start	end	text
1030	4210	Hey everyone, and welcome to Identity Crisis,
4210	7190	the mad rise of online account opening fraud.
7190	9750	My name is Yuri, and I'm Chief Cyber Officer
9750	12670	and Co-Founder at BioCatch.
12990	16730	We are at an identity crisis point.
17350	21550	If you were asking credit card companies and banks
21690	24970	a few years ago about account opening fraud,
24970	28150	they would say, yeah, it's a kind of a minor inconvenience.
28150	30230	That's not their reaction nowadays.
30770	33770	It's getting to be a tidal wave.
34010	36730	This is from Gartner a few years ago.
36730	39830	You can see things like account takeover fraud,
39830	42970	payment fraud, these are the main areas of concern
42970	46350	for risk and security management.
46470	51110	But there's one thing that tops all of these concerns,
51110	55710	and that's new account synthetic or stolen identity fraud.
55710	58350	So it is becoming the number one concern
59290	63990	regarding fraud in financial institutions.
64460	66370	Another interesting trend is to see
66370	70710	what sort of information financial criminals
70710	72830	are stealing these days.
72830	75010	It used to be credit card information.
75010	78910	That was the top priority for financial cyber criminals.
78910	81770	But now the number one data element
81770	86530	is social security number, which is an identity element.
86530	90290	And in fact, identity is becoming a commodity.
90290	92270	It's traded in the dark web,
92810	96990	and every American citizen's records
97670	101190	have already been stolen several times over.
101730	103970	If we can look at this list, for example,
103970	107270	it shows all sorts of data breaches.
107570	111270	Many of those are related to identity.
111870	113290	Specifically, if we talk about
113290	115430	the big credit reference agency,
115430	116730	the big credit bureaus,
117790	121350	data aggregators that have been hacked over the years,
121350	126230	and this fuels this economy of account opening fraud.
126270	128370	Now, the industry is fighting back,
128370	131690	realizing that good old KYC,
131690	134590	know your customer, is basically dead,
134590	137090	and long live next generation data.
137190	139350	So it used to be about what you know
139350	142510	and matching all of the information about the user,
142510	145730	looking at the data that the user provides
145730	147830	and seeing that it all stacks,
147830	151530	and it's what the records show.
152190	154990	But now we have additional data to look at.
154990	158330	For example, what you have, which is user resources,
158330	161350	and what you do, which is your digital footprint,
161350	165150	and what you are, user behavior, that behavior biometrics.
165250	168190	So a couple of examples for each of those categories.
168210	171950	Again, historically, this would be KYC data,
172360	176770	residence, license information, credit history information.
177430	181650	Those type of data points are already in the wrong hands.
181650	184410	And when someone, a cyber criminal,
184410	185930	is doing account opening fraud,
185930	188110	they have access to all of this.
188910	192670	So therefore, a lot of financial institutions
193000	195190	and other related industries
195580	199610	have started to untap additional lines of defense.
199610	200850	Starting with device,
200850	205010	this has been something that the industry started to adopt
205550	208110	about 10 years ago, 15 years ago.
208690	210670	What sort of device are you coming from?
210670	212730	What's the reputation of that device?
212730	215410	Information about your location,
215410	218290	information about your phone and phone line.
219090	221610	More recently, what are you doing?
221610	223310	So what's your digital footprint?
223310	225770	Any kind of social media reputation that you have,
225770	229870	email reputation, open source analysis on your identity.
229870	232750	And more recently, behavioral biometrics.
233170	235910	These are different types of analysis.
235910	238810	For example, if you're opening an account,
238810	242290	you should be familiar with the data that you're providing.
242290	244230	It's your own personal information.
244250	245390	You should not be familiar
245390	246790	with the process of account opening
246790	248950	because, hey, you've just opened an account.
249150	250950	A criminal is gonna be the opposite.
250950	253350	They're gonna be very familiar with the process,
253350	254990	but not familiar with the data.
254990	257370	And that's the sort of analysis
257370	260630	that behavioral biometrics is now providing.
261350	263270	So behavioral biometrics,
263270	266190	you kind of heard about behavioral biometrics before,
266190	268910	but more in the context of profiling.
269030	271050	So the idea of behavioral biometrics,
271050	273350	when it actually started,
273350	277150	was to create a profile of a regular user behavior
277150	279090	and then watch for anomalies.
279090	280930	This is a classic example.
280930	284190	You see someone that logs in
284190	286930	and then interacts with their online banking application.
286930	290330	What you see on the screen is the person's mouse motion.
290730	293150	These are several sessions, several pages,
293150	295650	but the mouse motion is basically the same.
295650	297450	So that's how you create a profile
297450	300270	of the regular user behavior.
300270	303110	You can use keyboard analysis.
303110	305330	You can analyze mouse motion.
305330	307610	If the user is operating on a mobile device,
307610	311250	you're gonna look at accelerometer, gyro, and touch data.
311350	313370	The idea is to create a baseline
313820	315670	and then watch for anomalies.
315670	318870	In this specific case, this account was compromised.
318870	321330	The user provided the credentials to a criminal,
321330	323390	and now the criminal is accessing the account.
323390	326570	You're gonna see a very different type of behavior.
326850	330210	So now it's not the same mouse motion.
330210	332690	There's a strange bump in the center of the motion.
332870	336470	And essentially, this is a way for the financial institution,
336470	337510	for example, to say,
337510	341090	hey, we do see an anomaly based on the profile,
341090	343950	based on the baseline that was created.
343950	347710	Another use of behavioral biometrics is to look for threats.
347710	349970	For example, remote access.
350230	351770	This is a mobile device.
351770	354210	User is interacting on a mobile device.
354210	356270	You can see the swipe motions.
356270	358390	These are not gonna be straight lines.
358390	361810	Even if you think that you move in a straight line
361810	364690	on your mobile device, you actually have a small arc.
365150	366610	Then you see the tabs.
366610	369110	Now the tabs are surrounded,
369110	371550	the dot is surrounded by a blue circle.
371550	375030	That's your finger pressing on the actual touch screen.
375030	377510	That's a normal situation for this account.
377590	381050	And now this account was compromised with a help desk scam.
381050	382070	Hey, we're the help desk,
382070	383950	there's something wrong with your account,
383950	387350	your bank account, your mobile device, something like that.
387350	389270	We're here to help you.
389270	390790	You just have to install something
391390	394030	allowing us remote assistance.
394050	395950	People fall for that and then install
395950	399350	some sort of remote assistant tools,
400250	403330	or maybe like a rogue application.
403330	406650	And then the attacker has remote access on their device.
406650	408550	This does not look the same.
408830	412230	Typically the attacker is gonna control that device
412230	414690	using a mouse and keyboard.
414690	417930	And essentially you're gonna see these long lines,
417930	419230	that's mouse motion,
419230	421790	not someone actually physically scrolling
421790	423710	up and down on the device.
423710	424710	And all of the dots,
424710	426310	you don't see the blue circle around them
426310	428910	because no one's actually touching the screen.
428910	430450	You know, mouse clicks.
430670	432810	Beyond that, because of the remote access,
432810	434490	there's gonna be some latency.
434630	436750	The latency creates some disruptions
436750	438530	to hand eye coordination.
438570	439650	And if you have the right system,
439650	441150	you can actually spot that and say,
441150	443890	okay, we now know that this mobile device
443890	446350	is being remotely controlled, right?
446850	449710	Now, if we talk about account opening though,
449710	451350	what's the use of behavioral barometrics?
451350	453390	You cannot really profile anyone.
453750	457490	They're just establishing the account, right?
458150	461630	But if you actually look at the way criminals behave,
462190	466690	you can now analyze second by second what they're doing.
466690	470450	We're gonna start with a very interesting case
470450	474850	from one of the top five credit card issuers in the US.
475210	477610	They basically give you a credit card online
477610	478790	within 30 seconds.
478790	481270	You go to the website, you select a credit card,
481270	482950	you click apply now,
482950	486050	and then you start filling this online form,
486050	489770	providing your name, email address, date of birth,
489770	493530	mobile phone number, address, social security number,
493530	495050	and other data points.
495930	499650	Essentially, that's what regular users will go through,
499650	501430	but also what criminals will go through.
501430	505630	So let's actually look at a specific application.
506170	508230	The session timeline here,
508230	510470	every vertical bar is an interaction,
510470	514390	like the user typed something or interacted with the form.
514390	517930	It took one minute and 34 seconds to complete that.
518210	520030	And the interesting thing is that the first name
520030	523690	was pasted three seconds into the session.
524490	527110	That's actually pretty incriminating.
527410	530350	You know, why are you pasting your first name?
530350	532410	You're supposed to be familiar with it.
532410	535010	And the other thing is, how come it's so fast?
535010	539150	There's actually a video that will show us how fast it was.
539310	541690	So three seconds into the session,
541690	543530	already we see control V.
543530	545590	It's not autofill, by the way.
545950	551310	Someone actually was ready before the application started,
551310	555030	form started, went to the application flow,
555030	557750	and then used control V to paste something.
557750	559870	That's criminal behavior.
560330	564270	Another thing that was pasted was the social security number,
564270	566290	the date of birth was also pasted.
566290	568950	You know, all of these suggest that whoever is doing this
568950	573510	are not really familiar with the personal information,
573510	575590	but they're also quite familiar with the process, right?
575590	578350	Three seconds and they're beginning to interact.
579730	582010	If we look at deposit fraud,
582010	584010	that's another interesting trend.
584010	586230	So we talked about credit card account opening.
586230	588210	Of course, a criminal will be interested in that
588210	590090	to just get a credit card or a loan
590090	592570	or some sort of instant credit.
592770	598070	But also deposit fraud is another lucrative type of business
598070	601270	because what you do there is you open a new account
601710	604010	and then you move money from a compromised account
604010	605390	that you have.
605630	607610	So let's say that you have money,
607610	610670	an account that you've compromised in bank A,
610670	612870	you open an account in bank B and say,
612870	615570	hey, I'm the user, I wanna open an account,
615570	617830	I wanna deposit something from bank A.
618370	623050	Typically bank B will send some small transaction to bank A
623050	627810	to prove that once you provide that specific amount
627810	630410	to prove that you own that account, you access that account
630730	632650	and you can provide that information.
632690	636490	Of course, they're gonna do all of the regular KYC checks.
636590	638530	But of course, if you own that account,
638530	642330	if you actually not own, but control that account,
642930	645990	you can provide all of that KYC information
645990	649630	because you have access to the identity information
649630	652870	and you also control the account in bank A,
652870	655030	you can just open an account in bank B
655030	658590	and move all of the money from account A to account B.
658590	663630	Thing is that bank B is now responsible for the fraud laws.
663630	665050	That's called deposit fraud.
665050	667470	And let's actually see someone opening an account.
667810	670370	They're pasting a lot of information.
670370	674790	In this case, they're pasting the routing code,
674790	677890	the account number, user ID, password,
678210	685050	when they do the actual payment.
685620	688870	And then the interesting thing here is,
688870	691530	all of this is happening quite fast.
691530	694510	And what you can see is they completed the funding.
694510	696910	Now they completed opening the account.
697550	703150	And look at the analysis showing genuine users
703150	704590	versus criminals.
704590	707090	About 2% of on an account opening sessions
707090	710890	will have this behavior where we see a paste
710890	712350	from a different application.
712350	714910	So essentially an alt tab to a different tab
715290	718130	and then paste the information from that tab.
718210	720270	That's 2% of the users.
720270	721990	For criminals, it's 25%.
722670	725250	This is pretty significant.
725250	727370	So it's quite informative seeing that.
727370	729390	At the same time, we also understand
729390	732150	that you cannot really incriminate 2% of the population
732710	735670	or we need more information because 25%
736370	739290	is not gonna be a good detection rate
739290	742050	if you wanna detect those sort of fraud cases.
742050	745210	So in any case, that's like one type of analysis.
745630	747830	Obviously, you need much more than that.
747830	751170	But deposit fraud is another type of account opening fraud
751170	753570	that is skyrocketing these days.
753990	756430	So we talked about pasting information.
756430	760430	We talked about typing information.
760430	761930	Now let's look at the difference
761930	764290	between good users and bad users.
764810	766990	Criminals are gonna type off a list.
766990	771270	So if they choose not to populate the field automatically
771270	774470	with some sort of bot or to use a pasting,
774470	778210	which you've seen that it's only 25% of the cases,
778210	779870	they will typically type off a list.
779870	781570	They have a list of victims.
782250	784210	Thing is that short memory is limited
784210	787070	to just seven characters or items.
787710	789950	So think about someone typing a social security number
789950	791410	that does not belong to them.
791410	794030	It will be very mechanical, right?
794230	799250	So we see someone typing the social security number.
799250	804670	It takes them quite like nine seconds to complete the SSN.
804670	807870	Typically it's gonna be something like four seconds
807870	809190	for an SSN.
810370	813530	Date of birth, it's like two digits.
813650	814790	I'm looking at the list.
814790	816790	I'm going back, okay, another two digits.
817130	818150	Okay, I know the year.
818150	819730	It's gonna be 19 something.
819730	821010	Okay, what's the number?
821010	823330	Again, going to the list, going back.
823330	825290	This is a very mechanical process.
825290	826170	Typing off a list is something
826170	830090	that you can also understand criminals do.
830430	832530	They wanna be efficient, they have a list,
832530	834770	but essentially that's the way for them
834770	839270	to show the fact that they are not familiar
839270	840210	with that information.
840210	841930	It's not top of their mind.
843390	845490	As opposed to something that we're gonna see right now,
845490	848870	sometimes the newer customer checks actually conflict
848870	850790	with the next generation analysis.
850790	853890	There was a specific case with one of the big card companies
854450	855970	that essentially said,
855970	857550	hey, we're gonna decline an application
857550	859810	because it's definitely fraud.
859810	863330	You know, 96% chance of something being fraud.
863610	866510	But when we looked at the data, it was interesting.
866530	868510	The session timeline, again,
868510	871050	is all of the activities that the user is doing.
871210	873890	And what you can see is that the social security number
873890	875830	is typed continuously.
876210	877170	And by the way, Behavioral Biometric
877170	879150	is not interested in the data itself.
879150	881330	You're gonna see it's all, you know, 111s.
881330	883890	When we actually look at it again,
883890	885990	the typing is quite confident.
886310	888590	You know, you don't see the same thing
888590	890030	like typing off of this.
890030	891810	Certainly you don't see any pasting.
891810	893170	It's not autofill.
893390	895910	Whoever is typing this information is quite familiar
895910	897250	with the social security number,
897250	900350	suggesting it's their own social security number.
900350	902830	Long-term memory is a very strong inheritance field.
903090	906230	The other interesting thing here, look at the timeline.
906290	908870	There's a 58 second pause.
908870	909590	Why?
909590	914310	Because in this specific case, it's a hotel credit card.
914370	916250	So in order to open the account,
916250	918710	you need to provide your hotel loyalty number.
918710	921150	You probably have some hotel loyalty numbers,
921150	922890	but no one remembers them.
922890	925170	And it takes you a minute or two to fetch them,
925170	927610	maybe from your inbox or something like that.
927610	928890	Maybe it's in your wallet.
929750	932310	So about one minute is the norm.
932590	935250	And we do see that this user also, you know,
935250	938110	paused for about one minute to fetch that number
938110	940090	and then continued with the application.
940290	943770	This is a very, very positive sign, right?
943770	946410	This person behaves like everyone else.
946410	949210	Criminals are not going to bother with waiting for one minute
949210	951090	because they need this information.
951090	953370	They have this information. It's all ready for them.
953370	955550	It's going to be right along, you know, the name,
955550	957290	date of birth and social security number
957970	960350	because they need it to open the account.
960730	963310	Whereas, you know, real users,
963310	964830	there's going to be some type of information
964830	966650	that you're going to be very familiar with.
966650	969170	It's etched in your long-term memory.
969450	971610	But other types of information you have to research,
971610	972990	you have to fetch.
974030	975730	And that's essentially analyzing
975730	979350	the way a genuine user will behave.
979490	980510	So what do we have here?
980510	982090	We have here a kind of a conflict
982090	984890	because the analysis suggests,
984890	986110	the next-generation analysis suggests
986110	988110	that it's a good user, right?
988110	989530	Familiar with the social security number,
989530	990970	behaves like everyone else.
991010	994030	But the card company said, hey, that's bad.
994370	996050	We were actually curious about that.
996050	997250	We asked the credit card company,
997250	998870	hey guys, what do you, you know,
998870	1002250	why you think this is going to be a fraudulent application?
1002470	1004610	They said, well, we like you very much guys,
1004610	1008070	but it has to be fraud because the guy is dead.
1008190	1009990	He's been dead for 10 years.
1009990	1011930	You know, we checked the social security number.
1011930	1013670	It belongs to a dead person.
1014610	1016070	Well, that was bad.
1016210	1018730	I mean, we were so sure that this is,
1019150	1021610	you know, an actual genuine person.
1022070	1024410	And, you know, we asked the issuer,
1024410	1026670	can you actually call the user, you know,
1026670	1028790	to try and find out what went on here?
1028790	1031210	Because, you know, it looks so real,
1031210	1033370	like it's a real genuine person.
1033370	1034830	They said, they're dead.
1034830	1035910	We're not going to call them.
1035910	1038530	We had a bit of an argument and eventually they caved in
1038530	1040150	and said, okay, we're going to call them.
1040150	1041310	Let's see what happens.
1042450	1046190	So the fraud operations team now calls the user.
1046230	1047390	It was a miracle.
1047390	1048210	He picked up the phone.
1048210	1049250	He was not dead.
1050390	1054510	Ended up that he had a typo in the social security number.
1054510	1055690	He just had a mistake.
1055690	1056810	Let's see it again.
1057030	1058990	You know, typed very confidently,
1058990	1061550	but with a typo that the user did not realize.
1062090	1064590	This actually matched to a totally different person.
1064590	1065410	The name was wrong.
1065410	1068870	The social security was belonging to someone that died.
1069730	1072350	So sometimes the data is going to suggest
1072350	1074770	that this is a bad application,
1074770	1076830	but some of the next generation analysis
1076830	1078490	don't really care about the data.
1078490	1081230	It cares about the way you behave.
1081230	1083350	It cares about, you know, your device,
1083350	1085690	your, you know, other elements.
1085790	1088530	And therefore sometimes it's more trustworthy
1088530	1091610	than actually, you know, looking at the data itself.
1092290	1094330	Let's move to synthetic identity.
1094330	1096870	Synthetic identity is a very interesting new problem
1096870	1099250	in the U.S., relatively new.
1099450	1101850	It hasn't been around for over a decade,
1101850	1104930	but it's becoming more and more of a problem.
1105530	1106950	This is from ID Analytics.
1106950	1109550	And what you can see is, you know,
1109550	1111570	social security belonging to, you know,
1111570	1115170	one identity, a name is invented,
1115170	1117650	or, you know, belonging to a different identity,
1117650	1119350	date of birth, et cetera, et cetera.
1119350	1124130	It's like combining a kind of, you know,
1124130	1127590	sort of a digital identity
1127590	1130230	that does not really belong to any specific person
1130230	1133230	because it's a mashup of various identities.
1134190	1137350	Now, then what do they do with this identity?
1137350	1139890	Because that identity obviously cannot open a credit card,
1139890	1142790	right? They don't have any kind of credit history.
1142790	1144750	No one's gonna give them a loan.
1144890	1146810	So the idea is to create a synthetic identity
1146810	1151910	and then through some collusion with rogue lenders,
1151910	1156130	begin to apply for loans and then build credit history
1156130	1157870	by returning the loan.
1157870	1160750	So it's reported as a positive thing.
1160750	1164130	Another trick is to attach this identity
1164560	1167090	to someone who has a perfect FICO score,
1167090	1168530	like a credit card account holder
1168530	1171690	as a secondary user in that account.
1171690	1172990	That's another thing that you can do
1172990	1177650	to essentially get the tenure of a good user.
1178170	1181010	So whether you focus on building a credit history
1181010	1184490	or just, you know, a very good tenure,
1184490	1186310	the idea is to create this identity
1186310	1190030	and then, you know, create a credit history
1190030	1192390	and, you know, good credit for that person
1192390	1194190	who does not exist, of course.
1194190	1195430	And then launching your attack.
1195430	1199610	You know, you just go to a credit card company,
1199610	1201490	open a credit card account,
1201490	1205290	you maybe apply for a loan, a mortgage even, et cetera.
1206230	1207830	One in four synthetic identities
1207830	1210930	are actually using child's social security numbers.
1210930	1214210	And the, you know, trafficking in child social security number
1214210	1216590	in the dark web has increased dramatically.
1217000	1220510	A lot of these are coming from healthcare breaches.
1221230	1222910	So that's a very interesting trend.
1222910	1225330	And of course, not something that we want to see,
1225330	1226850	you know, in the industry.
1227030	1228950	The reaction of the industry
1229340	1232150	was to start suspecting lots of people.
1232590	1236390	So let's actually see one example.
1236390	1240970	We see someone who is 31 years old,
1240970	1244890	no driver's license, very thin credit history,
1244890	1247350	and the social security was issued recently,
1247350	1250390	just a few years ago, obviously highly suspicious.
1250390	1251950	They were asked to provide, you know,
1251950	1254050	government records, tax records,
1254050	1256050	and then they never submitted the records.
1256050	1257490	So the transaction was canceled.
1257490	1259010	The application was canceled.
1259150	1260790	Let's see the way they apply.
1260790	1262510	This is from an iPhone.
1262510	1265010	So they're applying via an iPhone.
1265010	1268230	They're providing right now their email.
1269070	1272770	They're providing date of birth.
1272770	1274970	They had a typo in the date of birth,
1274970	1276490	so they corrected it and just continued,
1276490	1278670	but it's all natural and very confident.
1278670	1280070	This is the phone number.
1281210	1283310	Little pause before annual income,
1283310	1284150	they kind of thought about it,
1284150	1286410	and then they provided the annual income,
1286410	1289090	and then went to type the social security.
1289090	1292410	And again, you can see it's all very natural, no pauses.
1292410	1294590	This is not someone typing off a list,
1294590	1296210	not someone pasting information.
1296210	1299770	They're familiar with all of the personal data fields.
1299910	1301630	Another interesting thing is,
1301630	1306110	they also looked at the rates and fees for 90 seconds
1306110	1308670	before even starting the application.
1308770	1311710	Now, if you kind of look at all of these together,
1311710	1314150	this is not gonna be a synthetic identity.
1314190	1318450	This may be a suspect, but it looks like a genuine person.
1318450	1320850	And when the credit issuer, you know,
1320850	1325670	that had this level of analysis investigated further,
1325670	1328730	what they found was, it's an immigrant.
1328730	1330470	It kind of explains everything, you know,
1330470	1333090	the SSN and the thin file.
1333850	1336070	This is someone who works for a big tech firm
1336070	1338930	in San Francisco area.
1338990	1340570	They're actually a great candidate,
1340750	1342190	a great acquisition target.
1342570	1346290	So, you know, blaming them and pointing the finger
1346290	1348490	and saying, hey, you probably some sort of
1349010	1351370	synthetic identity, you have to prove yourself.
1351710	1354530	That was something that almost killed
1354530	1355730	that specific application.
1355730	1358690	Of course, that's not what banks
1358690	1360090	and issuers would like to do.
1361670	1362950	Let's see the opposite.
1363050	1366010	Now let's see someone who is too familiar with the process.
1366610	1369050	You know, before we saw someone that was not familiar,
1369050	1370590	wanting to see the terms and conditions
1370590	1371570	and stuff like that.
1371570	1373950	But this is someone who is too familiar.
1374470	1375550	Income source, right?
1375550	1377190	When you click on the income source,
1377190	1380530	when you open an account, there's this window that says,
1380530	1382910	okay, employed, retired, self-employed, unemployed,
1382910	1383630	military, et cetera.
1383630	1385930	It takes you maybe like four seconds, five seconds
1385930	1388230	to read through and say, okay, well, I'm employed.
1388230	1389830	So let's click employed.
1390650	1394130	And then if we look at specific cyber grant,
1394130	1397170	again, that was attacking one of the banks,
1397170	1398670	it was less than a second.
1398670	1401790	I mean, they knew what's going to happen.
1401790	1403530	They have been there before.
1403530	1405670	They are opening, you know, lots of accounts.
1405750	1408710	So they're not stuck on this screen.
1408710	1409730	They know what to select.
1409730	1412330	It takes them less than a second to select something
1412330	1413710	and then proceed.
1413710	1416830	This is someone too familiar with the process.
1416970	1418570	So if you think about all of the criminals,
1418570	1419930	I mean, they have the data.
1420350	1423070	They're attacking the same target, you know,
1423070	1426430	again and again, because they know the specific controls
1426430	1428150	in that specific target.
1428210	1431150	They know they're not going to be caught.
1431270	1433330	So therefore, they're going to be very familiar
1433330	1434370	with the process.
1434370	1436390	They're not going to be familiar with the data.
1436390	1439750	And that's essentially what we see here.
1439890	1444230	Another interesting trend is looking at the age
1444230	1447630	of the user reflected in their behavior.
1447630	1450710	And this is another fascinating example.
1450710	1453930	This specific user applying for a credit card
1453930	1456450	was born in 1918.
1456450	1458590	You kind of remember the year, right?
1458590	1462570	Because World War I ended and also the Spanish flu.
1462570	1464610	That was also 1918.
1464710	1467450	Let's see someone who is over 100 years old
1467450	1468950	applying for a credit card.
1468950	1471610	So extremely rapid mouse motion,
1472330	1475670	extensive use of tab and mouse wheel.
1475670	1480090	This is not typical for someone who is over 100 years old.
1480090	1483490	And of course, it's all around statistics and probabilities,
1483490	1486650	but it's highly unlikely that this person
1486650	1493350	is such an elderly citizen.
1493760	1496990	The bottom line is that when you look at criminals
1497550	1499970	and a lot of the behavior that they will display
1500520	1503750	is not going to be in line with genuine users,
1504270	1507750	claimed age of the user or the known age of the user,
1507750	1509210	et cetera.
1510650	1517750	Another interesting thing is the fact that sometimes,
1517750	1520390	even without seeing any of the data,
1520390	1524310	you do know that something is wrong.
1525210	1529530	And this is called the curious case of the straw company.
1530140	1530910	Let me explain.
1530910	1531990	This is a straw company.
1534090	1536610	The name of the company, we kind of changed.
1536610	1537830	It's not the last straw,
1537830	1541450	but it's a company based in San Diego.
1541450	1545190	It provides quality paper straws.
1545190	1547710	As you know, in California, it's the law.
1547710	1552170	You have to provide your customers with paper straws.
1552170	1555030	So people can buy those packs.
1555030	1558570	If you're a restaurant, you buy a crate full of straws.
1558810	1563010	There was a sizable order of 62 crates.
1564770	1569550	740,000 straws costing $15,000
1570560	1574550	plus $10,000 for urgent shipping to Tuvalu.
1574550	1576290	What's Tuvalu?
1576290	1577730	Welcome to Tuvalu.
1577730	1581050	It's an island in the Pacific Ocean, 11,000 people.
1581050	1583110	They don't need that many straws.
1583110	1585150	So this is all curious.
1585450	1589610	However, in this specific case,
1589610	1592970	even without knowing any of this data,
1592970	1596210	not the fact that it's a straw company selling straws,
1596210	1598130	not the fact that it's a very big order,
1598130	1600570	the number of straws, the payment for the straws,
1600570	1603710	the $10,000 for the urgent shipping,
1603710	1606970	the location in the middle of the Pacific Ocean,
1606970	1609650	without seeing any of this data,
1609650	1611370	you could know that this is fraud
1611370	1615850	simply based on the way the information was provided.
1615970	1617770	And again, let's see a quick video.
1617770	1622470	This is someone pasting the credit card number
1623470	1626270	and the CV2,
1626950	1628670	typing the expiration
1629970	1632170	and pasting the postal code.
1632170	1634210	Think about your postal code.
1634210	1636550	Did you ever paste your postal code?
1636550	1638770	It's easier to type your postal code,
1638770	1640430	you know, your zip code,
1640430	1642490	than to type it, you know,
1642490	1644810	easier to type it than to paste it.
1644810	1647530	You know, people don't paste the zip code.
1647670	1649810	In fact, when you look at the statistics,
1649810	1652250	it's about 99.9% of the users,
1652250	1653910	they never paste the zip code.
1654930	1656730	This is by the way, one small fact,
1656730	1659730	but there are, you know, dozens of features,
1659730	1662870	you know, around each of those fields.
1663030	1666050	Another interesting thing about zip code
1666050	1668710	is how fast you begin typing your zip code.
1668950	1670430	Because you're familiar with it,
1670430	1673670	you have some muscle memory that immediately starts,
1674190	1675290	you know, going into action
1675290	1678310	and almost like automatically typing your zip code
1678310	1682690	if you go through some sort of online form.
1682970	1685710	Bottom line is this person is not familiar
1685710	1688450	with their own zip code.
1689330	1691850	Now, this was a curious case
1691850	1694930	because you can say, okay, fine,
1695410	1697230	we shouldn't trust this transaction.
1697230	1700190	You know, it looks very, very suspicious.
1700630	1704530	But why would a fraudster go through all of the trouble
1705070	1709270	of buying 62 crates, okay, all of these straws
1709750	1712110	and ship them urgently to Tuvalu?
1712110	1713070	What's the point?
1713070	1714330	What are they trying to achieve?
1714330	1715970	I mean, are they trying to, you know,
1715970	1719050	take the goods and then sell them in Tuvalu?
1719050	1720910	What for, you know?
1721390	1724910	You might think of all sorts of creative ideas.
1724910	1728430	I mean, maybe they need the straws to buy some,
1728430	1730850	you know, to build some huts.
1731470	1735090	Tuvalu is actually having water level issues.
1735090	1741310	I mean, the surface water level is rising all the time.
1741310	1743850	Maybe they need the straws for emergency or something.
1743850	1746030	No, it wasn't something like that.
1746030	1748170	And the interesting thing about this specific fraud
1748170	1752730	was the amount for the shipping, $10,000.
1752730	1756990	The entire thing was built to inflate the amount.
1756990	1760230	It's an urgent shipping to the middle of the Pacific Ocean,
1760230	1761510	62 crates.
1761510	1763810	It will have to cost a fortune.
1764090	1767010	So what actually happened here was the following.
1767030	1769870	After making the payment, go through, right?
1769870	1772490	So, you know, using a corporate credit card,
1772490	1774750	one of the U.S. banks,
1776570	1781270	the, you know, user called the merchant and said,
1781270	1783230	hey, I have made a terrible mistake.
1783230	1785670	I didn't realize it's so expensive.
1785670	1787770	You know, $10,000, you know,
1787770	1790030	your shipping company is crazy.
1790030	1792070	They charge $10,000 for this.
1792070	1794370	I have another shipping company that I prefer using
1794370	1796650	and they only charge $2,000.
1796650	1797870	Can you do me a favor?
1797870	1799870	Because I already paid you $10,000.
1800350	1803910	Can you move $10,000 to that shipping company?
1803950	1805410	And then they'll use it for this shipping
1805410	1808470	and then additional shipping that they'll have in the future.
1808470	1810230	You know, like crediting me.
1810670	1813050	And the merchant says, are you sure?
1813050	1814410	I mean, there's lots of crates here.
1814410	1815890	Yeah, they're fantastic.
1815890	1816810	We work with them all the time.
1816810	1817510	They're very cheap.
1817510	1819890	You should, you know, use them for all of your shipping.
1821270	1824450	And of course it wasn't a real, you know,
1824450	1826210	shipping company, it was an account created
1826210	1828430	or opened by the criminal.
1828510	1831750	The bottom line is when you think about account opening,
1831750	1833250	you know, even e-commerce fraud,
1833250	1836770	any kind of case and scenario where you have a new user,
1836770	1839490	you don't have any kind of profile on the user,
1839490	1841170	prior behavior to look at,
1841170	1844110	transaction monitoring to look at and things like that.
1844730	1847230	You know that KYC is dead,
1847230	1849970	but you do have more and more capabilities,
1849970	1853130	device reputation, location analysis,
1853130	1855030	this sort of analysis called behavior biometrics
1855490	1859870	to tell you, hey, something is either very good about this
1859870	1863590	or something is terribly wrong about this.
1864370	1866590	Another interesting thing to notice
1866590	1870650	that the AO fraud is really changing the ecosystem.
1870910	1874070	This is from California.
1875090	1876730	There was a new digital bank
1876730	1878170	that was opened.
1878630	1882310	And when you actually look at number of new users
1882310	1883970	on a daily basis, you know,
1883970	1888130	it's around 100 people on a daily basis.
1888210	1892870	And all of a sudden, it jumped to about 700 people.
1893270	1894450	So this is crazy.
1894450	1895270	I mean, they said, hey,
1895270	1897710	finally the marketing team is doing something.
1897730	1899930	No, they're not.
1899930	1901110	It's an attack.
1901110	1903350	You have 100 good users
1903760	1907550	and 600 bad users every day.
1908310	1912490	And essentially the bank did have device reputation
1913300	1915150	and email reputation,
1915150	1917250	meaning what do we know about this email
1917250	1918690	and how does it relate to the device
1918690	1920350	and the phone and other elements.
1920350	1924350	This was allowing them to stop about 50% of the attack,
1924350	1926430	but there were still 300 people
1927120	1929830	that were registering every day
1930250	1933590	as opposed to something like 100 good users.
1933670	1935070	This is not sustainable.
1935070	1937090	The bank will have to either, you know,
1937090	1940070	stop receiving new customers or allow them in,
1940070	1942610	but then don't allow them to make, you know,
1942610	1944450	any kind of money transfers or move money out
1944450	1946030	until they sort out, you know,
1946030	1948230	who's a good user and who's a bad user.
1948230	1948910	And that's difficult
1948910	1950890	because the criminals will know everything
1950890	1952290	about the good users.
1953790	1955310	Initially, when I looked at that,
1955310	1956810	I thought that it may be like a bot
1956810	1958610	that is opening all of these accounts.
1958650	1959610	No, it wasn't.
1959610	1960850	It was a human being.
1961110	1963790	And in fact, it was a specific person
1963790	1966690	that was opening all of these hundreds of accounts.
1966910	1968690	They were doing it very mechanically.
1968690	1971190	They were very familiar with the onboarding process.
1971210	1974390	They were totally unfamiliar with the data, okay?
1974390	1977530	Short the memory, typing mechanically, working off a list,
1977530	1978870	not pasting any information.
1978870	1981550	They were just typing all, you know, all day long.
1982230	1984850	So that's essentially one of the risks
1984850	1990070	that banks and fintech companies are facing these days.
1990070	1992370	Whenever you launch a new digital product
1992770	1995810	and you just open it to, you know,
1995810	1998190	the entire world to register,
1998190	2000910	if you don't have the right capabilities
2000910	2004050	to detect those sort of attacks, you can go down.
2004110	2007490	You can really suffer from a massive campaign like this.
2007490	2011550	Not a bot campaign, not a DDoS attack, nothing like that.
2011550	2014650	Just, you know, opening a lot of fake accounts
2014650	2016690	that belong to real people.
2016870	2019470	Not synthetic identities, it's just identity theft
2019470	2021750	because the data is there.
2021750	2024850	And then it's gonna be very, very problematic
2025370	2027170	to handle the situation.
2027170	2030230	So new digital banks, you know, good luck with that.
2030230	2033570	Make sure that you have these sort of defenses in place.
2033650	2036510	Another impact of account opening fraud on the economy
2037070	2041610	is a new service in the US called Zelle.
2041610	2043430	And I'm sure most of you know Zelle.
2043430	2044470	It's a great service.
2044470	2047550	It allows you to pay from your account.
2048730	2050350	You know, I think that in the UK,
2050350	2058170	you'll have similar types of money movement capabilities.
2058190	2062130	You basically can send money to anyone in your contact list.
2062130	2064830	You can send money to an email account,
2064830	2065850	you know, things like that.
2066170	2072310	This is in the US and because of the ease of account opening
2072670	2075970	and the ease of compromising email accounts,
2076290	2082130	the whole Zelle industry is essentially shaking
2082130	2085630	because this is, you know, a single story,
2085630	2089550	but it kind of reflects the underlying problem
2089550	2092010	of the whole system.
2092010	2092830	So in this case,
2092830	2094170	this process randomly compromised
2094170	2096770	the business owner's email account, right?
2096770	2100850	So just a regular, you know, Gmail, Yahoo,
2100850	2106070	whatever sort of account belonging to a person,
2107150	2110690	they saw that this person was interacting
2111350	2116410	with the renters of their property and saying,
2116410	2119730	hey, if you want to move money, why don't you use Zelle?
2119730	2123610	You can send me the rent money using Zelle.
2123610	2127730	So what the criminal did was open a fake account, okay?
2127730	2134050	Using the same information at a top five bank
2134390	2137570	and then enrolling for Zelle at that bank
2137570	2139870	using the compromised email.
2139910	2144210	Now the thing is that once you use the email of the user,
2144210	2148670	that new bank account is now attached to that email, right?
2148670	2151730	The bank will obviously send something to the email
2151730	2154210	like a one-time code that you have to repeat.
2154210	2157830	So it basically proves that you control that email.
2157970	2160770	But if that email is compromised, okay,
2160770	2163030	this check doesn't mean anything.
2163030	2165630	So essentially, you know, beating the KYC checks
2165630	2174030	and then beating the email check of a new registration,
2174790	2177070	attaching that new bank account to that email.
2177690	2180290	And the bank said, okay, but this email address
2180290	2182990	is already linked to another account at another bank.
2182990	2185110	Do you want to change it to our bank?
2185110	2186490	And the fraudster says, yeah.
2186870	2190710	And the bank simply enrolled the fraudster in Zelle,
2190710	2195770	you know, because now this email account, you know,
2195770	2198930	basically is attached to this new account.
2201750	2204750	And basically at that point, it's a game over
2204750	2210250	because any money movement that will go to this email account
2210250	2212470	will automatically go to the fraudster's new account
2212470	2216050	at this top five bank.
2216110	2217530	All right, so the renter sent the money
2217530	2220190	to the Zelle email address as normal,
2220190	2222050	but now going to a newly open account
2222050	2223030	controlled by the criminal
2223030	2225990	rather than the real user, game over.
2225990	2230710	So essentially, the fact that account opening
2231610	2234810	so far was not top priority for banks,
2234810	2236630	credit card companies, et cetera,
2236630	2239470	and it's changing the industry, right?
2239470	2241790	You have all of these cases.
2241870	2243630	It doesn't have to be fraud.
2243630	2245210	It can also be money laundering.
2245210	2246450	It can be mule accounts.
2246450	2247590	Let's actually talk about mules
2247590	2250390	because there is an implication
2250390	2253890	of a high account opening fraud world.
2254570	2258250	This is like a diagram, a very crude one,
2258250	2264230	showing a typical fraud supply chain.
2264430	2267830	Obviously, it's not a single person that can do everything.
2267830	2270030	As a fraudster, you typically choose
2270690	2273150	between am I gonna harvest information,
2273150	2276710	break into accounts and break into databases
2276710	2280170	or do phishing, frauds, et cetera, collect the information
2280170	2284450	or am I gonna use that stolen information to cash out?
2284450	2286750	Typically, people make that choice.
2287350	2289730	The harvesting process would use tools
2289730	2291330	and hosting and delivery mechanisms
2291330	2294390	to infect more people or send them phishing emails
2294390	2298650	and stuff like that, or just break into a database.
2298710	2301090	The cash out process will be the ones
2301090	2303950	that are tasked with emptying all of these accounts.
2303950	2307130	They understand everything about the specific bank defenses,
2307130	2308630	the credit card defenses.
2308650	2310130	They know how to move money.
2310130	2312090	They know what sort of controls are in place.
2312090	2314770	And they also need to send the money,
2314770	2316210	obviously not to themselves,
2316210	2319770	but to some sort of collaboration account.
2320070	2322290	And for many years, those were new accounts
2322290	2325430	because it was very difficult to open an account,
2325430	2328630	let's say locally, if you're a criminal outside of the UK
2328630	2330610	to use an account in the UK.
2330610	2332850	If you're outside of the US, use an account in the US.
2332850	2335990	So you always recruited local collaborators,
2335990	2339470	some of them knowingly, some of them unknowingly.
2340050	2341330	I mean, in Australia, for example,
2341330	2346050	there was a case where the criminals went to high schools
2346050	2349230	and said, hey, you have like a teenager account.
2349770	2353250	We are kind of a charity company,
2354330	2358090	charity, big charity, and donors,
2358090	2359730	people that have lots of money
2359730	2363410	will send money to your account.
2363590	2366730	You're gonna pass it to us, we're the charity in East Europe
2366730	2368870	and you're gonna get a commission.
2368870	2371630	So the teenagers didn't really realize
2371630	2375270	they're actually collaborating with this sort of scheme.
2375270	2377730	So sometimes the mules know that they're mules,
2377730	2379190	sometimes they don't know that they're mules
2379190	2380410	and they recruited.
2381390	2386770	Mules have been a very important part of that ecosystem,
2386770	2389370	but now you don't need them.
2389370	2390830	You can be your own mule.
2390830	2393090	You can just open an account online.
2393090	2395450	It's so easy these days and just send money
2396010	2397350	from your compromised account
2397350	2400070	to your newly established account,
2400070	2403270	saving the need to work with mules.
2403390	2404930	It's saving you a lot of money,
2404930	2407810	opening an account is free, you don't have to pay anyone.
2407870	2409650	And once the money is in your new account,
2409650	2411450	you can just do whatever you want with it.
2411450	2414730	You can send it anywhere, you can buy things, whatever.
2414970	2420970	So this is changing a lot of the economics of online fraud.
2421910	2424070	All right, so let's actually summarize.
2424990	2426370	What have we learned today?
2427110	2429130	Identity is totally broken.
2429530	2431270	Criminals behave differently.
2431810	2435070	And when in doubt, call the dead guy.
2437670	2439610	I hope you enjoyed the presentation
2439610	2441910	and let's see if you have any questions.