1
00:00:01,030 --> 00:00:07,190
Hey everyone, and welcome to Identity Crisis, the mad rise of online account opening fraud.

2
00:00:07,190 --> 00:00:12,670
My name is Yuri, and I'm Chief Cyber Officer and Co-Founder at BioCatch.

3
00:00:12,990 --> 00:00:16,730
We are at an identity crisis point.

4
00:00:17,350 --> 00:00:28,150
If you were asking credit card companies and banks a few years ago about account opening fraud, they would say, yeah, it's a kind of a minor inconvenience.

5
00:00:28,150 --> 00:00:30,230
That's not their reaction nowadays.

6
00:00:30,770 --> 00:00:33,770
It's getting to be a tidal wave.

7
00:00:34,010 --> 00:00:36,730
This is from Gartner a few years ago.

8
00:00:36,730 --> 00:00:46,350
You can see things like account takeover fraud, payment fraud, these are the main areas of concern for risk and security management.

9
00:00:46,470 --> 00:00:55,710
But there's one thing that tops all of these concerns, and that's new account synthetic or stolen identity fraud.

10
00:00:55,710 --> 00:01:03,990
So it is becoming the number one concern regarding fraud in financial institutions.

11
00:01:04,460 --> 00:01:12,830
Another interesting trend is to see what sort of information financial criminals are stealing these days.

12
00:01:12,830 --> 00:01:15,010
It used to be credit card information.

13
00:01:15,010 --> 00:01:18,910
That was the top priority for financial cyber criminals.

14
00:01:18,910 --> 00:01:26,530
But now the number one data element is social security number, which is an identity element.

15
00:01:26,530 --> 00:01:30,290
And in fact, identity is becoming a commodity.

16
00:01:30,290 --> 00:01:41,190
It's traded in the dark web, and every American citizen's records have already been stolen several times over.

17
00:01:41,730 --> 00:01:47,270
If we can look at this list, for example, it shows all sorts of data breaches.

18
00:01:47,570 --> 00:01:51,270
Many of those are related to identity.

19
00:01:51,870 --> 00:02:06,230
Specifically, if we talk about the big credit reference agency, the big credit bureaus, data aggregators that have been hacked over the years, and this fuels this economy of account opening fraud.

20
00:02:06,270 --> 00:02:17,090
Now, the industry is fighting back, realizing that good old KYC, know your customer, is basically dead, and long live next generation data.

21
00:02:17,190 --> 00:02:31,530
So it used to be about what you know and matching all of the information about the user, looking at the data that the user provides and seeing that it all stacks, and it's what the records show.

22
00:02:32,190 --> 00:02:34,990
But now we have additional data to look at.

23
00:02:34,990 --> 00:02:45,150
For example, what you have, which is user resources, and what you do, which is your digital footprint, and what you are, user behavior, that behavior biometrics.

24
00:02:45,250 --> 00:02:48,190
So a couple of examples for each of those categories.

25
00:02:48,210 --> 00:02:56,770
Again, historically, this would be KYC data, residence, license information, credit history information.

26
00:02:57,430 --> 00:03:01,650
Those type of data points are already in the wrong hands.

27
00:03:01,650 --> 00:03:08,110
And when someone, a cyber criminal, is doing account opening fraud, they have access to all of this.

28
00:03:08,910 --> 00:03:19,610
So therefore, a lot of financial institutions and other related industries have started to untap additional lines of defense.

29
00:03:19,610 --> 00:03:28,110
Starting with device, this has been something that the industry started to adopt about 10 years ago, 15 years ago.

30
00:03:28,690 --> 00:03:30,670
What sort of device are you coming from?

31
00:03:30,670 --> 00:03:32,730
What's the reputation of that device?

32
00:03:32,730 --> 00:03:38,290
Information about your location, information about your phone and phone line.

33
00:03:39,090 --> 00:03:41,610
More recently, what are you doing?

34
00:03:41,610 --> 00:03:43,310
So what's your digital footprint?

35
00:03:43,310 --> 00:03:49,870
Any kind of social media reputation that you have, email reputation, open source analysis on your identity.

36
00:03:49,870 --> 00:03:52,750
And more recently, behavioral biometrics.

37
00:03:53,170 --> 00:03:55,910
These are different types of analysis.

38
00:03:55,910 --> 00:04:02,290
For example, if you're opening an account, you should be familiar with the data that you're providing.

39
00:04:02,290 --> 00:04:04,230
It's your own personal information.

40
00:04:04,250 --> 00:04:08,950
You should not be familiar with the process of account opening because, hey, you've just opened an account.

41
00:04:09,150 --> 00:04:10,950
A criminal is gonna be the opposite.

42
00:04:10,950 --> 00:04:14,990
They're gonna be very familiar with the process, but not familiar with the data.

43
00:04:14,990 --> 00:04:20,630
And that's the sort of analysis that behavioral biometrics is now providing.

44
00:04:21,350 --> 00:04:28,910
So behavioral biometrics, you kind of heard about behavioral biometrics before, but more in the context of profiling.

45
00:04:29,030 --> 00:04:39,090
So the idea of behavioral biometrics, when it actually started, was to create a profile of a regular user behavior and then watch for anomalies.

46
00:04:39,090 --> 00:04:40,930
This is a classic example.

47
00:04:40,930 --> 00:04:46,930
You see someone that logs in and then interacts with their online banking application.

48
00:04:46,930 --> 00:04:50,330
What you see on the screen is the person's mouse motion.

49
00:04:50,730 --> 00:04:55,650
These are several sessions, several pages, but the mouse motion is basically the same.

50
00:04:55,650 --> 00:05:00,270
So that's how you create a profile of the regular user behavior.

51
00:05:00,270 --> 00:05:03,110
You can use keyboard analysis.

52
00:05:03,110 --> 00:05:05,330
You can analyze mouse motion.

53
00:05:05,330 --> 00:05:11,250
If the user is operating on a mobile device, you're gonna look at accelerometer, gyro, and touch data.

54
00:05:11,350 --> 00:05:15,670
The idea is to create a baseline and then watch for anomalies.

55
00:05:15,670 --> 00:05:18,870
In this specific case, this account was compromised.

56
00:05:18,870 --> 00:05:23,390
The user provided the credentials to a criminal, and now the criminal is accessing the account.

57
00:05:23,390 --> 00:05:26,570
You're gonna see a very different type of behavior.

58
00:05:26,850 --> 00:05:30,210
So now it's not the same mouse motion.

59
00:05:30,210 --> 00:05:32,690
There's a strange bump in the center of the motion.

60
00:05:32,870 --> 00:05:43,950
And essentially, this is a way for the financial institution, for example, to say, hey, we do see an anomaly based on the profile, based on the baseline that was created.

61
00:05:43,950 --> 00:05:47,710
Another use of behavioral biometrics is to look for threats.

62
00:05:47,710 --> 00:05:49,970
For example, remote access.

63
00:05:50,230 --> 00:05:51,770
This is a mobile device.

64
00:05:51,770 --> 00:05:54,210
User is interacting on a mobile device.

65
00:05:54,210 --> 00:05:56,270
You can see the swipe motions.

66
00:05:56,270 --> 00:05:58,390
These are not gonna be straight lines.

67
00:05:58,390 --> 00:06:04,690
Even if you think that you move in a straight line on your mobile device, you actually have a small arc.

68
00:06:05,150 --> 00:06:06,610
Then you see the tabs.

69
00:06:06,610 --> 00:06:11,550
Now the tabs are surrounded, the dot is surrounded by a blue circle.

70
00:06:11,550 --> 00:06:15,030
That's your finger pressing on the actual touch screen.

71
00:06:15,030 --> 00:06:17,510
That's a normal situation for this account.

72
00:06:17,590 --> 00:06:21,050
And now this account was compromised with a help desk scam.

73
00:06:21,050 --> 00:06:27,350
Hey, we're the help desk, there's something wrong with your account, your bank account, your mobile device, something like that.

74
00:06:27,350 --> 00:06:29,270
We're here to help you.

75
00:06:29,270 --> 00:06:34,030
You just have to install something allowing us remote assistance.

76
00:06:34,050 --> 00:06:43,330
People fall for that and then install some sort of remote assistant tools, or maybe like a rogue application.

77
00:06:43,330 --> 00:06:46,650
And then the attacker has remote access on their device.

78
00:06:46,650 --> 00:06:48,550
This does not look the same.

79
00:06:48,830 --> 00:06:54,690
Typically the attacker is gonna control that device using a mouse and keyboard.

80
00:06:54,690 --> 00:07:03,710
And essentially you're gonna see these long lines, that's mouse motion, not someone actually physically scrolling up and down on the device.

81
00:07:03,710 --> 00:07:08,910
And all of the dots, you don't see the blue circle around them because no one's actually touching the screen.

82
00:07:08,910 --> 00:07:10,450
You know, mouse clicks.

83
00:07:10,670 --> 00:07:14,490
Beyond that, because of the remote access, there's gonna be some latency.

84
00:07:14,630 --> 00:07:18,530
The latency creates some disruptions to hand eye coordination.

85
00:07:18,570 --> 00:07:26,350
And if you have the right system, you can actually spot that and say, okay, we now know that this mobile device is being remotely controlled, right?

86
00:07:26,850 --> 00:07:31,350
Now, if we talk about account opening though, what's the use of behavioral barometrics?

87
00:07:31,350 --> 00:07:33,390
You cannot really profile anyone.

88
00:07:33,750 --> 00:07:37,490
They're just establishing the account, right?

89
00:07:38,150 --> 00:07:46,690
But if you actually look at the way criminals behave, you can now analyze second by second what they're doing.

90
00:07:46,690 --> 00:07:54,850
We're gonna start with a very interesting case from one of the top five credit card issuers in the US.

91
00:07:55,210 --> 00:07:58,790
They basically give you a credit card online within 30 seconds.

92
00:07:58,790 --> 00:08:15,050
You go to the website, you select a credit card, you click apply now, and then you start filling this online form, providing your name, email address, date of birth, mobile phone number, address, social security number, and other data points.

93
00:08:15,930 --> 00:08:21,430
Essentially, that's what regular users will go through, but also what criminals will go through.

94
00:08:21,430 --> 00:08:25,630
So let's actually look at a specific application.

95
00:08:26,170 --> 00:08:34,390
The session timeline here, every vertical bar is an interaction, like the user typed something or interacted with the form.

96
00:08:34,390 --> 00:08:37,930
It took one minute and 34 seconds to complete that.

97
00:08:38,210 --> 00:08:43,690
And the interesting thing is that the first name was pasted three seconds into the session.

98
00:08:44,490 --> 00:08:47,110
That's actually pretty incriminating.

99
00:08:47,410 --> 00:08:50,350
You know, why are you pasting your first name?

100
00:08:50,350 --> 00:08:52,410
You're supposed to be familiar with it.

101
00:08:52,410 --> 00:08:55,010
And the other thing is, how come it's so fast?

102
00:08:55,010 --> 00:08:59,150
There's actually a video that will show us how fast it was.

103
00:08:59,310 --> 00:09:03,530
So three seconds into the session, already we see control V.

104
00:09:03,530 --> 00:09:05,590
It's not autofill, by the way.

105
00:09:05,950 --> 00:09:17,750
Someone actually was ready before the application started, form started, went to the application flow, and then used control V to paste something.

106
00:09:17,750 --> 00:09:19,870
That's criminal behavior.

107
00:09:20,330 --> 00:09:26,290
Another thing that was pasted was the social security number, the date of birth was also pasted.

108
00:09:26,290 --> 00:09:35,590
You know, all of these suggest that whoever is doing this are not really familiar with the personal information, but they're also quite familiar with the process, right?

109
00:09:35,590 --> 00:09:38,350
Three seconds and they're beginning to interact.

110
00:09:39,730 --> 00:09:44,010
If we look at deposit fraud, that's another interesting trend.

111
00:09:44,010 --> 00:09:46,230
So we talked about credit card account opening.

112
00:09:46,230 --> 00:09:52,570
Of course, a criminal will be interested in that to just get a credit card or a loan or some sort of instant credit.

113
00:09:52,770 --> 00:10:05,390
But also deposit fraud is another lucrative type of business because what you do there is you open a new account and then you move money from a compromised account that you have.

114
00:10:05,630 --> 00:10:17,830
So let's say that you have money, an account that you've compromised in bank A, you open an account in bank B and say, hey, I'm the user, I wanna open an account, I wanna deposit something from bank A.

115
00:10:18,370 --> 00:10:32,650
Typically bank B will send some small transaction to bank A to prove that once you provide that specific amount to prove that you own that account, you access that account and you can provide that information.

116
00:10:32,690 --> 00:10:36,490
Of course, they're gonna do all of the regular KYC checks.

117
00:10:36,590 --> 00:10:58,590
But of course, if you own that account, if you actually not own, but control that account, you can provide all of that KYC information because you have access to the identity information and you also control the account in bank A, you can just open an account in bank B and move all of the money from account A to account B.

118
00:10:58,590 --> 00:11:03,630
Thing is that bank B is now responsible for the fraud laws.

119
00:11:03,630 --> 00:11:05,050
That's called deposit fraud.

120
00:11:05,050 --> 00:11:07,470
And let's actually see someone opening an account.

121
00:11:07,810 --> 00:11:10,370
They're pasting a lot of information.

122
00:11:10,370 --> 00:11:25,050
In this case, they're pasting the routing code, the account number, user ID, password, when they do the actual payment.

123
00:11:25,620 --> 00:11:31,530
And then the interesting thing here is, all of this is happening quite fast.

124
00:11:31,530 --> 00:11:34,510
And what you can see is they completed the funding.

125
00:11:34,510 --> 00:11:36,910
Now they completed opening the account.

126
00:11:37,550 --> 00:11:44,590
And look at the analysis showing genuine users versus criminals.

127
00:11:44,590 --> 00:11:52,350
About 2% of on an account opening sessions will have this behavior where we see a paste from a different application.

128
00:11:52,350 --> 00:11:58,130
So essentially an alt tab to a different tab and then paste the information from that tab.

129
00:11:58,210 --> 00:12:00,270
That's 2% of the users.

130
00:12:00,270 --> 00:12:01,990
For criminals, it's 25%.

131
00:12:02,670 --> 00:12:05,250
This is pretty significant.

132
00:12:05,250 --> 00:12:07,370
So it's quite informative seeing that.

133
00:12:07,370 --> 00:12:22,050
At the same time, we also understand that you cannot really incriminate 2% of the population or we need more information because 25% is not gonna be a good detection rate if you wanna detect those sort of fraud cases.

134
00:12:22,050 --> 00:12:25,210
So in any case, that's like one type of analysis.

135
00:12:25,630 --> 00:12:27,830
Obviously, you need much more than that.

136
00:12:27,830 --> 00:12:33,570
But deposit fraud is another type of account opening fraud that is skyrocketing these days.

137
00:12:33,990 --> 00:12:36,430
So we talked about pasting information.

138
00:12:36,430 --> 00:12:40,430
We talked about typing information.

139
00:12:40,430 --> 00:12:44,290
Now let's look at the difference between good users and bad users.

140
00:12:44,810 --> 00:12:46,990
Criminals are gonna type off a list.

141
00:12:46,990 --> 00:12:59,870
So if they choose not to populate the field automatically with some sort of bot or to use a pasting, which you've seen that it's only 25% of the cases, they will typically type off a list.

142
00:12:59,870 --> 00:13:01,570
They have a list of victims.

143
00:13:02,250 --> 00:13:07,070
Thing is that short memory is limited to just seven characters or items.

144
00:13:07,710 --> 00:13:11,410
So think about someone typing a social security number that does not belong to them.

145
00:13:11,410 --> 00:13:14,030
It will be very mechanical, right?

146
00:13:14,230 --> 00:13:19,250
So we see someone typing the social security number.

147
00:13:19,250 --> 00:13:24,670
It takes them quite like nine seconds to complete the SSN.

148
00:13:24,670 --> 00:13:29,190
Typically it's gonna be something like four seconds for an SSN.

149
00:13:30,370 --> 00:13:33,530
Date of birth, it's like two digits.

150
00:13:33,650 --> 00:13:34,790
I'm looking at the list.

151
00:13:34,790 --> 00:13:36,790
I'm going back, okay, another two digits.

152
00:13:37,130 --> 00:13:38,150
Okay, I know the year.

153
00:13:38,150 --> 00:13:39,730
It's gonna be 19 something.

154
00:13:39,730 --> 00:13:41,010
Okay, what's the number?

155
00:13:41,010 --> 00:13:43,330
Again, going to the list, going back.

156
00:13:43,330 --> 00:13:45,290
This is a very mechanical process.

157
00:13:45,290 --> 00:13:50,090
Typing off a list is something that you can also understand criminals do.

158
00:13:50,430 --> 00:14:00,210
They wanna be efficient, they have a list, but essentially that's the way for them to show the fact that they are not familiar with that information.

159
00:14:00,210 --> 00:14:01,930
It's not top of their mind.

160
00:14:03,390 --> 00:14:10,790
As opposed to something that we're gonna see right now, sometimes the newer customer checks actually conflict with the next generation analysis.

161
00:14:10,790 --> 00:14:19,810
There was a specific case with one of the big card companies that essentially said, hey, we're gonna decline an application because it's definitely fraud.

162
00:14:19,810 --> 00:14:23,330
You know, 96% chance of something being fraud.

163
00:14:23,610 --> 00:14:26,510
But when we looked at the data, it was interesting.

164
00:14:26,530 --> 00:14:31,050
The session timeline, again, is all of the activities that the user is doing.

165
00:14:31,210 --> 00:14:35,830
And what you can see is that the social security number is typed continuously.

166
00:14:36,210 --> 00:14:39,150
And by the way, Behavioral Biometric is not interested in the data itself.

167
00:14:39,150 --> 00:14:41,330
You're gonna see it's all, you know, 111s.

168
00:14:41,330 --> 00:14:45,990
When we actually look at it again, the typing is quite confident.

169
00:14:46,310 --> 00:14:50,030
You know, you don't see the same thing like typing off of this.

170
00:14:50,030 --> 00:14:51,810
Certainly you don't see any pasting.

171
00:14:51,810 --> 00:14:53,170
It's not autofill.

172
00:14:53,390 --> 00:15:00,350
Whoever is typing this information is quite familiar with the social security number, suggesting it's their own social security number.

173
00:15:00,350 --> 00:15:02,830
Long-term memory is a very strong inheritance field.

174
00:15:03,090 --> 00:15:06,230
The other interesting thing here, look at the timeline.

175
00:15:06,290 --> 00:15:08,870
There's a 58 second pause.

176
00:15:08,870 --> 00:15:09,590
Why?

177
00:15:09,590 --> 00:15:14,310
Because in this specific case, it's a hotel credit card.

178
00:15:14,370 --> 00:15:18,710
So in order to open the account, you need to provide your hotel loyalty number.

179
00:15:18,710 --> 00:15:22,890
You probably have some hotel loyalty numbers, but no one remembers them.

180
00:15:22,890 --> 00:15:27,610
And it takes you a minute or two to fetch them, maybe from your inbox or something like that.

181
00:15:27,610 --> 00:15:28,890
Maybe it's in your wallet.

182
00:15:29,750 --> 00:15:32,310
So about one minute is the norm.

183
00:15:32,590 --> 00:15:40,090
And we do see that this user also, you know, paused for about one minute to fetch that number and then continued with the application.

184
00:15:40,290 --> 00:15:43,770
This is a very, very positive sign, right?

185
00:15:43,770 --> 00:15:46,410
This person behaves like everyone else.

186
00:15:46,410 --> 00:15:51,090
Criminals are not going to bother with waiting for one minute because they need this information.

187
00:15:51,090 --> 00:15:52,130
They have this information.

188
00:15:52,130 --> 00:15:53,370
It's all ready for them.

189
00:15:53,370 --> 00:16:00,350
It's going to be right along, you know, the name, date of birth and social security number because they need it to open the account.

190
00:16:00,730 --> 00:16:06,650
Whereas, you know, real users, there's going to be some type of information that you're going to be very familiar with.

191
00:16:06,650 --> 00:16:09,170
It's etched in your long-term memory.

192
00:16:09,450 --> 00:16:12,990
But other types of information you have to research, you have to fetch.

193
00:16:14,030 --> 00:16:19,350
And that's essentially analyzing the way a genuine user will behave.

194
00:16:19,490 --> 00:16:20,510
So what do we have here?

195
00:16:20,510 --> 00:16:28,110
We have here a kind of a conflict because the analysis suggests, the next-generation analysis suggests that it's a good user, right?

196
00:16:28,110 --> 00:16:30,970
Familiar with the social security number, behaves like everyone else.

197
00:16:31,010 --> 00:16:34,030
But the card company said, hey, that's bad.

198
00:16:34,370 --> 00:16:36,050
We were actually curious about that.

199
00:16:36,050 --> 00:16:42,250
We asked the credit card company, hey guys, what do you, you know, why you think this is going to be a fraudulent application?

200
00:16:42,470 --> 00:16:48,070
They said, well, we like you very much guys, but it has to be fraud because the guy is dead.

201
00:16:48,190 --> 00:16:49,990
He's been dead for 10 years.

202
00:16:49,990 --> 00:16:51,930
You know, we checked the social security number.

203
00:16:51,930 --> 00:16:53,670
It belongs to a dead person.

204
00:16:54,610 --> 00:16:56,070
Well, that was bad.

205
00:16:56,210 --> 00:17:01,610
I mean, we were so sure that this is, you know, an actual genuine person.

206
00:17:02,070 --> 00:17:08,790
And, you know, we asked the issuer, can you actually call the user, you know, to try and find out what went on here?

207
00:17:08,790 --> 00:17:13,370
Because, you know, it looks so real, like it's a real genuine person.

208
00:17:13,370 --> 00:17:14,830
They said, they're dead.

209
00:17:14,830 --> 00:17:15,910
We're not going to call them.

210
00:17:15,910 --> 00:17:20,150
We had a bit of an argument and eventually they caved in and said, okay, we're going to call them.

211
00:17:20,150 --> 00:17:21,310
Let's see what happens.

212
00:17:22,450 --> 00:17:26,190
So the fraud operations team now calls the user.

213
00:17:26,230 --> 00:17:27,390
It was a miracle.

214
00:17:27,390 --> 00:17:28,210
He picked up the phone.

215
00:17:28,210 --> 00:17:29,250
He was not dead.

216
00:17:30,390 --> 00:17:34,510
Ended up that he had a typo in the social security number.

217
00:17:34,510 --> 00:17:35,690
He just had a mistake.

218
00:17:35,690 --> 00:17:36,810
Let's see it again.

219
00:17:37,030 --> 00:17:41,550
You know, typed very confidently, but with a typo that the user did not realize.

220
00:17:42,090 --> 00:17:44,590
This actually matched to a totally different person.

221
00:17:44,590 --> 00:17:45,410
The name was wrong.

222
00:17:45,410 --> 00:17:48,870
The social security was belonging to someone that died.

223
00:17:49,730 --> 00:17:58,490
So sometimes the data is going to suggest that this is a bad application, but some of the next generation analysis don't really care about the data.

224
00:17:58,490 --> 00:18:01,230
It cares about the way you behave.

225
00:18:01,230 --> 00:18:05,690
It cares about, you know, your device, your, you know, other elements.

226
00:18:05,790 --> 00:18:11,610
And therefore sometimes it's more trustworthy than actually, you know, looking at the data itself.

227
00:18:12,290 --> 00:18:14,330
Let's move to synthetic identity.

228
00:18:14,330 --> 00:18:19,250
Synthetic identity is a very interesting new problem in the U.S., relatively new.

229
00:18:19,450 --> 00:18:24,930
It hasn't been around for over a decade, but it's becoming more and more of a problem.

230
00:18:25,530 --> 00:18:26,950
This is from ID Analytics.

231
00:18:26,950 --> 00:18:39,350
And what you can see is, you know, social security belonging to, you know, one identity, a name is invented, or, you know, belonging to a different identity, date of birth, et cetera, et cetera.

232
00:18:39,350 --> 00:18:53,230
It's like combining a kind of, you know, sort of a digital identity that does not really belong to any specific person because it's a mashup of various identities.

233
00:18:54,190 --> 00:18:57,350
Now, then what do they do with this identity?

234
00:18:57,350 --> 00:19:00,070
Because that identity obviously cannot open a credit card, right?

235
00:19:00,070 --> 00:19:02,790
They don't have any kind of credit history.

236
00:19:02,790 --> 00:19:04,750
No one's gonna give them a loan.

237
00:19:04,890 --> 00:19:17,870
So the idea is to create a synthetic identity and then through some collusion with rogue lenders, begin to apply for loans and then build credit history by returning the loan.

238
00:19:17,870 --> 00:19:20,750
So it's reported as a positive thing.

239
00:19:20,750 --> 00:19:31,690
Another trick is to attach this identity to someone who has a perfect FICO score, like a credit card account holder as a secondary user in that account.

240
00:19:31,690 --> 00:19:37,650
That's another thing that you can do to essentially get the tenure of a good user.

241
00:19:38,170 --> 00:19:54,190
So whether you focus on building a credit history or just, you know, a very good tenure, the idea is to create this identity and then, you know, create a credit history and, you know, good credit for that person who does not exist, of course.

242
00:19:54,190 --> 00:19:55,430
And then launching your attack.

243
00:19:55,430 --> 00:20:05,290
You know, you just go to a credit card company, open a credit card account, you maybe apply for a loan, a mortgage even, et cetera.

244
00:20:06,230 --> 00:20:10,930
One in four synthetic identities are actually using child's social security numbers.

245
00:20:10,930 --> 00:20:16,590
And the, you know, trafficking in child social security number in the dark web has increased dramatically.

246
00:20:17,000 --> 00:20:20,510
A lot of these are coming from healthcare breaches.

247
00:20:21,230 --> 00:20:22,910
So that's a very interesting trend.

248
00:20:22,910 --> 00:20:26,850
And of course, not something that we want to see, you know, in the industry.

249
00:20:27,030 --> 00:20:32,150
The reaction of the industry was to start suspecting lots of people.

250
00:20:32,590 --> 00:20:36,390
So let's actually see one example.

251
00:20:36,390 --> 00:20:50,390
We see someone who is 31 years old, no driver's license, very thin credit history, and the social security was issued recently, just a few years ago, obviously highly suspicious.

252
00:20:50,390 --> 00:20:56,050
They were asked to provide, you know, government records, tax records, and then they never submitted the records.

253
00:20:56,050 --> 00:20:57,490
So the transaction was canceled.

254
00:20:57,490 --> 00:20:59,010
The application was canceled.

255
00:20:59,150 --> 00:21:00,790
Let's see the way they apply.

256
00:21:00,790 --> 00:21:02,510
This is from an iPhone.

257
00:21:02,510 --> 00:21:05,010
So they're applying via an iPhone.

258
00:21:05,010 --> 00:21:08,230
They're providing right now their email.

259
00:21:09,070 --> 00:21:12,770
They're providing date of birth.

260
00:21:12,770 --> 00:21:18,670
They had a typo in the date of birth, so they corrected it and just continued, but it's all natural and very confident.

261
00:21:18,670 --> 00:21:20,070
This is the phone number.

262
00:21:21,210 --> 00:21:29,090
Little pause before annual income, they kind of thought about it, and then they provided the annual income, and then went to type the social security.

263
00:21:29,090 --> 00:21:32,410
And again, you can see it's all very natural, no pauses.

264
00:21:32,410 --> 00:21:36,210
This is not someone typing off a list, not someone pasting information.

265
00:21:36,210 --> 00:21:39,770
They're familiar with all of the personal data fields.

266
00:21:39,910 --> 00:21:48,670
Another interesting thing is, they also looked at the rates and fees for 90 seconds before even starting the application.

267
00:21:48,770 --> 00:21:54,150
Now, if you kind of look at all of these together, this is not gonna be a synthetic identity.

268
00:21:54,190 --> 00:21:58,450
This may be a suspect, but it looks like a genuine person.

269
00:21:58,450 --> 00:22:08,730
And when the credit issuer, you know, that had this level of analysis investigated further, what they found was, it's an immigrant.

270
00:22:08,730 --> 00:22:13,090
It kind of explains everything, you know, the SSN and the thin file.

271
00:22:13,850 --> 00:22:18,930
This is someone who works for a big tech firm in San Francisco area.

272
00:22:18,990 --> 00:22:22,190
They're actually a great candidate, a great acquisition target.

273
00:22:22,570 --> 00:22:31,370
So, you know, blaming them and pointing the finger and saying, hey, you probably some sort of synthetic identity, you have to prove yourself.

274
00:22:31,710 --> 00:22:35,730
That was something that almost killed that specific application.

275
00:22:35,730 --> 00:22:40,090
Of course, that's not what banks and issuers would like to do.

276
00:22:41,670 --> 00:22:42,950
Let's see the opposite.

277
00:22:43,050 --> 00:22:46,010
Now let's see someone who is too familiar with the process.

278
00:22:46,610 --> 00:22:51,570
You know, before we saw someone that was not familiar, wanting to see the terms and conditions and stuff like that.

279
00:22:51,570 --> 00:22:53,950
But this is someone who is too familiar.

280
00:22:54,470 --> 00:22:55,550
Income source, right?

281
00:22:55,550 --> 00:23:03,630
When you click on the income source, when you open an account, there's this window that says, okay, employed, retired, self-employed, unemployed, military, et cetera.

282
00:23:03,630 --> 00:23:08,230
It takes you maybe like four seconds, five seconds to read through and say, okay, well, I'm employed.

283
00:23:08,230 --> 00:23:09,830
So let's click employed.

284
00:23:10,650 --> 00:23:18,670
And then if we look at specific cyber grant, again, that was attacking one of the banks, it was less than a second.

285
00:23:18,670 --> 00:23:21,790
I mean, they knew what's going to happen.

286
00:23:21,790 --> 00:23:23,530
They have been there before.

287
00:23:23,530 --> 00:23:25,670
They are opening, you know, lots of accounts.

288
00:23:25,750 --> 00:23:28,710
So they're not stuck on this screen.

289
00:23:28,710 --> 00:23:29,730
They know what to select.

290
00:23:29,730 --> 00:23:33,710
It takes them less than a second to select something and then proceed.

291
00:23:33,710 --> 00:23:36,830
This is someone too familiar with the process.

292
00:23:36,970 --> 00:23:39,930
So if you think about all of the criminals, I mean, they have the data.

293
00:23:40,350 --> 00:23:48,150
They're attacking the same target, you know, again and again, because they know the specific controls in that specific target.

294
00:23:48,210 --> 00:23:51,150
They know they're not going to be caught.

295
00:23:51,270 --> 00:23:54,370
So therefore, they're going to be very familiar with the process.

296
00:23:54,370 --> 00:23:56,390
They're not going to be familiar with the data.

297
00:23:56,390 --> 00:23:59,750
And that's essentially what we see here.

298
00:23:59,890 --> 00:24:07,630
Another interesting trend is looking at the age of the user reflected in their behavior.

299
00:24:07,630 --> 00:24:10,710
And this is another fascinating example.

300
00:24:10,710 --> 00:24:16,450
This specific user applying for a credit card was born in 1918.

301
00:24:16,450 --> 00:24:18,590
You kind of remember the year, right?

302
00:24:18,590 --> 00:24:22,570
Because World War I ended and also the Spanish flu.

303
00:24:22,570 --> 00:24:24,610
That was also 1918.

304
00:24:24,710 --> 00:24:28,950
Let's see someone who is over 100 years old applying for a credit card.

305
00:24:28,950 --> 00:24:35,670
So extremely rapid mouse motion, extensive use of tab and mouse wheel.

306
00:24:35,670 --> 00:24:40,090
This is not typical for someone who is over 100 years old.

307
00:24:40,090 --> 00:24:53,350
And of course, it's all around statistics and probabilities, but it's highly unlikely that this person is such an elderly citizen.

308
00:24:53,760 --> 00:25:09,210
The bottom line is that when you look at criminals and a lot of the behavior that they will display is not going to be in line with genuine users, claimed age of the user or the known age of the user, et cetera.

309
00:25:10,650 --> 00:25:24,310
Another interesting thing is the fact that sometimes, even without seeing any of the data, you do know that something is wrong.

310
00:25:25,210 --> 00:25:29,530
And this is called the curious case of the straw company.

311
00:25:30,140 --> 00:25:30,910
Let me explain.

312
00:25:30,910 --> 00:25:31,990
This is a straw company.

313
00:25:34,090 --> 00:25:36,610
The name of the company, we kind of changed.

314
00:25:36,610 --> 00:25:41,450
It's not the last straw, but it's a company based in San Diego.

315
00:25:41,450 --> 00:25:45,190
It provides quality paper straws.

316
00:25:45,190 --> 00:25:47,710
As you know, in California, it's the law.

317
00:25:47,710 --> 00:25:52,170
You have to provide your customers with paper straws.

318
00:25:52,170 --> 00:25:55,030
So people can buy those packs.

319
00:25:55,030 --> 00:25:58,570
If you're a restaurant, you buy a crate full of straws.

320
00:25:58,810 --> 00:26:03,010
There was a sizable order of 62 crates.

321
00:26:04,770 --> 00:26:14,550
740,000 straws costing $15,000 plus $10,000 for urgent shipping to Tuvalu.

322
00:26:14,550 --> 00:26:16,290
What's Tuvalu?

323
00:26:16,290 --> 00:26:17,730
Welcome to Tuvalu.

324
00:26:17,730 --> 00:26:21,050
It's an island in the Pacific Ocean, 11,000 people.

325
00:26:21,050 --> 00:26:23,110
They don't need that many straws.

326
00:26:23,110 --> 00:26:25,150
So this is all curious.

327
00:26:25,450 --> 00:26:43,710
However, in this specific case, even without knowing any of this data, not the fact that it's a straw company selling straws, not the fact that it's a very big order, the number of straws, the payment for the straws, the $10,000 for the urgent shipping,

328
00:26:43,710 --> 00:26:55,850
the location in the middle of the Pacific Ocean, without seeing any of this data, you could know that this is fraud simply based on the way the information was provided.

329
00:26:55,970 --> 00:26:57,770
And again, let's see a quick video.

330
00:26:57,770 --> 00:27:12,170
This is someone pasting the credit card number and the CV2, typing the expiration and pasting the postal code.

331
00:27:12,170 --> 00:27:14,210
Think about your postal code.

332
00:27:14,210 --> 00:27:16,550
Did you ever paste your postal code?

333
00:27:16,550 --> 00:27:24,810
It's easier to type your postal code, you know, your zip code, than to type it, you know, easier to type it than to paste it.

334
00:27:24,810 --> 00:27:27,530
You know, people don't paste the zip code.

335
00:27:27,670 --> 00:27:33,910
In fact, when you look at the statistics, it's about 99.9% of the users, they never paste the zip code.

336
00:27:34,930 --> 00:27:42,870
This is by the way, one small fact, but there are, you know, dozens of features, you know, around each of those fields.

337
00:27:43,030 --> 00:27:48,710
Another interesting thing about zip code is how fast you begin typing your zip code.

338
00:27:48,950 --> 00:28:02,690
Because you're familiar with it, you have some muscle memory that immediately starts, you know, going into action and almost like automatically typing your zip code if you go through some sort of online form.

339
00:28:02,970 --> 00:28:08,450
Bottom line is this person is not familiar with their own zip code.

340
00:28:09,330 --> 00:28:17,230
Now, this was a curious case because you can say, okay, fine, we shouldn't trust this transaction.

341
00:28:17,230 --> 00:28:20,190
You know, it looks very, very suspicious.

342
00:28:20,630 --> 00:28:32,110
But why would a fraudster go through all of the trouble of buying 62 crates, okay, all of these straws and ship them urgently to Tuvalu?

343
00:28:32,110 --> 00:28:33,070
What's the point?

344
00:28:33,070 --> 00:28:34,330
What are they trying to achieve?

345
00:28:34,330 --> 00:28:39,050
I mean, are they trying to, you know, take the goods and then sell them in Tuvalu?

346
00:28:39,050 --> 00:28:40,910
What for, you know?

347
00:28:41,390 --> 00:28:44,910
You might think of all sorts of creative ideas.

348
00:28:44,910 --> 00:28:50,850
I mean, maybe they need the straws to buy some, you know, to build some huts.

349
00:28:51,470 --> 00:28:55,090
Tuvalu is actually having water level issues.

350
00:28:55,090 --> 00:29:01,310
I mean, the surface water level is rising all the time.

351
00:29:01,310 --> 00:29:03,850
Maybe they need the straws for emergency or something.

352
00:29:03,850 --> 00:29:06,030
No, it wasn't something like that.

353
00:29:06,030 --> 00:29:12,730
And the interesting thing about this specific fraud was the amount for the shipping, $10,000.

354
00:29:12,730 --> 00:29:16,990
The entire thing was built to inflate the amount.

355
00:29:16,990 --> 00:29:21,510
It's an urgent shipping to the middle of the Pacific Ocean, 62 crates.

356
00:29:21,510 --> 00:29:23,810
It will have to cost a fortune.

357
00:29:24,090 --> 00:29:27,010
So what actually happened here was the following.

358
00:29:27,030 --> 00:29:29,870
After making the payment, go through, right?

359
00:29:29,870 --> 00:29:33,770
So, you know, using a corporate credit card, one of the U.S.

360
00:29:33,770 --> 00:29:43,230
banks, the, you know, user called the merchant and said, hey, I have made a terrible mistake.

361
00:29:43,230 --> 00:29:45,670
I didn't realize it's so expensive.

362
00:29:45,670 --> 00:29:50,030
You know, $10,000, you know, your shipping company is crazy.

363
00:29:50,030 --> 00:29:52,070
They charge $10,000 for this.

364
00:29:52,070 --> 00:29:56,650
I have another shipping company that I prefer using and they only charge $2,000.

365
00:29:56,650 --> 00:29:57,870
Can you do me a favor?

366
00:29:57,870 --> 00:29:59,870
Because I already paid you $10,000.

367
00:30:00,350 --> 00:30:03,910
Can you move $10,000 to that shipping company?

368
00:30:03,950 --> 00:30:08,470
And then they'll use it for this shipping and then additional shipping that they'll have in the future.

369
00:30:08,470 --> 00:30:10,230
You know, like crediting me.

370
00:30:10,670 --> 00:30:13,050
And the merchant says, are you sure?

371
00:30:13,050 --> 00:30:14,410
I mean, there's lots of crates here.

372
00:30:14,410 --> 00:30:15,890
Yeah, they're fantastic.

373
00:30:15,890 --> 00:30:16,810
We work with them all the time.

374
00:30:16,810 --> 00:30:17,510
They're very cheap.

375
00:30:17,510 --> 00:30:19,890
You should, you know, use them for all of your shipping.

376
00:30:21,270 --> 00:30:28,430
And of course it wasn't a real, you know, shipping company, it was an account created or opened by the criminal.

377
00:30:28,510 --> 00:30:44,110
The bottom line is when you think about account opening, you know, even e-commerce fraud, any kind of case and scenario where you have a new user, you don't have any kind of profile on the user, prior behavior to look at, transaction monitoring to look at and things like that.

378
00:30:44,730 --> 00:31:03,590
You know that KYC is dead, but you do have more and more capabilities, device reputation, location analysis, this sort of analysis called behavior biometrics to tell you, hey, something is either very good about this or something is terribly wrong about this.

379
00:31:04,370 --> 00:31:10,650
Another interesting thing to notice that the AO fraud is really changing the ecosystem.

380
00:31:10,910 --> 00:31:14,070
This is from California.

381
00:31:15,090 --> 00:31:18,170
There was a new digital bank that was opened.

382
00:31:18,630 --> 00:31:28,130
And when you actually look at number of new users on a daily basis, you know, it's around 100 people on a daily basis.

383
00:31:28,210 --> 00:31:32,870
And all of a sudden, it jumped to about 700 people.

384
00:31:33,270 --> 00:31:34,450
So this is crazy.

385
00:31:34,450 --> 00:31:37,710
I mean, they said, hey, finally the marketing team is doing something.

386
00:31:37,730 --> 00:31:39,930
No, they're not.

387
00:31:39,930 --> 00:31:41,110
It's an attack.

388
00:31:41,110 --> 00:31:47,550
You have 100 good users and 600 bad users every day.

389
00:31:48,310 --> 00:32:00,350
And essentially the bank did have device reputation and email reputation, meaning what do we know about this email and how does it relate to the device and the phone and other elements.

390
00:32:00,350 --> 00:32:13,590
This was allowing them to stop about 50% of the attack, but there were still 300 people that were registering every day as opposed to something like 100 good users.

391
00:32:13,670 --> 00:32:15,070
This is not sustainable.

392
00:32:15,070 --> 00:32:28,230
The bank will have to either, you know, stop receiving new customers or allow them in, but then don't allow them to make, you know, any kind of money transfers or move money out until they sort out, you know, who's a good user and who's a bad user.

393
00:32:28,230 --> 00:32:32,290
And that's difficult because the criminals will know everything about the good users.

394
00:32:33,790 --> 00:32:38,610
Initially, when I looked at that, I thought that it may be like a bot that is opening all of these accounts.

395
00:32:38,650 --> 00:32:39,610
No, it wasn't.

396
00:32:39,610 --> 00:32:40,850
It was a human being.

397
00:32:41,110 --> 00:32:46,690
And in fact, it was a specific person that was opening all of these hundreds of accounts.

398
00:32:46,910 --> 00:32:48,690
They were doing it very mechanically.

399
00:32:48,690 --> 00:32:51,190
They were very familiar with the onboarding process.

400
00:32:51,210 --> 00:32:54,390
They were totally unfamiliar with the data, okay?

401
00:32:54,390 --> 00:32:58,870
Short the memory, typing mechanically, working off a list, not pasting any information.

402
00:32:58,870 --> 00:33:01,550
They were just typing all, you know, all day long.

403
00:33:02,230 --> 00:33:10,070
So that's essentially one of the risks that banks and fintech companies are facing these days.

404
00:33:10,070 --> 00:33:24,050
Whenever you launch a new digital product and you just open it to, you know, the entire world to register, if you don't have the right capabilities to detect those sort of attacks, you can go down.

405
00:33:24,110 --> 00:33:27,490
You can really suffer from a massive campaign like this.

406
00:33:27,490 --> 00:33:31,550
Not a bot campaign, not a DDoS attack, nothing like that.

407
00:33:31,550 --> 00:33:36,690
Just, you know, opening a lot of fake accounts that belong to real people.

408
00:33:36,870 --> 00:33:41,750
Not synthetic identities, it's just identity theft because the data is there.

409
00:33:41,750 --> 00:33:47,170
And then it's gonna be very, very problematic to handle the situation.

410
00:33:47,170 --> 00:33:50,230
So new digital banks, you know, good luck with that.

411
00:33:50,230 --> 00:33:53,570
Make sure that you have these sort of defenses in place.

412
00:33:53,650 --> 00:34:01,610
Another impact of account opening fraud on the economy is a new service in the US called Zelle.

413
00:34:01,610 --> 00:34:03,430
And I'm sure most of you know Zelle.

414
00:34:03,430 --> 00:34:04,470
It's a great service.

415
00:34:04,470 --> 00:34:07,550
It allows you to pay from your account.

416
00:34:08,730 --> 00:34:18,170
You know, I think that in the UK, you'll have similar types of money movement capabilities.

417
00:34:18,190 --> 00:34:22,130
You basically can send money to anyone in your contact list.

418
00:34:22,130 --> 00:34:25,850
You can send money to an email account, you know, things like that.

419
00:34:26,170 --> 00:34:52,010
This is in the US and because of the ease of account opening and the ease of compromising email accounts, the whole Zelle industry is essentially shaking because this is, you know, a single story, but it kind of reflects the underlying problem of the whole system.

420
00:34:52,010 --> 00:34:56,770
So in this case, this process randomly compromised the business owner's email account, right?

421
00:34:56,770 --> 00:35:19,730
So just a regular, you know, Gmail, Yahoo, whatever sort of account belonging to a person, they saw that this person was interacting with the renters of their property and saying, hey, if you want to move money, why don't you use Zelle?

422
00:35:19,730 --> 00:35:23,610
You can send me the rent money using Zelle.

423
00:35:23,610 --> 00:35:27,730
So what the criminal did was open a fake account, okay?

424
00:35:27,730 --> 00:35:39,870
Using the same information at a top five bank and then enrolling for Zelle at that bank using the compromised email.

425
00:35:39,910 --> 00:35:48,670
Now the thing is that once you use the email of the user, that new bank account is now attached to that email, right?

426
00:35:48,670 --> 00:35:54,210
The bank will obviously send something to the email like a one-time code that you have to repeat.

427
00:35:54,210 --> 00:35:57,830
So it basically proves that you control that email.

428
00:35:57,970 --> 00:36:03,030
But if that email is compromised, okay, this check doesn't mean anything.

429
00:36:03,030 --> 00:36:17,070
So essentially, you know, beating the KYC checks and then beating the email check of a new registration, attaching that new bank account to that email.

430
00:36:17,690 --> 00:36:22,990
And the bank said, okay, but this email address is already linked to another account at another bank.

431
00:36:22,990 --> 00:36:25,110
Do you want to change it to our bank?

432
00:36:25,110 --> 00:36:26,490
And the fraudster says, yeah.

433
00:36:26,870 --> 00:36:38,930
And the bank simply enrolled the fraudster in Zelle, you know, because now this email account, you know, basically is attached to this new account.

434
00:36:41,750 --> 00:36:56,050
And basically at that point, it's a game over because any money movement that will go to this email account will automatically go to the fraudster's new account at this top five bank.

435
00:36:56,110 --> 00:37:05,990
All right, so the renter sent the money to the Zelle email address as normal, but now going to a newly open account controlled by the criminal rather than the real user, game over.

436
00:37:05,990 --> 00:37:19,470
So essentially, the fact that account opening so far was not top priority for banks, credit card companies, et cetera, and it's changing the industry, right?

437
00:37:19,470 --> 00:37:21,790
You have all of these cases.

438
00:37:21,870 --> 00:37:23,630
It doesn't have to be fraud.

439
00:37:23,630 --> 00:37:25,210
It can also be money laundering.

440
00:37:25,210 --> 00:37:26,450
It can be mule accounts.

441
00:37:26,450 --> 00:37:33,890
Let's actually talk about mules because there is an implication of a high account opening fraud world.

442
00:37:34,570 --> 00:37:44,230
This is like a diagram, a very crude one, showing a typical fraud supply chain.

443
00:37:44,430 --> 00:37:47,830
Obviously, it's not a single person that can do everything.

444
00:37:47,830 --> 00:38:04,450
As a fraudster, you typically choose between am I gonna harvest information, break into accounts and break into databases or do phishing, frauds, et cetera, collect the information or am I gonna use that stolen information to cash out?

445
00:38:04,450 --> 00:38:06,750
Typically, people make that choice.

446
00:38:07,350 --> 00:38:18,650
The harvesting process would use tools and hosting and delivery mechanisms to infect more people or send them phishing emails and stuff like that, or just break into a database.

447
00:38:18,710 --> 00:38:23,950
The cash out process will be the ones that are tasked with emptying all of these accounts.

448
00:38:23,950 --> 00:38:28,630
They understand everything about the specific bank defenses, the credit card defenses.

449
00:38:28,650 --> 00:38:30,130
They know how to move money.

450
00:38:30,130 --> 00:38:32,090
They know what sort of controls are in place.

451
00:38:32,090 --> 00:38:39,770
And they also need to send the money, obviously not to themselves, but to some sort of collaboration account.

452
00:38:40,070 --> 00:38:50,610
And for many years, those were new accounts because it was very difficult to open an account, let's say locally, if you're a criminal outside of the UK to use an account in the UK.

453
00:38:50,610 --> 00:38:52,850
If you're outside of the US, use an account in the US.

454
00:38:52,850 --> 00:38:59,470
So you always recruited local collaborators, some of them knowingly, some of them unknowingly.

455
00:39:00,050 --> 00:39:09,230
I mean, in Australia, for example, there was a case where the criminals went to high schools and said, hey, you have like a teenager account.

456
00:39:09,770 --> 00:39:23,410
We are kind of a charity company, charity, big charity, and donors, people that have lots of money will send money to your account.

457
00:39:23,590 --> 00:39:28,870
You're gonna pass it to us, we're the charity in East Europe and you're gonna get a commission.

458
00:39:28,870 --> 00:39:35,270
So the teenagers didn't really realize they're actually collaborating with this sort of scheme.

459
00:39:35,270 --> 00:39:40,410
So sometimes the mules know that they're mules, sometimes they don't know that they're mules and they recruited.

460
00:39:41,390 --> 00:39:49,370
Mules have been a very important part of that ecosystem, but now you don't need them.

461
00:39:49,370 --> 00:39:50,830
You can be your own mule.

462
00:39:50,830 --> 00:39:53,090
You can just open an account online.

463
00:39:53,090 --> 00:40:03,270
It's so easy these days and just send money from your compromised account to your newly established account, saving the need to work with mules.

464
00:40:03,390 --> 00:40:07,810
It's saving you a lot of money, opening an account is free, you don't have to pay anyone.

465
00:40:07,870 --> 00:40:11,450
And once the money is in your new account, you can just do whatever you want with it.

466
00:40:11,450 --> 00:40:14,730
You can send it anywhere, you can buy things, whatever.

467
00:40:14,970 --> 00:40:20,970
So this is changing a lot of the economics of online fraud.

468
00:40:21,910 --> 00:40:24,070
All right, so let's actually summarize.

469
00:40:24,990 --> 00:40:26,370
What have we learned today?

470
00:40:27,110 --> 00:40:29,130
Identity is totally broken.

471
00:40:29,530 --> 00:40:31,270
Criminals behave differently.

472
00:40:31,810 --> 00:40:35,070
And when in doubt, call the dead guy.

473
00:40:37,670 --> 00:40:41,910
I hope you enjoyed the presentation and let's see if you have any questions.