 --> 00:02:41.368
But do we know?
00:02:41.389 --> 00:02:42.651
what happened right after.
00:02:42.651 --> 00:02:52.554
I think it's still somewhat hazy, but here's my understanding is that Evolve did determine that they had a data breach going back to May of this year.
00:02:52.554 --> 00:02:55.830
The data breach was caused by take a guess Maia.
00:02:55.830 --> 00:02:57.646
How do you think this data breach started?
00:02:57.646 --> 00:03:00.487
How does every data breach start?
00:03:01.221 --> 00:03:04.069
So it depends on what decade we're talking about.
00:03:04.069 --> 00:03:09.223
So it depends on what decade we're talking about.
00:03:09.223 --> 00:03:12.092
If it was the 90s, a data breach happened because somebody left their laptop on the bus on the way home to work.
00:03:12.092 --> 00:03:24.368
If it's the 2000s, but yeah, I mean, uh, they could have been spearfished yeah, in this case it was clicking on a link.
00:03:24.549 --> 00:03:26.252
Right, an employee clicked on a link.
00:03:26.252 --> 00:03:33.713
Those wonderful phishing attacks that opened up the gates, that allowed lock bit to get in um lock.
00:03:34.502 --> 00:03:35.165
It is interesting.
00:03:35.165 --> 00:03:37.175
So, and back up a little bit, we've talked about this.
00:03:37.175 --> 00:03:37.336
Um.
00:03:37.336 --> 00:03:40.644
So an employee clicked on the link terrible, totally.
00:03:40.644 --> 00:03:42.967
Like everybody gets trained not to do that.
00:03:42.967 --> 00:03:48.524
But how much freaking access did this employee have, you know?
00:03:48.524 --> 00:03:50.931
Like was this and was this the CEO?
00:03:50.931 --> 00:03:52.114
Like it's not.
00:03:52.114 --> 00:03:59.070
Like every lay person at a bank has access to the PII for a million.
00:03:59.070 --> 00:04:18.011
And you know, a good system, besides having layers of permissions and things like that, has a lot of rate limiting in place, so that there are some employees who are allowed to look at the social security number for any customer, but if they look at more than like 100 in an hour, right, you start to shut that system down.
00:04:18.939 --> 00:04:20.341
Yeah, I mean, it's unbelievable.
00:04:20.341 --> 00:04:23.766
I mean the unfolding drama.
00:04:23.766 --> 00:04:28.995
I guess one of the best places is to follow Jason Mikula, who we both know and love.
00:04:29.341 --> 00:04:30.285
Jason is the expert here.
00:04:30.839 --> 00:04:31.040
Man.
00:04:31.040 --> 00:04:33.627
He's done an incredible job of reporting on this.
00:04:33.627 --> 00:04:38.970
Yeah, on Twitter, so much so that he's received a cease and desist order from Evolve Bank.
00:04:38.970 --> 00:04:39.591
Bless you, jason.
00:04:39.591 --> 00:04:46.925
But yeah, I mean, it even appears that they were able to hack into a large volume of their internal emails.
00:04:46.925 --> 00:04:52.706
Something like 9.9 gigabytes of PST files, which is basically Outlook data files are sitting out there.
00:04:53.201 --> 00:04:54.904
Why do they even have like don't?
00:04:54.904 --> 00:05:01.509
I mean many companies right sort of delete all their emails every three months or six months or a year.
00:05:01.509 --> 00:05:04.247
Right, it's like why was there access to so many emails?
00:05:05.331 --> 00:05:06.836
It is just it's amazing.
00:05:06.836 --> 00:05:08.000
It's like why was there access to so many emails?
00:05:08.000 --> 00:05:11.223
It is just it's amazing.
00:05:11.223 --> 00:05:15.776
I'll tell you what we need to do a show sometime just on ransomware companies, because I went out and did a little bit of reading about LockBit and it's fascinating.
00:05:15.776 --> 00:05:20.351
They're basically, you know how you have banking as a service and software as a service.
00:05:20.351 --> 00:05:24.708
So LockBit is ransomware as a service, so is a business.
00:05:24.708 --> 00:05:32.699
Everybody, um, and and this group is flipping really, really good about good at it they're the world's most politic ransomware.
00:05:32.699 --> 00:05:36.509
Um, I guess firm, I don't know a better way of saying it group.
00:05:36.528 --> 00:05:37.591
I guess it's a ball.
00:05:37.591 --> 00:05:46.194
It is all about incentives, right, and the thing is we not want nobody wants social security numbers released on the dark web.
00:05:46.194 --> 00:05:47.964
It's not good for anybody, right?
00:05:47.964 --> 00:05:50.071
And I'm including LockBit.
00:05:50.071 --> 00:05:54.091
Lockbit isn't profiting off of having social security numbers on the dark web.
00:05:54.091 --> 00:06:00.024
Americans are obviously going to get screwed from this, and so that's what I'm saying.
00:06:00.024 --> 00:06:00.987
This is really kind of the worst case scenario.
00:06:00.987 --> 00:06:01.529
That's what I'm saying.
00:06:01.529 --> 00:06:03.637
This is really kind of the worst case scenario.
00:06:04.940 --> 00:06:05.321
Oh, it's horrible.
00:06:05.321 --> 00:06:10.033
What's interesting is, again, we believe the hack occurred toward the back end of May.
00:06:10.033 --> 00:06:24.387
In the first week of May the US government actually charged the founders of Lockpit, which is a Russian national Shocker, basically put a $10 million bounty on their head.
00:06:24.387 --> 00:06:30.581
So yeah, of all things right, I mean just we're talking weeks before this hack even happened.
00:06:30.581 --> 00:06:33.639
You know the US government basically was going out for them.
00:06:33.639 --> 00:06:39.882
So I mean, again, like we said at the beginning, there are just some weeks where you're like man, could we use a little good news?
00:06:39.882 --> 00:06:41.836
You know, just a little bit.
00:06:42.410 --> 00:06:46.149
Well, and Evolve so, really, honestly, a great target for LockBit.
00:06:46.149 --> 00:06:49.040
They're in this really interesting vulnerable position, right.
00:06:49.040 --> 00:07:00.663
So my guess Evolve is a small bank in the scheme of things, right, if you compare it up to Chase Bank of America, they are a small bank.
00:07:00.663 --> 00:07:01.425
They probably do not have the same.
00:07:01.425 --> 00:07:03.896
We know that they don't have sufficient security practices, right.
00:07:03.896 --> 00:07:07.411
They don't have the IT staff that one of these bigger banks has.
00:07:07.411 --> 00:07:13.269
But on the flip side, evolve has built their business as a partner to fintech companies.
00:07:13.269 --> 00:07:19.997
So Evolve is probably the number one biggest partner bank that supports fintech programs.
00:07:19.997 --> 00:07:24.077
They power a bunch of banking as a service software platforms, right.
00:07:24.077 --> 00:07:24.879
So those are the.
00:07:24.879 --> 00:07:31.293
Evolve is the bank behind a bunch of software platforms, including infamous Synapse.
00:07:31.293 --> 00:07:38.964
That powers a bunch of other programs as well as just working directly with really big companies like Affirm and Stripe.
00:07:40.271 --> 00:07:41.173
Yeah, I mean Evolve.
00:07:41.173 --> 00:07:42.459
I was just looking at it now.
00:07:42.459 --> 00:07:48.262
I mean, you know, when we think of the big boys, evolve is based out of Tennessee, if I remember right.
00:07:48.262 --> 00:07:56.418
You know this is sub $5 billion in assets when you talk about total assets for the bank, so a small bank, but a massive player.
00:07:56.459 --> 00:07:57.201
Durban exempt.
00:07:57.891 --> 00:08:07.475
Yeah, I mean massive player, though when it comes to fintech, I mean the number of companies that they service is I mean you're talking.
00:08:07.475 --> 00:08:09.872
Affirm Earning Marketta.
00:08:09.872 --> 00:08:12.819
Lord Alloy Bond Branch.
00:08:12.819 --> 00:08:16.702
Dave Melio, mercury Love.
00:08:16.723 --> 00:08:19.896
Mercury Mercury, I think Mercury previously, but not currently.
00:08:20.237 --> 00:08:23.637
Yeah, not currently, and I think that's a good point.
00:08:24.649 --> 00:08:26.478
Yeah, with Mercury, although I'm curious.
00:08:26.478 --> 00:08:47.966
So if Mercury customers I mean presumably if personal information was hacked, evolve still has all the personal information from Mercury customers, even though they have since switched off it, unless, as part of their switching, they I mean I honestly I don't even think you can request that data be deleted.
00:08:47.966 --> 00:08:58.241
I think the banks need to keep that data in order to comply with regulations and for future reporting, and so it stems the damage.
00:08:58.241 --> 00:09:01.734
It makes Mercury look good that they've moved off of Evolve.
00:09:01.734 --> 00:09:13.975
Anyone who's signed up super recently will not have been a victim, but it seems like most Mercury customers are still impacted by this, as well as anyone else who has moved off of Evolve.
00:09:15.198 --> 00:09:20.096
Did you get a chance to read the post by Supes over at Sardine AI?
00:09:20.096 --> 00:09:21.419
Nope, when he talked about this.
00:09:21.440 --> 00:09:21.780
What did he say?
00:09:21.801 --> 00:09:22.582
It's fascinating.
00:09:22.582 --> 00:09:23.571
He did a.
00:09:23.571 --> 00:09:28.139
Supes went on a thread rant about this a couple days ago.
00:09:28.139 --> 00:09:28.961
So everyone doesn't know.
00:09:28.961 --> 00:09:32.392
Supes is the founder of Sardine AI, which is again in this.
00:09:32.392 --> 00:09:36.899
You know the AML KYC space and fraud.
00:09:36.899 --> 00:09:39.491
Very fascinating one because he's like you.
00:09:39.491 --> 00:09:40.453
Please understand.
00:09:40.453 --> 00:09:42.942
The second your social security number is compromised.
00:09:42.942 --> 00:09:44.451
It's compromised.
00:09:44.451 --> 00:09:47.216
There's no tokenization around your social security.
00:09:47.216 --> 00:09:52.085
There's no way to go out and get a new SSN issued, right, or an EIN.
00:09:52.085 --> 00:09:54.273
I mean it's again.
00:09:54.273 --> 00:09:57.158
We are in this day and age.
00:09:57.158 --> 00:10:02.393
We talk about this in banking all the time, but this extends far beyond banking.
00:10:02.393 --> 00:10:10.475
What we rely upon for PIA data is data that can't be changed your date of birth, your social.
00:10:10.475 --> 00:10:15.499
You know I mean, let's go back to the day right, your mother's maiden name, your favorite hobby.
00:10:15.499 --> 00:10:17.037
I guess you can change your favorite hobby.
00:10:17.037 --> 00:10:18.495
You can't change your mother's maiden name.
00:10:18.495 --> 00:10:21.878
You're not changing your date of birth, you're not changing your social, you know.
00:10:21.878 --> 00:10:27.169
I mean, just like you said, when that PII data is out there, it's out there, I mean- there.
00:10:27.190 --> 00:10:27.812
I mean it's just game over.
00:10:27.812 --> 00:10:34.974
I mean, honestly, it's like after after the um equifax hack, a lot of that is out there anyway.
00:10:34.974 --> 00:10:49.879
Um, I think, frankly, this is not the first time that we've realized, like, look, we cannot depend on social security number, on knowing social security number, as proof that somebody is who they say they are and a proof of their identity.
00:10:49.879 --> 00:10:57.270
Right, we got to step up it, like has to.
00:10:57.270 --> 00:10:58.592
It's an arms race and it's got to continue to be multifaceted.
00:10:58.592 --> 00:11:05.784
I know other data that was leaked that is a little bit less sensitive, but the full 16 digit card numbers referred to as the pan.
00:11:05.784 --> 00:11:14.725
I think a firm just confirmed that their card product is totally compromised.
00:11:14.725 --> 00:11:16.676
That's kind of rough right.
00:11:16.676 --> 00:11:19.119
There's a lot of protections baked into cards.
00:11:19.119 --> 00:11:22.299
People can get those reissued, but it's a huge pain in the ass.
00:11:22.299 --> 00:11:34.836
A lot of settlement files, ach files, I think, even people who did not have an account at Evolve but who sent a transfer to somebody who has an account at Evolve.
00:11:34.836 --> 00:11:36.421
Some of their information has been compromised too.
00:11:36.929 --> 00:11:41.000
That's what makes this interesting, because that's where we've gotten in the gotten.
00:11:41.000 --> 00:11:42.692
I don't think that's great English, everybody.
00:11:42.692 --> 00:11:48.402
That's where we're at now, in 2024, with FinTech.
00:11:48.402 --> 00:11:57.477
That's part of the skin in the game level that we're at, because we're talking about banking as a service, or blank as a service.
00:11:57.477 --> 00:12:25.759
There's multiple layers of integration, right, I mean, I'm, I'm a bank, I am servicing, say this, this, this payments company, and then there's a kyc vendor that sits out there and a fraud vendor that's out there and take your pick, and so the spider webs of tracking this back to figure out the impact is the CSI for fintech and hacks like this.
00:12:25.759 --> 00:12:28.184
That's a business model.
00:12:28.184 --> 00:12:29.755
That's something I should have gone into.
00:12:29.755 --> 00:12:33.220
But again, everybody, I like what Maia referenced when you talked about Equifax.
00:12:33.220 --> 00:12:36.078
That was back in 2017, the hack that occurred there.
00:12:37.212 --> 00:12:37.476
Again.
00:12:37.476 --> 00:12:38.349
This isn't new.
00:12:38.349 --> 00:12:40.537
We already lost everybody's social security number.
00:12:40.537 --> 00:12:41.259
Let's be real.
00:12:41.590 --> 00:12:45.181
It wasn't secret, amen, it wasn't secret, we it wasn't secret.
00:12:45.250 --> 00:12:46.111
We lost it again.
00:12:46.111 --> 00:12:52.610
Um, but this is I mean it's really far reaching my well one of my biggest concerns.
00:12:52.610 --> 00:12:54.033
I mean, sam, this is our industry, right?
00:12:54.033 --> 00:13:02.438
You, you and I have kind of bet our careers on FinTech and this is a huge trust-breaking moment.
00:13:02.438 --> 00:13:13.155
Um, equifax lost a lot of trust in the breach, but people can't really decide whether they're a part of Equifax or whether they're using it or not.
00:13:13.155 --> 00:13:18.302
The credit bureaus do not have strong consumer brands, right?
00:13:18.429 --> 00:13:22.875
They are mostly, and so that was sort of a side A lot of this consumer stuff.
00:13:22.875 --> 00:13:34.158
I mean, dude, everybody who gets instant payouts from Uber I think they might have been affected because Branch, the payments provider there, was powered by Evolve.
00:13:34.158 --> 00:13:49.719
I mean FinTech, like all of the stuff that people love from FinTech, which is those instant payouts, right, which is fee-free banking, which is all that stuff that Stripe does, which is buy nowfree banking, which is, um, all you know all that stuff that stripe does, which is buy now, pay later from a firm.
00:13:49.719 --> 00:13:51.948
Like there's a ton of consumer demand for this.
00:13:51.948 --> 00:14:03.397
But this is kind of a big trust-breaking moment and I gotta say I mean, ever the social security numbers were out evolve as a small bank.
00:14:03.397 --> 00:14:04.480
They don't have the it.
00:14:04.480 --> 00:14:15.120
I can be a little bit understanding for some of the stuff with the, with the hack, but the comms has been abysmal people are getting emails, the timing, the confusion.
00:14:15.460 --> 00:14:18.192
It seems like nobody knows exactly what happened.
00:14:18.192 --> 00:14:23.754
Um, I am getting my phone is blowing up with text messages from people saying, hey, I bank with mercury.
00:14:23.754 --> 00:14:26.160
Like am, is my money at risk?
00:14:26.160 --> 00:14:29.200
Hey, like I have an Affirm card, what do I need?
00:14:29.200 --> 00:14:35.679
Like nobody is on top of this stuff and Evolve is way behind the ball.
00:14:35.679 --> 00:14:40.221
I mean, you kind of casually mentioned the cease and desist against Jason for reporting.
00:14:40.221 --> 00:14:45.461
I feel like that shows how much they've sort of lost the thread on this.
00:14:46.331 --> 00:14:47.875
Yeah, I'm with you on that one.
00:14:47.894 --> 00:14:50.160
They're out of control it's interesting.
00:14:51.452 --> 00:15:10.980
Yeah, I mean, and that was a Twitter thread that was going on when Jason was talking about this and he literally mentioned something about a firm and Max Levchin, right out in the blue, replied to Jason and said yeah, if there's anything you can do to give me more information to help with this, I give Max Levchin props for that Right.
00:15:10.980 --> 00:15:13.495
Get out in front of this Wise has done that.
00:15:13.730 --> 00:15:15.658
Max has had great comms throughout this.
00:15:16.510 --> 00:15:19.039
I'm a big everybody just so we can get past this.
00:15:19.039 --> 00:15:22.355
I'm a Max Levchin fanboy, so I like Max.
00:15:22.610 --> 00:15:24.437
I think he's brilliant One of the PayPal mafia.
00:15:24.437 --> 00:15:26.335
Everybody Very good at what he does.
00:15:27.410 --> 00:15:30.259
And proved that buy now, pay later was a real thing, because everyone yeah.
00:15:31.169 --> 00:15:34.056
Through, like it feels like Max's, like force of will.
00:15:34.777 --> 00:15:35.859
Yeah, max, come on the show.
00:15:35.859 --> 00:15:36.921
Come on, baby.
00:15:36.921 --> 00:15:38.423
Would love to interview.
00:15:38.423 --> 00:15:42.293
But yeah, I think he did a fantastic job jumping in front of this.
00:15:42.293 --> 00:15:43.974
Wise has done the same thing.
00:15:43.974 --> 00:15:48.616
You know, on the comms part, I think Mercury has done a good job, mercury has been excellent, you know.
00:15:49.717 --> 00:15:50.538
I kind of you know.
00:15:50.538 --> 00:15:51.458
I think it evolved.
00:15:51.458 --> 00:15:59.966
I think you positioned this correctly when Equifax had this you know, massive hack everyone back in 2017, and they were fined.
00:15:59.966 --> 00:16:02.086
I think it was like $1.3 billion, if I remember.
00:16:02.086 --> 00:16:03.711
It was a chunk of change.
00:16:03.711 --> 00:16:04.615
They had to pay out the door.
00:16:04.615 --> 00:16:06.419
Equifax can survive that.
00:16:06.419 --> 00:16:19.282
Evolve is not a large bank they aren't and on top of this, they had the whole Synapse debacle, which was also happening, this whole reconciliation issue that they had.
00:16:19.282 --> 00:16:21.917
They had the OCC come at them with the.
00:16:21.917 --> 00:16:32.754
You know they got nailed there and then you know just not that I think it was yesterday or the day before.
00:16:32.754 --> 00:16:35.460
You know, now you've got congressmen more or less coming after Evolve too.
00:16:35.460 --> 00:16:37.283
You know it's been reported.
00:16:37.283 --> 00:16:42.541
So some rough days in Tennessee, I think, right now.
00:16:42.701 --> 00:16:43.143
Rough days.
00:16:43.143 --> 00:16:43.595
So we have.
00:16:43.595 --> 00:16:46.977
So there's a couple of weaknesses that have been highlighted by recent events.
00:16:46.977 --> 00:16:51.556
So one we've got like a concentration risk in the fintech ecosystem.
00:16:51.556 --> 00:17:03.972
So many products were powered by Evolve on the backend, that then, right, with this one hack, it's taken down like a ton of the fintech industry including.
00:17:03.972 --> 00:17:05.518
Well, yeah, so that's one risk.
00:17:06.230 --> 00:17:16.881
A second risk, you know, having these sponsor banks, since it's so difficult to get a bank charter and to be regulated, as a bank in the US has had all these interesting things.
00:17:16.881 --> 00:17:22.442
So the sponsor banks don't really have the end customer relationship, and that's what the fintechs want.
00:17:22.442 --> 00:17:29.171
They say, hey, we want to own the customer relationship and all the communications with them and we just want to kind of rent out your bank charter.
00:17:29.171 --> 00:17:41.240
Well, we're in a weird ass position now where, like, even a bunch of the startups that were backed by Evolve have shut down, right, so they don't even exist anymore.
00:17:41.661 --> 00:17:44.535
Their customers' information was leaked in the Evolve hack.
00:17:44.535 --> 00:17:46.199
Well, who's sending out the emails?
00:17:46.199 --> 00:17:47.260
Who's sending out the notification?
00:17:47.260 --> 00:17:51.096
Is it Evolve, this company that they may not have even heard of before?
00:17:51.096 --> 00:18:02.519
Right, it's got that small print at the bottom you signed up for a Glorify account and there's this tiny print that are like banking services provided by Evolve, na, like whatever the whole thing, and then you get an email from them out of the blue.
00:18:02.519 --> 00:18:18.000
So I feel like the customer comms piece has just been done really poorly, both because we have like a little bit of incompetence, but also just as a structural weakness like this is the way that the fintech ecosystem is structured.
00:18:18.000 --> 00:18:30.634
It's a lot of benefits to separating out the customer relationship to be owned by the fintech, but this is we're kind of seeing one of the weaknesses too, particularly if the fintech is shorter lived than the bank, which is going to be the case.
00:18:30.634 --> 00:18:34.211
It's almost by design that banks are pretty hard to fail in the US.
00:18:34.932 --> 00:18:38.420
Yeah, I think there's a great quote in paymentscom today.
00:18:38.420 --> 00:18:45.651
It was from Thread CEO, jim McCarthy.
00:18:45.651 --> 00:18:46.133
Thread being T-H-R-E-D-D.
00:18:46.133 --> 00:18:46.755
Welcome to FinTech.
00:18:46.755 --> 00:18:48.402
There's so many companies named the same thing, but this is a good quote.
00:18:48.402 --> 00:18:49.566
He said the regulators are now awake.
00:18:49.566 --> 00:18:56.042
Too many people are focused on the as a service part but have minored in the banking part of it all.
00:18:56.042 --> 00:19:02.740
If you're going to play in that space, I'd argue that if you fail at the banking part, the service piece doesn't even matter.
00:19:02.740 --> 00:19:05.183
Yeah, yeah, 100%.
00:19:05.183 --> 00:19:12.763
There's a lot Like what Wade Arnold, the founder of Move Railwork, says there's a lot of fin in fintech, but there needs to be a bit more.
00:19:12.763 --> 00:19:26.112
You know, what I find really interesting about this is way back in the day, when I was on subs bouncing around under the ocean, we had what we called casualty operating procedures.
00:19:26.112 --> 00:19:37.631
They were cops, Maia, and there were these 13 manuals that basically addressed every single situation that would take our guidance system down and not allow us to launch nuclear missiles.
00:19:38.311 --> 00:19:47.185
And they were step-by-step manuals that, by the way, as the navigation supervisor where I worked, I had to have them memorized.
00:19:47.185 --> 00:19:49.217
I had 13 manuals.
00:19:49.217 --> 00:19:52.734
I knew every step, every step, and we practiced.
00:19:52.734 --> 00:19:54.119
We did drills.
00:19:54.119 --> 00:19:57.078
Practice just didn't sound like the military.
00:19:57.078 --> 00:19:59.215
We drilled on them over and over again.
00:19:59.215 --> 00:20:00.400
We'd do them in the dark.
00:20:00.400 --> 00:20:02.277
We'd do them with our air mask on.
00:20:02.277 --> 00:20:04.518
We would do them while diving deep.
00:20:04.518 --> 00:20:05.499
We'd do them with our air mask on.
00:20:05.499 --> 00:20:06.680
We would do them while diving deep.
00:20:06.680 --> 00:20:08.080
We'd do them while doing an emergency surface.
00:20:08.080 --> 00:20:14.711
We would go through every scenario and they would constantly get updated because we'd think of another terrible thing that could happen, because essentially, we could end the world.
00:20:14.711 --> 00:20:20.093
That was, the job of the submarine was to launch nuclear missiles, you wonder.
00:20:22.278 --> 00:20:30.516
Dude, it doesn't look to me like Evolve that I'm just gonna say it might be good, everybody yeah critical large data leak.
00:20:30.596 --> 00:20:31.376
What do we do?
00:20:31.376 --> 00:20:32.358
What's step one?
00:20:33.020 --> 00:20:37.455
yep, yep, yep, because right now you've got about five or six different things hitting all at the same time.
00:20:37.455 --> 00:20:45.260
I get it, I understand, I feel your pain, but man, everybody, um, let's do better.
00:20:45.651 --> 00:20:47.317
Their leadership team is going to get some ulcers.
00:20:48.049 --> 00:20:52.662
Yeah, I'll say this, Maia, and this even ties back to the Synapse debacle that was going on.
00:20:52.662 --> 00:21:06.824
When you read, we have to remember, at the end of the day, we're servicing real people, whether they're small businesses or individuals, consumers who can't access the money they put into synapse, you know, and say, hey, I'm out $30,000.
00:21:06.824 --> 00:21:09.335
I'm actually suicidal, I believe that was one of the letters.
00:21:09.355 --> 00:21:10.138
I mean it's unacceptable.
00:21:10.910 --> 00:21:12.477
That's at the end of the day.
00:21:12.477 --> 00:21:15.230
We have a fiduciary and ethical responsibility.
00:21:15.230 --> 00:21:16.836
I'm preaching everybody, but I don't care.
00:21:17.309 --> 00:21:28.156
We have a fiduciary and ethical responsibility to do better to remember who we're servicing Ethical and, frankly, regulatory responsibility to do better, to remember who we're servicing.
00:21:28.156 --> 00:21:30.143
Ethical and, frankly, regulatory responsibility yes give people access to their funds.
00:21:30.163 --> 00:21:31.226
So everybody, let's do better.
00:21:31.226 --> 00:21:32.770
Okay, how's that?
00:21:32.790 --> 00:21:41.021
let's do better let's wrap this up I know we're in the middle of this, we don't even know all the consequences exactly, yet still unfolding but excited to keep an eye on it.
00:21:41.021 --> 00:21:43.094
Hopefully it doesn't take down the whole industry.
00:21:43.094 --> 00:21:45.259
Hey, that would be nice.
00:21:46.221 --> 00:21:49.518
Please don't I like working here everybody.
00:21:49.518 --> 00:21:52.114
Hey, go out and read Jason Malika's.
00:21:52.114 --> 00:21:57.084
Oh, jason, come on, mikula, sorry, jason, I keep trying.
00:21:57.084 --> 00:21:58.934
Great Twitter feed.
00:21:58.934 --> 00:22:01.457
There's others that are reporting.
00:22:01.457 --> 00:22:03.217
Great, a lot of reporting going on right now.
00:22:03.217 --> 00:22:08.720
The story is unfolding, even some of the things that we talked about we're going to get more clarity on.
00:22:08.720 --> 00:22:13.074
But again, everybody, let's just do better.
00:22:13.074 --> 00:22:14.519
Hey, thanks for listening.
00:22:14.519 --> 00:22:17.537
Really, we really do appreciate it.
00:22:17.537 --> 00:22:18.412
We love this space.
00:22:18.412 --> 00:22:20.491
Like I said, Maia and I just keep learning, right, Maia?
00:22:20.491 --> 00:22:22.814
I mean, every week something new comes up.
00:22:22.814 --> 00:22:23.936
It's fascinating.
00:22:24.217 --> 00:22:25.882
You know it's fun when there's so much drama.
00:22:28.251 --> 00:22:31.481
Yeah, drama Drama's fun as long as it's not your drama or mine.
00:22:31.481 --> 00:22:33.978
Hey everybody, have a great week.
00:22:34.730 --> 00:22:41.503
So thanks so much for listening to another episode of Artificially Intelligent part of the Money 2020 Network.
00:22:41.503 --> 00:22:43.655
We will see you next week.
BUSCAR EPISODIOS ANTERIORES
Buscar episodios anteriores de Artificially Intelligent with Sam Maule and Maia Bittner.
Descargo de responsabilidad: El podcast y el arte incluidos en esta página son de Sam Maule, Maia Bittner, Rachel Morrissey, que es propiedad de su propietario y no está afiliado ni respaldado por Listen Notes, Inc.
EDITAR
Gracias por ayudar a mantener actualizada la base de datos de podcasts.
