Hey everyone, and welcome to Identity Crisis,
the mad rise of online account opening fraud.
My name is Yuri, and I'm Chief Cyber Officer
and Co-Founder at BioCatch.
We are at an identity crisis point.
If you were asking credit card companies and banks
a few years ago about account opening fraud,
they would say, yeah, it's a kind of a minor inconvenience.
That's not their reaction nowadays.
It's getting to be a tidal wave.
This is from Gartner a few years ago.
You can see things like account takeover fraud,
payment fraud, these are the main areas of concern
for risk and security management.
But there's one thing that tops all of these concerns,
and that's new account synthetic or stolen identity fraud.
So it is becoming the number one concern
regarding fraud in financial institutions.
Another interesting trend is to see
what sort of information financial criminals
are stealing these days.
It used to be credit card information.
That was the top priority for financial cyber criminals.
But now the number one data element
is social security number, which is an identity element.
And in fact, identity is becoming a commodity.
It's traded in the dark web,
and every American citizen's records
have already been stolen several times over.
If we can look at this list, for example,
it shows all sorts of data breaches.
Many of those are related to identity.
Specifically, if we talk about
the big credit reference agency,
the big credit bureaus,
data aggregators that have been hacked over the years,
and this fuels this economy of account opening fraud.
Now, the industry is fighting back,
realizing that good old KYC,
know your customer, is basically dead,
and long live next generation data.
So it used to be about what you know
and matching all of the information about the user,
looking at the data that the user provides
and seeing that it all stacks,
and it's what the records show.
But now we have additional data to look at.
For example, what you have, which is user resources,
and what you do, which is your digital footprint,
and what you are, user behavior, that behavior biometrics.
So a couple of examples for each of those categories.
Again, historically, this would be KYC data,
residence, license information, credit history information.
Those type of data points are already in the wrong hands.
And when someone, a cyber criminal,
is doing account opening fraud,
they have access to all of this.
So therefore, a lot of financial institutions
and other related industries
have started to untap additional lines of defense.
Starting with device,
this has been something that the industry started to adopt
about 10 years ago, 15 years ago.
What sort of device are you coming from?
What's the reputation of that device?
Information about your location,
information about your phone and phone line.
More recently, what are you doing?
So what's your digital footprint?
Any kind of social media reputation that you have,
email reputation, open source analysis on your identity.
And more recently, behavioral biometrics.
These are different types of analysis.
For example, if you're opening an account,
you should be familiar with the data that you're providing.
It's your own personal information.
You should not be familiar
with the process of account opening
because, hey, you've just opened an account.
A criminal is gonna be the opposite.
They're gonna be very familiar with the process,
but not familiar with the data.
And that's the sort of analysis
that behavioral biometrics is now providing.
So behavioral biometrics,
you kind of heard about behavioral biometrics before,
but more in the context of profiling.
So the idea of behavioral biometrics,
when it actually started,
was to create a profile of a regular user behavior
and then watch for anomalies.
This is a classic example.
You see someone that logs in
and then interacts with their online banking application.
What you see on the screen is the person's mouse motion.
These are several sessions, several pages,
but the mouse motion is basically the same.
So that's how you create a profile
of the regular user behavior.
You can use keyboard analysis.
You can analyze mouse motion.
If the user is operating on a mobile device,
you're gonna look at accelerometer, gyro, and touch data.
The idea is to create a baseline
and then watch for anomalies.
In this specific case, this account was compromised.
The user provided the credentials to a criminal,
and now the criminal is accessing the account.
You're gonna see a very different type of behavior.
So now it's not the same mouse motion.
There's a strange bump in the center of the motion.
And essentially, this is a way for the financial institution,
for example, to say,
hey, we do see an anomaly based on the profile,
based on the baseline that was created.
Another use of behavioral biometrics is to look for threats.
For example, remote access.
This is a mobile device.
User is interacting on a mobile device.
You can see the swipe motions.
These are not gonna be straight lines.
Even if you think that you move in a straight line
on your mobile device, you actually have a small arc.
Then you see the tabs.
Now the tabs are surrounded,
the dot is surrounded by a blue circle.
That's your finger pressing on the actual touch screen.
That's a normal situation for this account.
And now this account was compromised with a help desk scam.
Hey, we're the help desk,
there's something wrong with your account,
your bank account, your mobile device, something like that.
We're here to help you.
You just have to install something
allowing us remote assistance.
People fall for that and then install
some sort of remote assistant tools,
or maybe like a rogue application.
And then the attacker has remote access on their device.
This does not look the same.
Typically the attacker is gonna control that device
using a mouse and keyboard.
And essentially you're gonna see these long lines,
that's mouse motion,
not someone actually physically scrolling
up and down on the device.
And all of the dots,
you don't see the blue circle around them
because no one's actually touching the screen.
You know, mouse clicks.
Beyond that, because of the remote access,
there's gonna be some latency.
The latency creates some disruptions
to hand eye coordination.
And if you have the right system,
you can actually spot that and say,
okay, we now know that this mobile device
is being remotely controlled, right?
Now, if we talk about account opening though,
what's the use of behavioral barometrics?
You cannot really profile anyone.
They're just establishing the account, right?
But if you actually look at the way criminals behave,
you can now analyze second by second what they're doing.
We're gonna start with a very interesting case
from one of the top five credit card issuers in the US.
They basically give you a credit card online
within 30 seconds.
You go to the website, you select a credit card,
you click apply now,
and then you start filling this online form,
providing your name, email address, date of birth,
mobile phone number, address, social security number,
and other data points.
Essentially, that's what regular users will go through,
but also what criminals will go through.
So let's actually look at a specific application.
The session timeline here,
every vertical bar is an interaction,
like the user typed something or interacted with the form.
It took one minute and 34 seconds to complete that.
And the interesting thing is that the first name
was pasted three seconds into the session.
That's actually pretty incriminating.
You know, why are you pasting your first name?
You're supposed to be familiar with it.
And the other thing is, how come it's so fast?
There's actually a video that will show us how fast it was.
So three seconds into the session,
already we see control V.
It's not autofill, by the way.
Someone actually was ready before the application started,
form started, went to the application flow,
and then used control V to paste something.
That's criminal behavior.
Another thing that was pasted was the social security number,
the date of birth was also pasted.
You know, all of these suggest that whoever is doing this
are not really familiar with the personal information,
but they're also quite familiar with the process, right?
Three seconds and they're beginning to interact.
If we look at deposit fraud,
that's another interesting trend.
So we talked about credit card account opening.
Of course, a criminal will be interested in that
to just get a credit card or a loan
or some sort of instant credit.
But also deposit fraud is another lucrative type of business
because what you do there is you open a new account
and then you move money from a compromised account
that you have.
So let's say that you have money,
an account that you've compromised in bank A,
you open an account in bank B and say,
hey, I'm the user, I wanna open an account,
I wanna deposit something from bank A.
Typically bank B will send some small transaction to bank A
to prove that once you provide that specific amount
to prove that you own that account, you access that account
and you can provide that information.
Of course, they're gonna do all of the regular KYC checks.
But of course, if you own that account,
if you actually not own, but control that account,
you can provide all of that KYC information
because you have access to the identity information
and you also control the account in bank A,
you can just open an account in bank B
and move all of the money from account A to account B.
Thing is that bank B is now responsible for the fraud laws.
That's called deposit fraud.
And let's actually see someone opening an account.
They're pasting a lot of information.
In this case, they're pasting the routing code,
the account number, user ID, password,
when they do the actual payment.
And then the interesting thing here is,
all of this is happening quite fast.
And what you can see is they completed the funding.
Now they completed opening the account.
And look at the analysis showing genuine users
versus criminals.
About 2% of on an account opening sessions
will have this behavior where we see a paste
from a different application.
So essentially an alt tab to a different tab
and then paste the information from that tab.
That's 2% of the users.
For criminals, it's 25%.
This is pretty significant.
So it's quite informative seeing that.
At the same time, we also understand
that you cannot really incriminate 2% of the population
or we need more information because 25%
is not gonna be a good detection rate
if you wanna detect those sort of fraud cases.
So in any case, that's like one type of analysis.
Obviously, you need much more than that.
But deposit fraud is another type of account opening fraud
that is skyrocketing these days.
So we talked about pasting information.
We talked about typing information.
Now let's look at the difference
between good users and bad users.
Criminals are gonna type off a list.
So if they choose not to populate the field automatically
with some sort of bot or to use a pasting,
which you've seen that it's only 25% of the cases,
they will typically type off a list.
They have a list of victims.
Thing is that short memory is limited
to just seven characters or items.
So think about someone typing a social security number
that does not belong to them.
It will be very mechanical, right?
So we see someone typing the social security number.
It takes them quite like nine seconds to complete the SSN.
Typically it's gonna be something like four seconds
for an SSN.
Date of birth, it's like two digits.
I'm looking at the list.
I'm going back, okay, another two digits.
Okay, I know the year.
It's gonna be 19 something.
Okay, what's the number?
Again, going to the list, going back.
This is a very mechanical process.
Typing off a list is something
that you can also understand criminals do.
They wanna be efficient, they have a list,
but essentially that's the way for them
to show the fact that they are not familiar
with that information.
It's not top of their mind.
As opposed to something that we're gonna see right now,
sometimes the newer customer checks actually conflict
with the next generation analysis.
There was a specific case with one of the big card companies
that essentially said,
hey, we're gonna decline an application
because it's definitely fraud.
You know, 96% chance of something being fraud.
But when we looked at the data, it was interesting.
The session timeline, again,
is all of the activities that the user is doing.
And what you can see is that the social security number
is typed continuously.
And by the way, Behavioral Biometric
is not interested in the data itself.
You're gonna see it's all, you know, 111s.
When we actually look at it again,
the typing is quite confident.
You know, you don't see the same thing
like typing off of this.
Certainly you don't see any pasting.
It's not autofill.
Whoever is typing this information is quite familiar
with the social security number,
suggesting it's their own social security number.
Long-term memory is a very strong inheritance field.
The other interesting thing here, look at the timeline.
There's a 58 second pause.
Why?
Because in this specific case, it's a hotel credit card.
So in order to open the account,
you need to provide your hotel loyalty number.
You probably have some hotel loyalty numbers,
but no one remembers them.
And it takes you a minute or two to fetch them,
maybe from your inbox or something like that.
Maybe it's in your wallet.
So about one minute is the norm.
And we do see that this user also, you know,
paused for about one minute to fetch that number
and then continued with the application.
This is a very, very positive sign, right?
This person behaves like everyone else.
Criminals are not going to bother with waiting for one minute
because they need this information.
They have this information. It's all ready for them.
It's going to be right along, you know, the name,
date of birth and social security number
because they need it to open the account.
Whereas, you know, real users,
there's going to be some type of information
that you're going to be very familiar with.
It's etched in your long-term memory.
But other types of information you have to research,
you have to fetch.
And that's essentially analyzing
the way a genuine user will behave.
So what do we have here?
We have here a kind of a conflict
because the analysis suggests,
the next-generation analysis suggests
that it's a good user, right?
Familiar with the social security number,
behaves like everyone else.
But the card company said, hey, that's bad.
We were actually curious about that.
We asked the credit card company,
hey guys, what do you, you know,
why you think this is going to be a fraudulent application?
They said, well, we like you very much guys,
but it has to be fraud because the guy is dead.
He's been dead for 10 years.
You know, we checked the social security number.
It belongs to a dead person.
Well, that was bad.
I mean, we were so sure that this is,
you know, an actual genuine person.
And, you know, we asked the issuer,
can you actually call the user, you know,
to try and find out what went on here?
Because, you know, it looks so real,
like it's a real genuine person.
They said, they're dead.
We're not going to call them.
We had a bit of an argument and eventually they caved in
and said, okay, we're going to call them.
Let's see what happens.
So the fraud operations team now calls the user.
It was a miracle.
He picked up the phone.
He was not dead.
Ended up that he had a typo in the social security number.
He just had a mistake.
Let's see it again.
You know, typed very confidently,
but with a typo that the user did not realize.
This actually matched to a totally different person.
The name was wrong.
The social security was belonging to someone that died.
So sometimes the data is going to suggest
that this is a bad application,
but some of the next generation analysis
don't really care about the data.
It cares about the way you behave.
It cares about, you know, your device,
your, you know, other elements.
And therefore sometimes it's more trustworthy
than actually, you know, looking at the data itself.
Let's move to synthetic identity.
Synthetic identity is a very interesting new problem
in the U.S., relatively new.
It hasn't been around for over a decade,
but it's becoming more and more of a problem.
This is from ID Analytics.
And what you can see is, you know,
social security belonging to, you know,
one identity, a name is invented,
or, you know, belonging to a different identity,
date of birth, et cetera, et cetera.
It's like combining a kind of, you know,
sort of a digital identity
that does not really belong to any specific person
because it's a mashup of various identities.
Now, then what do they do with this identity?
Because that identity obviously cannot open a credit card,
right? They don't have any kind of credit history.
No one's gonna give them a loan.
So the idea is to create a synthetic identity
and then through some collusion with rogue lenders,
begin to apply for loans and then build credit history
by returning the loan.
So it's reported as a positive thing.
Another trick is to attach this identity
to someone who has a perfect FICO score,
like a credit card account holder
as a secondary user in that account.
That's another thing that you can do
to essentially get the tenure of a good user.
So whether you focus on building a credit history
or just, you know, a very good tenure,
the idea is to create this identity
and then, you know, create a credit history
and, you know, good credit for that person
who does not exist, of course.
And then launching your attack.
You know, you just go to a credit card company,
open a credit card account,
you maybe apply for a loan, a mortgage even, et cetera.
One in four synthetic identities
are actually using child's social security numbers.
And the, you know, trafficking in child social security number
in the dark web has increased dramatically.
A lot of these are coming from healthcare breaches.
So that's a very interesting trend.
And of course, not something that we want to see,
you know, in the industry.
The reaction of the industry
was to start suspecting lots of people.
So let's actually see one example.
We see someone who is 31 years old,
no driver's license, very thin credit history,
and the social security was issued recently,
just a few years ago, obviously highly suspicious.
They were asked to provide, you know,
government records, tax records,
and then they never submitted the records.
So the transaction was canceled.
The application was canceled.
Let's see the way they apply.
This is from an iPhone.
So they're applying via an iPhone.
They're providing right now their email.
They're providing date of birth.
They had a typo in the date of birth,
so they corrected it and just continued,
but it's all natural and very confident.
This is the phone number.
Little pause before annual income,
they kind of thought about it,
and then they provided the annual income,
and then went to type the social security.
And again, you can see it's all very natural, no pauses.
This is not someone typing off a list,
not someone pasting information.
They're familiar with all of the personal data fields.
Another interesting thing is,
they also looked at the rates and fees for 90 seconds
before even starting the application.
Now, if you kind of look at all of these together,
this is not gonna be a synthetic identity.
This may be a suspect, but it looks like a genuine person.
And when the credit issuer, you know,
that had this level of analysis investigated further,
what they found was, it's an immigrant.
It kind of explains everything, you know,
the SSN and the thin file.
This is someone who works for a big tech firm
in San Francisco area.
They're actually a great candidate,
a great acquisition target.
So, you know, blaming them and pointing the finger
and saying, hey, you probably some sort of
synthetic identity, you have to prove yourself.
That was something that almost killed
that specific application.
Of course, that's not what banks
and issuers would like to do.
Let's see the opposite.
Now let's see someone who is too familiar with the process.
You know, before we saw someone that was not familiar,
wanting to see the terms and conditions
and stuff like that.
But this is someone who is too familiar.
Income source, right?
When you click on the income source,
when you open an account, there's this window that says,
okay, employed, retired, self-employed, unemployed,
military, et cetera.
It takes you maybe like four seconds, five seconds
to read through and say, okay, well, I'm employed.
So let's click employed.
And then if we look at specific cyber grant,
again, that was attacking one of the banks,
it was less than a second.
I mean, they knew what's going to happen.
They have been there before.
They are opening, you know, lots of accounts.
So they're not stuck on this screen.
They know what to select.
It takes them less than a second to select something
and then proceed.
This is someone too familiar with the process.
So if you think about all of the criminals,
I mean, they have the data.
They're attacking the same target, you know,
again and again, because they know the specific controls
in that specific target.
They know they're not going to be caught.
So therefore, they're going to be very familiar
with the process.
They're not going to be familiar with the data.
And that's essentially what we see here.
Another interesting trend is looking at the age
of the user reflected in their behavior.
And this is another fascinating example.
This specific user applying for a credit card
was born in 1918.
You kind of remember the year, right?
Because World War I ended and also the Spanish flu.
That was also 1918.
Let's see someone who is over 100 years old
applying for a credit card.
So extremely rapid mouse motion,
extensive use of tab and mouse wheel.
This is not typical for someone who is over 100 years old.
And of course, it's all around statistics and probabilities,
but it's highly unlikely that this person
is such an elderly citizen.
The bottom line is that when you look at criminals
and a lot of the behavior that they will display
is not going to be in line with genuine users,
claimed age of the user or the known age of the user,
et cetera.
Another interesting thing is the fact that sometimes,
even without seeing any of the data,
you do know that something is wrong.
And this is called the curious case of the straw company.
Let me explain.
This is a straw company.
The name of the company, we kind of changed.
It's not the last straw,
but it's a company based in San Diego.
It provides quality paper straws.
As you know, in California, it's the law.
You have to provide your customers with paper straws.
So people can buy those packs.
If you're a restaurant, you buy a crate full of straws.
There was a sizable order of 62 crates.
740,000 straws costing $15,000
plus $10,000 for urgent shipping to Tuvalu.
What's Tuvalu?
Welcome to Tuvalu.
It's an island in the Pacific Ocean, 11,000 people.
They don't need that many straws.
So this is all curious.
However, in this specific case,
even without knowing any of this data,
not the fact that it's a straw company selling straws,
not the fact that it's a very big order,
the number of straws, the payment for the straws,
the $10,000 for the urgent shipping,
the location in the middle of the Pacific Ocean,
without seeing any of this data,
you could know that this is fraud
simply based on the way the information was provided.
And again, let's see a quick video.
This is someone pasting the credit card number
and the CV2,
typing the expiration
and pasting the postal code.
Think about your postal code.
Did you ever paste your postal code?
It's easier to type your postal code,
you know, your zip code,
than to type it, you know,
easier to type it than to paste it.
You know, people don't paste the zip code.
In fact, when you look at the statistics,
it's about 99.9% of the users,
they never paste the zip code.
This is by the way, one small fact,
but there are, you know, dozens of features,
you know, around each of those fields.
Another interesting thing about zip code
is how fast you begin typing your zip code.
Because you're familiar with it,
you have some muscle memory that immediately starts,
you know, going into action
and almost like automatically typing your zip code
if you go through some sort of online form.
Bottom line is this person is not familiar
with their own zip code.
Now, this was a curious case
because you can say, okay, fine,
we shouldn't trust this transaction.
You know, it looks very, very suspicious.
But why would a fraudster go through all of the trouble
of buying 62 crates, okay, all of these straws
and ship them urgently to Tuvalu?
What's the point?
What are they trying to achieve?
I mean, are they trying to, you know,
take the goods and then sell them in Tuvalu?
What for, you know?
You might think of all sorts of creative ideas.
I mean, maybe they need the straws to buy some,
you know, to build some huts.
Tuvalu is actually having water level issues.
I mean, the surface water level is rising all the time.
Maybe they need the straws for emergency or something.
No, it wasn't something like that.
And the interesting thing about this specific fraud
was the amount for the shipping, $10,000.
The entire thing was built to inflate the amount.
It's an urgent shipping to the middle of the Pacific Ocean,
62 crates.
It will have to cost a fortune.
So what actually happened here was the following.
After making the payment, go through, right?
So, you know, using a corporate credit card,
one of the U.S. banks,
the, you know, user called the merchant and said,
hey, I have made a terrible mistake.
I didn't realize it's so expensive.
You know, $10,000, you know,
your shipping company is crazy.
They charge $10,000 for this.
I have another shipping company that I prefer using
and they only charge $2,000.
Can you do me a favor?
Because I already paid you $10,000.
Can you move $10,000 to that shipping company?
And then they'll use it for this shipping
and then additional shipping that they'll have in the future.
You know, like crediting me.
And the merchant says, are you sure?
I mean, there's lots of crates here.
Yeah, they're fantastic.
We work with them all the time.
They're very cheap.
You should, you know, use them for all of your shipping.
And of course it wasn't a real, you know,
shipping company, it was an account created
or opened by the criminal.
The bottom line is when you think about account opening,
you know, even e-commerce fraud,
any kind of case and scenario where you have a new user,
you don't have any kind of profile on the user,
prior behavior to look at,
transaction monitoring to look at and things like that.
You know that KYC is dead,
but you do have more and more capabilities,
device reputation, location analysis,
this sort of analysis called behavior biometrics
to tell you, hey, something is either very good about this
or something is terribly wrong about this.
Another interesting thing to notice
that the AO fraud is really changing the ecosystem.
This is from California.
There was a new digital bank
that was opened.
And when you actually look at number of new users
on a daily basis, you know,
it's around 100 people on a daily basis.
And all of a sudden, it jumped to about 700 people.
So this is crazy.
I mean, they said, hey,
finally the marketing team is doing something.
No, they're not.
It's an attack.
You have 100 good users
and 600 bad users every day.
And essentially the bank did have device reputation
and email reputation,
meaning what do we know about this email
and how does it relate to the device
and the phone and other elements.
This was allowing them to stop about 50% of the attack,
but there were still 300 people
that were registering every day
as opposed to something like 100 good users.
This is not sustainable.
The bank will have to either, you know,
stop receiving new customers or allow them in,
but then don't allow them to make, you know,
any kind of money transfers or move money out
until they sort out, you know,
who's a good user and who's a bad user.
And that's difficult
because the criminals will know everything
about the good users.
Initially, when I looked at that,
I thought that it may be like a bot
that is opening all of these accounts.
No, it wasn't.
It was a human being.
And in fact, it was a specific person
that was opening all of these hundreds of accounts.
They were doing it very mechanically.
They were very familiar with the onboarding process.
They were totally unfamiliar with the data, okay?
Short the memory, typing mechanically, working off a list,
not pasting any information.
They were just typing all, you know, all day long.
So that's essentially one of the risks
that banks and fintech companies are facing these days.
Whenever you launch a new digital product
and you just open it to, you know,
the entire world to register,
if you don't have the right capabilities
to detect those sort of attacks, you can go down.
You can really suffer from a massive campaign like this.
Not a bot campaign, not a DDoS attack, nothing like that.
Just, you know, opening a lot of fake accounts
that belong to real people.
Not synthetic identities, it's just identity theft
because the data is there.
And then it's gonna be very, very problematic
to handle the situation.
So new digital banks, you know, good luck with that.
Make sure that you have these sort of defenses in place.
Another impact of account opening fraud on the economy
is a new service in the US called Zelle.
And I'm sure most of you know Zelle.
It's a great service.
It allows you to pay from your account.
You know, I think that in the UK,
you'll have similar types of money movement capabilities.
You basically can send money to anyone in your contact list.
You can send money to an email account,
you know, things like that.
This is in the US and because of the ease of account opening
and the ease of compromising email accounts,
the whole Zelle industry is essentially shaking
because this is, you know, a single story,
but it kind of reflects the underlying problem
of the whole system.
So in this case,
this process randomly compromised
the business owner's email account, right?
So just a regular, you know, Gmail, Yahoo,
whatever sort of account belonging to a person,
they saw that this person was interacting
with the renters of their property and saying,
hey, if you want to move money, why don't you use Zelle?
You can send me the rent money using Zelle.
So what the criminal did was open a fake account, okay?
Using the same information at a top five bank
and then enrolling for Zelle at that bank
using the compromised email.
Now the thing is that once you use the email of the user,
that new bank account is now attached to that email, right?
The bank will obviously send something to the email
like a one-time code that you have to repeat.
So it basically proves that you control that email.
But if that email is compromised, okay,
this check doesn't mean anything.
So essentially, you know, beating the KYC checks
and then beating the email check of a new registration,
attaching that new bank account to that email.
And the bank said, okay, but this email address
is already linked to another account at another bank.
Do you want to change it to our bank?
And the fraudster says, yeah.
And the bank simply enrolled the fraudster in Zelle,
you know, because now this email account, you know,
basically is attached to this new account.
And basically at that point, it's a game over
because any money movement that will go to this email account
will automatically go to the fraudster's new account
at this top five bank.
All right, so the renter sent the money
to the Zelle email address as normal,
but now going to a newly open account
controlled by the criminal
rather than the real user, game over.
So essentially, the fact that account opening
so far was not top priority for banks,
credit card companies, et cetera,
and it's changing the industry, right?
You have all of these cases.
It doesn't have to be fraud.
It can also be money laundering.
It can be mule accounts.
Let's actually talk about mules
because there is an implication
of a high account opening fraud world.
This is like a diagram, a very crude one,
showing a typical fraud supply chain.
Obviously, it's not a single person that can do everything.
As a fraudster, you typically choose
between am I gonna harvest information,
break into accounts and break into databases
or do phishing, frauds, et cetera, collect the information
or am I gonna use that stolen information to cash out?
Typically, people make that choice.
The harvesting process would use tools
and hosting and delivery mechanisms
to infect more people or send them phishing emails
and stuff like that, or just break into a database.
The cash out process will be the ones
that are tasked with emptying all of these accounts.
They understand everything about the specific bank defenses,
the credit card defenses.
They know how to move money.
They know what sort of controls are in place.
And they also need to send the money,
obviously not to themselves,
but to some sort of collaboration account.
And for many years, those were new accounts
because it was very difficult to open an account,
let's say locally, if you're a criminal outside of the UK
to use an account in the UK.
If you're outside of the US, use an account in the US.
So you always recruited local collaborators,
some of them knowingly, some of them unknowingly.
I mean, in Australia, for example,
there was a case where the criminals went to high schools
and said, hey, you have like a teenager account.
We are kind of a charity company,
charity, big charity, and donors,
people that have lots of money
will send money to your account.
You're gonna pass it to us, we're the charity in East Europe
and you're gonna get a commission.
So the teenagers didn't really realize
they're actually collaborating with this sort of scheme.
So sometimes the mules know that they're mules,
sometimes they don't know that they're mules
and they recruited.
Mules have been a very important part of that ecosystem,
but now you don't need them.
You can be your own mule.
You can just open an account online.
It's so easy these days and just send money
from your compromised account
to your newly established account,
saving the need to work with mules.
It's saving you a lot of money,
opening an account is free, you don't have to pay anyone.
And once the money is in your new account,
you can just do whatever you want with it.
You can send it anywhere, you can buy things, whatever.
So this is changing a lot of the economics of online fraud.
All right, so let's actually summarize.
What have we learned today?
Identity is totally broken.
Criminals behave differently.
And when in doubt, call the dead guy.
I hope you enjoyed the presentation
and let's see if you have any questions.