WEBVTT 00:01.030 --> 00:07.190 Hey everyone, and welcome to Identity Crisis, the mad rise of online account opening fraud. 00:07.190 --> 00:12.670 My name is Yuri, and I'm Chief Cyber Officer and Co-Founder at BioCatch. 00:12.990 --> 00:16.730 We are at an identity crisis point. 00:17.350 --> 00:28.150 If you were asking credit card companies and banks a few years ago about account opening fraud, they would say, yeah, it's a kind of a minor inconvenience. 00:28.150 --> 00:30.230 That's not their reaction nowadays. 00:30.770 --> 00:33.770 It's getting to be a tidal wave. 00:34.010 --> 00:36.730 This is from Gartner a few years ago. 00:36.730 --> 00:46.350 You can see things like account takeover fraud, payment fraud, these are the main areas of concern for risk and security management. 00:46.470 --> 00:55.710 But there's one thing that tops all of these concerns, and that's new account synthetic or stolen identity fraud. 00:55.710 --> 01:03.990 So it is becoming the number one concern regarding fraud in financial institutions. 01:04.460 --> 01:12.830 Another interesting trend is to see what sort of information financial criminals are stealing these days. 01:12.830 --> 01:15.010 It used to be credit card information. 01:15.010 --> 01:18.910 That was the top priority for financial cyber criminals. 01:18.910 --> 01:26.530 But now the number one data element is social security number, which is an identity element. 01:26.530 --> 01:30.290 And in fact, identity is becoming a commodity. 01:30.290 --> 01:41.190 It's traded in the dark web, and every American citizen's records have already been stolen several times over. 01:41.730 --> 01:47.270 If we can look at this list, for example, it shows all sorts of data breaches. 01:47.570 --> 01:51.270 Many of those are related to identity. 01:51.870 --> 02:06.230 Specifically, if we talk about the big credit reference agency, the big credit bureaus, data aggregators that have been hacked over the years, and this fuels this economy of account opening fraud. 02:06.270 --> 02:17.090 Now, the industry is fighting back, realizing that good old KYC, know your customer, is basically dead, and long live next generation data. 02:17.190 --> 02:31.530 So it used to be about what you know and matching all of the information about the user, looking at the data that the user provides and seeing that it all stacks, and it's what the records show. 02:32.190 --> 02:34.990 But now we have additional data to look at. 02:34.990 --> 02:45.150 For example, what you have, which is user resources, and what you do, which is your digital footprint, and what you are, user behavior, that behavior biometrics. 02:45.250 --> 02:48.190 So a couple of examples for each of those categories. 02:48.210 --> 02:56.770 Again, historically, this would be KYC data, residence, license information, credit history information. 02:57.430 --> 03:01.650 Those type of data points are already in the wrong hands. 03:01.650 --> 03:08.110 And when someone, a cyber criminal, is doing account opening fraud, they have access to all of this. 03:08.910 --> 03:19.610 So therefore, a lot of financial institutions and other related industries have started to untap additional lines of defense. 03:19.610 --> 03:28.110 Starting with device, this has been something that the industry started to adopt about 10 years ago, 15 years ago. 03:28.690 --> 03:30.670 What sort of device are you coming from? 03:30.670 --> 03:32.730 What's the reputation of that device? 03:32.730 --> 03:38.290 Information about your location, information about your phone and phone line. 03:39.090 --> 03:41.610 More recently, what are you doing? 03:41.610 --> 03:43.310 So what's your digital footprint? 03:43.310 --> 03:49.870 Any kind of social media reputation that you have, email reputation, open source analysis on your identity. 03:49.870 --> 03:52.750 And more recently, behavioral biometrics. 03:53.170 --> 03:55.910 These are different types of analysis. 03:55.910 --> 04:02.290 For example, if you're opening an account, you should be familiar with the data that you're providing. 04:02.290 --> 04:04.230 It's your own personal information. 04:04.250 --> 04:08.950 You should not be familiar with the process of account opening because, hey, you've just opened an account. 04:09.150 --> 04:10.950 A criminal is gonna be the opposite. 04:10.950 --> 04:14.990 They're gonna be very familiar with the process, but not familiar with the data. 04:14.990 --> 04:20.630 And that's the sort of analysis that behavioral biometrics is now providing. 04:21.350 --> 04:28.910 So behavioral biometrics, you kind of heard about behavioral biometrics before, but more in the context of profiling. 04:29.030 --> 04:39.090 So the idea of behavioral biometrics, when it actually started, was to create a profile of a regular user behavior and then watch for anomalies. 04:39.090 --> 04:40.930 This is a classic example. 04:40.930 --> 04:46.930 You see someone that logs in and then interacts with their online banking application. 04:46.930 --> 04:50.330 What you see on the screen is the person's mouse motion. 04:50.730 --> 04:55.650 These are several sessions, several pages, but the mouse motion is basically the same. 04:55.650 --> 05:00.270 So that's how you create a profile of the regular user behavior. 05:00.270 --> 05:03.110 You can use keyboard analysis. 05:03.110 --> 05:05.330 You can analyze mouse motion. 05:05.330 --> 05:11.250 If the user is operating on a mobile device, you're gonna look at accelerometer, gyro, and touch data. 05:11.350 --> 05:15.670 The idea is to create a baseline and then watch for anomalies. 05:15.670 --> 05:18.870 In this specific case, this account was compromised. 05:18.870 --> 05:23.390 The user provided the credentials to a criminal, and now the criminal is accessing the account. 05:23.390 --> 05:26.570 You're gonna see a very different type of behavior. 05:26.850 --> 05:30.210 So now it's not the same mouse motion. 05:30.210 --> 05:32.690 There's a strange bump in the center of the motion. 05:32.870 --> 05:43.950 And essentially, this is a way for the financial institution, for example, to say, hey, we do see an anomaly based on the profile, based on the baseline that was created. 05:43.950 --> 05:47.710 Another use of behavioral biometrics is to look for threats. 05:47.710 --> 05:49.970 For example, remote access. 05:50.230 --> 05:51.770 This is a mobile device. 05:51.770 --> 05:54.210 User is interacting on a mobile device. 05:54.210 --> 05:56.270 You can see the swipe motions. 05:56.270 --> 05:58.390 These are not gonna be straight lines. 05:58.390 --> 06:04.690 Even if you think that you move in a straight line on your mobile device, you actually have a small arc. 06:05.150 --> 06:06.610 Then you see the tabs. 06:06.610 --> 06:11.550 Now the tabs are surrounded, the dot is surrounded by a blue circle. 06:11.550 --> 06:15.030 That's your finger pressing on the actual touch screen. 06:15.030 --> 06:17.510 That's a normal situation for this account. 06:17.590 --> 06:21.050 And now this account was compromised with a help desk scam. 06:21.050 --> 06:27.350 Hey, we're the help desk, there's something wrong with your account, your bank account, your mobile device, something like that. 06:27.350 --> 06:29.270 We're here to help you. 06:29.270 --> 06:34.030 You just have to install something allowing us remote assistance. 06:34.050 --> 06:43.330 People fall for that and then install some sort of remote assistant tools, or maybe like a rogue application. 06:43.330 --> 06:46.650 And then the attacker has remote access on their device. 06:46.650 --> 06:48.550 This does not look the same. 06:48.830 --> 06:54.690 Typically the attacker is gonna control that device using a mouse and keyboard. 06:54.690 --> 07:03.710 And essentially you're gonna see these long lines, that's mouse motion, not someone actually physically scrolling up and down on the device. 07:03.710 --> 07:08.910 And all of the dots, you don't see the blue circle around them because no one's actually touching the screen. 07:08.910 --> 07:10.450 You know, mouse clicks. 07:10.670 --> 07:14.490 Beyond that, because of the remote access, there's gonna be some latency. 07:14.630 --> 07:18.530 The latency creates some disruptions to hand eye coordination. 07:18.570 --> 07:26.350 And if you have the right system, you can actually spot that and say, okay, we now know that this mobile device is being remotely controlled, right? 07:26.850 --> 07:31.350 Now, if we talk about account opening though, what's the use of behavioral barometrics? 07:31.350 --> 07:33.390 You cannot really profile anyone. 07:33.750 --> 07:37.490 They're just establishing the account, right? 07:38.150 --> 07:46.690 But if you actually look at the way criminals behave, you can now analyze second by second what they're doing. 07:46.690 --> 07:54.850 We're gonna start with a very interesting case from one of the top five credit card issuers in the US. 07:55.210 --> 07:58.790 They basically give you a credit card online within 30 seconds. 07:58.790 --> 08:15.050 You go to the website, you select a credit card, you click apply now, and then you start filling this online form, providing your name, email address, date of birth, mobile phone number, address, social security number, and other data points. 08:15.930 --> 08:21.430 Essentially, that's what regular users will go through, but also what criminals will go through. 08:21.430 --> 08:25.630 So let's actually look at a specific application. 08:26.170 --> 08:34.390 The session timeline here, every vertical bar is an interaction, like the user typed something or interacted with the form. 08:34.390 --> 08:37.930 It took one minute and 34 seconds to complete that. 08:38.210 --> 08:43.690 And the interesting thing is that the first name was pasted three seconds into the session. 08:44.490 --> 08:47.110 That's actually pretty incriminating. 08:47.410 --> 08:50.350 You know, why are you pasting your first name? 08:50.350 --> 08:52.410 You're supposed to be familiar with it. 08:52.410 --> 08:55.010 And the other thing is, how come it's so fast? 08:55.010 --> 08:59.150 There's actually a video that will show us how fast it was. 08:59.310 --> 09:03.530 So three seconds into the session, already we see control V. 09:03.530 --> 09:05.590 It's not autofill, by the way. 09:05.950 --> 09:17.750 Someone actually was ready before the application started, form started, went to the application flow, and then used control V to paste something. 09:17.750 --> 09:19.870 That's criminal behavior. 09:20.330 --> 09:26.290 Another thing that was pasted was the social security number, the date of birth was also pasted. 09:26.290 --> 09:35.590 You know, all of these suggest that whoever is doing this are not really familiar with the personal information, but they're also quite familiar with the process, right? 09:35.590 --> 09:38.350 Three seconds and they're beginning to interact. 09:39.730 --> 09:44.010 If we look at deposit fraud, that's another interesting trend. 09:44.010 --> 09:46.230 So we talked about credit card account opening. 09:46.230 --> 09:52.570 Of course, a criminal will be interested in that to just get a credit card or a loan or some sort of instant credit. 09:52.770 --> 10:05.390 But also deposit fraud is another lucrative type of business because what you do there is you open a new account and then you move money from a compromised account that you have. 10:05.630 --> 10:17.830 So let's say that you have money, an account that you've compromised in bank A, you open an account in bank B and say, hey, I'm the user, I wanna open an account, I wanna deposit something from bank A. 10:18.370 --> 10:32.650 Typically bank B will send some small transaction to bank A to prove that once you provide that specific amount to prove that you own that account, you access that account and you can provide that information. 10:32.690 --> 10:36.490 Of course, they're gonna do all of the regular KYC checks. 10:36.590 --> 10:58.590 But of course, if you own that account, if you actually not own, but control that account, you can provide all of that KYC information because you have access to the identity information and you also control the account in bank A, you can just open an account in bank B and move all of the money from account A to account B. 10:58.590 --> 11:03.630 Thing is that bank B is now responsible for the fraud laws. 11:03.630 --> 11:05.050 That's called deposit fraud. 11:05.050 --> 11:07.470 And let's actually see someone opening an account. 11:07.810 --> 11:10.370 They're pasting a lot of information. 11:10.370 --> 11:25.050 In this case, they're pasting the routing code, the account number, user ID, password, when they do the actual payment. 11:25.620 --> 11:31.530 And then the interesting thing here is, all of this is happening quite fast. 11:31.530 --> 11:34.510 And what you can see is they completed the funding. 11:34.510 --> 11:36.910 Now they completed opening the account. 11:37.550 --> 11:44.590 And look at the analysis showing genuine users versus criminals. 11:44.590 --> 11:52.350 About 2% of on an account opening sessions will have this behavior where we see a paste from a different application. 11:52.350 --> 11:58.130 So essentially an alt tab to a different tab and then paste the information from that tab. 11:58.210 --> 12:00.270 That's 2% of the users. 12:00.270 --> 12:01.990 For criminals, it's 25%. 12:02.670 --> 12:05.250 This is pretty significant. 12:05.250 --> 12:07.370 So it's quite informative seeing that. 12:07.370 --> 12:22.050 At the same time, we also understand that you cannot really incriminate 2% of the population or we need more information because 25% is not gonna be a good detection rate if you wanna detect those sort of fraud cases. 12:22.050 --> 12:25.210 So in any case, that's like one type of analysis. 12:25.630 --> 12:27.830 Obviously, you need much more than that. 12:27.830 --> 12:33.570 But deposit fraud is another type of account opening fraud that is skyrocketing these days. 12:33.990 --> 12:36.430 So we talked about pasting information. 12:36.430 --> 12:40.430 We talked about typing information. 12:40.430 --> 12:44.290 Now let's look at the difference between good users and bad users. 12:44.810 --> 12:46.990 Criminals are gonna type off a list. 12:46.990 --> 12:59.870 So if they choose not to populate the field automatically with some sort of bot or to use a pasting, which you've seen that it's only 25% of the cases, they will typically type off a list. 12:59.870 --> 13:01.570 They have a list of victims. 13:02.250 --> 13:07.070 Thing is that short memory is limited to just seven characters or items. 13:07.710 --> 13:11.410 So think about someone typing a social security number that does not belong to them. 13:11.410 --> 13:14.030 It will be very mechanical, right? 13:14.230 --> 13:19.250 So we see someone typing the social security number. 13:19.250 --> 13:24.670 It takes them quite like nine seconds to complete the SSN. 13:24.670 --> 13:29.190 Typically it's gonna be something like four seconds for an SSN. 13:30.370 --> 13:33.530 Date of birth, it's like two digits. 13:33.650 --> 13:34.790 I'm looking at the list. 13:34.790 --> 13:36.790 I'm going back, okay, another two digits. 13:37.130 --> 13:38.150 Okay, I know the year. 13:38.150 --> 13:39.730 It's gonna be 19 something. 13:39.730 --> 13:41.010 Okay, what's the number? 13:41.010 --> 13:43.330 Again, going to the list, going back. 13:43.330 --> 13:45.290 This is a very mechanical process. 13:45.290 --> 13:50.090 Typing off a list is something that you can also understand criminals do. 13:50.430 --> 14:00.210 They wanna be efficient, they have a list, but essentially that's the way for them to show the fact that they are not familiar with that information. 14:00.210 --> 14:01.930 It's not top of their mind. 14:03.390 --> 14:10.790 As opposed to something that we're gonna see right now, sometimes the newer customer checks actually conflict with the next generation analysis. 14:10.790 --> 14:19.810 There was a specific case with one of the big card companies that essentially said, hey, we're gonna decline an application because it's definitely fraud. 14:19.810 --> 14:23.330 You know, 96% chance of something being fraud. 14:23.610 --> 14:26.510 But when we looked at the data, it was interesting. 14:26.530 --> 14:31.050 The session timeline, again, is all of the activities that the user is doing. 14:31.210 --> 14:35.830 And what you can see is that the social security number is typed continuously. 14:36.210 --> 14:39.150 And by the way, Behavioral Biometric is not interested in the data itself. 14:39.150 --> 14:41.330 You're gonna see it's all, you know, 111s. 14:41.330 --> 14:45.990 When we actually look at it again, the typing is quite confident. 14:46.310 --> 14:50.030 You know, you don't see the same thing like typing off of this. 14:50.030 --> 14:51.810 Certainly you don't see any pasting. 14:51.810 --> 14:53.170 It's not autofill. 14:53.390 --> 15:00.350 Whoever is typing this information is quite familiar with the social security number, suggesting it's their own social security number. 15:00.350 --> 15:02.830 Long-term memory is a very strong inheritance field. 15:03.090 --> 15:06.230 The other interesting thing here, look at the timeline. 15:06.290 --> 15:08.870 There's a 58 second pause. 15:08.870 --> 15:09.590 Why? 15:09.590 --> 15:14.310 Because in this specific case, it's a hotel credit card. 15:14.370 --> 15:18.710 So in order to open the account, you need to provide your hotel loyalty number. 15:18.710 --> 15:22.890 You probably have some hotel loyalty numbers, but no one remembers them. 15:22.890 --> 15:27.610 And it takes you a minute or two to fetch them, maybe from your inbox or something like that. 15:27.610 --> 15:28.890 Maybe it's in your wallet. 15:29.750 --> 15:32.310 So about one minute is the norm. 15:32.590 --> 15:40.090 And we do see that this user also, you know, paused for about one minute to fetch that number and then continued with the application. 15:40.290 --> 15:43.770 This is a very, very positive sign, right? 15:43.770 --> 15:46.410 This person behaves like everyone else. 15:46.410 --> 15:51.090 Criminals are not going to bother with waiting for one minute because they need this information. 15:51.090 --> 15:52.130 They have this information. 15:52.130 --> 15:53.370 It's all ready for them. 15:53.370 --> 16:00.350 It's going to be right along, you know, the name, date of birth and social security number because they need it to open the account. 16:00.730 --> 16:06.650 Whereas, you know, real users, there's going to be some type of information that you're going to be very familiar with. 16:06.650 --> 16:09.170 It's etched in your long-term memory. 16:09.450 --> 16:12.990 But other types of information you have to research, you have to fetch. 16:14.030 --> 16:19.350 And that's essentially analyzing the way a genuine user will behave. 16:19.490 --> 16:20.510 So what do we have here? 16:20.510 --> 16:28.110 We have here a kind of a conflict because the analysis suggests, the next-generation analysis suggests that it's a good user, right? 16:28.110 --> 16:30.970 Familiar with the social security number, behaves like everyone else. 16:31.010 --> 16:34.030 But the card company said, hey, that's bad. 16:34.370 --> 16:36.050 We were actually curious about that. 16:36.050 --> 16:42.250 We asked the credit card company, hey guys, what do you, you know, why you think this is going to be a fraudulent application? 16:42.470 --> 16:48.070 They said, well, we like you very much guys, but it has to be fraud because the guy is dead. 16:48.190 --> 16:49.990 He's been dead for 10 years. 16:49.990 --> 16:51.930 You know, we checked the social security number. 16:51.930 --> 16:53.670 It belongs to a dead person. 16:54.610 --> 16:56.070 Well, that was bad. 16:56.210 --> 17:01.610 I mean, we were so sure that this is, you know, an actual genuine person. 17:02.070 --> 17:08.790 And, you know, we asked the issuer, can you actually call the user, you know, to try and find out what went on here? 17:08.790 --> 17:13.370 Because, you know, it looks so real, like it's a real genuine person. 17:13.370 --> 17:14.830 They said, they're dead. 17:14.830 --> 17:15.910 We're not going to call them. 17:15.910 --> 17:20.150 We had a bit of an argument and eventually they caved in and said, okay, we're going to call them. 17:20.150 --> 17:21.310 Let's see what happens. 17:22.450 --> 17:26.190 So the fraud operations team now calls the user. 17:26.230 --> 17:27.390 It was a miracle. 17:27.390 --> 17:28.210 He picked up the phone. 17:28.210 --> 17:29.250 He was not dead. 17:30.390 --> 17:34.510 Ended up that he had a typo in the social security number. 17:34.510 --> 17:35.690 He just had a mistake. 17:35.690 --> 17:36.810 Let's see it again. 17:37.030 --> 17:41.550 You know, typed very confidently, but with a typo that the user did not realize. 17:42.090 --> 17:44.590 This actually matched to a totally different person. 17:44.590 --> 17:45.410 The name was wrong. 17:45.410 --> 17:48.870 The social security was belonging to someone that died. 17:49.730 --> 17:58.490 So sometimes the data is going to suggest that this is a bad application, but some of the next generation analysis don't really care about the data. 17:58.490 --> 18:01.230 It cares about the way you behave. 18:01.230 --> 18:05.690 It cares about, you know, your device, your, you know, other elements. 18:05.790 --> 18:11.610 And therefore sometimes it's more trustworthy than actually, you know, looking at the data itself. 18:12.290 --> 18:14.330 Let's move to synthetic identity. 18:14.330 --> 18:19.250 Synthetic identity is a very interesting new problem in the U.S., relatively new. 18:19.450 --> 18:24.930 It hasn't been around for over a decade, but it's becoming more and more of a problem. 18:25.530 --> 18:26.950 This is from ID Analytics. 18:26.950 --> 18:39.350 And what you can see is, you know, social security belonging to, you know, one identity, a name is invented, or, you know, belonging to a different identity, date of birth, et cetera, et cetera. 18:39.350 --> 18:53.230 It's like combining a kind of, you know, sort of a digital identity that does not really belong to any specific person because it's a mashup of various identities. 18:54.190 --> 18:57.350 Now, then what do they do with this identity? 18:57.350 --> 19:00.070 Because that identity obviously cannot open a credit card, right? 19:00.070 --> 19:02.790 They don't have any kind of credit history. 19:02.790 --> 19:04.750 No one's gonna give them a loan. 19:04.890 --> 19:17.870 So the idea is to create a synthetic identity and then through some collusion with rogue lenders, begin to apply for loans and then build credit history by returning the loan. 19:17.870 --> 19:20.750 So it's reported as a positive thing. 19:20.750 --> 19:31.690 Another trick is to attach this identity to someone who has a perfect FICO score, like a credit card account holder as a secondary user in that account. 19:31.690 --> 19:37.650 That's another thing that you can do to essentially get the tenure of a good user. 19:38.170 --> 19:54.190 So whether you focus on building a credit history or just, you know, a very good tenure, the idea is to create this identity and then, you know, create a credit history and, you know, good credit for that person who does not exist, of course. 19:54.190 --> 19:55.430 And then launching your attack. 19:55.430 --> 20:05.290 You know, you just go to a credit card company, open a credit card account, you maybe apply for a loan, a mortgage even, et cetera. 20:06.230 --> 20:10.930 One in four synthetic identities are actually using child's social security numbers. 20:10.930 --> 20:16.590 And the, you know, trafficking in child social security number in the dark web has increased dramatically. 20:17.000 --> 20:20.510 A lot of these are coming from healthcare breaches. 20:21.230 --> 20:22.910 So that's a very interesting trend. 20:22.910 --> 20:26.850 And of course, not something that we want to see, you know, in the industry. 20:27.030 --> 20:32.150 The reaction of the industry was to start suspecting lots of people. 20:32.590 --> 20:36.390 So let's actually see one example. 20:36.390 --> 20:50.390 We see someone who is 31 years old, no driver's license, very thin credit history, and the social security was issued recently, just a few years ago, obviously highly suspicious. 20:50.390 --> 20:56.050 They were asked to provide, you know, government records, tax records, and then they never submitted the records. 20:56.050 --> 20:57.490 So the transaction was canceled. 20:57.490 --> 20:59.010 The application was canceled. 20:59.150 --> 21:00.790 Let's see the way they apply. 21:00.790 --> 21:02.510 This is from an iPhone. 21:02.510 --> 21:05.010 So they're applying via an iPhone. 21:05.010 --> 21:08.230 They're providing right now their email. 21:09.070 --> 21:12.770 They're providing date of birth. 21:12.770 --> 21:18.670 They had a typo in the date of birth, so they corrected it and just continued, but it's all natural and very confident. 21:18.670 --> 21:20.070 This is the phone number. 21:21.210 --> 21:29.090 Little pause before annual income, they kind of thought about it, and then they provided the annual income, and then went to type the social security. 21:29.090 --> 21:32.410 And again, you can see it's all very natural, no pauses. 21:32.410 --> 21:36.210 This is not someone typing off a list, not someone pasting information. 21:36.210 --> 21:39.770 They're familiar with all of the personal data fields. 21:39.910 --> 21:48.670 Another interesting thing is, they also looked at the rates and fees for 90 seconds before even starting the application. 21:48.770 --> 21:54.150 Now, if you kind of look at all of these together, this is not gonna be a synthetic identity. 21:54.190 --> 21:58.450 This may be a suspect, but it looks like a genuine person. 21:58.450 --> 22:08.730 And when the credit issuer, you know, that had this level of analysis investigated further, what they found was, it's an immigrant. 22:08.730 --> 22:13.090 It kind of explains everything, you know, the SSN and the thin file. 22:13.850 --> 22:18.930 This is someone who works for a big tech firm in San Francisco area. 22:18.990 --> 22:22.190 They're actually a great candidate, a great acquisition target. 22:22.570 --> 22:31.370 So, you know, blaming them and pointing the finger and saying, hey, you probably some sort of synthetic identity, you have to prove yourself. 22:31.710 --> 22:35.730 That was something that almost killed that specific application. 22:35.730 --> 22:40.090 Of course, that's not what banks and issuers would like to do. 22:41.670 --> 22:42.950 Let's see the opposite. 22:43.050 --> 22:46.010 Now let's see someone who is too familiar with the process. 22:46.610 --> 22:51.570 You know, before we saw someone that was not familiar, wanting to see the terms and conditions and stuff like that. 22:51.570 --> 22:53.950 But this is someone who is too familiar. 22:54.470 --> 22:55.550 Income source, right? 22:55.550 --> 23:03.630 When you click on the income source, when you open an account, there's this window that says, okay, employed, retired, self-employed, unemployed, military, et cetera. 23:03.630 --> 23:08.230 It takes you maybe like four seconds, five seconds to read through and say, okay, well, I'm employed. 23:08.230 --> 23:09.830 So let's click employed. 23:10.650 --> 23:18.670 And then if we look at specific cyber grant, again, that was attacking one of the banks, it was less than a second. 23:18.670 --> 23:21.790 I mean, they knew what's going to happen. 23:21.790 --> 23:23.530 They have been there before. 23:23.530 --> 23:25.670 They are opening, you know, lots of accounts. 23:25.750 --> 23:28.710 So they're not stuck on this screen. 23:28.710 --> 23:29.730 They know what to select. 23:29.730 --> 23:33.710 It takes them less than a second to select something and then proceed. 23:33.710 --> 23:36.830 This is someone too familiar with the process. 23:36.970 --> 23:39.930 So if you think about all of the criminals, I mean, they have the data. 23:40.350 --> 23:48.150 They're attacking the same target, you know, again and again, because they know the specific controls in that specific target. 23:48.210 --> 23:51.150 They know they're not going to be caught. 23:51.270 --> 23:54.370 So therefore, they're going to be very familiar with the process. 23:54.370 --> 23:56.390 They're not going to be familiar with the data. 23:56.390 --> 23:59.750 And that's essentially what we see here. 23:59.890 --> 24:07.630 Another interesting trend is looking at the age of the user reflected in their behavior. 24:07.630 --> 24:10.710 And this is another fascinating example. 24:10.710 --> 24:16.450 This specific user applying for a credit card was born in 1918. 24:16.450 --> 24:18.590 You kind of remember the year, right? 24:18.590 --> 24:22.570 Because World War I ended and also the Spanish flu. 24:22.570 --> 24:24.610 That was also 1918. 24:24.710 --> 24:28.950 Let's see someone who is over 100 years old applying for a credit card. 24:28.950 --> 24:35.670 So extremely rapid mouse motion, extensive use of tab and mouse wheel. 24:35.670 --> 24:40.090 This is not typical for someone who is over 100 years old. 24:40.090 --> 24:53.350 And of course, it's all around statistics and probabilities, but it's highly unlikely that this person is such an elderly citizen. 24:53.760 --> 25:09.210 The bottom line is that when you look at criminals and a lot of the behavior that they will display is not going to be in line with genuine users, claimed age of the user or the known age of the user, et cetera. 25:10.650 --> 25:24.310 Another interesting thing is the fact that sometimes, even without seeing any of the data, you do know that something is wrong. 25:25.210 --> 25:29.530 And this is called the curious case of the straw company. 25:30.140 --> 25:30.910 Let me explain. 25:30.910 --> 25:31.990 This is a straw company. 25:34.090 --> 25:36.610 The name of the company, we kind of changed. 25:36.610 --> 25:41.450 It's not the last straw, but it's a company based in San Diego. 25:41.450 --> 25:45.190 It provides quality paper straws. 25:45.190 --> 25:47.710 As you know, in California, it's the law. 25:47.710 --> 25:52.170 You have to provide your customers with paper straws. 25:52.170 --> 25:55.030 So people can buy those packs. 25:55.030 --> 25:58.570 If you're a restaurant, you buy a crate full of straws. 25:58.810 --> 26:03.010 There was a sizable order of 62 crates. 26:04.770 --> 26:14.550 740,000 straws costing $15,000 plus $10,000 for urgent shipping to Tuvalu. 26:14.550 --> 26:16.290 What's Tuvalu? 26:16.290 --> 26:17.730 Welcome to Tuvalu. 26:17.730 --> 26:21.050 It's an island in the Pacific Ocean, 11,000 people. 26:21.050 --> 26:23.110 They don't need that many straws. 26:23.110 --> 26:25.150 So this is all curious. 26:25.450 --> 26:43.710 However, in this specific case, even without knowing any of this data, not the fact that it's a straw company selling straws, not the fact that it's a very big order, the number of straws, the payment for the straws, the $10,000 for the urgent shipping, 26:43.710 --> 26:55.850 the location in the middle of the Pacific Ocean, without seeing any of this data, you could know that this is fraud simply based on the way the information was provided. 26:55.970 --> 26:57.770 And again, let's see a quick video. 26:57.770 --> 27:12.170 This is someone pasting the credit card number and the CV2, typing the expiration and pasting the postal code. 27:12.170 --> 27:14.210 Think about your postal code. 27:14.210 --> 27:16.550 Did you ever paste your postal code? 27:16.550 --> 27:24.810 It's easier to type your postal code, you know, your zip code, than to type it, you know, easier to type it than to paste it. 27:24.810 --> 27:27.530 You know, people don't paste the zip code. 27:27.670 --> 27:33.910 In fact, when you look at the statistics, it's about 99.9% of the users, they never paste the zip code. 27:34.930 --> 27:42.870 This is by the way, one small fact, but there are, you know, dozens of features, you know, around each of those fields. 27:43.030 --> 27:48.710 Another interesting thing about zip code is how fast you begin typing your zip code. 27:48.950 --> 28:02.690 Because you're familiar with it, you have some muscle memory that immediately starts, you know, going into action and almost like automatically typing your zip code if you go through some sort of online form. 28:02.970 --> 28:08.450 Bottom line is this person is not familiar with their own zip code. 28:09.330 --> 28:17.230 Now, this was a curious case because you can say, okay, fine, we shouldn't trust this transaction. 28:17.230 --> 28:20.190 You know, it looks very, very suspicious. 28:20.630 --> 28:32.110 But why would a fraudster go through all of the trouble of buying 62 crates, okay, all of these straws and ship them urgently to Tuvalu? 28:32.110 --> 28:33.070 What's the point? 28:33.070 --> 28:34.330 What are they trying to achieve? 28:34.330 --> 28:39.050 I mean, are they trying to, you know, take the goods and then sell them in Tuvalu? 28:39.050 --> 28:40.910 What for, you know? 28:41.390 --> 28:44.910 You might think of all sorts of creative ideas. 28:44.910 --> 28:50.850 I mean, maybe they need the straws to buy some, you know, to build some huts. 28:51.470 --> 28:55.090 Tuvalu is actually having water level issues. 28:55.090 --> 29:01.310 I mean, the surface water level is rising all the time. 29:01.310 --> 29:03.850 Maybe they need the straws for emergency or something. 29:03.850 --> 29:06.030 No, it wasn't something like that. 29:06.030 --> 29:12.730 And the interesting thing about this specific fraud was the amount for the shipping, $10,000. 29:12.730 --> 29:16.990 The entire thing was built to inflate the amount. 29:16.990 --> 29:21.510 It's an urgent shipping to the middle of the Pacific Ocean, 62 crates. 29:21.510 --> 29:23.810 It will have to cost a fortune. 29:24.090 --> 29:27.010 So what actually happened here was the following. 29:27.030 --> 29:29.870 After making the payment, go through, right? 29:29.870 --> 29:33.770 So, you know, using a corporate credit card, one of the U.S. 29:33.770 --> 29:43.230 banks, the, you know, user called the merchant and said, hey, I have made a terrible mistake. 29:43.230 --> 29:45.670 I didn't realize it's so expensive. 29:45.670 --> 29:50.030 You know, $10,000, you know, your shipping company is crazy. 29:50.030 --> 29:52.070 They charge $10,000 for this. 29:52.070 --> 29:56.650 I have another shipping company that I prefer using and they only charge $2,000. 29:56.650 --> 29:57.870 Can you do me a favor? 29:57.870 --> 29:59.870 Because I already paid you $10,000. 30:00.350 --> 30:03.910 Can you move $10,000 to that shipping company? 30:03.950 --> 30:08.470 And then they'll use it for this shipping and then additional shipping that they'll have in the future. 30:08.470 --> 30:10.230 You know, like crediting me. 30:10.670 --> 30:13.050 And the merchant says, are you sure? 30:13.050 --> 30:14.410 I mean, there's lots of crates here. 30:14.410 --> 30:15.890 Yeah, they're fantastic. 30:15.890 --> 30:16.810 We work with them all the time. 30:16.810 --> 30:17.510 They're very cheap. 30:17.510 --> 30:19.890 You should, you know, use them for all of your shipping. 30:21.270 --> 30:28.430 And of course it wasn't a real, you know, shipping company, it was an account created or opened by the criminal. 30:28.510 --> 30:44.110 The bottom line is when you think about account opening, you know, even e-commerce fraud, any kind of case and scenario where you have a new user, you don't have any kind of profile on the user, prior behavior to look at, transaction monitoring to look at and things like that. 30:44.730 --> 31:03.590 You know that KYC is dead, but you do have more and more capabilities, device reputation, location analysis, this sort of analysis called behavior biometrics to tell you, hey, something is either very good about this or something is terribly wrong about this. 31:04.370 --> 31:10.650 Another interesting thing to notice that the AO fraud is really changing the ecosystem. 31:10.910 --> 31:14.070 This is from California. 31:15.090 --> 31:18.170 There was a new digital bank that was opened. 31:18.630 --> 31:28.130 And when you actually look at number of new users on a daily basis, you know, it's around 100 people on a daily basis. 31:28.210 --> 31:32.870 And all of a sudden, it jumped to about 700 people. 31:33.270 --> 31:34.450 So this is crazy. 31:34.450 --> 31:37.710 I mean, they said, hey, finally the marketing team is doing something. 31:37.730 --> 31:39.930 No, they're not. 31:39.930 --> 31:41.110 It's an attack. 31:41.110 --> 31:47.550 You have 100 good users and 600 bad users every day. 31:48.310 --> 32:00.350 And essentially the bank did have device reputation and email reputation, meaning what do we know about this email and how does it relate to the device and the phone and other elements. 32:00.350 --> 32:13.590 This was allowing them to stop about 50% of the attack, but there were still 300 people that were registering every day as opposed to something like 100 good users. 32:13.670 --> 32:15.070 This is not sustainable. 32:15.070 --> 32:28.230 The bank will have to either, you know, stop receiving new customers or allow them in, but then don't allow them to make, you know, any kind of money transfers or move money out until they sort out, you know, who's a good user and who's a bad user. 32:28.230 --> 32:32.290 And that's difficult because the criminals will know everything about the good users. 32:33.790 --> 32:38.610 Initially, when I looked at that, I thought that it may be like a bot that is opening all of these accounts. 32:38.650 --> 32:39.610 No, it wasn't. 32:39.610 --> 32:40.850 It was a human being. 32:41.110 --> 32:46.690 And in fact, it was a specific person that was opening all of these hundreds of accounts. 32:46.910 --> 32:48.690 They were doing it very mechanically. 32:48.690 --> 32:51.190 They were very familiar with the onboarding process. 32:51.210 --> 32:54.390 They were totally unfamiliar with the data, okay? 32:54.390 --> 32:58.870 Short the memory, typing mechanically, working off a list, not pasting any information. 32:58.870 --> 33:01.550 They were just typing all, you know, all day long. 33:02.230 --> 33:10.070 So that's essentially one of the risks that banks and fintech companies are facing these days. 33:10.070 --> 33:24.050 Whenever you launch a new digital product and you just open it to, you know, the entire world to register, if you don't have the right capabilities to detect those sort of attacks, you can go down. 33:24.110 --> 33:27.490 You can really suffer from a massive campaign like this. 33:27.490 --> 33:31.550 Not a bot campaign, not a DDoS attack, nothing like that. 33:31.550 --> 33:36.690 Just, you know, opening a lot of fake accounts that belong to real people. 33:36.870 --> 33:41.750 Not synthetic identities, it's just identity theft because the data is there. 33:41.750 --> 33:47.170 And then it's gonna be very, very problematic to handle the situation. 33:47.170 --> 33:50.230 So new digital banks, you know, good luck with that. 33:50.230 --> 33:53.570 Make sure that you have these sort of defenses in place. 33:53.650 --> 34:01.610 Another impact of account opening fraud on the economy is a new service in the US called Zelle. 34:01.610 --> 34:03.430 And I'm sure most of you know Zelle. 34:03.430 --> 34:04.470 It's a great service. 34:04.470 --> 34:07.550 It allows you to pay from your account. 34:08.730 --> 34:18.170 You know, I think that in the UK, you'll have similar types of money movement capabilities. 34:18.190 --> 34:22.130 You basically can send money to anyone in your contact list. 34:22.130 --> 34:25.850 You can send money to an email account, you know, things like that. 34:26.170 --> 34:52.010 This is in the US and because of the ease of account opening and the ease of compromising email accounts, the whole Zelle industry is essentially shaking because this is, you know, a single story, but it kind of reflects the underlying problem of the whole system. 34:52.010 --> 34:56.770 So in this case, this process randomly compromised the business owner's email account, right? 34:56.770 --> 35:19.730 So just a regular, you know, Gmail, Yahoo, whatever sort of account belonging to a person, they saw that this person was interacting with the renters of their property and saying, hey, if you want to move money, why don't you use Zelle? 35:19.730 --> 35:23.610 You can send me the rent money using Zelle. 35:23.610 --> 35:27.730 So what the criminal did was open a fake account, okay? 35:27.730 --> 35:39.870 Using the same information at a top five bank and then enrolling for Zelle at that bank using the compromised email. 35:39.910 --> 35:48.670 Now the thing is that once you use the email of the user, that new bank account is now attached to that email, right? 35:48.670 --> 35:54.210 The bank will obviously send something to the email like a one-time code that you have to repeat. 35:54.210 --> 35:57.830 So it basically proves that you control that email. 35:57.970 --> 36:03.030 But if that email is compromised, okay, this check doesn't mean anything. 36:03.030 --> 36:17.070 So essentially, you know, beating the KYC checks and then beating the email check of a new registration, attaching that new bank account to that email. 36:17.690 --> 36:22.990 And the bank said, okay, but this email address is already linked to another account at another bank. 36:22.990 --> 36:25.110 Do you want to change it to our bank? 36:25.110 --> 36:26.490 And the fraudster says, yeah. 36:26.870 --> 36:38.930 And the bank simply enrolled the fraudster in Zelle, you know, because now this email account, you know, basically is attached to this new account. 36:41.750 --> 36:56.050 And basically at that point, it's a game over because any money movement that will go to this email account will automatically go to the fraudster's new account at this top five bank. 36:56.110 --> 37:05.990 All right, so the renter sent the money to the Zelle email address as normal, but now going to a newly open account controlled by the criminal rather than the real user, game over. 37:05.990 --> 37:19.470 So essentially, the fact that account opening so far was not top priority for banks, credit card companies, et cetera, and it's changing the industry, right? 37:19.470 --> 37:21.790 You have all of these cases. 37:21.870 --> 37:23.630 It doesn't have to be fraud. 37:23.630 --> 37:25.210 It can also be money laundering. 37:25.210 --> 37:26.450 It can be mule accounts. 37:26.450 --> 37:33.890 Let's actually talk about mules because there is an implication of a high account opening fraud world. 37:34.570 --> 37:44.230 This is like a diagram, a very crude one, showing a typical fraud supply chain. 37:44.430 --> 37:47.830 Obviously, it's not a single person that can do everything. 37:47.830 --> 38:04.450 As a fraudster, you typically choose between am I gonna harvest information, break into accounts and break into databases or do phishing, frauds, et cetera, collect the information or am I gonna use that stolen information to cash out? 38:04.450 --> 38:06.750 Typically, people make that choice. 38:07.350 --> 38:18.650 The harvesting process would use tools and hosting and delivery mechanisms to infect more people or send them phishing emails and stuff like that, or just break into a database. 38:18.710 --> 38:23.950 The cash out process will be the ones that are tasked with emptying all of these accounts. 38:23.950 --> 38:28.630 They understand everything about the specific bank defenses, the credit card defenses. 38:28.650 --> 38:30.130 They know how to move money. 38:30.130 --> 38:32.090 They know what sort of controls are in place. 38:32.090 --> 38:39.770 And they also need to send the money, obviously not to themselves, but to some sort of collaboration account. 38:40.070 --> 38:50.610 And for many years, those were new accounts because it was very difficult to open an account, let's say locally, if you're a criminal outside of the UK to use an account in the UK. 38:50.610 --> 38:52.850 If you're outside of the US, use an account in the US. 38:52.850 --> 38:59.470 So you always recruited local collaborators, some of them knowingly, some of them unknowingly. 39:00.050 --> 39:09.230 I mean, in Australia, for example, there was a case where the criminals went to high schools and said, hey, you have like a teenager account. 39:09.770 --> 39:23.410 We are kind of a charity company, charity, big charity, and donors, people that have lots of money will send money to your account. 39:23.590 --> 39:28.870 You're gonna pass it to us, we're the charity in East Europe and you're gonna get a commission. 39:28.870 --> 39:35.270 So the teenagers didn't really realize they're actually collaborating with this sort of scheme. 39:35.270 --> 39:40.410 So sometimes the mules know that they're mules, sometimes they don't know that they're mules and they recruited. 39:41.390 --> 39:49.370 Mules have been a very important part of that ecosystem, but now you don't need them. 39:49.370 --> 39:50.830 You can be your own mule. 39:50.830 --> 39:53.090 You can just open an account online. 39:53.090 --> 40:03.270 It's so easy these days and just send money from your compromised account to your newly established account, saving the need to work with mules. 40:03.390 --> 40:07.810 It's saving you a lot of money, opening an account is free, you don't have to pay anyone. 40:07.870 --> 40:11.450 And once the money is in your new account, you can just do whatever you want with it. 40:11.450 --> 40:14.730 You can send it anywhere, you can buy things, whatever. 40:14.970 --> 40:20.970 So this is changing a lot of the economics of online fraud. 40:21.910 --> 40:24.070 All right, so let's actually summarize. 40:24.990 --> 40:26.370 What have we learned today? 40:27.110 --> 40:29.130 Identity is totally broken. 40:29.530 --> 40:31.270 Criminals behave differently. 40:31.810 --> 40:35.070 And when in doubt, call the dead guy. 40:37.670 --> 40:41.910 I hope you enjoyed the presentation and let's see if you have any questions.