WEBVTT
00:00:00.320 --> 00:00:02.799
Welcome to Executive Conversations by the Papers.
00:00:03.040 --> 00:00:04.160
I'm Dwayne Jeffrey.
00:00:04.559 --> 00:00:11.759
In this episode, I'm joined by Andre Farraz, CEO of Incne and Joe Wilson, board member at Bunk.
00:00:13.599 --> 00:00:17.920
And we're going to be talking a little bit about fraud, especially APP fraud.
00:00:18.079 --> 00:00:20.239
So Andre, I want to talk start with you.
00:00:20.320 --> 00:00:29.600
Um, maybe in plain terms, for those who don't know, what is APP fraud and why is it different from fraud that most bank professionals already know um how to stop?
00:00:30.079 --> 00:00:30.320
Alright.
00:00:30.480 --> 00:00:34.560
Well, so APP fraud stands for authorized push payment fraud.
00:00:34.960 --> 00:00:48.159
So basically it's the kind of fraud in which the end user is convinced to move money um thinking that they're um trying to protect their funds or something like that.
00:00:48.320 --> 00:01:05.760
So it's usually related to social engineering scams in which uh a scammer would call them and say, for example, like, oh I work for the bank, there's something wrong with your account and I need you to send money to this secure account here uh so that uh you you don't lose your money.
00:01:05.920 --> 00:01:09.760
And then that secure account was actually the account of the fraud street, right?
00:01:09.920 --> 00:01:28.159
So the end user logged into their bank account from their device, probably went through some form of biometrics or MFA, right, authenticated to their account, did the transaction, and then they realized, oh, I sent the money to to the wrong person that was in the bank.
00:01:28.480 --> 00:01:29.840
It was it was a scammer.
00:01:30.079 --> 00:01:31.040
Yeah, absolutely.
00:01:31.120 --> 00:01:37.840
So, Joe, of course, working at a bank, right, um, you see a lot of those different types of interactions.
00:01:37.920 --> 00:01:41.680
You see what's happening when it comes to fraud, and this is of course a fraud that's been on the rise.
00:01:41.840 --> 00:01:50.319
But when that customer authorizes the payment, as uh Andre already mentioned, like the normal fraud book playbook would probably does not fire, right?
00:01:50.480 --> 00:01:56.799
How did this change the way that a bank like Bunk is actually approaching this um and trying to solve it?
00:01:57.040 --> 00:02:00.560
Yeah, by the way, thanks for the initial Dutch pronunciation of the word bunk.
00:02:01.040 --> 00:02:09.360
Uh look, I think maybe your question is like, how we evolved or what do we do now because these things are on the rise and progressing?
00:02:09.520 --> 00:02:13.759
What I would he refers to in a really good way, I think of as this dark art of convincing people, right?
00:02:13.840 --> 00:02:14.719
They do this.
00:02:14.960 --> 00:02:17.439
Um these are things you have to put in place, right?
00:02:17.520 --> 00:02:29.599
You have to take your time and energy and you have to focus it not just on the back-end systems and catching things after they happen, but you have to start to focus out forward, like when it could happen, where might it happen, how do you educate people?
00:02:29.840 --> 00:02:38.159
We have a feature that we recently implemented called Safety Shield, which basically we keep a like we run a constant scan against your patterns and your behaviors.
00:02:38.240 --> 00:02:47.840
And then when we send something that's out of the ordinary or above a threshold you might normally do, we might freeze that for 24 hours and give you a chance for a second thought on some of those and even announce it to you and let you know.
00:02:47.919 --> 00:02:48.879
So that's one example.
00:02:48.960 --> 00:02:53.199
I'm not saying it's the perfect all answer, but those are the types of things we have to start doing now.
00:02:53.280 --> 00:03:01.120
I think we have a responsibility in that trust relationship to try and put technology to work even out at the human error side where we can.
00:03:01.439 --> 00:03:02.159
Absolutely.
00:03:02.319 --> 00:03:09.039
So um I think maybe, Andre, for to help the audience maybe get a better size of this, right?
00:03:09.120 --> 00:03:12.080
Like how big is the APP fraud?
00:03:12.400 --> 00:03:13.520
You know, how big is it?
00:03:13.599 --> 00:03:15.280
How how fast has it grown?
00:03:15.520 --> 00:03:19.840
And what moved so that this can actually happen?
00:03:20.639 --> 00:03:29.599
Yeah, I'd say right now, I don't have exact figures, but I would estimate like in the hundreds of bidens per year across the entire financial services industry.
00:03:29.919 --> 00:03:37.280
Um, and one of the key challenges is that right now this is for many financial institutions the top fraud issue.
00:03:37.840 --> 00:03:42.319
And a lot of regulators, for example, are currently discussing like what to do, right?
00:03:42.879 --> 00:03:44.080
Who should should be liable?
00:03:44.240 --> 00:03:48.080
Is it the receiving end, the sending end of the transaction, for example?
00:03:48.319 --> 00:03:57.120
So there's a lot of discussion right now in multiple jurisdictions about who who's responsible for this and who should be liable.
00:03:57.280 --> 00:04:05.039
So yeah, major, major problem and one that the industry hasn't really found the really solid solution.
00:04:05.439 --> 00:04:05.759
Absolutely.
00:04:05.919 --> 00:04:07.680
And you just mentioned liability, right?
00:04:07.759 --> 00:04:13.199
I think um we we see the liability aspect, especially in this particular uh fraud.
00:04:13.439 --> 00:04:14.719
Who's actually responsible?
00:04:14.879 --> 00:04:19.759
Like, do you already have an answer to that, or is it still a debate between it's either the bank or the customer?
00:04:20.000 --> 00:04:21.199
Yeah, I want all of this.
00:04:22.000 --> 00:04:23.439
There's a debate, right?
00:04:23.600 --> 00:04:33.920
Um, there are some places, like I think the UK, for example, currently has um the receiving end of the transaction being liable.
00:04:34.000 --> 00:04:47.680
And basically that's because like on that side of the transaction, um, it's kind of the bank didn't really run proper KYC um to ensure that that account was is being used by the right person.
00:04:47.759 --> 00:04:52.639
So that account is probably a Mule account or a fake account that's receiving those funds.
00:04:53.199 --> 00:04:54.959
So they're being held liable.
00:04:55.120 --> 00:04:59.600
In other places, you have the the other side being liable.
00:04:59.759 --> 00:05:04.000
Um I don't know which approach is is vast, to be honest.
00:05:04.240 --> 00:05:10.240
Um there are other places that are discussing having both sides being partially liable.
00:05:10.480 --> 00:05:14.000
Um, and and in other areas no one is liable.
00:05:14.240 --> 00:05:16.000
It's like depends on the country there.
00:05:16.160 --> 00:05:18.319
That's a that's a country-based answer too, as well, right?
00:05:18.480 --> 00:05:19.120
Yeah, yeah.
00:05:19.199 --> 00:05:24.480
So I mean, um it's still open uh discussion right now.
00:05:24.560 --> 00:05:31.519
Uh I I don't think there's a a perfect model, but in the end, like there's there are multiple parties in involved in this.
00:05:31.600 --> 00:05:44.879
Like in some places there's even discussion about like, for example, having the social media companies being liable and for for some of this, because it's like, oh, the conversation originated on social media and it led to this kind of scam, etc.
00:05:45.519 --> 00:05:48.560
Which I I think it's probably a bit too far, in my opinion.
00:05:49.199 --> 00:06:03.759
Um, but it it has to be like more in between like the the financial institutions and probably having the financial institution like sharing more intelligence so that they can like identify and blot these these scam networks.
00:06:04.079 --> 00:06:04.480
Absolutely.
00:06:04.639 --> 00:06:12.000
And I believe it's in the UK where actually banks are actually responsible for paying back they have to reimburse the reimbursement.
00:06:12.160 --> 00:06:18.720
So maybe for you then, when when you look at that, do you think that paying back victims sounds right?
00:06:18.879 --> 00:06:23.519
Or uh does it just guarantee that reimbursement risk makes people much more less careful?
00:06:24.160 --> 00:06:27.199
I think I gotta separate um liability and responsibility.
00:06:27.439 --> 00:06:30.560
And I know they sound kind of similar, but I want to split the hair a little bit.
00:06:30.720 --> 00:06:34.079
Because in a sense, I think we're all, we're both sides of this quite responsible.
00:06:34.240 --> 00:06:39.600
Like we as a an institution, a banking institution, responsible to educate people on what this is, what the risk is.
00:06:39.759 --> 00:06:42.160
I mean, I'll give you a very basic cultural example.
00:06:42.399 --> 00:06:44.800
Go to my LinkedIn, go look at my picture.
00:06:44.959 --> 00:06:47.360
You'll see my picture, but behind my picture, you're gonna see a banner.
00:06:47.439 --> 00:06:48.800
And it looks like the bunk banner.
00:06:48.879 --> 00:06:52.319
Read the words, and it's gonna say, bunk will never call you.
00:06:52.480 --> 00:06:53.920
Well, so it's that basic.
00:06:54.079 --> 00:07:02.079
The first day you start in our company, you basically get this package that you, if you're gonna announce anything, if you're gonna represent yourself on LinkedIn, you have to put that up.
00:07:02.240 --> 00:07:03.360
So it's every employee.
00:07:03.439 --> 00:07:06.399
So you're just trying to make you as a company, you have a set of cultures.
00:07:06.560 --> 00:07:07.360
So we're responsible.
00:07:07.519 --> 00:07:08.800
That's a very simple one, right?
00:07:08.959 --> 00:07:13.040
But we're also responsible to basically say, look, if this looks weird, we should tell you.
00:07:13.199 --> 00:07:15.519
You might still say, No, I want to do this anyway, right?
00:07:15.600 --> 00:07:16.720
I still, yes, yes, yes.
00:07:16.800 --> 00:07:18.560
I might make you say yes 40 times.
00:07:18.720 --> 00:07:21.519
And so then I'm slicing responsibility and liability.
00:07:21.680 --> 00:07:29.519
So, but I do think we have a responsibility to educate, we have a responsibility to use technology to prevent and to and to sort of put up some blockers.
00:07:29.600 --> 00:07:31.600
And also the KYC thing is really important.
00:07:31.759 --> 00:07:35.439
I can tell you the I band doesn't match the name of the person that you're sending it to, right?
00:07:35.519 --> 00:07:37.199
Um, but you might still want to send it.
00:07:37.360 --> 00:07:38.639
So there is those two things.
00:07:38.720 --> 00:07:42.399
So, do I think that um, you know, I don't have a hard answer to that.
00:07:42.480 --> 00:07:49.040
And I and I don't think I want to publicly decide for the world what that answer is, but I do think we should look at that at least in more than one direction.
00:07:49.439 --> 00:07:49.839
Absolutely.
00:07:49.920 --> 00:07:51.279
No, I I absolutely agree.
00:07:51.439 --> 00:08:06.720
I think there's one thing, and that's maybe the form of personal anecdote where I think it might be a little bit overbearing, is when um, just as an example, I was trying to move some money to somebody else, but I was on the phone with the person, and then my entire accounts got shut down, right?
00:08:06.800 --> 00:08:14.319
Just for the fact that I moved some money, I did it was uh still a answer to all of the questions, but then still my whole account got shut down.
00:08:14.480 --> 00:08:20.160
And I think that might be a little bit too overbearing as well, because and I think a lot of consumers might might agree with that.
00:08:20.240 --> 00:08:24.079
Have you had any pushback on that or are you even utilizing those uh uh technologies?
00:08:24.480 --> 00:08:32.639
So I mean, anything that has an element of anti-fraud to it, especially the sort of agentic AI components where you can go and sort of try and find these things before they happen.
00:08:32.799 --> 00:08:35.039
Um, yes, we'll utilize those technologies.
00:08:35.120 --> 00:08:37.039
We we really use them deeply in that space.
00:08:37.279 --> 00:08:43.519
Have we had pushback from people where we held up a transaction because we thought that it had suspicion to it?
00:08:43.679 --> 00:08:44.639
Yeah, we have.
00:08:44.720 --> 00:08:45.759
Like it happened to me.
00:08:45.919 --> 00:08:47.919
I mean, I was booking a holiday house, right?
00:08:48.000 --> 00:08:57.120
And it was out of whatever my normal patterns were, and my and my payment got frozen by bunk, and I was like, but then you know, it wasn't something that had to be done within 24 hours.
00:08:57.279 --> 00:09:00.639
Once 24 hours was over, which is the safety shield I mentioned, it was fine.
00:09:00.799 --> 00:09:02.159
So I didn't mind it.
00:09:02.320 --> 00:09:06.320
Um, I'd rather have the protection than to have the problem.
00:09:06.480 --> 00:09:08.000
So for me, it was it was okay.
00:09:08.080 --> 00:09:17.120
But yeah, we see, I mean, all sides of this conversation, I promise you, uh, from a user perspective, we're seeing absolutely no, I think that's great to see.
00:09:17.360 --> 00:09:23.600
So maybe you can take us, uh Andre, maybe you can take us through a scam, right?
00:09:23.679 --> 00:09:27.759
Like, um let's say I'm a victim on that side, from start to finish.
00:09:27.919 --> 00:09:34.000
What makes a normal, careful person actually hand over money in a case like an APP scam?
00:09:34.480 --> 00:09:35.679
I'm sorry, I didn't.
00:09:36.080 --> 00:09:37.200
Sorry, let me rephrase that.
00:09:37.360 --> 00:09:43.440
So let's walk through a scenario of this particular scam taking place, right, from start to finish.
00:09:43.679 --> 00:09:51.039
What makes a normal, careful person always think that they're pretty well secure, they know their passwords, they know how to work with that?
00:09:51.120 --> 00:09:53.919
Uh what makes them actually hand over money at this case?
00:09:54.240 --> 00:10:10.799
Yeah, I'd say the key thing that fraudsters do in those cases is is to put the the victim in a like psychological situation in which they they become a lot more vulnerable.
00:10:11.039 --> 00:10:14.559
So for example, they would try to attack your weak spots.
00:10:14.720 --> 00:10:36.240
So for example, there there's the classic scam of like people find your picture in social media, try to identify like family members, create a phone number, reach out to you on on a uh a chat app like WhatsApp, for example, and say, like, hey mom, I need some money, got a new number, can you help me?
00:10:36.399 --> 00:10:36.720
Right.
00:10:37.039 --> 00:10:42.639
That puts that mom in the emotional state in which they're like, Oh, I need to protect my child.
00:10:42.720 --> 00:10:44.000
I I need to help him.
00:10:44.320 --> 00:10:48.320
And they don't think like, oh, is this the right person?
00:10:48.480 --> 00:10:48.799
Right?
00:10:48.960 --> 00:10:55.440
Like, they they maybe don't think, like, should I call my son to identify if if this is real?
00:10:55.600 --> 00:10:55.919
Right.
00:10:56.000 --> 00:11:07.120
No, the the emotional state in which the fraudster puts that person in forces them to do things um much more quickly and and being like a lot more reactive, for example.
00:11:07.360 --> 00:11:11.279
Another one is is the bank impersonation scam, right?
00:11:11.360 --> 00:11:14.159
Which the bank would call you, not the bank, right?
00:11:14.240 --> 00:11:21.600
But they would spoof the phone number to make it look like the bank's number, but maybe the area code is likely uh different.
00:11:21.759 --> 00:11:29.840
If you search on Google, for example, for that phone number, you're gonna see that, oh yes, that is the right number from from my bank.
00:11:30.080 --> 00:11:45.919
Um, and and then they start guiding you through all this um story about like your account is compromised, we're here to help you, and they have all this like verbiage to make it look like they're serious and and they really represent the bank.
00:11:46.159 --> 00:11:54.000
Um, so they're again putting you in that emotional state that in which you're concerned, and you're gonna do whatever they they ask you to do.
00:11:54.080 --> 00:12:03.279
So so basically they try to exploit those things and and those those weak spots and and users, and it's a it's a numbers game.
00:12:03.440 --> 00:12:03.679
Yeah.
00:12:03.840 --> 00:12:06.080
So it's it's not like 100% conversion.
00:12:06.240 --> 00:12:11.600
They're probably gonna call like 500 people during a day and and scan like 20.
00:12:11.919 --> 00:12:17.600
But if they're able to make a lot of money from each individual transaction, that's a pretty good business for them, right?
00:12:17.759 --> 00:12:24.720
So I'd say it's a mix of putting the end user in an emotional state in which they're vulnerable, plus a numbers game.
00:12:25.759 --> 00:12:26.399
Can I add to that?
00:12:26.480 --> 00:12:32.240
Please, I so um Andre's doing a great job covering the space.
00:12:32.320 --> 00:12:40.960
I think the thing to remember here is that we're in an arms race, a technical arms, a technology arms race when it comes to the the how this is being done.
00:12:41.200 --> 00:12:45.200
Let's take his example of you know your son, you think it may be your son calling you.
00:12:45.279 --> 00:13:10.480
What's what they've also done is they've taken these low-cost, no-cost AI tools, they've gone online, they've gone through the Instagram accounts, they've found out who your son is, they've recorded their voice off of videos that they posted for 20, 30, 40 times, they then recreated that voice and put it through the phone, and then they've called you from this number or they've contacted you through Instagram on an account that sort of looks less very similar to what your son's looks like, and maybe even took their photos and should put them up there.
00:13:10.639 --> 00:13:13.120
And now you're doing your best to check these things out.
00:13:13.200 --> 00:13:21.679
But like again, the emotional state, the panic, the energy, the the the you know, the fear that gets put in place is where they you're getting a hole.
00:13:21.759 --> 00:13:26.399
So you have to be able to somehow in that moment be like, well, hold on, wait, wait, wait.
00:13:26.559 --> 00:13:37.200
To sort of know, first off, they have to realize that that possibility of it being that close and being that sophisticated exists at an incredibly low barrier to entry right now.
00:13:37.279 --> 00:13:41.440
I mean, companies like his exist because this this barrier entry, they have to fight this all the time.
00:13:41.600 --> 00:13:42.399
We have to fight this.
00:13:42.480 --> 00:13:44.480
So that's why I tend to call this an arms race.
00:13:44.559 --> 00:13:44.720
Yep.
00:13:45.759 --> 00:13:51.120
Yeah, like if you just look back a couple of years ago, just spotting a an email, right?
00:13:51.200 --> 00:13:53.840
Like had a bunch of you know, see who it's from.
00:13:54.320 --> 00:13:58.399
See who it's from, it's coming from a Gmail account, it had misspellings in it.
00:13:58.559 --> 00:14:12.399
And indeed, now you're you're you're absolutely right, is that the level of sophistication of trying to imitate or trying to be that person, and then adding on the psychological aspect of it as well, right?
00:14:12.559 --> 00:14:19.600
Putting you in a state of fear or having to react at that moment, those two combined can be a dangerous combination.
00:14:19.840 --> 00:14:27.120
So um, is it even fair to to look at it and say, hey, we're just common sense or my gut is going to protect me?
00:14:27.200 --> 00:14:29.039
You need solutions basically out of that.
00:14:29.279 --> 00:14:31.120
I mean, it works because it works, right?
00:14:31.200 --> 00:14:32.399
Yeah, they know that.
00:14:32.720 --> 00:14:41.440
So I'll give you one example on on that, um, on how like smart these these fraudsters are when they're trying to impersonate any company.
00:14:41.600 --> 00:14:54.960
Um, it was one scam in which uh the fraudsters were impersonating Microsoft's support, and they bought this domain, which was not really Microsoft, it was RN Icrosoft.
00:14:55.120 --> 00:15:00.639
And if you type it, it and and you don't look carefully, it looks like Microsoft.
00:15:00.960 --> 00:15:01.519
That's it.
00:15:01.600 --> 00:15:02.720
Oh, yes, say we're at the end.
00:15:02.960 --> 00:15:03.279
Yeah, yeah.
00:15:03.759 --> 00:15:08.080
So when when you when you were reading that email, it's like, oh yeah, Microsoft sent me an email.
00:15:08.159 --> 00:15:08.720
I'm gonna click.
00:15:08.879 --> 00:15:09.360
That's legit.
00:15:10.480 --> 00:15:15.440
So so they they really think through everything uh to make it look legit.
00:15:15.759 --> 00:15:16.480
Absolutely.
00:15:16.799 --> 00:15:21.360
So banks, of course, run awareness programs all the time, right?
00:15:21.440 --> 00:15:26.720
Like in the Netherlands, you had the three times knocking, and then you you had to go through different checks, of course.
00:15:26.799 --> 00:15:33.519
And in the UK, you have different ones, in the UK, US they run different programs as well, and they help, but they do have a limit.
00:15:33.679 --> 00:15:41.759
So, where does education stop working once somebody is, you know, like you mentioned, emotionally manipulated in into that particular moment?
00:15:42.159 --> 00:15:43.279
I think there's a couple of things.
00:15:43.440 --> 00:15:51.120
First, I think you have to know, I think as a bank technology company with a banking lesson, um, you need to be clear.
00:15:51.279 --> 00:15:53.039
First off, we focus on a particular audience.
00:15:53.120 --> 00:15:54.639
That audience is quite tech savvy.
00:15:54.720 --> 00:15:57.519
Um, that doesn't give them any greater defenses, by the way.
00:15:57.600 --> 00:16:01.679
Um, but we also have to position in message what it is that we stand for, what we do and we don't do.
00:16:01.759 --> 00:16:06.080
So this thing that I mentioned about LinkedIn, like this whole, like that is constant message that comes out of us, right?
00:16:06.159 --> 00:16:08.399
We will never call you under any circumstances we ever call you.
00:16:08.559 --> 00:16:10.960
So you can establish that relationship as truth.
00:16:11.120 --> 00:16:12.879
You can sort of start to rely on it.
00:16:13.039 --> 00:16:14.159
I would say just beginning.
00:16:14.240 --> 00:16:15.519
So there's a little bit of like basic.
00:16:15.600 --> 00:16:16.960
Let's start with basic things.
00:16:17.120 --> 00:16:18.559
Um, where do we go from there?
00:16:18.799 --> 00:16:21.039
Well, then you have to start to employ technology, right?
00:16:21.120 --> 00:16:28.320
You you have to assume that people will make mistakes, and and you have to assume that they will do these things that Andre describes that will happen.
00:16:28.480 --> 00:16:29.519
So then what can you do?
00:16:29.600 --> 00:16:31.039
I mentioned things like Safety Shield.
00:16:31.200 --> 00:16:31.919
There's other methods.
00:16:32.080 --> 00:16:35.200
Can you there's this is where the arms race is on the positive side.
00:16:35.279 --> 00:16:41.840
Like the good guys are going after this with technology to sort of prevent it as and see it as soon as possible and early as possible.
00:16:42.000 --> 00:16:44.960
Maybe we can give you a chance to take it back when you realize you've made a mistake.
00:16:45.120 --> 00:16:46.720
Maybe we can work with you on those things.
00:16:46.799 --> 00:16:48.799
Maybe we can go find them and get this solved.
00:16:48.879 --> 00:16:50.639
Like there's ways that we can partner together.
00:16:50.879 --> 00:17:07.440
As an industry, I actually would argue that if we were to connect a bit better and sort of think of this as a not just my problem or your problem or their problem, but everybody's problem that's sort of harming the industry, we probably could even get a greater uh ability, a greater defense going.
00:17:07.599 --> 00:17:09.920
I don't know exactly what that looks like, so I'm not going to articulate.
00:17:10.079 --> 00:17:11.839
Andre might have a better clear picture of that.
00:17:12.000 --> 00:17:21.200
But I do think that there's a way that we could anonymously share more that would create a larger conjoined defense that we don't necessarily do without an exent.
00:17:21.440 --> 00:17:21.599
Yep.
00:17:21.759 --> 00:17:22.480
Yeah, it does.
00:17:22.720 --> 00:17:23.119
It does.
00:17:23.200 --> 00:17:43.519
And one one of the things we're doing in some markets where we have like a very strong penetration is we are enabling financial institutions to exchange data through our platform so that they're able to identify, especially meal accounts, which is like usually what's used to receive the funds from these scams, right?
00:17:43.680 --> 00:17:52.160
So whenever there is a transaction and we we have visibility into the receiving ends and we're able to say, like, this is a meal account, we've seen it before.
00:17:52.319 --> 00:17:55.359
Um, they're they're gonna stop the transaction right there.
00:17:55.599 --> 00:18:02.799
Um, and we're able to do this without ever sharing any PII between organisation institutions because basically anonymous, but it's a fact.
00:18:02.960 --> 00:18:03.200
Exactly.
00:18:03.279 --> 00:18:03.440
Yeah.
00:18:03.599 --> 00:18:19.519
So so the the reason why like not sharing PI is important is because prior to this, the banks were like, no, I'm not gonna share like my customers' like personal information because then this other bank can use that data and advertise to these people and steal my customer, right?
00:18:19.839 --> 00:18:34.240
But if we're just saying, like, okay, this is a meal account and that's it, and they have the visibility into um who they're sending to, but that's it just for that specific account, then they feel a lot more comfortable sharing the kind of information.
00:18:34.400 --> 00:18:42.720
So embedding this into a like privacy preserving way is is probably the best way to enable this kind of data sharing.
00:18:42.960 --> 00:18:43.759
Yeah, absolutely.
00:18:43.920 --> 00:18:55.519
So, and look, especially in the fraud space, if you go look at it, you go you go search for solutions as a financial institution or as a bank, there's already plenty of tools, right?
00:18:55.599 --> 00:19:00.799
Like there's a number of different tools that are actually trying to fix fraud overall.
00:19:00.960 --> 00:19:05.920
Um, why is looking at the signals around APP fraud so interesting?
00:19:06.079 --> 00:19:10.799
Um, and on and why is there a different approach that can actually help solve this?
00:19:11.119 --> 00:19:19.119
Yeah, well, the the tricky part about APP fraud is that if you look at the traditional signals, everything is gonna look fine, right?
00:19:19.519 --> 00:19:25.200
You're authenticated to your account, you use your credentials, it's the device that you typically use.
00:19:25.359 --> 00:19:32.000
You're probably at a trusted location, uh, you're probably connected to your home Wi-Fi, something like that, right?
00:19:32.240 --> 00:19:35.920
So at a high level, everything looks fine.
00:19:36.559 --> 00:19:45.039
What's unusual, and and these are the auto signals that we try to focus on are things like is this user actively on a call?
00:19:45.359 --> 00:19:50.559
Is there any kind of like remote access tool being used at that moment?
00:19:51.359 --> 00:19:52.960
Is this a new pay?
00:19:54.559 --> 00:20:03.119
Is the like transaction like is is it too big compared to the normal transactions that this user typically does?
00:20:03.440 --> 00:20:06.720
When you see all these factors, that's a red flag.
00:20:07.119 --> 00:20:19.279
But then if you're able to analyze the receiving end of the transaction and verify like this is a Mule account, then you're like 100% sure this is ABP fraud.
00:20:19.440 --> 00:20:22.880
So so this last mile here, I'd say is the most important.
00:20:22.960 --> 00:20:28.480
The otters are like important signals, but the last one is is really when you when you nail it.
00:20:28.640 --> 00:20:29.119
Absolutely.
00:20:29.359 --> 00:20:34.640
In in his description, one of the elements that we're we're spending more time on is that moment of the call.
00:20:34.960 --> 00:20:45.359
So we are encouraging any user who is on a call and actively on a call and unsure to get on get get with our get in the app customer support right now.
00:20:45.599 --> 00:20:53.039
Get a user support, contact us instantly, and we will walk you through how to check and test and walk this thing and even whether you should or shouldn't do this, we will move it.
00:20:53.119 --> 00:20:59.279
So we're looking at that moment because the more that we can stop before it happens, of course, um, the better it will be.
00:20:59.359 --> 00:21:11.119
The backward signals of what happened um are are useful and you will use them, and the technology will help inform other things, but they're not as good as the moment of a bad thing happening where you can prevent it from happening.
00:21:11.519 --> 00:21:12.079
Absolutely.
00:21:12.319 --> 00:21:15.039
And you mentioned mule accounts several times, right?
00:21:15.119 --> 00:21:26.559
I think maybe for those who are not as familiar with what a mule account is, um what is a mule account and why does it why does catching it depend on uh banks working together?
00:21:26.880 --> 00:21:40.160
Yeah, so it's a very challenging um issue because the Mule account is is basically the one that's used by the fraudster, and the fraudster is not gonna use their own information, right?
00:21:40.400 --> 00:21:52.880
So they're basically like convincing other people to give them access to their accounts, and usually they're paying these people or they're coercing these people to give their their accounts.
00:21:53.200 --> 00:22:03.920
And the tricky part about it is that during the onboarding stage, during the KYC, everything will fine because it's the actual person creating that account.
00:22:04.240 --> 00:22:06.720
But then they transfer that account to the fraudster.
00:22:06.960 --> 00:22:12.720
They even like give their credentials or even like give the device that has access to that account.
00:22:13.039 --> 00:22:17.359
And then that fraudster starts using that account going forward.
00:22:18.319 --> 00:22:29.279
So the tricky part is identifying that handover process because most of the verification happens at the account opening stage, not continuously.
00:22:29.839 --> 00:22:39.759
So the way in which many financial institutions are evolving now is that they're starting to continuously verify this account over time versus just at the front door.
00:22:40.640 --> 00:22:45.279
So this is this is how you would identify this kind of behavior.
00:22:46.160 --> 00:22:56.559
And particularly identifying the behavior of the device that uses that account versus the behavior of the device that opened that account in the first place.
00:22:56.720 --> 00:23:01.119
If those behaviors don't match, the likelihood that this is a new account is extremely high.
00:23:01.279 --> 00:23:14.799
And then there's a second layer to it which is if you're able to identify that the second device is associated to other accounts or other devices then you identify what we call the device farm.
00:23:15.279 --> 00:23:18.720
And this is where there's a high concentration of accounts.
00:23:18.880 --> 00:23:32.640
So to give an example we had a financial institution that was testing this this capability and we were able to find in a single apartment 200 devices that were connected to 4500 accounts.
00:23:32.880 --> 00:23:37.680
So wait 200 devices that were connected to 4500 accounts.
00:23:37.839 --> 00:23:43.759
Exactly wow all in one place and you were able to detect that in a single apartment.
00:23:44.559 --> 00:23:47.839
Very easy so not apartment building but apartment apartment.
00:23:48.160 --> 00:23:56.319
Exactly what he's saying like you know someone could track the electric power usage of that apartment you would notice they get the heat signal coming out of that right?
00:23:56.480 --> 00:24:03.839
Yeah absolutely well and then bunk of course being a digital only bank you don't have any locations in it.
00:24:04.240 --> 00:24:12.000
So the device is actually the customer's device device and the the contact bars and the it could also be a business device both of those are possible.
00:24:12.079 --> 00:24:18.799
Yeah yeah so the you could have a user that has multiple has a personal account in a business on one device or you could have multiple devices.
00:24:19.119 --> 00:24:30.160
You could this as one so how are you using the information that you're gathering of course when it comes to uh preventing yourselves from those mule accounts or those mule account takeovers.
00:24:30.400 --> 00:24:48.720
Yeah I think one of the uh we put out an annual report just in the last few days so there's some good data in there if you want to check it uh for the facts behind the conversation and one of the big areas of focus was the preventing the incoming fraud right so that's coming in and we've been able to reduce that by something I had to look at number I think it's the 80% in a lot.
00:24:48.799 --> 00:24:59.440
So we're reducing that coming in part of that is that you are running a constant again agenti component or an AI component on the behavioral patterns the the if you will the stats.
00:24:59.680 --> 00:25:07.599
I mean I can use it in whatever term you find most comfortable but I mean like you're running the numbers at a 24-7 to look at the patterns and the behaviors and what's happening.
00:25:07.680 --> 00:25:13.279
And so you can look at the devices and I think you did an eloquent way of describing it like is a device changing its pattern?
00:25:13.440 --> 00:25:15.279
Is a group of devices changing their patterns?
00:25:15.440 --> 00:25:21.440
Is what's happening with this account with that and re-verification I think is also a one of the ways that you you will be able to do that.
00:25:21.519 --> 00:25:35.680
So we're employing very similar um technologies and techniques to go after this but we feel like I said there's a responsibility to also on the front end make that education make that moment of something going bad as best as we can stop it when we can.
00:25:35.839 --> 00:25:39.359
But it's it's all it this is all data this is all information.
00:25:39.440 --> 00:25:54.880
This is like massive spreadsheets in the sky just to be simple that we are all running through constantly and trying to pick the pattern so that we can go find the uh the the the evil the darkness out there before it can occur that's that's exactly as as Andre described it.
00:25:55.119 --> 00:26:15.839
Absolutely but I think even for brink especially you've been one of the banks that has actually been proactive in not just utilizing data but utilizing AI in sure on boring processes and other things as well so how are you currently utilizing order point I doubt it's going to be spreadsheet but it's probably please no everyone that was a metaphor.
00:26:16.240 --> 00:26:20.559
Okay perfect yeah so how are you using AI now to help the great tables out there right?
00:26:21.279 --> 00:27:02.559
So how is like so yes so fraud prevention um so there's an AI component to our fraud prevention of course of course of course because we're battling the AI components that sit on the outside um there is a AI component to KYC there's an AI component to I mean really we're a generative AI company so there's an AI component to everything that we do but I would sort of reel it all back to like getting started with who the user is who are they where do they come from not just what we talk about in this conversation that's KYC that's an internal bank conversation but I mean who are they what do they want where are they heading what are they trying to do we're an entire bank built around a user and our entire obsession and focus of all time is to what does the user meet and what do they want?
00:27:02.640 --> 00:27:03.359
So we build everything.
00:27:03.440 --> 00:27:10.000
We make every decision every feature every expansion everything we do is based on what the users are asking of us or what they want.
00:27:10.079 --> 00:27:21.759
So we have to gut check that and then AI plays a role there we also have AI as 97% of all of our customer support inquiries are answered through AI with a 90% plus satisfaction rate.
00:27:22.000 --> 00:27:27.680
Tapman gives us magnificent amounts of data that we can then turn back into these other conversations, right?
00:27:27.920 --> 00:27:36.079
So one of the advantages of having a sophisticated AI customer support ability is that that is then data.
00:27:36.160 --> 00:27:52.160
It's not just a recorded conversation it is an AI analyzed and capability that you can then recycle into proactive information to go fight fraud with so that is there's an upside to that and I'll be honest anybody who's running an institution like ours, this isn't something you do overnight.
00:27:52.240 --> 00:28:02.160
People don't just flip this on like we've been we've been doing generative AI as a company for more than a decade and we've had we got there's a lot of mistakes that happened in that to get this to where it's at these satisfaction rates.
00:28:02.319 --> 00:28:09.519
So it is you guys are in this industry you it this is something it takes time to do right and it can be done wrong and you can feel still feel good about it.
00:28:09.839 --> 00:28:14.240
But you have to be able to capture this information and reuse it for prevention.
00:28:14.480 --> 00:28:18.480
And that's how we want everyone to feel safe and secure and that is our responsibility.
00:28:18.720 --> 00:28:32.240
Absolutely and in in cogne of course like you're you're you're providing a solution of course to help with a lot of that how are you utilizing AI uh how has it helped you to evolve the company as well yeah well pretty much everywhere.
00:28:32.480 --> 00:29:35.119
So from the like device IDs that we generate using transformer based architecture to how we predict what users are um expected to do and then we compare this to the real-time data to see like okay if there's a good match the likelihood that this is the right person is higher um to AI assistance in which like the the users of our platform the the the customers they're able to for example run like very big and sophisticated queries on like what's going on the anomalies in the data identify like new fraud patterns etc um all the way to for example readjusting how each individual data feature is is weighted in in our models by um basically talking to our system um so so yeah it's pretty much all over the place um helping both the customers but also the underlying technology that helps us identify the users correctly is is is all powered by AI.
00:29:35.440 --> 00:30:00.880
Absolutely so it's more than just the well everybody uses AI very broadly of course but I've heard you talk about generative AIs of course in the chat bot being able to take language and actually have responses but then connecting that into your internal sources and helping uh customers to solve problems uh directly to all the way to applying machine learning in in different ways and and going beyond that as well.
00:30:02.079 --> 00:30:10.400
Like maybe maybe to sidetrack that a little bit as far as I'd love to add to that if we do think it's important when people are listening to separate generative and agentic.
00:30:10.559 --> 00:30:18.400
Yeah in terms of let's just in all simple terms if this is the first time you ever heard of it generative is like you know you give it a prompt you give it some information and it does something.
00:30:18.559 --> 00:30:20.160
Agentic is you've given it agency.
00:30:20.240 --> 00:30:28.079
So it has a set of uh let's say pre-decided uh behaviors or capabilities and it's making a decision has agency it's going and doing something on its own.
00:30:28.319 --> 00:30:33.119
I find as a bank I find we find agency agency capable AI is very good.
00:30:33.200 --> 00:30:41.359
I mean AML fraud prevention you can really use these technologies there because your risk level of getting something wrong is you're actually out there in data trying to get something right.
00:30:41.599 --> 00:31:05.359
When it comes to say um uh user support or access to a user account it's a very different story right you this isn't something right now we're ready to just turn agents loose on so that's not we don't think that's the right time for that but it can inform that inform that data is collected and can inform what you can educate talk about and and engage from a generative AI user support scenario.
00:31:05.519 --> 00:31:12.720
I know that's a little bit of what we would say in US inside baseball but um it is very much like to good to separate those two things.
00:31:12.880 --> 00:31:26.960
And then for anyone who talks about AI in our space, we should very much separate and I think Andre will be with me on this the lab and the factory because there is a lab where we're out token maxing we're talking about how much we can do and like how far AI can go.
00:31:27.039 --> 00:31:42.319
And then there's I think you and me and we're running businesses on AI right so the day-to-day usage of this is running of the business which is very much we're in the factory and we're delivering on a day-to-day basis which isn't the the perfect uh PR scenario but it's the hard and difficult work of keeping people safe.
00:31:42.480 --> 00:31:54.000
Yep I agree absolutely so maybe there's even that extension of that right and maybe a topic that um nowadays at payments conferences, banking conferences here all the time, which is agente commerce.
00:31:54.240 --> 00:31:56.960
So what are your views on agentic commerce?
00:31:57.119 --> 00:32:09.680
Because then all of a sudden we don't just have a user anymore we don't have a person or a business or a business person, but we have an agent on itself shopping with either a card or the access to the bank account.
00:32:10.000 --> 00:32:16.960
Well let's assume in a best case scenario that it's in an agent with rules but I think let's start with agentic commerce.
00:32:17.039 --> 00:32:52.400
So actually I think of agentic commerce less than the way you do which is sort of maybe an agent out shopping I think of it as more as um agent-to-agent commerce right so this is this is commerce that's passing between different agents one's like uh on one side one's on another and so this agentic commerce is actually happening you know without humans being involved because both of the agents have been given agency and they've been given rules that they play by um and I think in a best world scenario where the rules are set in those things this thing I'm a lumber company and I sell seven types of lumber and there's rules about what I sell and what the SKUs are and then I'm a buyer and I have an inventory I have to keep and I have a budget.
00:32:52.559 --> 00:33:01.119
Well that seems pretty simple maybe we could agent that the agent agent who says here's my credit card I want something new that sounds like a bad idea to me.
00:33:01.359 --> 00:33:04.000
So I think there's uh there's rules that still have to be put in place.
00:33:04.160 --> 00:33:52.640
I think it's very brand new but I do think it's an industry that's headed our way and at one time or another we will all have the same conversations we're having today about human fraud that we will once at some point we will engage in well we have a genetic fraud already but an agent to agent fraud let's say we will have to find you know we'll have to be smarter and better when the time comes but I just don't know exactly when that is now maybe for you Andre like of course you have know your agents and all these different protocols that are being launched as well how do you see that changing or maybe expanding your business when it comes to preventing that type of fraud as well yeah I'd say the there are two challenges here right one is the know your agents which I believe this one is more straightforward like each agent can have like a cryptographic signature and you're able to authenticate it that's all fine.
00:33:52.960 --> 00:35:33.039
The tricky part is is establishing the um connection between like the agent and the user and doing that in a continuous way because what if that session is hijacked right what if I take over your account and your account has an agent that has for example your payment credentials and your login credentials to your bank account for example that could be a huge problem right um so this part I'd say is is the most challenging and this is where we are acting more um right now which is finding ways to basically create like a a way to bind the end user to the agent continuously the way we're doing it is by focusing on pretty much the same things that we do with with otter uh customers which is focusing on the device and its location and if anything changes here we need to make sure that at least one of these two uh remains consistent so for example if it's the device that you always use and you always use to connect to that agent that's all good if it's a new device the location behavior of that new device should match the old device otherwise there's a risk that this is something else someone else uh impersonating you for example so we focus on like look into these two things specifically and and I'd say like at a at a higher level it's thinking about like what is vulnerable today and pretty much every signal to like represent a user in the digital world that um can be fake by AI is no longer reliable.
00:35:33.199 --> 00:35:44.400
So for example if you think about like remote biometric authentication defakes are destroying that document verification probably in five years that's not going to happen anymore.
00:35:45.599 --> 00:35:55.440
OTPs very easy to fish passwords same thing right so all of these like digital signals are are becoming less and less reliable over time.
00:35:55.760 --> 00:36:10.880
So we're taking approach that which is much more like about grounding the user's digital identity into physical reality because that's probably the only thing that AI won't be able to fake so so that's what we're we're betting on.
00:36:11.119 --> 00:36:19.920
Absolutely there's an opportunity there's a technology opportunity here right there's no what it's this isn't so much a technical problem we can build if we know what to go after.
00:36:20.079 --> 00:36:24.159
It is a trust verification type of issue.
00:36:24.400 --> 00:36:43.119
So there's a which leaves there's a technical gap for greater technologies uh to address the things that Andre just described what is the next level of if we're if he's going back to the old world what's your address and are you at your address uh what is the what is the technology opportunity there is something we don't I don't know what it is but I know there's something.
00:36:43.360 --> 00:36:51.679
Yeah absolutely so I like to look into the future always and I'm a very upbeat and positive person when it comes to that.
00:36:51.840 --> 00:37:21.280
However I think what we're seeing around us nowadays is very challenging right there's AI of course there's regulations also not just in in Europe but also across the world um and other things are coming in that what is something in maybe your perspective that you believe needs to change for at least let's just keep it to APP fraud or fraud overall as a bank that allows us to grow further, to do more transactions, to grow as businesses as well.
00:37:21.440 --> 00:37:22.239
What needs to change?
00:37:22.400 --> 00:37:23.440
Is that regulations?
00:37:23.599 --> 00:37:27.280
Is that the adoption to AI, adopted to stable coins?
00:37:27.440 --> 00:37:28.320
What might that be?
00:37:29.039 --> 00:37:39.039
There's a lot of ways we can go with this and it sounds like I'm gonna end on the same place I started which is um I think the opportunity on the human end is our challenge.
00:37:39.199 --> 00:37:48.800
I think uh responsibility uh not necessarily liability but responsibility to develop the technologies and the capabilities to better secure the human end of a transaction.
00:37:49.039 --> 00:37:50.079
What does that mean?
00:37:50.400 --> 00:37:52.239
I I mentioned Safety Shield a few times.
00:37:52.320 --> 00:38:03.519
Andres mentioned some different ways that they do it but I think the we're exploring the both in a different way how we go and affect this, if I may say weak end of the problem in a sense.
00:38:03.599 --> 00:38:15.360
So I think what needs to change is I think A, it would be great if the whole world at the same time raised its acumen around how dangerous this is, but that probably won't happen and we'll still make mistakes.
00:38:15.519 --> 00:38:29.599
So we have to be responsible to continue on a company by company basis to really educate and create technologies that can prevent people from making mistakes without of course handcuffing them like let's say what happened to you on a completely legit transaction.
00:38:29.679 --> 00:38:31.039
So how do you balance between the two?
00:38:31.199 --> 00:38:46.159
I'm sure that we're gonna still make some mistakes along the way but I think that's the thing that needs to change is we need to help people understand the breadth and the depth of this and provide technologies that are seamless so that they're not you know stuck with nothing nowhere to go and nothing to do about it.
00:38:46.639 --> 00:38:47.280
Thank you very much.
00:38:47.440 --> 00:38:48.719
Now over to Andre.
00:38:49.119 --> 00:39:07.280
Yeah I'd say my my goal is to enable the financial institutions to get to a point in which they don't need to worry about educating their users about security anymore because the tech is so good that they don't need to worry about that.
00:39:07.440 --> 00:40:03.119
So for example think about um account takeovers driven by social engineering right um a lot of that was because OTPs was one of the main um forms of multifactor authentication and an OTP can be easily fished right like if someone is calling you trying to impersonate the bank and they're saying like oh I'm from the bank we're going to receive a six digit code on your phone um please tell me that six digit code okay I got your account right but if we're able to replace that with better technology that the fraudster is not able to say like oh there's there's there's a code that you're gonna receive you you shut down that door right um so basically like continuing to upgrade the technology to a point in which even the last like tech savvy user is still protected because like the tech is working for them.
00:40:04.719 --> 00:40:32.960
In the meantime obviously we need to invest a lot in in educating uh the users but um I I believe you're gonna agree with me sometimes it's frustrating right you you try a lot how could it be possible and you're like oh my god you can't I can't believe someone did that you guys have those factors it does but you know I don't think it's it's it's a you can't blame the victim here like it's still someone is preying upon and we have to be smart enough to like understand who the who the bad guy and the good guys are here.
00:40:33.039 --> 00:40:33.280
Yeah.
00:40:33.519 --> 00:40:42.880
So so my goal is to like help the FIs get rid of this problem and not have to to worry about uh running campaigns to educate their users anymore.
00:40:43.199 --> 00:40:43.679
Perfect.
00:40:43.920 --> 00:40:48.400
Well I want to thank the both of you for joining us here at Executive Conversations by the papers.
00:40:48.719 --> 00:40:49.119
Thank you very much.
00:40:49.920 --> 00:40:50.079
Thank you.
00:40:50.239 --> 00:40:51.360
Thanks a pleasure to be here.
00:40:51.920 --> 00:40:56.000
If you like this episode hit like follow and subscribe for more
00:00:00.320 --> 00:00:02.799
Welcome to Executive Conversations by the Papers.
00:00:03.040 --> 00:00:04.160
I'm Dwayne Jeffrey.
00:00:04.559 --> 00:00:11.759
In this episode, I'm joined by Andre Farraz, CEO of Incne and Joe Wilson, board member at Bunk.
00:00:13.599 --> 00:00:17.920
And we're going to be talking a little bit about fraud, especially APP fraud.
00:00:18.079 --> 00:00:20.239
So Andre, I want to talk start with you.
00:00:20.320 --> 00:00:29.600
Um, maybe in plain terms, for those who don't know, what is APP fraud and why is it different from fraud that most bank professionals already know um how to stop?
00:00:30.079 --> 00:00:30.320
Alright.
00:00:30.480 --> 00:00:34.560
Well, so APP fraud stands for authorized push payment fraud.
00:00:34.960 --> 00:00:48.159
So basically it's the kind of fraud in which the end user is convinced to move money um thinking that they're um trying to protect their funds or something like that.
00:00:48.320 --> 00:01:05.760
So it's usually related to social engineering scams in which uh a scammer would call them and say, for example, like, oh I work for the bank, there's something wrong with your account and I need you to send money to this secure account here uh so that uh you you don't lose your money.
00:01:05.920 --> 00:01:09.760
And then that secure account was actually the account of the fraud street, right?
00:01:09.920 --> 00:01:28.159
So the end user logged into their bank account from their device, probably went through some form of biometrics or MFA, right, authenticated to their account, did the transaction, and then they realized, oh, I sent the money to to the wrong person that was in the bank.
00:01:28.480 --> 00:01:29.840
It was it was a scammer.
00:01:30.079 --> 00:01:31.040
Yeah, absolutely.
00:01:31.120 --> 00:01:37.840
So, Joe, of course, working at a bank, right, um, you see a lot of those different types of interactions.
00:01:37.920 --> 00:01:41.680
You see what's happening when it comes to fraud, and this is of course a fraud that's been on the rise.
00:01:41.840 --> 00:01:50.319
But when that customer authorizes the payment, as uh Andre already mentioned, like the normal fraud book playbook would probably does not fire, right?
00:01:50.480 --> 00:01:56.799
How did this change the way that a bank like Bunk is actually approaching this um and trying to solve it?
00:01:57.040 --> 00:02:00.560
Yeah, by the way, thanks for the initial Dutch pronunciation of the word bunk.
00:02:01.040 --> 00:02:09.360
Uh look, I think maybe your question is like, how we evolved or what do we do now because these things are on the rise and progressing?
00:02:09.520 --> 00:02:13.759
What I would he refers to in a really good way, I think of as this dark art of convincing people, right?
00:02:13.840 --> 00:02:14.719
They do this.
00:02:14.960 --> 00:02:17.439
Um these are things you have to put in place, right?
00:02:17.520 --> 00:02:29.599
You have to take your time and energy and you have to focus it not just on the back-end systems and catching things after they happen, but you have to start to focus out forward, like when it could happen, where might it happen, how do you educate people?
00:02:29.840 --> 00:02:38.159
We have a feature that we recently implemented called Safety Shield, which basically we keep a like we run a constant scan against your patterns and your behaviors.
00:02:38.240 --> 00:02:47.840
And then when we send something that's out of the ordinary or above a threshold you might normally do, we might freeze that for 24 hours and give you a chance for a second thought on some of those and even announce it to you and let you know.
00:02:47.919 --> 00:02:48.879
So that's one example.
00:02:48.960 --> 00:02:53.199
I'm not saying it's the perfect all answer, but those are the types of things we have to start doing now.
00:02:53.280 --> 00:03:01.120
I think we have a responsibility in that trust relationship to try and put technology to work even out at the human error side where we can.
00:03:01.439 --> 00:03:02.159
Absolutely.
00:03:02.319 --> 00:03:09.039
So um I think maybe, Andre, for to help the audience maybe get a better size of this, right?
00:03:09.120 --> 00:03:12.080
Like how big is the APP fraud?
00:03:12.400 --> 00:03:13.520
You know, how big is it?
00:03:13.599 --> 00:03:15.280
How how fast has it grown?
00:03:15.520 --> 00:03:19.840
And what moved so that this can actually happen?
00:03:20.639 --> 00:03:29.599
Yeah, I'd say right now, I don't have exact figures, but I would estimate like in the hundreds of bidens per year across the entire financial services industry.
00:03:29.919 --> 00:03:37.280
Um, and one of the key challenges is that right now this is for many financial institutions the top fraud issue.
00:03:37.840 --> 00:03:42.319
And a lot of regulators, for example, are currently discussing like what to do, right?
00:03:42.879 --> 00:03:44.080
Who should should be liable?
00:03:44.240 --> 00:03:48.080
Is it the receiving end, the sending end of the transaction, for example?
00:03:48.319 --> 00:03:57.120
So there's a lot of discussion right now in multiple jurisdictions about who who's responsible for this and who should be liable.
00:03:57.280 --> 00:04:05.039
So yeah, major, major problem and one that the industry hasn't really found the really solid solution.
00:04:05.439 --> 00:04:05.759
Absolutely.
00:04:05.919 --> 00:04:07.680
And you just mentioned liability, right?
00:04:07.759 --> 00:04:13.199
I think um we we see the liability aspect, especially in this particular uh fraud.
00:04:13.439 --> 00:04:14.719
Who's actually responsible?
00:04:14.879 --> 00:04:19.759
Like, do you already have an answer to that, or is it still a debate between it's either the bank or the customer?
00:04:20.000 --> 00:04:21.199
Yeah, I want all of this.
00:04:22.000 --> 00:04:23.439
There's a debate, right?
00:04:23.600 --> 00:04:33.920
Um, there are some places, like I think the UK, for example, currently has um the receiving end of the transaction being liable.
00:04:34.000 --> 00:04:47.680
And basically that's because like on that side of the transaction, um, it's kind of the bank didn't really run proper KYC um to ensure that that account was is being used by the right person.
00:04:47.759 --> 00:04:52.639
So that account is probably a Mule account or a fake account that's receiving those funds.
00:04:53.199 --> 00:04:54.959
So they're being held liable.
00:04:55.120 --> 00:04:59.600
In other places, you have the the other side being liable.
00:04:59.759 --> 00:05:04.000
Um I don't know which approach is is vast, to be honest.
00:05:04.240 --> 00:05:10.240
Um there are other places that are discussing having both sides being partially liable.
00:05:10.480 --> 00:05:14.000
Um, and and in other areas no one is liable.
00:05:14.240 --> 00:05:16.000
It's like depends on the country there.
00:05:16.160 --> 00:05:18.319
That's a that's a country-based answer too, as well, right?
00:05:18.480 --> 00:05:19.120
Yeah, yeah.
00:05:19.199 --> 00:05:24.480
So I mean, um it's still open uh discussion right now.
00:05:24.560 --> 00:05:31.519
Uh I I don't think there's a a perfect model, but in the end, like there's there are multiple parties in involved in this.
00:05:31.600 --> 00:05:44.879
Like in some places there's even discussion about like, for example, having the social media companies being liable and for for some of this, because it's like, oh, the conversation originated on social media and it led to this kind of scam, etc.
00:05:45.519 --> 00:05:48.560
Which I I think it's probably a bit too far, in my opinion.
00:05:49.199 --> 00:06:03.759
Um, but it it has to be like more in between like the the financial institutions and probably having the financial institution like sharing more intelligence so that they can like identify and blot these these scam networks.
00:06:04.079 --> 00:06:04.480
Absolutely.
00:06:04.639 --> 00:06:12.000
And I believe it's in the UK where actually banks are actually responsible for paying back they have to reimburse the reimbursement.
00:06:12.160 --> 00:06:18.720
So maybe for you then, when when you look at that, do you think that paying back victims sounds right?
00:06:18.879 --> 00:06:23.519
Or uh does it just guarantee that reimbursement risk makes people much more less careful?
00:06:24.160 --> 00:06:27.199
I think I gotta separate um liability and responsibility.
00:06:27.439 --> 00:06:30.560
And I know they sound kind of similar, but I want to split the hair a little bit.
00:06:30.720 --> 00:06:34.079
Because in a sense, I think we're all, we're both sides of this quite responsible.
00:06:34.240 --> 00:06:39.600
Like we as a an institution, a banking institution, responsible to educate people on what this is, what the risk is.
00:06:39.759 --> 00:06:42.160
I mean, I'll give you a very basic cultural example.
00:06:42.399 --> 00:06:44.800
Go to my LinkedIn, go look at my picture.
00:06:44.959 --> 00:06:47.360
You'll see my picture, but behind my picture, you're gonna see a banner.
00:06:47.439 --> 00:06:48.800
And it looks like the bunk banner.
00:06:48.879 --> 00:06:52.319
Read the words, and it's gonna say, bunk will never call you.
00:06:52.480 --> 00:06:53.920
Well, so it's that basic.
00:06:54.079 --> 00:07:02.079
The first day you start in our company, you basically get this package that you, if you're gonna announce anything, if you're gonna represent yourself on LinkedIn, you have to put that up.
00:07:02.240 --> 00:07:03.360
So it's every employee.
00:07:03.439 --> 00:07:06.399
So you're just trying to make you as a company, you have a set of cultures.
00:07:06.560 --> 00:07:07.360
So we're responsible.
00:07:07.519 --> 00:07:08.800
That's a very simple one, right?
00:07:08.959 --> 00:07:13.040
But we're also responsible to basically say, look, if this looks weird, we should tell you.
00:07:13.199 --> 00:07:15.519
You might still say, No, I want to do this anyway, right?
00:07:15.600 --> 00:07:16.720
I still, yes, yes, yes.
00:07:16.800 --> 00:07:18.560
I might make you say yes 40 times.
00:07:18.720 --> 00:07:21.519
And so then I'm slicing responsibility and liability.
00:07:21.680 --> 00:07:29.519
So, but I do think we have a responsibility to educate, we have a responsibility to use technology to prevent and to and to sort of put up some blockers.
00:07:29.600 --> 00:07:31.600
And also the KYC thing is really important.
00:07:31.759 --> 00:07:35.439
I can tell you the I band doesn't match the name of the person that you're sending it to, right?
00:07:35.519 --> 00:07:37.199
Um, but you might still want to send it.
00:07:37.360 --> 00:07:38.639
So there is those two things.
00:07:38.720 --> 00:07:42.399
So, do I think that um, you know, I don't have a hard answer to that.
00:07:42.480 --> 00:07:49.040
And I and I don't think I want to publicly decide for the world what that answer is, but I do think we should look at that at least in more than one direction.
00:07:49.439 --> 00:07:49.839
Absolutely.
00:07:49.920 --> 00:07:51.279
No, I I absolutely agree.
00:07:51.439 --> 00:08:06.720
I think there's one thing, and that's maybe the form of personal anecdote where I think it might be a little bit overbearing, is when um, just as an example, I was trying to move some money to somebody else, but I was on the phone with the person, and then my entire accounts got shut down, right?
00:08:06.800 --> 00:08:14.319
Just for the fact that I moved some money, I did it was uh still a answer to all of the questions, but then still my whole account got shut down.
00:08:14.480 --> 00:08:20.160
And I think that might be a little bit too overbearing as well, because and I think a lot of consumers might might agree with that.
00:08:20.240 --> 00:08:24.079
Have you had any pushback on that or are you even utilizing those uh uh technologies?
00:08:24.480 --> 00:08:32.639
So I mean, anything that has an element of anti-fraud to it, especially the sort of agentic AI components where you can go and sort of try and find these things before they happen.
00:08:32.799 --> 00:08:35.039
Um, yes, we'll utilize those technologies.
00:08:35.120 --> 00:08:37.039
We we really use them deeply in that space.
00:08:37.279 --> 00:08:43.519
Have we had pushback from people where we held up a transaction because we thought that it had suspicion to it?
00:08:43.679 --> 00:08:44.639
Yeah, we have.
00:08:44.720 --> 00:08:45.759
Like it happened to me.
00:08:45.919 --> 00:08:47.919
I mean, I was booking a holiday house, right?
00:08:48.000 --> 00:08:57.120
And it was out of whatever my normal patterns were, and my and my payment got frozen by bunk, and I was like, but then you know, it wasn't something that had to be done within 24 hours.
00:08:57.279 --> 00:09:00.639
Once 24 hours was over, which is the safety shield I mentioned, it was fine.
00:09:00.799 --> 00:09:02.159
So I didn't mind it.
00:09:02.320 --> 00:09:06.320
Um, I'd rather have the protection than to have the problem.
00:09:06.480 --> 00:09:08.000
So for me, it was it was okay.
00:09:08.080 --> 00:09:17.120
But yeah, we see, I mean, all sides of this conversation, I promise you, uh, from a user perspective, we're seeing absolutely no, I think that's great to see.
00:09:17.360 --> 00:09:23.600
So maybe you can take us, uh Andre, maybe you can take us through a scam, right?
00:09:23.679 --> 00:09:27.759
Like, um let's say I'm a victim on that side, from start to finish.
00:09:27.919 --> 00:09:34.000
What makes a normal, careful person actually hand over money in a case like an APP scam?
00:09:34.480 --> 00:09:35.679
I'm sorry, I didn't.
00:09:36.080 --> 00:09:37.200
Sorry, let me rephrase that.
00:09:37.360 --> 00:09:43.440
So let's walk through a scenario of this particular scam taking place, right, from start to finish.
00:09:43.679 --> 00:09:51.039
What makes a normal, careful person always think that they're pretty well secure, they know their passwords, they know how to work with that?
00:09:51.120 --> 00:09:53.919
Uh what makes them actually hand over money at this case?
00:09:54.240 --> 00:10:10.799
Yeah, I'd say the key thing that fraudsters do in those cases is is to put the the victim in a like psychological situation in which they they become a lot more vulnerable.
00:10:11.039 --> 00:10:14.559
So for example, they would try to attack your weak spots.
00:10:14.720 --> 00:10:36.240
So for example, there there's the classic scam of like people find your picture in social media, try to identify like family members, create a phone number, reach out to you on on a uh a chat app like WhatsApp, for example, and say, like, hey mom, I need some money, got a new number, can you help me?
00:10:36.399 --> 00:10:36.720
Right.
00:10:37.039 --> 00:10:42.639
That puts that mom in the emotional state in which they're like, Oh, I need to protect my child.
00:10:42.720 --> 00:10:44.000
I I need to help him.
00:10:44.320 --> 00:10:48.320
And they don't think like, oh, is this the right person?
00:10:48.480 --> 00:10:48.799
Right?
00:10:48.960 --> 00:10:55.440
Like, they they maybe don't think, like, should I call my son to identify if if this is real?
00:10:55.600 --> 00:10:55.919
Right.
00:10:56.000 --> 00:11:07.120
No, the the emotional state in which the fraudster puts that person in forces them to do things um much more quickly and and being like a lot more reactive, for example.
00:11:07.360 --> 00:11:11.279
Another one is is the bank impersonation scam, right?
00:11:11.360 --> 00:11:14.159
Which the bank would call you, not the bank, right?
00:11:14.240 --> 00:11:21.600
But they would spoof the phone number to make it look like the bank's number, but maybe the area code is likely uh different.
00:11:21.759 --> 00:11:29.840
If you search on Google, for example, for that phone number, you're gonna see that, oh yes, that is the right number from from my bank.
00:11:30.080 --> 00:11:45.919
Um, and and then they start guiding you through all this um story about like your account is compromised, we're here to help you, and they have all this like verbiage to make it look like they're serious and and they really represent the bank.
00:11:46.159 --> 00:11:54.000
Um, so they're again putting you in that emotional state that in which you're concerned, and you're gonna do whatever they they ask you to do.
00:11:54.080 --> 00:12:03.279
So so basically they try to exploit those things and and those those weak spots and and users, and it's a it's a numbers game.
00:12:03.440 --> 00:12:03.679
Yeah.
00:12:03.840 --> 00:12:06.080
So it's it's not like 100% conversion.
00:12:06.240 --> 00:12:11.600
They're probably gonna call like 500 people during a day and and scan like 20.
00:12:11.919 --> 00:12:17.600
But if they're able to make a lot of money from each individual transaction, that's a pretty good business for them, right?
00:12:17.759 --> 00:12:24.720
So I'd say it's a mix of putting the end user in an emotional state in which they're vulnerable, plus a numbers game.
00:12:25.759 --> 00:12:26.399
Can I add to that?
00:12:26.480 --> 00:12:32.240
Please, I so um Andre's doing a great job covering the space.
00:12:32.320 --> 00:12:40.960
I think the thing to remember here is that we're in an arms race, a technical arms, a technology arms race when it comes to the the how this is being done.
00:12:41.200 --> 00:12:45.200
Let's take his example of you know your son, you think it may be your son calling you.
00:12:45.279 --> 00:13:10.480
What's what they've also done is they've taken these low-cost, no-cost AI tools, they've gone online, they've gone through the Instagram accounts, they've found out who your son is, they've recorded their voice off of videos that they posted for 20, 30, 40 times, they then recreated that voice and put it through the phone, and then they've called you from this number or they've contacted you through Instagram on an account that sort of looks less very similar to what your son's looks like, and maybe even took their photos and should put them up there.
00:13:10.639 --> 00:13:13.120
And now you're doing your best to check these things out.
00:13:13.200 --> 00:13:21.679
But like again, the emotional state, the panic, the energy, the the the you know, the fear that gets put in place is where they you're getting a hole.
00:13:21.759 --> 00:13:26.399
So you have to be able to somehow in that moment be like, well, hold on, wait, wait, wait.
00:13:26.559 --> 00:13:37.200
To sort of know, first off, they have to realize that that possibility of it being that close and being that sophisticated exists at an incredibly low barrier to entry right now.
00:13:37.279 --> 00:13:41.440
I mean, companies like his exist because this this barrier entry, they have to fight this all the time.
00:13:41.600 --> 00:13:42.399
We have to fight this.
00:13:42.480 --> 00:13:44.480
So that's why I tend to call this an arms race.
00:13:44.559 --> 00:13:44.720
Yep.
00:13:45.759 --> 00:13:51.120
Yeah, like if you just look back a couple of years ago, just spotting a an email, right?
00:13:51.200 --> 00:13:53.840
Like had a bunch of you know, see who it's from.
00:13:54.320 --> 00:13:58.399
See who it's from, it's coming from a Gmail account, it had misspellings in it.
00:13:58.559 --> 00:14:12.399
And indeed, now you're you're you're absolutely right, is that the level of sophistication of trying to imitate or trying to be that person, and then adding on the psychological aspect of it as well, right?
00:14:12.559 --> 00:14:19.600
Putting you in a state of fear or having to react at that moment, those two combined can be a dangerous combination.
00:14:19.840 --> 00:14:27.120
So um, is it even fair to to look at it and say, hey, we're just common sense or my gut is going to protect me?
00:14:27.200 --> 00:14:29.039
You need solutions basically out of that.
00:14:29.279 --> 00:14:31.120
I mean, it works because it works, right?
00:14:31.200 --> 00:14:32.399
Yeah, they know that.
00:14:32.720 --> 00:14:41.440
So I'll give you one example on on that, um, on how like smart these these fraudsters are when they're trying to impersonate any company.
00:14:41.600 --> 00:14:54.960
Um, it was one scam in which uh the fraudsters were impersonating Microsoft's support, and they bought this domain, which was not really Microsoft, it was RN Icrosoft.
00:14:55.120 --> 00:15:00.639
And if you type it, it and and you don't look carefully, it looks like Microsoft.
00:15:00.960 --> 00:15:01.519
That's it.
00:15:01.600 --> 00:15:02.720
Oh, yes, say we're at the end.
00:15:02.960 --> 00:15:03.279
Yeah, yeah.
00:15:03.759 --> 00:15:08.080
So when when you when you were reading that email, it's like, oh yeah, Microsoft sent me an email.
00:15:08.159 --> 00:15:08.720
I'm gonna click.
00:15:08.879 --> 00:15:09.360
That's legit.
00:15:10.480 --> 00:15:15.440
So so they they really think through everything uh to make it look legit.
00:15:15.759 --> 00:15:16.480
Absolutely.
00:15:16.799 --> 00:15:21.360
So banks, of course, run awareness programs all the time, right?
00:15:21.440 --> 00:15:26.720
Like in the Netherlands, you had the three times knocking, and then you you had to go through different checks, of course.
00:15:26.799 --> 00:15:33.519
And in the UK, you have different ones, in the UK, US they run different programs as well, and they help, but they do have a limit.
00:15:33.679 --> 00:15:41.759
So, where does education stop working once somebody is, you know, like you mentioned, emotionally manipulated in into that particular moment?
00:15:42.159 --> 00:15:43.279
I think there's a couple of things.
00:15:43.440 --> 00:15:51.120
First, I think you have to know, I think as a bank technology company with a banking lesson, um, you need to be clear.
00:15:51.279 --> 00:15:53.039
First off, we focus on a particular audience.
00:15:53.120 --> 00:15:54.639
That audience is quite tech savvy.
00:15:54.720 --> 00:15:57.519
Um, that doesn't give them any greater defenses, by the way.
00:15:57.600 --> 00:16:01.679
Um, but we also have to position in message what it is that we stand for, what we do and we don't do.
00:16:01.759 --> 00:16:06.080
So this thing that I mentioned about LinkedIn, like this whole, like that is constant message that comes out of us, right?
00:16:06.159 --> 00:16:08.399
We will never call you under any circumstances we ever call you.
00:16:08.559 --> 00:16:10.960
So you can establish that relationship as truth.
00:16:11.120 --> 00:16:12.879
You can sort of start to rely on it.
00:16:13.039 --> 00:16:14.159
I would say just beginning.
00:16:14.240 --> 00:16:15.519
So there's a little bit of like basic.
00:16:15.600 --> 00:16:16.960
Let's start with basic things.
00:16:17.120 --> 00:16:18.559
Um, where do we go from there?
00:16:18.799 --> 00:16:21.039
Well, then you have to start to employ technology, right?
00:16:21.120 --> 00:16:28.320
You you have to assume that people will make mistakes, and and you have to assume that they will do these things that Andre describes that will happen.
00:16:28.480 --> 00:16:29.519
So then what can you do?
00:16:29.600 --> 00:16:31.039
I mentioned things like Safety Shield.
00:16:31.200 --> 00:16:31.919
There's other methods.
00:16:32.080 --> 00:16:35.200
Can you there's this is where the arms race is on the positive side.
00:16:35.279 --> 00:16:41.840
Like the good guys are going after this with technology to sort of prevent it as and see it as soon as possible and early as possible.
00:16:42.000 --> 00:16:44.960
Maybe we can give you a chance to take it back when you realize you've made a mistake.
00:16:45.120 --> 00:16:46.720
Maybe we can work with you on those things.
00:16:46.799 --> 00:16:48.799
Maybe we can go find them and get this solved.
00:16:48.879 --> 00:16:50.639
Like there's ways that we can partner together.
00:16:50.879 --> 00:17:07.440
As an industry, I actually would argue that if we were to connect a bit better and sort of think of this as a not just my problem or your problem or their problem, but everybody's problem that's sort of harming the industry, we probably could even get a greater uh ability, a greater defense going.
00:17:07.599 --> 00:17:09.920
I don't know exactly what that looks like, so I'm not going to articulate.
00:17:10.079 --> 00:17:11.839
Andre might have a better clear picture of that.
00:17:12.000 --> 00:17:21.200
But I do think that there's a way that we could anonymously share more that would create a larger conjoined defense that we don't necessarily do without an exent.
00:17:21.440 --> 00:17:21.599
Yep.
00:17:21.759 --> 00:17:22.480
Yeah, it does.
00:17:22.720 --> 00:17:23.119
It does.
00:17:23.200 --> 00:17:43.519
And one one of the things we're doing in some markets where we have like a very strong penetration is we are enabling financial institutions to exchange data through our platform so that they're able to identify, especially meal accounts, which is like usually what's used to receive the funds from these scams, right?
00:17:43.680 --> 00:17:52.160
So whenever there is a transaction and we we have visibility into the receiving ends and we're able to say, like, this is a meal account, we've seen it before.
00:17:52.319 --> 00:17:55.359
Um, they're they're gonna stop the transaction right there.
00:17:55.599 --> 00:18:02.799
Um, and we're able to do this without ever sharing any PII between organisation institutions because basically anonymous, but it's a fact.
00:18:02.960 --> 00:18:03.200
Exactly.
00:18:03.279 --> 00:18:03.440
Yeah.
00:18:03.599 --> 00:18:19.519
So so the the reason why like not sharing PI is important is because prior to this, the banks were like, no, I'm not gonna share like my customers' like personal information because then this other bank can use that data and advertise to these people and steal my customer, right?
00:18:19.839 --> 00:18:34.240
But if we're just saying, like, okay, this is a meal account and that's it, and they have the visibility into um who they're sending to, but that's it just for that specific account, then they feel a lot more comfortable sharing the kind of information.
00:18:34.400 --> 00:18:42.720
So embedding this into a like privacy preserving way is is probably the best way to enable this kind of data sharing.
00:18:42.960 --> 00:18:43.759
Yeah, absolutely.
00:18:43.920 --> 00:18:55.519
So, and look, especially in the fraud space, if you go look at it, you go you go search for solutions as a financial institution or as a bank, there's already plenty of tools, right?
00:18:55.599 --> 00:19:00.799
Like there's a number of different tools that are actually trying to fix fraud overall.
00:19:00.960 --> 00:19:05.920
Um, why is looking at the signals around APP fraud so interesting?
00:19:06.079 --> 00:19:10.799
Um, and on and why is there a different approach that can actually help solve this?
00:19:11.119 --> 00:19:19.119
Yeah, well, the the tricky part about APP fraud is that if you look at the traditional signals, everything is gonna look fine, right?
00:19:19.519 --> 00:19:25.200
You're authenticated to your account, you use your credentials, it's the device that you typically use.
00:19:25.359 --> 00:19:32.000
You're probably at a trusted location, uh, you're probably connected to your home Wi-Fi, something like that, right?
00:19:32.240 --> 00:19:35.920
So at a high level, everything looks fine.
00:19:36.559 --> 00:19:45.039
What's unusual, and and these are the auto signals that we try to focus on are things like is this user actively on a call?
00:19:45.359 --> 00:19:50.559
Is there any kind of like remote access tool being used at that moment?
00:19:51.359 --> 00:19:52.960
Is this a new pay?
00:19:54.559 --> 00:20:03.119
Is the like transaction like is is it too big compared to the normal transactions that this user typically does?
00:20:03.440 --> 00:20:06.720
When you see all these factors, that's a red flag.
00:20:07.119 --> 00:20:19.279
But then if you're able to analyze the receiving end of the transaction and verify like this is a Mule account, then you're like 100% sure this is ABP fraud.
00:20:19.440 --> 00:20:22.880
So so this last mile here, I'd say is the most important.
00:20:22.960 --> 00:20:28.480
The otters are like important signals, but the last one is is really when you when you nail it.
00:20:28.640 --> 00:20:29.119
Absolutely.
00:20:29.359 --> 00:20:34.640
In in his description, one of the elements that we're we're spending more time on is that moment of the call.
00:20:34.960 --> 00:20:45.359
So we are encouraging any user who is on a call and actively on a call and unsure to get on get get with our get in the app customer support right now.
00:20:45.599 --> 00:20:53.039
Get a user support, contact us instantly, and we will walk you through how to check and test and walk this thing and even whether you should or shouldn't do this, we will move it.
00:20:53.119 --> 00:20:59.279
So we're looking at that moment because the more that we can stop before it happens, of course, um, the better it will be.
00:20:59.359 --> 00:21:11.119
The backward signals of what happened um are are useful and you will use them, and the technology will help inform other things, but they're not as good as the moment of a bad thing happening where you can prevent it from happening.
00:21:11.519 --> 00:21:12.079
Absolutely.
00:21:12.319 --> 00:21:15.039
And you mentioned mule accounts several times, right?
00:21:15.119 --> 00:21:26.559
I think maybe for those who are not as familiar with what a mule account is, um what is a mule account and why does it why does catching it depend on uh banks working together?
00:21:26.880 --> 00:21:40.160
Yeah, so it's a very challenging um issue because the Mule account is is basically the one that's used by the fraudster, and the fraudster is not gonna use their own information, right?
00:21:40.400 --> 00:21:52.880
So they're basically like convincing other people to give them access to their accounts, and usually they're paying these people or they're coercing these people to give their their accounts.
00:21:53.200 --> 00:22:03.920
And the tricky part about it is that during the onboarding stage, during the KYC, everything will fine because it's the actual person creating that account.
00:22:04.240 --> 00:22:06.720
But then they transfer that account to the fraudster.
00:22:06.960 --> 00:22:12.720
They even like give their credentials or even like give the device that has access to that account.
00:22:13.039 --> 00:22:17.359
And then that fraudster starts using that account going forward.
00:22:18.319 --> 00:22:29.279
So the tricky part is identifying that handover process because most of the verification happens at the account opening stage, not continuously.
00:22:29.839 --> 00:22:39.759
So the way in which many financial institutions are evolving now is that they're starting to continuously verify this account over time versus just at the front door.
00:22:40.640 --> 00:22:45.279
So this is this is how you would identify this kind of behavior.
00:22:46.160 --> 00:22:56.559
And particularly identifying the behavior of the device that uses that account versus the behavior of the device that opened that account in the first place.
00:22:56.720 --> 00:23:01.119
If those behaviors don't match, the likelihood that this is a new account is extremely high.
00:23:01.279 --> 00:23:14.799
And then there's a second layer to it which is if you're able to identify that the second device is associated to other accounts or other devices then you identify what we call the device farm.
00:23:15.279 --> 00:23:18.720
And this is where there's a high concentration of accounts.
00:23:18.880 --> 00:23:32.640
So to give an example we had a financial institution that was testing this this capability and we were able to find in a single apartment 200 devices that were connected to 4500 accounts.
00:23:32.880 --> 00:23:37.680
So wait 200 devices that were connected to 4500 accounts.
00:23:37.839 --> 00:23:43.759
Exactly wow all in one place and you were able to detect that in a single apartment.
00:23:44.559 --> 00:23:47.839
Very easy so not apartment building but apartment apartment.
00:23:48.160 --> 00:23:56.319
Exactly what he's saying like you know someone could track the electric power usage of that apartment you would notice they get the heat signal coming out of that right?
00:23:56.480 --> 00:24:03.839
Yeah absolutely well and then bunk of course being a digital only bank you don't have any locations in it.
00:24:04.240 --> 00:24:12.000
So the device is actually the customer's device device and the the contact bars and the it could also be a business device both of those are possible.
00:24:12.079 --> 00:24:18.799
Yeah yeah so the you could have a user that has multiple has a personal account in a business on one device or you could have multiple devices.
00:24:19.119 --> 00:24:30.160
You could this as one so how are you using the information that you're gathering of course when it comes to uh preventing yourselves from those mule accounts or those mule account takeovers.
00:24:30.400 --> 00:24:48.720
Yeah I think one of the uh we put out an annual report just in the last few days so there's some good data in there if you want to check it uh for the facts behind the conversation and one of the big areas of focus was the preventing the incoming fraud right so that's coming in and we've been able to reduce that by something I had to look at number I think it's the 80% in a lot.
00:24:48.799 --> 00:24:59.440
So we're reducing that coming in part of that is that you are running a constant again agenti component or an AI component on the behavioral patterns the the if you will the stats.
00:24:59.680 --> 00:25:07.599
I mean I can use it in whatever term you find most comfortable but I mean like you're running the numbers at a 24-7 to look at the patterns and the behaviors and what's happening.
00:25:07.680 --> 00:25:13.279
And so you can look at the devices and I think you did an eloquent way of describing it like is a device changing its pattern?
00:25:13.440 --> 00:25:15.279
Is a group of devices changing their patterns?
00:25:15.440 --> 00:25:21.440
Is what's happening with this account with that and re-verification I think is also a one of the ways that you you will be able to do that.
00:25:21.519 --> 00:25:35.680
So we're employing very similar um technologies and techniques to go after this but we feel like I said there's a responsibility to also on the front end make that education make that moment of something going bad as best as we can stop it when we can.
00:25:35.839 --> 00:25:39.359
But it's it's all it this is all data this is all information.
00:25:39.440 --> 00:25:54.880
This is like massive spreadsheets in the sky just to be simple that we are all running through constantly and trying to pick the pattern so that we can go find the uh the the the evil the darkness out there before it can occur that's that's exactly as as Andre described it.
00:25:55.119 --> 00:26:15.839
Absolutely but I think even for brink especially you've been one of the banks that has actually been proactive in not just utilizing data but utilizing AI in sure on boring processes and other things as well so how are you currently utilizing order point I doubt it's going to be spreadsheet but it's probably please no everyone that was a metaphor.
00:26:16.240 --> 00:26:20.559
Okay perfect yeah so how are you using AI now to help the great tables out there right?
00:26:21.279 --> 00:27:02.559
So how is like so yes so fraud prevention um so there's an AI component to our fraud prevention of course of course of course because we're battling the AI components that sit on the outside um there is a AI component to KYC there's an AI component to I mean really we're a generative AI company so there's an AI component to everything that we do but I would sort of reel it all back to like getting started with who the user is who are they where do they come from not just what we talk about in this conversation that's KYC that's an internal bank conversation but I mean who are they what do they want where are they heading what are they trying to do we're an entire bank built around a user and our entire obsession and focus of all time is to what does the user meet and what do they want?
00:27:02.640 --> 00:27:03.359
So we build everything.
00:27:03.440 --> 00:27:10.000
We make every decision every feature every expansion everything we do is based on what the users are asking of us or what they want.
00:27:10.079 --> 00:27:21.759
So we have to gut check that and then AI plays a role there we also have AI as 97% of all of our customer support inquiries are answered through AI with a 90% plus satisfaction rate.
00:27:22.000 --> 00:27:27.680
Tapman gives us magnificent amounts of data that we can then turn back into these other conversations, right?
00:27:27.920 --> 00:27:36.079
So one of the advantages of having a sophisticated AI customer support ability is that that is then data.
00:27:36.160 --> 00:27:52.160
It's not just a recorded conversation it is an AI analyzed and capability that you can then recycle into proactive information to go fight fraud with so that is there's an upside to that and I'll be honest anybody who's running an institution like ours, this isn't something you do overnight.
00:27:52.240 --> 00:28:02.160
People don't just flip this on like we've been we've been doing generative AI as a company for more than a decade and we've had we got there's a lot of mistakes that happened in that to get this to where it's at these satisfaction rates.
00:28:02.319 --> 00:28:09.519
So it is you guys are in this industry you it this is something it takes time to do right and it can be done wrong and you can feel still feel good about it.
00:28:09.839 --> 00:28:14.240
But you have to be able to capture this information and reuse it for prevention.
00:28:14.480 --> 00:28:18.480
And that's how we want everyone to feel safe and secure and that is our responsibility.
00:28:18.720 --> 00:28:32.240
Absolutely and in in cogne of course like you're you're you're providing a solution of course to help with a lot of that how are you utilizing AI uh how has it helped you to evolve the company as well yeah well pretty much everywhere.
00:28:32.480 --> 00:29:35.119
So from the like device IDs that we generate using transformer based architecture to how we predict what users are um expected to do and then we compare this to the real-time data to see like okay if there's a good match the likelihood that this is the right person is higher um to AI assistance in which like the the users of our platform the the the customers they're able to for example run like very big and sophisticated queries on like what's going on the anomalies in the data identify like new fraud patterns etc um all the way to for example readjusting how each individual data feature is is weighted in in our models by um basically talking to our system um so so yeah it's pretty much all over the place um helping both the customers but also the underlying technology that helps us identify the users correctly is is is all powered by AI.
00:29:35.440 --> 00:30:00.880
Absolutely so it's more than just the well everybody uses AI very broadly of course but I've heard you talk about generative AIs of course in the chat bot being able to take language and actually have responses but then connecting that into your internal sources and helping uh customers to solve problems uh directly to all the way to applying machine learning in in different ways and and going beyond that as well.
00:30:02.079 --> 00:30:10.400
Like maybe maybe to sidetrack that a little bit as far as I'd love to add to that if we do think it's important when people are listening to separate generative and agentic.
00:30:10.559 --> 00:30:18.400
Yeah in terms of let's just in all simple terms if this is the first time you ever heard of it generative is like you know you give it a prompt you give it some information and it does something.
00:30:18.559 --> 00:30:20.160
Agentic is you've given it agency.
00:30:20.240 --> 00:30:28.079
So it has a set of uh let's say pre-decided uh behaviors or capabilities and it's making a decision has agency it's going and doing something on its own.
00:30:28.319 --> 00:30:33.119
I find as a bank I find we find agency agency capable AI is very good.
00:30:33.200 --> 00:30:41.359
I mean AML fraud prevention you can really use these technologies there because your risk level of getting something wrong is you're actually out there in data trying to get something right.
00:30:41.599 --> 00:31:05.359
When it comes to say um uh user support or access to a user account it's a very different story right you this isn't something right now we're ready to just turn agents loose on so that's not we don't think that's the right time for that but it can inform that inform that data is collected and can inform what you can educate talk about and and engage from a generative AI user support scenario.
00:31:05.519 --> 00:31:12.720
I know that's a little bit of what we would say in US inside baseball but um it is very much like to good to separate those two things.
00:31:12.880 --> 00:31:26.960
And then for anyone who talks about AI in our space, we should very much separate and I think Andre will be with me on this the lab and the factory because there is a lab where we're out token maxing we're talking about how much we can do and like how far AI can go.
00:31:27.039 --> 00:31:42.319
And then there's I think you and me and we're running businesses on AI right so the day-to-day usage of this is running of the business which is very much we're in the factory and we're delivering on a day-to-day basis which isn't the the perfect uh PR scenario but it's the hard and difficult work of keeping people safe.
00:31:42.480 --> 00:31:54.000
Yep I agree absolutely so maybe there's even that extension of that right and maybe a topic that um nowadays at payments conferences, banking conferences here all the time, which is agente commerce.
00:31:54.240 --> 00:31:56.960
So what are your views on agentic commerce?
00:31:57.119 --> 00:32:09.680
Because then all of a sudden we don't just have a user anymore we don't have a person or a business or a business person, but we have an agent on itself shopping with either a card or the access to the bank account.
00:32:10.000 --> 00:32:16.960
Well let's assume in a best case scenario that it's in an agent with rules but I think let's start with agentic commerce.
00:32:17.039 --> 00:32:52.400
So actually I think of agentic commerce less than the way you do which is sort of maybe an agent out shopping I think of it as more as um agent-to-agent commerce right so this is this is commerce that's passing between different agents one's like uh on one side one's on another and so this agentic commerce is actually happening you know without humans being involved because both of the agents have been given agency and they've been given rules that they play by um and I think in a best world scenario where the rules are set in those things this thing I'm a lumber company and I sell seven types of lumber and there's rules about what I sell and what the SKUs are and then I'm a buyer and I have an inventory I have to keep and I have a budget.
00:32:52.559 --> 00:33:01.119
Well that seems pretty simple maybe we could agent that the agent agent who says here's my credit card I want something new that sounds like a bad idea to me.
00:33:01.359 --> 00:33:04.000
So I think there's uh there's rules that still have to be put in place.
00:33:04.160 --> 00:33:52.640
I think it's very brand new but I do think it's an industry that's headed our way and at one time or another we will all have the same conversations we're having today about human fraud that we will once at some point we will engage in well we have a genetic fraud already but an agent to agent fraud let's say we will have to find you know we'll have to be smarter and better when the time comes but I just don't know exactly when that is now maybe for you Andre like of course you have know your agents and all these different protocols that are being launched as well how do you see that changing or maybe expanding your business when it comes to preventing that type of fraud as well yeah I'd say the there are two challenges here right one is the know your agents which I believe this one is more straightforward like each agent can have like a cryptographic signature and you're able to authenticate it that's all fine.
00:33:52.960 --> 00:35:33.039
The tricky part is is establishing the um connection between like the agent and the user and doing that in a continuous way because what if that session is hijacked right what if I take over your account and your account has an agent that has for example your payment credentials and your login credentials to your bank account for example that could be a huge problem right um so this part I'd say is is the most challenging and this is where we are acting more um right now which is finding ways to basically create like a a way to bind the end user to the agent continuously the way we're doing it is by focusing on pretty much the same things that we do with with otter uh customers which is focusing on the device and its location and if anything changes here we need to make sure that at least one of these two uh remains consistent so for example if it's the device that you always use and you always use to connect to that agent that's all good if it's a new device the location behavior of that new device should match the old device otherwise there's a risk that this is something else someone else uh impersonating you for example so we focus on like look into these two things specifically and and I'd say like at a at a higher level it's thinking about like what is vulnerable today and pretty much every signal to like represent a user in the digital world that um can be fake by AI is no longer reliable.
00:35:33.199 --> 00:35:44.400
So for example if you think about like remote biometric authentication defakes are destroying that document verification probably in five years that's not going to happen anymore.
00:35:45.599 --> 00:35:55.440
OTPs very easy to fish passwords same thing right so all of these like digital signals are are becoming less and less reliable over time.
00:35:55.760 --> 00:36:10.880
So we're taking approach that which is much more like about grounding the user's digital identity into physical reality because that's probably the only thing that AI won't be able to fake so so that's what we're we're betting on.
00:36:11.119 --> 00:36:19.920
Absolutely there's an opportunity there's a technology opportunity here right there's no what it's this isn't so much a technical problem we can build if we know what to go after.
00:36:20.079 --> 00:36:24.159
It is a trust verification type of issue.
00:36:24.400 --> 00:36:43.119
So there's a which leaves there's a technical gap for greater technologies uh to address the things that Andre just described what is the next level of if we're if he's going back to the old world what's your address and are you at your address uh what is the what is the technology opportunity there is something we don't I don't know what it is but I know there's something.
00:36:43.360 --> 00:36:51.679
Yeah absolutely so I like to look into the future always and I'm a very upbeat and positive person when it comes to that.
00:36:51.840 --> 00:37:21.280
However I think what we're seeing around us nowadays is very challenging right there's AI of course there's regulations also not just in in Europe but also across the world um and other things are coming in that what is something in maybe your perspective that you believe needs to change for at least let's just keep it to APP fraud or fraud overall as a bank that allows us to grow further, to do more transactions, to grow as businesses as well.
00:37:21.440 --> 00:37:22.239
What needs to change?
00:37:22.400 --> 00:37:23.440
Is that regulations?
00:37:23.599 --> 00:37:27.280
Is that the adoption to AI, adopted to stable coins?
00:37:27.440 --> 00:37:28.320
What might that be?
00:37:29.039 --> 00:37:39.039
There's a lot of ways we can go with this and it sounds like I'm gonna end on the same place I started which is um I think the opportunity on the human end is our challenge.
00:37:39.199 --> 00:37:48.800
I think uh responsibility uh not necessarily liability but responsibility to develop the technologies and the capabilities to better secure the human end of a transaction.
00:37:49.039 --> 00:37:50.079
What does that mean?
00:37:50.400 --> 00:37:52.239
I I mentioned Safety Shield a few times.
00:37:52.320 --> 00:38:03.519
Andres mentioned some different ways that they do it but I think the we're exploring the both in a different way how we go and affect this, if I may say weak end of the problem in a sense.
00:38:03.599 --> 00:38:15.360
So I think what needs to change is I think A, it would be great if the whole world at the same time raised its acumen around how dangerous this is, but that probably won't happen and we'll still make mistakes.
00:38:15.519 --> 00:38:29.599
So we have to be responsible to continue on a company by company basis to really educate and create technologies that can prevent people from making mistakes without of course handcuffing them like let's say what happened to you on a completely legit transaction.
00:38:29.679 --> 00:38:31.039
So how do you balance between the two?
00:38:31.199 --> 00:38:46.159
I'm sure that we're gonna still make some mistakes along the way but I think that's the thing that needs to change is we need to help people understand the breadth and the depth of this and provide technologies that are seamless so that they're not you know stuck with nothing nowhere to go and nothing to do about it.
00:38:46.639 --> 00:38:47.280
Thank you very much.
00:38:47.440 --> 00:38:48.719
Now over to Andre.
00:38:49.119 --> 00:39:07.280
Yeah I'd say my my goal is to enable the financial institutions to get to a point in which they don't need to worry about educating their users about security anymore because the tech is so good that they don't need to worry about that.
00:39:07.440 --> 00:40:03.119
So for example think about um account takeovers driven by social engineering right um a lot of that was because OTPs was one of the main um forms of multifactor authentication and an OTP can be easily fished right like if someone is calling you trying to impersonate the bank and they're saying like oh I'm from the bank we're going to receive a six digit code on your phone um please tell me that six digit code okay I got your account right but if we're able to replace that with better technology that the fraudster is not able to say like oh there's there's there's a code that you're gonna receive you you shut down that door right um so basically like continuing to upgrade the technology to a point in which even the last like tech savvy user is still protected because like the tech is working for them.
00:40:04.719 --> 00:40:32.960
In the meantime obviously we need to invest a lot in in educating uh the users but um I I believe you're gonna agree with me sometimes it's frustrating right you you try a lot how could it be possible and you're like oh my god you can't I can't believe someone did that you guys have those factors it does but you know I don't think it's it's it's a you can't blame the victim here like it's still someone is preying upon and we have to be smart enough to like understand who the who the bad guy and the good guys are here.
00:40:33.039 --> 00:40:33.280
Yeah.
00:40:33.519 --> 00:40:42.880
So so my goal is to like help the FIs get rid of this problem and not have to to worry about uh running campaigns to educate their users anymore.
00:40:43.199 --> 00:40:43.679
Perfect.
00:40:43.920 --> 00:40:48.400
Well I want to thank the both of you for joining us here at Executive Conversations by the papers.
00:40:48.719 --> 00:40:49.119
Thank you very much.
00:40:49.920 --> 00:40:50.079
Thank you.
00:40:50.239 --> 00:40:51.360
Thanks a pleasure to be here.
00:40:51.920 --> 00:40:56.000
If you like this episode hit like follow and subscribe for more
