Beyond OTPs Building Trust in a Device First, Authentication Future

Good afternoon everyone. Can you guys hear me? Okay, cool. Cool. Yeah.

So, I'm Subs. I'm CEO co-founder of Sardine. We are a behavior-based fraud prevention company. And today I'm going to be talking to you about you know as the world of fraud and scams has evolved uh how we think about authentication and identity verification has to evolve as well. So uh sardine we work with 300 institutions globally uh we work with fintex banks payment companies as well as high-risisk industries such as crypto exchanges gift cards and marketplaces and you can see a list of some of the customers that we work with over here.

So uh Warren Buffett has said that fraud and financial crime will be the biggest industry of all time and we all know that we should never bet against Warren Buffett, right? And as we are seeing uh AI generated scams and AI generated deep fakes have really proliferated to the extent that you can no longer trust people when they say who they are. Right? So this video that you see playing over here on the right of the screen is me. On the left of the screen I'm impersonating the head of risk of one of my customers.

So whenever somebody is doing a selfie verification during online KYC or when you're doing a video interview of a candidate, do you really trust who they say they are? Probably not because it's so easy to generate these deep fake videos. It took me 30 seconds to generate a deep fake where I could actually move my face side to side and impersonate as him, right? However, with the the technology that Sardine has built, we can detect these deep fakes in real time because at the end of the day, when you are injecting the deep fake back, we look at how it is being injected. And now that brings me to the main point of this presentation which is that identity verification or authentication online uh when you think about 2FA the two factors the first factor is what you know which is your password the second factor is you know who you are which we said basically corresponds to your device.

However, with you know uh the rise in deep fakes etc and the rise in scams, people are being fished to the extent that scammers can impersonate you because they have obtained your OTP code and they can enter it as you right or there SIM swap attacks where they have actually taken control of your phone number. So therefore what a lot of fintexs and banks have now gone on to is that they're also doing selfiebased authentication as the third factor. However, fraud is really a cat and boss game. If you do selfie based livveness checks, even that can be deep fake as I showed you earlier. So then the real question becomes how do you actually then prove that you are who you say you are, right?

So at Sardine, we believe that in order to truly verify somebody who they are, you have to not not just look at how they look or, you know, how they talk because how you look or how you talk can be deep faked, right? Because for all of us all, you know, you must have some video online of yourself on YouTube and a camera just needs a few seconds of your face or your audio to replicate you. And therefore in order to truly to truly identify you, you have to look at your device behavior. So for instance in that deep fake video that I showed you earlier when my when I was impersonating my friend, how what was the orientation of the device? Was the device actually face down and then I was doing a deep fake was the camera even in front of me?

Because all those signals like your intrinsic signals are what truly define you. the way you hold your phone, the way you type, the way you move your mouse, etc. And we have the saying at Sardine that to truly define you, it's not just your extrinsic identity, which is your face or your audio. It's also all about your intrinsic identity. And these intrinsic signals like how you type, how you swipe, how you hold the phone, etc.

They cannot be replicated by AI because that information is not publicly available. Right? So that is the that is the main message I have because uh who you really are is defined by not just what you know or not just the phone you have but you truly who you are is defined by your intrinsic behavior. Right? So that is the the main message I have and u I'm going to just skip through a few of these slides.

I just want to give you a little bit more visual of how sardine goes about detecting these things. So for instance, if a scammer is socially engineering you and you are not typing your OTP, we look at your typing behavior. Are you stressed when typing it? Right? Or if you have a malware on your device which is actually now looking or you know eavesdropping on your password and is going to replicate it then the malware it actually types very differently than a human would type.

In fact you could go even deeper right. So for instance when you're typing as I said earlier what is orientation of the phone. So I'm sure all of you have seen videos online of these scam centers in uh Southeast Asia where they have racks and racks of devices. They're all in the same fixed orientation and there's no tap pressure and you may be typing but the battery is 100% charged in a data center etc. So those are the type of signals we get into.

In fact, we go even deeper, which is if a scammer is socially engineering me, if I'm on an active call with a scammer, right, while I'm doing a transaction, we'll tell you or there are remote access tools out there like Team Viewer, any desk or even Zoom calls. Scammers often have you on these calls and they are, you know, telling you what to do. They're asking you to do KYC. They're asking you to, you know, take a screenshot or what have you. and then at the right moment they'll actually blank your screen and then they can move the mouse on your screen and they can move your money out.

Right? So with Sardine technology if our SDK is embedded in your banking application then we can tell you that when somebody was typing there was somebody else actually remotely controlling the screen. So we have quickly grown uh our consortium. So across 300 customers that we work with globally uh our consortium is now more than three billion devices. And uh the other fact I want to share here is that fraudsters they you know often live uh in the gaps between the different point solutions that your bank might be using.

I'll give you an example. Before I founded Sardine, I used to head fraud for companies like Coinbase and I was heading financial crime prevention for companies like Revolute. And one of the common uh attack patterns that we had seen at these places was that bank impersonation scams which is somebody might take uh uh the the somebody might create a replica of your website it takes like 30 seconds to do it. They take a replica of you know bank ABC except when uh you look at the URL there's maybe an umlaw or a dot on top of the A and you don't pay attention. You may be like ah maybe there's a dust on the screen.

However, now you type in your password on this bank fake ABC and then they take the password and they replay it. When they replay it, then they can actually get into the application. They can get a new virtual card issued in uh you know uh as you they add the virtual card to Apple Pay, Google Pay and then they go on a spending spree. point solutions that banks are using might see that hey soups never I live in San Francisco so soups never usually travels to Dubai why is he spending in Dubai but they have no idea this attack started as a fishing scam up front so therefore what sardine is all about is stitching all these different point solutions together in one platform so that we could tell you that that scam that happened at the card swipe it actually originated as a fishing scam so that's basically all the time I have you can Find out more about us at our website sardine.ai.

Thank you.