The Future of Trust Identity Verification to Entity Centric Risk

Good afternoon. Uh, thanks for joining us and just to keep you between yourselves in the end of a long day, I'm sure. Um, we're delighted to be here this afternoon to talk to you about a follow on from the previous session focusing on risk and entitycentric risk. Um this is a huge issue. 350 billion financial payments in 2025.

An increase of nearly 30% on the previous year. 10.5 trillion in cyber security crimes this year of which the majority or a significant proportion is fraud and embezzlement. Joe, let's start with you if you don't mind. um how do you sleep at night and can perhaps you look at the compliance landscape from where it was to where it is today.

Um

so if I think about John how um what fraud prevention looked like 10 years ago it was very much a checklist. Um was is there a transaction over X amount uh in a high-risisk country happening within a short time space. Um but if we were to follow that model um that that would collapse very quickly because what we see today is highly more sophisticated than that. Um what we're seeing now is sophistication not just because uh fosters have far better tools, AI, all of that. But also because um the digital age right after COVID everybody went online.

They were just more accessible. Um so if you think about it globally we're seeing as you said half a trillion of fraud losses um yearon year uh it's not just card fraud it's account takeover authorized push payments um account takeover in particular has really exploded over the last 5 years um and it's be it's becoming harder to detect

because these fraudsters arrive looking very much like our customers same device same IP uh behave the certain way. And so your the things we're used to the x amount over x time period is almost like bringing a calculator to an AI fight. It just won't work anymore. Um what you have to now we have to pivot and think in a sort of a different way a way larger picture looking at digital footprint. So not just looking at is this transaction suspicious but rather um is this person plus device plus network plus behavior um legitimate?

Does it look like a customer? Uh has there been a recent device registration? Has there is the um the IP addresses network or uh the beneficiary is something we've seen before in other scam networks. So KYC itself is no more just a piece of paper that used to get filled and then put aside. right now.

I think KYC is more of a continuous streaming risk assessment. Um and I think um the regulatory landscape has also helped push the industry in this in the right direction when it comes to this. I

was going to ask you about that.

Yeah. Um they've for example uh early this year uh they've mandated that all I mean all the fintex all the banks all the LFIs basically move away from static SMSOTps into using strong authentication methods. So you could tell that they're also now understanding that this problem is bigger than it is and we need to pivot around it.

Thank you Joe. Rich in your capacity as CLO can you talk a bit more about that regulatory landscape? what's being mandated. So clearly the the landscape has changed fundamentally in the last few years. So from 2022 to where we are now, a material change, what's actually being pushed on to to financial um entities?

Absolutely. So firstly, everything Joe said I reiterate entirely. Um it's absolutely what um we're finding out in market too. from a kind of a legal and regulatory standpoint, I think there's the the broader recognition now that um the current approach to risk management fraud um is insufficient. Um not only is technology expected to be used on the bank and the fintech side of the the business, but is also absolutely being employed by the fraudsters alike.

Um so really what you've seen is a convergence globally particularly by the primary regulators on uh instituting um and mandating effectively banks and financial financial institutions to employ appropriate and emerging technologies. So to Joe's point uh the central bank of the UAE has actually been leading the charge. Um earlier this year they introduced a new law which for the first time actually mandated the requirement for for licensed financial institutions to actually employ appropriate technology and um actually very specifically mandated certain criteria that needed to be followed from um you know confirmation of payes is just an example. Um looking at the US similar uh the consumer um protection finance bureau um equally has also been looking um and expecting financial institutions to to share data and to that end they've been looking at open banking um and Europe in particular I think uh Europe's been at the forefront with with Dora um the recent anti-money laundering directive and also the payment services directives too again expecting that all licensed financial institutions employ appropriate technologies to uh prevent the fraud. But

okay, thanks Rich and Sups. You've clearly been looking at the space very actively from a Sardine perspective. Do you want to sort of anything you want to add to either what Joe or Rich have said in terms of the background, the backdrop to where things are trending to and how the regulatory landscape is interacting?

Yeah. Um [clears throat] to add to what both Rich and Joe have said, right? So with the rise of u AI generated deep fakes and scams, right? Um as you said earlier as well like you know trillions of dollars are being lost every year right uh and with the new regulations that are being adopted worldwide around strong customer authentication I feel like even those regulations are actually reactive right we need to actually go above and beyond what the regulators are asking us to do. So uh for instance right like when you are logging in uh the general advice is that you have to have two factors right uh what you know which is your password and who you are which is basically was always tied to an OTP being delivered to your phone number because you know uh what you have in your pocket always is a phone number.

Uh however you know there are now sim swap attacks where that phone number doesn't mean much anymore. somebody could actually port your phone number, right? And then there are uh in reaction to the fact that you know uh there's fishing attacks where you know uh [clears throat] for instance uh I could set up like a bank impersonation scam where you know just taking an example like you know I if I am a scammer I would set up a lookalike to VO and maybe you know underneath the O there is a dot which if uh general consumer doesn't pay attention they think that there's a speck of dust they click on the VO with the dot underneath the O and then they enter the password. Then I as a scammer what I do is I take the password and I replay it on the real VO app and then I can go and provision a new virtual card and then I can add that virtual card to an Apple Pay, Google Pay and I can start spending right. So therefore you know with these rise in like bank impersonation scams what is happening is that you know even those two factors are no longer sufficient because as a fraudster I have obtained the username and the password and even the OTP that was delivered.

I'm replaying all of it. Right? So therefore, what you need is actually above and beyond it. And we at Sardine like to say that, you know, you got to start looking at, you know, consumer behavior. Behavior meaning like how do you behave when you're interacting?

like if I typed in my password really at VO I'm either using a password manager uh or you know the fraudster when they are replaying it they're going to copy paste it or if they're using an AI agent the AI agent is going to actually type without moving the mouse so those are some intrinsic behavior patterns that we go after u and if so long as you capture all the behavior data points about a login or a payment or a signup you can always go and go back and find how how the fraudster was behaving and every fraudster they still leave a tell they still leave some signs which can distinguish them from real users

so I think just to soup's point I think back in the day we were profiling transactions now you have to actually profile customer behavior

and that's not just one data point that's about how they log in what how how they type in what speed they type their passwords uh what devices they use um you know uh who who they usually pay and receive funds from. Um, so it's almost like you're it's a continuous process, right? You're not validating one thing, but you're constantly validating them. So your your rules can't be static anymore and one-dimensional. And I think a lot of I think previously and this changed very quickly.

Um, the rules that you had could be tested by the fraudster because all he had to do was basically guess what the thresholds were or the blacklists were. So you have to sort of like move away from that. And I think uh even the regulator now for example when we adopted uh the moved away from SMSOTP and push it into inapp OTPs we almost completely eradicated the SIM swap cases. Why? Cuz now the the the fraudster doesn't need to take hold of your phone number because you don't get the OTPs anymore.

the OTPs are going into the app and then by doing device verification uh identity verification to bind your device to your profile you then also will only get receive the OTP in one of those safe sessions. Um so again multi-layered approach is what you need in today's world. So if you require as much data as it sounds as you do now to create the biggest environment you can to to focus in on on individuals and the entity how are you seeing the interaction um between for example rich to your point the US and the UAE how are you allowing for that in your model because I assume that you require huge amounts of data to be able to provide you know Joe with the the ability to sleep at night so you know where how's that interaction happening So uh in the case of you know our technology at sardine we provide a piece of software that you know banks and fintex they embed in their login flow or the signup flow or the payments flow uh hundreds of kilobytes as an SDK which you drop it into your Android or iOS app or on the website it's really 10 lines of code as an iframe uh and then all the telemetry of how you type how you swipe how you hold the phone uh mouse movement etc They're gathered like kind of opaquely to a client. A client is not really aware. And these are, if you think about it, these are actually privacy aware data points,

right? Because all software tools like us we're collecting is really just XYZ coordinates of your device orientation, right? There's no PII there except an IP address, which in some jurisdictions is considered PII, but in many others it's not.

Okay.

Yeah. And I would just like to add that um you know the whole idea of entity centric data uh sorry entitycentric risk uh thrives on one thing which is data right um and I think that's where it gets it's a sensitive topic and I think that's where as a bank what we really think about is okay how much data can we collect um how do we store it use it and then how do we communicate with the customer cuz what we want is we want enough data that will make sure that we have enough to protect you. But when you have too much data, I think you don't want the customer gets uncomfortable with that. We're not playing big brother here. So, we just want to be very clear that we're just taking what we need.

Um, if I think about um, you know, what are we collecting? So, we I mean, if you think of models and stuff, we don't really need a lot of personal data. What we're looking for is a digital thing.

Yeah. We're looking for behaviors. So we and and wherever we can we'll use UAE pass to replicate instead of replicating documents. Um in terms of how we use it and store it again the models don't need your name they just need again other data points right and where we can we'll um use pseudonymization or tokenization encryption and strict access controls around it. Then of course it's how you then communicate it to the customer.

So instead of telling the customer um you know we're monitoring your behavior because that sounds a bit creepy, I would you would want to tell them that look we're um we're just keeping an eye on your account for or your your login patterns to ensure that there's no unauthorized access. And I think customers do appreciate that. Um but I think the idea is that we have to be um designing this into our systems before like on the onset as opposed to thinking of it as an aftermath.

Got it. Yeah.

And to that point then around where you're seeing the the kinds of risks, the kinds of attacks that are you're all sort of thinking about and facing. Um do they change by jurisdiction and geography? I mean are you seeing different kinds of attacks in the US for example suits as you might do in the UAE?

No, it's actually surprisingly very similar. uh because as the world economy has gotten more globalized a fraudster who's sitting in let's say Southeast Asia they are aware that they can use the same techn techniques to defraud someone sitting in the UAE or someone sitting in the US

and we serve customers globally and we find that you know it's similar patterns everywhere with like AI generated deep fake attacks like you know in doing KYC processes there's a lot of deep fakes nowadays uh we also see a lot rise in account takeovers. We see uh the bank impersonation scam that I talked about. So, it's like very similar in in nature now.

Okay, good.

Rich, anything to add to that? I can see you wanting to jump in.

Look, I think uh Sips is the expert here and and Joe on um actually what happens day-to-day from a fraud perspective. I think what I'd like to comment on is what we were touching on before in relation to the interaction of of data and privacy. Um and I think what I touched on earlier was absolutely globally there's a regulatory convergence on the approach to adopt to um preventing fraud which is effectively utilizing technologies. Um where there is some regulatory fragmentation at the moment is actually to what extent is data actually used and shared across jurisdictions and across different fraud um systems to actually um identify um that fraud. And I think the short answer is I don't think there's an answer.

I think we're we're still as a a kind of a a world trying to to map out what the right what the right mix is. Um I think it's it's definitely a watch this space kind of a brief but um at least me on a personal level I'm um optimistic about the use of kind of decentralized IDs and you know onchain and tokenization moving forward is potentially a longer longer term solution. Um, so I I think that's the the real interesting area for for me rather than the uh the uh day-to-day account takeovers and um obviously the thousands of pieces of uh technology that the Sups and his team are are obviously implementing into their solution.

I think um you know Rich this is not prevention and detection of fraud is not a new thing and the regulatory environments interacting um is also not a new thing. Clearly this move to the proactive approach that you've been discussing today is a new thing and is obviously required given sophistication of the attacks that are now happening. But do you not all think that um inevitably whilst it'll go in the same direction there'll be some kind of sensible interaction to the extent that it becomes consistent such that it makes it easier for the end user to understand why to your point Joe they are better off and I think actually it's really important that you reiterate this is about the privacy aspects are one dimension to this but actually if you're looking soups through behavioral interactions it is a slightly different conversation to what it was perhaps from a KYC perspective 10 years ago Yeah. No, 100%. I think the

one of the one of the obser observations that if if you make right like worldwide, what's happening is uh as a lot of payments are moving to faster payment methods.

What has happened is that consumers are and businesses are losing money very quickly. And we say that you know with faster payments comes faster fraud.

Right? Previously most payments were on cards and card networks anyways had it all locked up. They have like the chargeback dispute resolution process locked up right but with the bank payment methods there wasn't any which is what you saw with the UK with the authorized push payment scam the regime they put together and pretty much every other geography they they they will be putting something together. So that's what you're saying with the regulatory side.

Yeah.

I think in the GCC as well, I think um is a lot of expats, a lot of movement and so a lot of the customers don't know what to expect and so impersonation scams here are quite big. Um and what we've seen is um a lot of the time it's there's always obviously been a data breach somewhere. Um, I know when I was when I first moved here, um, the only thing I was doing was ordering food on Taliban and Karim and then 3 days later I'm like, okay, I've got my first cam call and I was thinking, okay, I was trying to decide which one where where did where where was that gap? Who gave out my phone number? So, yeah.

So, I I I I'm sure that this is sort of because when you think about it, we're in a country where there's so much movement, a lot of people coming in and coming out. Um and that for fraudsters is great because um they have a lot of blueco collar workers that they could just give out a bit of money, get them to open mule accounts. Um you have people who don't really belong here. So they think okay let me just do a bit of fraud get back to my home country and I'm out of it. Um, but what is really difficult and I think this is where my work is and it's probably what drives me every day is I think about I mean all of us banks all I mean we all have money but I'm thinking about that that you know general average person who's brought all their life savings to this country someone calls them up and to Soup's point money's gone out instantly.

I mean I had one guy who gave out 126 OTPs in a two-hour phone call.

Oh my god.

And I remember asking him but why why did you give it? And he was said the guy came on video call in uniform

and he was completely

that's a police interrogation scam, right?

Correct. Correct. And he was sold on the idea

um and just gave out all his OTPs. But the difficult part about it is again the speed. The money's gone and then it makes it really hard for us to then recover it and try to get I mean thankfully in his case we were able to recover half of his losses. Um, but it goes to show to what extent the fraudsters, you know, the attempts they take and how much effort they put into it.

Yeah.

So, we're always going to be playing cat and m like like cat and mouse. That's always going to be the case. But I think the idea is to introduce enough sensible friction that you're not going to piss your customer off who's who's just now used to convenience. I mean, we are an economy of convenience. So as you said with convenience comes ample opportunity to defraud people.

Um so it's getting that balance right as well. Um and that is where this the whole you know this the entitycentric risk comes to play.

Um maybe soups does you know pay new uh beneficiaries all the time. Why? He's a business owner. But Joe, who's a retail customer um who only ever pays her landlord once a month and her electricity bill shouldn't be paying some guy in Kenya a large sum of money in one go. So it's understanding that behavior uh holistically that that will help us sort of at least combat and be able to take a step in front of any future AI enabled fraud types.

Great.

Thanks. Just conscious of the time. Um so it's obviously come a long ways I don't know whether you've got any observations as to where you see patterns and trends going in the future. Yeah. So, um I would go back to what one of the sayings that you know u resonated with me which is that Warren Buffett has said that fraud will be the biggest business of all time right uh so we we just as consumers and businesses we have to be very aware of that fact and make sure you don't trust any incoming call or incoming text message because you know there's a fraud lurking somewhere.

[laughter]

Yeah.

Yeah. It'll keep getting more sophisticated

100%. Yeah, Joe, what about yourself? What are you seeing at uh Weo? Where are you seeing this going? I assume you're seeing the same as what Sups has said, you know, an increase in the volume, an increase in the sophistication.

So, it'll, you know, just

I'm actually really I mean, while AI has really helped us in so many other ways, um I think the use of AI in fraud sort of scenarios is quite uh astonishing but also scary. Um, like Sup said, you know, deep fakes, um, forgeries, uh, synthetic identities, all of this stuff. Uh, that's the kind of stuff that I think we should prepare ourselves for.

Um, and try to stay ahead of it. Like, you know, it's always going to be, you know, you're always going to have to pivot. And that's where solutions that are adaptable and flexible are important because that's how fast fraud evolves. So I would say AI enabled fraud types, but also what I've starting to also think about is how long we can rely on device intelligence because even now they're able to spoof that with emulators and with all of the, you know, the privacy uh setting changes on Apple Pay, Google Pay, and all of these other sort of solutions. I don't know how long we could just use device intelligence, and that's something I think we should be thinking about in the future.

Thanks. And Rich, this all sounds like uh good business for for you and for Lean as a sort of tech enabler of financial services. Where are you thinking this all goes to?

Absolutely. Absolutely it is. Um because the kind of insights and information that we can provide we feel can um really add a lot of value to the ecosystem and help prevent

um along with with businesses um like like Sardine. But for me, I think Joe touched on it to be honest. It's the uh what I call the the dual use paradox which is the the double-edged sword of AI. Um not only can it be used to um to aid in a bet and minimize but equally um the fraudsters out there are also employing this technology. So, I think we watch this play out for the next few years.

Um, and um hopefully we continue to have supportive regulators, which I'm sure that we will that um will keep us in check and and hopefully we can uh continue to to minimize um what Warren Buffett said was what what was that? Soups, the the best growing industry.

Fraud will be the biggest business of all time.

Okay, I'm in the wrong business then. [laughter]

No one bets against Warren Buffett, right?

All right, we're out of time. Thank you all for your participation and um good to talk to you.

Yeah,

thanks very much.

Thank you. Thank you.

[music]