Nexi talks

Søren Winge: Welcome to our podcast, Nexi Talks, that will hopefully help you better understand and prevent deception during the war on payment fraud. My name is Søren Winge and I'll be your host. Today, we're talking social engineering and financial scams. Usually, as consumers, we are well protected by the card game rules, but with investment fraud, victims are lured into transferring funds directly between accounts.

This trend is rising. If fraudsters cannot break into your accounts easily, they will do anything to trick you into handing over the funds or keys to get inside. To discuss this today, I'm excited to be joined by Joy McKnight, former editor of The Banker, which is part of Financial Times Group. Her 20 year editorial experience spans the global banking industry, from retail through investment banking. In this time, she's focused on payments, technology, fintech, sustainability, and much more. Welcome to you, Joy.

Joy Macknight: Oh, thank you so much, Søren.

Søren Winge: And also, Sune Gabelgård, who is the leading expert on combating economic and digital crime across Europe. His extensive professional background over 25 years includes time with law enforcement, intelligence services, and key positions in the financial sector, giving him a unique insight into the psychology of criminals, fraud victims, and crime prevention strategies.

So, also welcome to you, Sune.

Sune Gabelgård: Thank you. Nice to be here.

Søren Winge: Right, let's get into it.

So Joy, as a journalist in this space for many years, you've spent a lot of time speaking with banks and helping wider audiences understand and explore the challenges they face. To set the scene, how big a problem is fraud, and in particular investment fraud, to the banking world today?

Joy Macknight: Of course it is a huge problem, and I guess the most worrying thing is that the problem just seems to be getting bigger, not smaller, no matter how much effort that the banks throw at trying to prevent it. Obviously, humans are the “weakest link”, as they say, as we can be manipulated in very different ways, particularly if you think there's a big shortcut as you put it, to big, guaranteed rewards, all of those “get rich quick” schemes.

And I think this is, really difficult, obviously, when times are tough in terms of the economy, et cetera. So, I think the vulnerability, and the susceptibility of consumers in different ways, make it easier for the bad actors to really swindle that money out of them. So I think we have to keep that in consideration.

I think there's been this sort of a coming together of different developments. One is the social media element, and I think a lot of the social engineering attacks have risen because of the arrival of social media, because it's so easy to look up a company's employees, their job titles, and work histories. It's very easy to impersonate them. I think most everyday people don't understand what kind of digital footprint they're leaving behind, as they do all sorts of things online. So, I think that's one thing that's developed that's different than from before.

I guess the other thing is just the sophistication of the attackers, and the technology that they're bringing to bear. I just think a little bit about,  you know, a few years ago, well, obviously I'm dating myself now, but maybe a couple of decades ago, when there was all the Nigerian Prince emails that came through that everyone, you know, I had someone at one of the publications I worked at on the sales side who actually asked me whether they should be responding to that, and of course you would think it would be pretty easy to understand, “oh, you shouldn't do that”, but at the same time, now the sophistication of what's coming through, the ability to use different technologies to do mass attacks, et cetera, but the emails that you get through, they really look like something, they use the logo of the company, they really look authentic. So, I think almost everyone, even people that are well versed in preventing fraud have a tough time actually determining whether something is authentic or not. And the hackers are also using sort of multi-pronged attacks, so there's obviously now numerous communication methods to build that trust with their victims. If you think about social media, email, phone, et cetera, and they can use multiple channels at the same time.

Obviously, the next thing that's come up more recently is the advent of artificial intelligence or AI. And so not only are AIs tools, they're widely available now, they're easy to use, and they're almost free online.

Bad actors can buy kits to do this for like less than 20 quid, for example. So, it makes it very easy and inexpensive for them to actually perpetuate this fraud. And obviously AI can also be emails, or voice can be fed into AI to reproduce their voice or photos, et cetera, in these big, deep fakes.

I guess the other thing that we need to think about, and I'm sure Sune will talk about this, which is that collaboration between bad actors as well. So on the one hand, the banks aren't really allowed to share information, but the bad actors definitely are. And I just wanted to come up with a few, kind of big numbers, to sort of show, the impact of what's happening.

So, U.S. consumers lost a record of $10 billion in fraud in 2023, which is a 14 percent rise from the year before. And that's more than a billion over 2022, and the highest ever in reported losses to the Federal Trade Commission. And investment scams were the top fraud category in terms of reported consumer loss, surpassing all others at more than $4.6 billion, so that’s huge.

Last year, the National Fraud Intelligence Bureau run by the City of London Police received more than, nine thousands reports of romance fraud, for example, accounting to losses of over £94.7 million. And the average loss per person was about £10,000. I think the other angle that we should bring in is the crypto angle in the UK, losses to crypto fraud increased by 40 percent to March 2023, surpassing £300 million.

And in the U.S., the Federal Bureau of Investigation Internet Client Complaint Center, which is called IC3, reported a 45 percent increase in losses from crypto fraud year on year with a total of $5.6 billion reported losses. So, you really have to say it costs the individual, it costs the banking industry, but it costs society overall.

So, I just think that the numbers are huge and they're only growing.

Søren Winge: And it seems that the game changer is really, and I guess the big challenge, the new tools available and data available for the fraudsters to enable these new manipulative techniques. So maybe, Sune, from your perspective, how do you see that this is fuelling a rise in social engineering driven fraud, as we've seen.

Sune Gabelgård: Yeah, so no matter how mind blowing the numbers Joy just shared seem to be, we also need to remember that there's underreporting on top of that, because there's so much stigma in this area. So victims are not really telling their stories. And I think that it's also interesting that when you describe it, Joy, as this, exploding numbers, because the data sharing between banks is complicated and fraudsters not so complicated.

You know, sometimes I joke with it as there's no regulation of, criminals, so they don't have the same respect for GDPR and also there seems to be no taxes on the proceeds of a crime. So that's also interesting, but actually in this area, we see that sharing amongst criminals is one of the things that is fuelling it.

I have seen numerous examples of victims that are being victimized by one actor, but then another actor shows up, and that just makes the number explode even more. And, and one of the things that we sometimes forget when we look at the numbers, is that no matter the financial laws, that there's this human side of the story you trust them on and as Joy said, we are the weakest link.

I would love just to get back to that in a moment, but just to say that, especially from authorities and, sometimes also the financial sector, we look at a number and see, this is the laws, and then we forget that, you know, there's actually a human behind, or at least a very sad story around a human behind this and, and for the victims, this is a life changing experience to be a victim of fraud.

And sometimes it doesn't have to be the size of the loss that changes their life. I discussed this with victims before that actually didn't have a loss because they got covered by the bank. But they had this feeling that they woke up and there was, you know, a man in their sleeping room. So, we need to acknowledge that.

And I think that, that's also interesting because that's also something that can actually, you know, motivate all of us to do better and, and try to avoid this. If we keep in mind that there's a story, behind it, and then just to your point on the weakest link. It's true.

I hate to acknowledge that we are the weakest link, but we need to acknowledge that, and, I actually think that in this area, in the investment fraud, the weakest link is present because we overestimate our own capabilities in this area.

We believe that, yes, I know what I'm doing, so I will enter into this. So, if we could just acknowledge the need for help and to talk to someone else, you know, outside, it could help a lot.

Søren Winge: And I guess the investment fraud, as maybe the most growing vertical within this space in terms of fraud, uh, it's the different dynamics of what you could call classical payment fraud, I would say the element of greed or quick money, I mean, really plays in, right? Because it's a completely different approach from when you are normally, you could say, phished, with your details and card details and somebody else takes over your account or your card. But the dynamics of investment fraud is a bit different. You’re kind of lured into investing and in some cases actually also succeeding. What looks to be earning a bit of quick money, and then suddenly you're in there for real and then you lose it all. Sune can maybe explain to you what, that kind of that funnel that the fraudsters are using in terms of getting people hooked.

Sune Gabelgård: I think it's a, it's a pretty natural development, you know, there's no bank robberies, at least not in the Nordics anymore because we have no cash left. The fraudsters are just trying to make some money somewhere else. And the thing about the investment fraud is that, um, it's not just, a five-minute, event where I trick you to hand over your credentials. This can be an ongoing fraud for several years.

Some of the victims I talked to in 2018, they're still being victimized today by the same criminals. So, it's a lot of years.

Joy Macknight: That's shocking.

Sune Gabelgård: Yeah, its mind blowing and I can tell you that, as an old police officer, I thought I could convince these people about, you know, this is fraud, you need to stop, but I was not able to do so.

So, not only are they getting you to authorize the payment, they also keep you on the hook and keep you in the loop for several years, making that impossible to actually realize that you are being victimized until you lost everything but it's also complicating stuff for the banks and players in the financial sector that actually want to do something about this because suddenly what is normal for you, had changed.

So, you know, what is normal for me, is actually based on a long story of fraud, and that is one of the things that fraudsters really love, they love to buy themselves some time, so they can earn the proceeds of the crimes and, and ensure that everything's gone before someone shows up.

Søren Winge: So where does this leave the banks, Joy? I mean, in terms of both understanding the dynamics, but also helping their customers really fend for themselves.

Joy Macknight: It puts them in a difficult situation and I think they're different from other industry sectors really, because, not only banks are responsible for their employees and their customers, but they're actually held liable for incurred losses, which obviously means the cost of protection just is astronomical and it's growing, right? And so, banks are big targets for these types of scams really because not only do they hold the data, but they hold the money, right? So, they're definitely targets. And I think, the problem is that as fraud increases, there's a lot of other things other than the financial loss.

Like obviously financial loss is huge. There could be regulatory or, fines and legal repercussions on the banks, for example, but I think it also damages the customer trust and the reputation of the institution. Okay and you see that especially now, there's been a lot of fraud cases in terms of challenger banks and they're sort of getting the brunt of it and, obviously some of them have been fine, but others have so many fraud complaints and, you know, you think about fintech platforms like Revolut or N26 and they've incorporated the cryptocurrency trading facilities and this can open the door to, again, a new wave of frauds, targeting inexperienced users, because they can use fake cryptocurrency investment schemes or phishing websites to steal digital assets, again, which can have a huge impact. So, I think that's a big problem.

I think sometimes in terms of data sharing between organizations obviously, which is, something that we really need to do. But I think even in terms of internally, sometimes the banks’ siloed systems also make it very difficult for them to track such activities across different products.

They have very complex banking products sometimes. And so sometimes it can make it really difficult to identify fraudulent schemes until it's way too late. And then of course banks still have to deal with very stringent regulations. And so, social engineering, for example, just consumes a huge amount of resources to maintain compliance, which is huge for banks.

They're really at the thin wedge of what's happening, and the amount of effort that they really need to do, to combat the fraudsters, is massive.

Søren Winge: So as you see it right now, is the burden on the banks to solve this alone, or do you see other industry bodies play an important role in terms of facilitating this closer collaboration across, both industries but also through legislation in this area?

Joy Macknight: Definitely the pressure is on the banks to do things. I think the banks, over the years that I've covered this area, have been calling out for more industry bodies and more ability to share more information, and I think that's starting to happen for sure. And so, like in the UK, for example, there was an announcement recently where Meta, decided to announce the expense around their partnership with UK banks to share fraud intelligence, um, with NatWest and Metrobank, joining efforts through the Fraud Intelligence Reciprocal Exchange Initiative. So, things like that are going to make a big difference, and I do think it's not just the banks, right? So I do think there needs to be, has to be banks, it has to be the government, it has to be law enforcement, it has to be, social media as all of these things together, will, you know, that's the only, and like for my big thing, it's all about education as well. So, you have to educate the human element as well.

But I think what we always have to remember is that these initiatives, on a national basis are good, but it's a global problem, right? So, it doesn't matter if you're a fraudster sitting in the UK or, you know, sitting somewhere completely different, it's a global problem and they can target anywhere.

Søren Winge: You know, from a technical standpoint, what more do you see that we should consider doing from a bank point of view?

Sune Gabelgård: There's a lot we can talk about here, but just maybe to comment on Joy's perspective.

If we look at the investment fraud and you unfold an investment fraud story and you do that in media, it will just look bad, no matter how you do it, you know, people will say, why didn't you detect this dear bank, uh, you know, a trained monkey could have revealed that this was fraud, so I think that's one thing that we need to keep in mind, , when we do this, on top of the victims in the other end, but make it as a, first thing that you think about, will we be able to explain this in a way where people would understand why this happened and then we can, dive into all the technical side of things.

Joy also touched upon the education of the users and the customers out there, and that's super, super important, and, I bet that there will be someone out there saying that, yeah, but we tried that, and it didn't help, but maybe we missed the point. Uh, and I would say that, not so technical, but at least, me anyway, a little bit technical is to make a very segmented or maybe even an individualized communication towards, the end users, and stop crying wolf, because that is what we have been doing in the industry for years now, and we need to make it very segmented so we ensure that, we get the right information to the right people at the right time, and that requires a lot of, technical investments to be able to identify who should be informed about what and when, maybe even in the moment of the transaction, they need to receive the right information.

So, yes, the educational awareness needs to be there, but we need to do it in another way than we've been doing in the past. And then, back to what I also mentioned in the beginning, that, this might be normal for me if you look at my history, but maybe we need to think about using the KYC data in another way that we haven't been doing in the past.

So, banks have been asking all sorts of questions and people have been annoyed about answering all these questions. But maybe we're not using it the right way. Maybe we're not asking the right questions. So, imagine in a world where we could ask questions that was also related to stuff like fraud. So we actually didn't know what is normal for users and then there might be like I explained before that this, you know, goes on for years and years, and it might at some point look normal what I'm doing, then you need to be able to compare it with what is normal for me. And then you need to be able to compare what is normal for my segment, and not for all of the customers because there's a tendency for us to look at all transactions and then we look for, you know, the fraudulent patterns, but in reality, what we need to combine with that is the ability to detect when something is unusual for me as an individual, but also for my segment.

That's the only way we can, on a technical level, be able to detect this, and that requires a lot of investment, not only do we have a need for having the data available in real time, we also need to start pre calculating stuff before transactions happen, so we can actually predict whether this is normal or not. So, I would say that there's a lot on the technical side that we need to invest in.

Joy Macknight: Yeah, I definitely agree. And obviously, I think artificial intelligence can help quite a bit in terms of the behavioural analytics, that they can do and then the predictive analytics as well.

But of course, at the same time, the bad actors are also using AI to ramp up their sophistication.

Sune Gabelgård: It's a bit of an arms race going down there. But I also think that, um, and this is also, uh, both technical and also, kind of super sensitive topic to touch upon is to break down the silos.

We talked about it earlier, I think also, and banks need to realize that, you cannot just have a fraud department that is working with this. You need to break down the silos, between fraud and AML IT security, marketing, uh, you need to bring everyone around the table to break this vicious circle, because you also need to understand what it is that motivates people to go into, as an example, the investment fraud, why do I as a victim get attracted to this?

That's an area where you really need to invest in the brains of your employees and ensure that you have the right people around the table. And then I think that to me is superior to using AI, I think you can get much further in your efforts of preventing fraud by having the right brains around the table.

Søren Winge: So broader internal collaboration, maybe within the bank, for instance.

So Joy, as these mass communication campaigns are clearly not working to the extent that the banks might've hoped for, are you seeing that some of the banks are taking new steps in terms of, as soon as points to, you know, trying to make not only the controls more individualized, enabling some of the data you do in fact have on KYC, but also going about the communication or information, in a different way.

Joy Macknight: Yeah, I do think they're making huge efforts, but I don't think any of them have really cracked it completely. So, I do think, to Sune's point, I think, know your customer – KYC - is very important and how you use that data, et cetera.

But I do think they are trying to make their communications more targeted for sure, and obviously we all know about the extra steps that we have to do when we're making payments, for example, through our mobile apps, et cetera. But I guess, the banks are always weighing up how to create a relatively frictionless experience with actual, proper controls. So, I think they are making progress.

Søren Winge: So again, it's the convenience against security in a way sometimes, right?

Joy Macknight: Yeah, it’s always, that's the big thing, right? Because you, but you also want it to be a simple, and frictionless, but effective, solution. And how do you do that? That's the big question.

I do think I want to go back to education really. At the end of the day, and I think public education starting in schools, I think that's amazing. You know, there should be a whole course on that as you work your way, through school, is really thinking about, your digital footprint, how much information is out there and how you protect yourself.

And I think digital identity comes into it, as well. So how do you create a digital identity that the person, the individual controls in terms of information that it's giving out as well, right? So, yeah, I did a whole, I did this, um, this was years ago actually, but I did a feature on digital identity and looking at blockchain, distributed ledger technology, and whether that could actually make a difference in terms of having all your identity traits on the blockchain, and then giving certain access to different entities.

Sune Gabelgård: That's a super interesting area because that might also solve the challenge that, you know, the authentication today is a little bit one way, but it's me as a user that has to authenticate towards my bank, but in reality, if we somehow, and I don't know how, we need to think very cleverly about this, we could make this a two way authentication, so I could actually trust that it's the bank in the other end and not me on a phishing page. Um, but that's, that's a tough one to settle. I also just wanted to bring in, maybe I want to bring this in as good news. Uh, because sometimes I feel like, you know, I'm always presenting the bad news, but.

Actually, if we talk about breaking down silos and collaborating across internal in banks, that's also, in my opinion, the last hidden gem that has not been leaned in the past. Because when you work in silos, you have two different, if we talk about fraud AML, then you have two different sets of technology to solve the same problem.

You might even create two separate data sets to solve the same problem. So, if we start thinking, of this as one area and break down the silos, there's a lot of stuff that we can, actually reduce and save a lot of money, in my opinion.

Søren Winge: So when the bank calls me to validate that a certain action is in fact me, then I should also be careful to validate that the bank calling is in fact my bank.

Joy Macknight: Exactly.

Sune Gabelgård: Good, good luck to you.

Søren Winge: Haha, ok thanks Sune. it's been great listening to both your perspectives today. Before we end, is there a key takeaway that you would like to leave the listeners with today? What would that be for you, Joy?

Joy Macknight: Oh, there's so many, isn't there? Um, obviously the public education I think is really important.

I think that coordinated action across government, tech, banking sectors, holding, the big global tech platforms and telco firms accountable as well. So not just all the pressure being put on the banks. I think that investing, in digital capabilities also for police forces, because I heard that, you know, I think that the police force is just so far behind, actually, the bad actors and the criminals in this space.

And I think they need more, more funding as well. And again, it comes back to that whole thing, it's a global problem, so you can't solve it within borders.

Søren Winge: What about you, Sune? What are the key reflections that you want to share?

Sune Gabelgård: Um, yeah, that's a really good one, but there's so much. Luckily you touched upon some of it.

I think that, if I should say something, then we should all stop looking at, the liability question, and just think about how we can contribute to making something or a society that is better, also the digital society. So, if everybody stopped looking at, the liability and just ask themselves, what's my role here? What can I do? Then that would be a much better world that we could live in. And then also think about, like I just mentioned before, breaking down the silos. I think that's super important. And Joy, you covered it with the awareness and educational side. I think that's super important. And if I could make one wish, then it would be that we could get this, you know, as a part of our education in the school. Navigating in a digital world, that would just be super cool.

Søren Winge: So, there we have it. Thanks, Joy and Sune for your valuable discussion today, and I hope that it has opened the eyes of some of our listeners and helped you better understand the threat landscape banks are grappling with right now.

If you want to discuss your thought concerns, as always, contact us. You can do it at Nexigroup.com or connect with us on LinkedIn and via @Nexi Group. In the next episode, we'll hear from a major bank in Europe, and a fraud and dispute expert from Nordics, talking about how data harvesting is driving impersonation and manipulation. So, stay tuned on that.

Thanks a lot all of you for listening today. Please join us again next time.

Søren Winge: Welcome to our podcast, Nexi Talks, that will hopefully help you better understand and prevent deception during the war on payment fraud. My name is Søren Winge and I'll be your host. Today, we're talking social engineering and financial scams. Usually, as consumers, we are well protected by the card game rules, but with investment fraud, victims are lured into transferring funds directly between accounts.

This trend is rising. If fraudsters cannot break into your accounts easily, they will do anything to trick you into handing over the funds or keys to get inside. To discuss this today, I'm excited to be joined by Joy McKnight, former editor of The Banker, which is part of Financial Times Group. Her 20 year editorial experience spans the global banking industry, from retail through investment banking. In this time, she's focused on payments, technology, fintech, sustainability, and much more. Welcome to you, Joy.

Joy Macknight: Oh, thank you so much, Søren.

Søren Winge: And also, Sune Gabelgård, who is the leading expert on combating economic and digital crime across Europe. His extensive professional background over 25 years includes time with law enforcement, intelligence services, and key positions in the financial sector, giving him a unique insight into the psychology of criminals, fraud victims, and crime prevention strategies.

So, also welcome to you, Sune.

Sune Gabelgård: Thank you. Nice to be here.

Søren Winge: Right, let's get into it.

So Joy, as a journalist in this space for many years, you've spent a lot of time speaking with banks and helping wider audiences understand and explore the challenges they face. To set the scene, how big a problem is fraud, and in particular investment fraud, to the banking world today?

Joy Macknight: Of course it is a huge problem, and I guess the most worrying thing is that the problem just seems to be getting bigger, not smaller, no matter how much effort that the banks throw at trying to prevent it. Obviously, humans are the “weakest link”, as they say, as we can be manipulated in very different ways, particularly if you think there's a big shortcut as you put it, to big, guaranteed rewards, all of those “get rich quick” schemes.

And I think this is, really difficult, obviously, when times are tough in terms of the economy, et cetera. So, I think the vulnerability, and the susceptibility of consumers in different ways, make it easier for the bad actors to really swindle that money out of them. So I think we have to keep that in consideration.

I think there's been this sort of a coming together of different developments. One is the social media element, and I think a lot of the social engineering attacks have risen because of the arrival of social media, because it's so easy to look up a company's employees, their job titles, and work histories. It's very easy to impersonate them. I think most everyday people don't understand what kind of digital footprint they're leaving behind, as they do all sorts of things online. So, I think that's one thing that's developed that's different than from before.

I guess the other thing is just the sophistication of the attackers, and the technology that they're bringing to bear. I just think a little bit about,  you know, a few years ago, well, obviously I'm dating myself now, but maybe a couple of decades ago, when there was all the Nigerian Prince emails that came through that everyone, you know, I had someone at one of the publications I worked at on the sales side who actually asked me whether they should be responding to that, and of course you would think it would be pretty easy to understand, “oh, you shouldn't do that”, but at the same time, now the sophistication of what's coming through, the ability to use different technologies to do mass attacks, et cetera, but the emails that you get through, they really look like something, they use the logo of the company, they really look authentic. So, I think almost everyone, even people that are well versed in preventing fraud have a tough time actually determining whether something is authentic or not. And the hackers are also using sort of multi-pronged attacks, so there's obviously now numerous communication methods to build that trust with their victims. If you think about social media, email, phone, et cetera, and they can use multiple channels at the same time.

Obviously, the next thing that's come up more recently is the advent of artificial intelligence or AI. And so not only are AIs tools, they're widely available now, they're easy to use, and they're almost free online.

Bad actors can buy kits to do this for like less than 20 quid, for example. So, it makes it very easy and inexpensive for them to actually perpetuate this fraud. And obviously AI can also be emails, or voice can be fed into AI to reproduce their voice or photos, et cetera, in these big, deep fakes.

I guess the other thing that we need to think about, and I'm sure Sune will talk about this, which is that collaboration between bad actors as well. So on the one hand, the banks aren't really allowed to share information, but the bad actors definitely are. And I just wanted to come up with a few, kind of big numbers, to sort of show, the impact of what's happening.

So, U.S. consumers lost a record of $10 billion in fraud in 2023, which is a 14 percent rise from the year before. And that's more than a billion over 2022, and the highest ever in reported losses to the Federal Trade Commission. And investment scams were the top fraud category in terms of reported consumer loss, surpassing all others at more than $4.6 billion, so that’s huge.

Last year, the National Fraud Intelligence Bureau run by the City of London Police received more than, nine thousands reports of romance fraud, for example, accounting to losses of over £94.7 million. And the average loss per person was about £10,000. I think the other angle that we should bring in is the crypto angle in the UK, losses to crypto fraud increased by 40 percent to March 2023, surpassing £300 million.

And in the U.S., the Federal Bureau of Investigation Internet Client Complaint Center, which is called IC3, reported a 45 percent increase in losses from crypto fraud year on year with a total of $5.6 billion reported losses. So, you really have to say it costs the individual, it costs the banking industry, but it costs society overall.

So, I just think that the numbers are huge and they're only growing.

Søren Winge: And it seems that the game changer is really, and I guess the big challenge, the new tools available and data available for the fraudsters to enable these new manipulative techniques. So maybe, Sune, from your perspective, how do you see that this is fuelling a rise in social engineering driven fraud, as we've seen.

Sune Gabelgård: Yeah, so no matter how mind blowing the numbers Joy just shared seem to be, we also need to remember that there's underreporting on top of that, because there's so much stigma in this area. So victims are not really telling their stories. And I think that it's also interesting that when you describe it, Joy, as this, exploding numbers, because the data sharing between banks is complicated and fraudsters not so complicated.

You know, sometimes I joke with it as there's no regulation of, criminals, so they don't have the same respect for GDPR and also there seems to be no taxes on the proceeds of a crime. So that's also interesting, but actually in this area, we see that sharing amongst criminals is one of the things that is fuelling it.

I have seen numerous examples of victims that are being victimized by one actor, but then another actor shows up, and that just makes the number explode even more. And, and one of the things that we sometimes forget when we look at the numbers, is that no matter the financial laws, that there's this human side of the story you trust them on and as Joy said, we are the weakest link.

I would love just to get back to that in a moment, but just to say that, especially from authorities and, sometimes also the financial sector, we look at a number and see, this is the laws, and then we forget that, you know, there's actually a human behind, or at least a very sad story around a human behind this and, and for the victims, this is a life changing experience to be a victim of fraud.

And sometimes it doesn't have to be the size of the loss that changes their life. I discussed this with victims before that actually didn't have a loss because they got covered by the bank. But they had this feeling that they woke up and there was, you know, a man in their sleeping room. So, we need to acknowledge that.

And I think that, that's also interesting because that's also something that can actually, you know, motivate all of us to do better and, and try to avoid this. If we keep in mind that there's a story, behind it, and then just to your point on the weakest link. It's true.

I hate to acknowledge that we are the weakest link, but we need to acknowledge that, and, I actually think that in this area, in the investment fraud, the weakest link is present because we overestimate our own capabilities in this area.

We believe that, yes, I know what I'm doing, so I will enter into this. So, if we could just acknowledge the need for help and to talk to someone else, you know, outside, it could help a lot.

Søren Winge: And I guess the investment fraud, as maybe the most growing vertical within this space in terms of fraud, uh, it's the different dynamics of what you could call classical payment fraud, I would say the element of greed or quick money, I mean, really plays in, right? Because it's a completely different approach from when you are normally, you could say, phished, with your details and card details and somebody else takes over your account or your card. But the dynamics of investment fraud is a bit different. You’re kind of lured into investing and in some cases actually also succeeding. What looks to be earning a bit of quick money, and then suddenly you're in there for real and then you lose it all. Sune can maybe explain to you what, that kind of that funnel that the fraudsters are using in terms of getting people hooked.

Sune Gabelgård: I think it's a, it's a pretty natural development, you know, there's no bank robberies, at least not in the Nordics anymore because we have no cash left. The fraudsters are just trying to make some money somewhere else. And the thing about the investment fraud is that, um, it's not just, a five-minute, event where I trick you to hand over your credentials. This can be an ongoing fraud for several years.

Some of the victims I talked to in 2018, they're still being victimized today by the same criminals. So, it's a lot of years.

Joy Macknight: That's shocking.

Sune Gabelgård: Yeah, its mind blowing and I can tell you that, as an old police officer, I thought I could convince these people about, you know, this is fraud, you need to stop, but I was not able to do so.

So, not only are they getting you to authorize the payment, they also keep you on the hook and keep you in the loop for several years, making that impossible to actually realize that you are being victimized until you lost everything but it's also complicating stuff for the banks and players in the financial sector that actually want to do something about this because suddenly what is normal for you, had changed.

So, you know, what is normal for me, is actually based on a long story of fraud, and that is one of the things that fraudsters really love, they love to buy themselves some time, so they can earn the proceeds of the crimes and, and ensure that everything's gone before someone shows up.

Søren Winge: So where does this leave the banks, Joy? I mean, in terms of both understanding the dynamics, but also helping their customers really fend for themselves.

Joy Macknight: It puts them in a difficult situation and I think they're different from other industry sectors really, because, not only banks are responsible for their employees and their customers, but they're actually held liable for incurred losses, which obviously means the cost of protection just is astronomical and it's growing, right? And so, banks are big targets for these types of scams really because not only do they hold the data, but they hold the money, right? So, they're definitely targets. And I think, the problem is that as fraud increases, there's a lot of other things other than the financial loss.

Like obviously financial loss is huge. There could be regulatory or, fines and legal repercussions on the banks, for example, but I think it also damages the customer trust and the reputation of the institution. Okay and you see that especially now, there's been a lot of fraud cases in terms of challenger banks and they're sort of getting the brunt of it and, obviously some of them have been fine, but others have so many fraud complaints and, you know, you think about fintech platforms like Revolut or N26 and they've incorporated the cryptocurrency trading facilities and this can open the door to, again, a new wave of frauds, targeting inexperienced users, because they can use fake cryptocurrency investment schemes or phishing websites to steal digital assets, again, which can have a huge impact. So, I think that's a big problem.

I think sometimes in terms of data sharing between organizations obviously, which is, something that we really need to do. But I think even in terms of internally, sometimes the banks’ siloed systems also make it very difficult for them to track such activities across different products.

They have very complex banking products sometimes. And so sometimes it can make it really difficult to identify fraudulent schemes until it's way too late. And then of course banks still have to deal with very stringent regulations. And so, social engineering, for example, just consumes a huge amount of resources to maintain compliance, which is huge for banks.

They're really at the thin wedge of what's happening, and the amount of effort that they really need to do, to combat the fraudsters, is massive.

Søren Winge: So as you see it right now, is the burden on the banks to solve this alone, or do you see other industry bodies play an important role in terms of facilitating this closer collaboration across, both industries but also through legislation in this area?

Joy Macknight: Definitely the pressure is on the banks to do things. I think the banks, over the years that I've covered this area, have been calling out for more industry bodies and more ability to share more information, and I think that's starting to happen for sure. And so, like in the UK, for example, there was an announcement recently where Meta, decided to announce the expense around their partnership with UK banks to share fraud intelligence, um, with NatWest and Metrobank, joining efforts through the Fraud Intelligence Reciprocal Exchange Initiative. So, things like that are going to make a big difference, and I do think it's not just the banks, right? So I do think there needs to be, has to be banks, it has to be the government, it has to be law enforcement, it has to be, social media as all of these things together, will, you know, that's the only, and like for my big thing, it's all about education as well. So, you have to educate the human element as well.

But I think what we always have to remember is that these initiatives, on a national basis are good, but it's a global problem, right? So, it doesn't matter if you're a fraudster sitting in the UK or, you know, sitting somewhere completely different, it's a global problem and they can target anywhere.

Søren Winge: You know, from a technical standpoint, what more do you see that we should consider doing from a bank point of view?

Sune Gabelgård: There's a lot we can talk about here, but just maybe to comment on Joy's perspective.

If we look at the investment fraud and you unfold an investment fraud story and you do that in media, it will just look bad, no matter how you do it, you know, people will say, why didn't you detect this dear bank, uh, you know, a trained monkey could have revealed that this was fraud, so I think that's one thing that we need to keep in mind, , when we do this, on top of the victims in the other end, but make it as a, first thing that you think about, will we be able to explain this in a way where people would understand why this happened and then we can, dive into all the technical side of things.

Joy also touched upon the education of the users and the customers out there, and that's super, super important, and, I bet that there will be someone out there saying that, yeah, but we tried that, and it didn't help, but maybe we missed the point. Uh, and I would say that, not so technical, but at least, me anyway, a little bit technical is to make a very segmented or maybe even an individualized communication towards, the end users, and stop crying wolf, because that is what we have been doing in the industry for years now, and we need to make it very segmented so we ensure that, we get the right information to the right people at the right time, and that requires a lot of, technical investments to be able to identify who should be informed about what and when, maybe even in the moment of the transaction, they need to receive the right information.

So, yes, the educational awareness needs to be there, but we need to do it in another way than we've been doing in the past. And then, back to what I also mentioned in the beginning, that, this might be normal for me if you look at my history, but maybe we need to think about using the KYC data in another way that we haven't been doing in the past.

So, banks have been asking all sorts of questions and people have been annoyed about answering all these questions. But maybe we're not using it the right way. Maybe we're not asking the right questions. So, imagine in a world where we could ask questions that was also related to stuff like fraud. So we actually didn't know what is normal for users and then there might be like I explained before that this, you know, goes on for years and years, and it might at some point look normal what I'm doing, then you need to be able to compare it with what is normal for me. And then you need to be able to compare what is normal for my segment, and not for all of the customers because there's a tendency for us to look at all transactions and then we look for, you know, the fraudulent patterns, but in reality, what we need to combine with that is the ability to detect when something is unusual for me as an individual, but also for my segment.

That's the only way we can, on a technical level, be able to detect this, and that requires a lot of investment, not only do we have a need for having the data available in real time, we also need to start pre calculating stuff before transactions happen, so we can actually predict whether this is normal or not. So, I would say that there's a lot on the technical side that we need to invest in.

Joy Macknight: Yeah, I definitely agree. And obviously, I think artificial intelligence can help quite a bit in terms of the behavioural analytics, that they can do and then the predictive analytics as well.

But of course, at the same time, the bad actors are also using AI to ramp up their sophistication.

Sune Gabelgård: It's a bit of an arms race going down there. But I also think that, um, and this is also, uh, both technical and also, kind of super sensitive topic to touch upon is to break down the silos.

We talked about it earlier, I think also, and banks need to realize that, you cannot just have a fraud department that is working with this. You need to break down the silos, between fraud and AML IT security, marketing, uh, you need to bring everyone around the table to break this vicious circle, because you also need to understand what it is that motivates people to go into, as an example, the investment fraud, why do I as a victim get attracted to this?

That's an area where you really need to invest in the brains of your employees and ensure that you have the right people around the table. And then I think that to me is superior to using AI, I think you can get much further in your efforts of preventing fraud by having the right brains around the table.

Søren Winge: So broader internal collaboration, maybe within the bank, for instance.

So Joy, as these mass communication campaigns are clearly not working to the extent that the banks might've hoped for, are you seeing that some of the banks are taking new steps in terms of, as soon as points to, you know, trying to make not only the controls more individualized, enabling some of the data you do in fact have on KYC, but also going about the communication or information, in a different way.

Joy Macknight: Yeah, I do think they're making huge efforts, but I don't think any of them have really cracked it completely. So, I do think, to Sune's point, I think, know your customer – KYC - is very important and how you use that data, et cetera.

But I do think they are trying to make their communications more targeted for sure, and obviously we all know about the extra steps that we have to do when we're making payments, for example, through our mobile apps, et cetera. But I guess, the banks are always weighing up how to create a relatively frictionless experience with actual, proper controls. So, I think they are making progress.

Søren Winge: So again, it's the convenience against security in a way sometimes, right?

Joy Macknight: Yeah, it’s always, that's the big thing, right? Because you, but you also want it to be a simple, and frictionless, but effective, solution. And how do you do that? That's the big question.

I do think I want to go back to education really. At the end of the day, and I think public education starting in schools, I think that's amazing. You know, there should be a whole course on that as you work your way, through school, is really thinking about, your digital footprint, how much information is out there and how you protect yourself.

And I think digital identity comes into it, as well. So how do you create a digital identity that the person, the individual controls in terms of information that it's giving out as well, right? So, yeah, I did a whole, I did this, um, this was years ago actually, but I did a feature on digital identity and looking at blockchain, distributed ledger technology, and whether that could actually make a difference in terms of having all your identity traits on the blockchain, and then giving certain access to different entities.

Sune Gabelgård: That's a super interesting area because that might also solve the challenge that, you know, the authentication today is a little bit one way, but it's me as a user that has to authenticate towards my bank, but in reality, if we somehow, and I don't know how, we need to think very cleverly about this, we could make this a two way authentication, so I could actually trust that it's the bank in the other end and not me on a phishing page. Um, but that's, that's a tough one to settle. I also just wanted to bring in, maybe I want to bring this in as good news. Uh, because sometimes I feel like, you know, I'm always presenting the bad news, but.

Actually, if we talk about breaking down silos and collaborating across internal in banks, that's also, in my opinion, the last hidden gem that has not been leaned in the past. Because when you work in silos, you have two different, if we talk about fraud AML, then you have two different sets of technology to solve the same problem.

You might even create two separate data sets to solve the same problem. So, if we start thinking, of this as one area and break down the silos, there's a lot of stuff that we can, actually reduce and save a lot of money, in my opinion.

Søren Winge: So when the bank calls me to validate that a certain action is in fact me, then I should also be careful to validate that the bank calling is in fact my bank.

Joy Macknight: Exactly.

Sune Gabelgård: Good, good luck to you.

Søren Winge: Haha, ok thanks Sune. it's been great listening to both your perspectives today. Before we end, is there a key takeaway that you would like to leave the listeners with today? What would that be for you, Joy?

Joy Macknight: Oh, there's so many, isn't there? Um, obviously the public education I think is really important.

I think that coordinated action across government, tech, banking sectors, holding, the big global tech platforms and telco firms accountable as well. So not just all the pressure being put on the banks. I think that investing, in digital capabilities also for police forces, because I heard that, you know, I think that the police force is just so far behind, actually, the bad actors and the criminals in this space.

And I think they need more, more funding as well. And again, it comes back to that whole thing, it's a global problem, so you can't solve it within borders.

Søren Winge: What about you, Sune? What are the key reflections that you want to share?

Sune Gabelgård: Um, yeah, that's a really good one, but there's so much. Luckily you touched upon some of it.

I think that, if I should say something, then we should all stop looking at, the liability question, and just think about how we can contribute to making something or a society that is better, also the digital society. So, if everybody stopped looking at, the liability and just ask themselves, what's my role here? What can I do? Then that would be a much better world that we could live in. And then also think about, like I just mentioned before, breaking down the silos. I think that's super important. And Joy, you covered it with the awareness and educational side. I think that's super important. And if I could make one wish, then it would be that we could get this, you know, as a part of our education in the school. Navigating in a digital world, that would just be super cool.

Søren Winge: So, there we have it. Thanks, Joy and Sune for your valuable discussion today, and I hope that it has opened the eyes of some of our listeners and helped you better understand the threat landscape banks are grappling with right now.

If you want to discuss your thought concerns, as always, contact us. You can do it at Nexigroup.com or connect with us on LinkedIn and via @Nexi Group. In the next episode, we'll hear from a major bank in Europe, and a fraud and dispute expert from Nordics, talking about how data harvesting is driving impersonation and manipulation. So, stay tuned on that.

Thanks a lot all of you for listening today. Please join us again next time.

Søren Winge: Welcome to our podcast, Nexi Talks, that will hopefully help you better understand and prevent deception during the current war on payment fraud. We'll be joined by some of the best minds in the business, so you can learn from those who know payment fraud best. My name is Søren Winge, and I'll be your host.

Now, if you missed episode one, please go back and listen. You'll get some great insights into the ways fraud is evolving. But today we will try to answer the question everyone is asking. How are the advancements in artificial intelligence and machine learning changing the fraud game, both for good and bad?

We’re asking these questions, not to machines, but to three very human experts today. So, I'm pleased to be joined by Troels Steenstrup Jensen, who’s Head of Machine Learning & Quantum Technologies at KPMG Denmark.

Troels Steenstrup Jensen: Thank you, Søren. It's great to be here.

Søren Winge: And Alberto Danese, who’s Head of Data Science at Nexi.

Alberto Danese: Hello everyone. It's good to be here.

Søren Winge: And finally, our usual guest, Sean Neary, Head of Fraud Risk Management Services at Nexi.

Sean Neary: Hello, Søren. Hi, everybody.

Søren Winge: Welcome to you all. Let's get into it. Now Troels, there's so much hype about generative AI and how this tool can revolutionize our daily work lives. But from a front perspective, when did the journey around AI really start?

Troels Steenstrup Jensen: AI has been around for a long time. It was actually defined all the way back in around 1955, where John McCarthy defined it as the science of making intelligent machines. So basically, making computers do intelligent things. It has, of course, evolved a lot since then. And, let me talk about these two different evolutions within AI.

So, there's the part that relies on what we call training data, on examples of what we want the computer to do. And there's a part that does not rely on training data, that does it out of the box. If we start with the one that does not rely on training data, that is an example. If you ask your navigation system to take you from point A to point B, it finds you the shortest route. It does not need a whole history of how people might have driven from point A to point B. But if you take the other part, the part that relies on data, this one is the one that's relevant for fraud and actually also for generative AIs. This is the one where you show the machine a lot of examples of what you're looking for.

So, in the case of fraud, you would show it a lot of transactions and say, this one was fraud, this one was a normal transaction. And then you ask it the question or basically get it to, to classify between these, these two types.

Søren Winge: So, how did the journey start at KPMG in terms of leveraging the strengths of AI?

Troels Steenstrup Jensen: So, the collaboration between KPMG and Nets, which is now part of Nexi, started back in 2016. That's exactly when Nets had decided to purchase a big data platform. Now, finally, it was possible to really connect all the transactions. So, we're talking billions and billions of transactions on, you can say, one piece of compute that could also train models. And with training models, we mean that we, in a certain way, show it the historical transactions and get it to create an algorithm that can decide whether this was normal behavior or fraudulent behavior.

Also, at that time, the behavior of the fraudsters was changing. Sure, we could talk more about this, but we were seeing more advanced attacks. We were seeing volume attacks; we were seeing robot attacks. And it was becoming more and more challenging to write rules to prevent this fraud because these rules needed to be more and more specific, making them harder to write and harder to maintain.

So suddenly, the idea of having AI to do automatic rule writing showed up, and that very quickly matured into, maybe it doesn't have to write a lot of rules. Maybe it just has to write, you can say, very advanced rules. So, maybe it just has to actually change over and not have binary rules, but actually create a score that gives the probability of this being fraud or normal behavior, giving all the information available to the algorithm.

Søren Winge: So, after about a decade of working with this in house and given the accelerated developments the last couple of years, we're around the time where we are ready to hand over the reins to AI. What do you say, Alberto?

Alberto Danese: Well, Søren, I think, we are not ready yet, to be honest. If you think about it, as humans, we have leveraged tools and machines for centuries. And every century, every decade, every year, we've seen improvements in such tools. No matter the hype around artificial intelligence or generative AI, at the end of the day, it's a tool, it's an extremely advanced tool, but it's been designed, it's been developed by humans. And I think the place for AI and for machine learning in fraud prevention, but also elsewhere, is that of a very advanced assistant that can help us improve what we do.

Søren Winge: So, how has that changed the role between us and the machines? What is our role today, maybe compared to before?

Alberto Danese: Looking at how fraud prevention actually works. I think in the past, it used to be 100% based on fraud analyst expertise. At Nexi, I'm privileged to be working with analysts that have years of experience and have seen many events, many situations where fraud prevention has to be in place. And until a few years ago, it was 100% on them to write, to define rules of anomaly, basically, in order to deny transactions that were very unlikely to be genuine.

Now, the situation has changed quite a bit, as Troels was saying, not just in the last year or two, but probably in the last decade and now the activity of fraud analyst has been integrated with algorithms with AI.

And so, we still have great expertise of our experts of our analysts, but we have been able to develop some AI algorithms that complement that integrate existing rules. We also have to consider that we are in a field where we have a strong time constraint because as cardholders, as users of digital payments, we all know that when we want to make a purchase online or in a physical store, we expect the transactions to be authorized right away, in a few milliseconds.

And as fraud experts, as data scientists, we have a very limited time frame to operate and to evaluate if a transaction is genuine or not. And so, we really have to design not only effective systems but also very quick systems in order for our customers to have a positive experience.

Sean Neary: And I suppose to add to that Alberto, you say about it, sort of has to co-exist with the traditional, as we call them, fraud analysts.

And the extra part of that is the adaptability to trends, right? I think there could be this misnomer that these machine learning AI models adapt to new trends instantaneously. And you know, the new trend kicks in today and it's working tomorrow, detecting it for tomorrow and the week going forward. Well, in fact, then if you agree, that's not true, right?

And this is why you need these rules in place to then put these tactical immediate changes in when a new trend kicks in, at which then eventually we'll make it into the model. But not at that reactive speed that I think some people often believe.

Alberto Danese: I agree 100%. I think AI may seem like magic, but there is a lot of work under the hood.

And as Troels was saying also, there is the need to train AI algorithms and training takes time and also deploying a new model takes time. So, I think it's very important to be able to put in place quick solutions in some specific events and take into consideration that releasing a new, updated AI model, it's something that doesn't happen from the day to the night or the other way around.

Søren Winge: So, clearly this is becoming an increasingly a powerful tool, but also an important one for the fraudsters who are also leveraging this opportunity. I think clearly the last couple of years, we've really seen a development. How do you see the fraud landscape developing from the fraudsters point of view, Sean?

Sean Neary: Yeah, so that is a very good question and probably a perspective not many people always originally thought about. I think you have these old-school long-term analysts and fraud fighters. If they remember, scams back in the day were quite manually done. They were organized criminals. You would find that they would probably be one or two major players in the fraud space.

It took a lot of organization, data gathering, preparation. It was a lot of investment on their side. They're very calculated in where they put their attack because they had to get a return on their investment because there was a lot of upfront cost in doing it. It was a lot of, it was very manual.

And what we've seen is, with this AI or ML becoming a commodity and available publicly available piece of technology now at cost or even sometimes free, they're able to industrialize this and they're able to create efficiencies. They are a company in their own right. They do have call centers. They have rooms of people.

They are collaborating across the globe, and now with the use of AI, a one-man band can act as if he was an army of 20 people, that we might've seen 10 years ago. And not only is the scale of efficiencies a scary thing and in part being utilized for fraud, but if you think about language barriers, you will find that there are certain regions that just really weren't constantly under attack.

Specifically, if you look at places like the Nordics, where the language is harder to grasp, harder to fake, there are so many nuances. There’re so many local ways, depending on where you are in your countries, that it was just, again, didn't give you your return on investment. Moving into the latest sort of technology we have for AI, such as ChatGPT, we're seeing a lot more fraud spread into these regions because of these translation services that are very convincing.

And then you're finding not just that, but they're diversifying their channels of attack. They're now not just doing via email: they're doing it through social media. They're now able to do it through video. Through voice, this is again, as a result of the accessible nature of some of the tools you can get with mimicking people's voices, mimicking people's faces with deep faking.

So, we've seen it, we've seen a huge change and it's changing in the modus operandi that we're seeing between the customers, the fraudsters, and the us as the banks and the financial institutions. And I know we're going to cover these in future episodes.

Søren Winge: Yeah, so many of these types of attacks, which are becoming much more tailored, maybe also discussed under the heading social engineering- how these criminals are really becoming much better at doing these targeted attacks.

So, Troels, seeing from your point of view, how are you seeing this develop?

Troels Steenstrup Jensen: I think there were very nice points covered by Sean. A part of the social engineering is, of course, to understand and say that the person that is being targeted. And you can really use these new AI developments in order to much closer understand who you're actually trying to target.

Let's say you have an open Facebook profile, or you have a LinkedIn profile, and then, then you can actually have AI that goes in there and analyzes the content that's available and tells the type of target you actually have, what might be the weak spots for this type, for this target. So again, as Sean was saying in the beginning, it really removes some of the investment needed from the fraudsters’ side, because if you can suddenly just have an AI analyze, this is the best attack vector for this person, given his LinkedIn or his Facebook profile. That makes it a lot easier to start that social engineering and make it successful.

There's also an element of fraud called CEO fraud, where the adversaries, they managed to hack their way into a CEO or senior person within a company, and then analyze the types of communication; the emails that are being sent back and forth, and then at some point starts an attack where they literally pretend that they're now the CEO of this person that they've taken over, and they've actually done the effort into actually learning how does this person write, what are the normal working hours and done their homework. So, this really looks like it's coming from the person that they're impersonating. And of course, making sure that there's an urgency and an important deadline.

Søren Winge: What can we do to stop this? How can we, maybe, further leverage AI to protect banks, merchants, and consumers from this growing fraud?

Troels Steenstrup Jensen: You can dig into that vast knowledge repository that Alberto also mentioned from the fraud analysts who are working with this, really to pull out what are the areas that, where the current rules are not strong, and how do we make that into an AI solution. We made a setup where all of these small pieces, small evidence that this might be fraud, were really connected up and then aggregated in through an example model to, you can say, reinforce those signals.

So, a little bit like looking for the small crumbs here and there that at the end of the day says, no, this is not normal behavior. There have been some major updates of the model since then. One of the updates was in order to also teach it how to do some of what the current model, current rules were doing. Because as Sean was also saying, it's a very nice setup where you, if you need to respond to a very new type of fraud that the model is not detecting. Then you can put in a rule and then as you're updating the model, you would like the model then to learn this behavior to a large extent so you can clean up in the number of rules you have, so you don't have a growing rule base.

I think explainability is really the part that fixes that gap between rules and scores, because rules are very easy to explain because you typically could write them with a certain scenario or a certain fraud pattern in mind.

So, it's embedded. Once a rule is filed, that this is this type of fraud, this has triggered on, or a score can be high for a number of reasons. So, you really need the explainability in order to, to say, why does this come out as high? And that can really be used by these agents who generally review alerts on the fraud platform afterwards, so they know what to look for.

Sean Neary: I suppose to add into that, you’re talking about sort of general model governance as well. So, there are some boundaries that we have to abide by when we're working in the environments we are. Such as things as protected attributes, for example, certain things that you're not necessarily allowed to utilize when modeling. Whereas for fraudsters, the gloves are off, whatever data attributes they have, whatever they can utilize to make a better output they can use.

So, there are some restrictions there, for sure. And as you say, explainability is very important for us to understand that we are utilizing this technology in the correct way, and we are not going in with utilizing it blindly either. It is in a controlled manner and that again, does hinder some of the algorithms you want to use, the types of approaches you want to take.

And Alberto, I'm sure you've probably seen the evolution of where model governance has gone and how strict it is. What do you see?

Alberto Danese: I think, you know, explainability is playing a crucial role for us. Being able to really understand why a model gave a high risk to a transaction, to an authorization is key also in debugging, let's say, in understanding if the model actually performed the way we expect.

It's very important, not just in production, when a model is live, but also in development. We can understand if there is something wrong in the development of the models because, at the end of the day, it's not magic.

Søren Winge: Maybe Sean, you could elaborate a bit on how we've also used this model internally and developed it ongoingly. Also, in terms of how we try to use the opportunities also in other areas.

Sean Neary: Yeah, definitely. And I think what I'm going to say, we, I'm going to address it more from an industry perspective. We say, is this the future? It's the now, and actually it's also the past. Alberto has already referenced how long it's been in use for, and the same with Troels, on the 10 years.

And that is true. We've been utilizing variations of the umbrella of AI, you know, machine learning in fraud commercially for decades. I've nearly been in this, 18, 20 years. The models have been around since them when I first started in this domain. So, it's more about how we adapted and iterating with the new capabilities that this tool gives us, AI in general, you heard about algorithms, algorithm types. I think there has been a vast, I'd say innovative movement on the types of algorithms that are then utilized in fraud detection, specifically. We started off heavily in the neural net world, the black box world, as everyone likes to call it, that we knew what was going on. And then we've moved more to that open-source capabilities and moving into like more explainable elements, such as like random forests, for example, gradient-boosted trees on top of that. These have been readily available off the shelf algorithms designed and created openly. And we're, we're adopting that and that's allowing us then to then get far models out faster, explain how they work, understand them. The cost of the hardware is obviously also then shrunk.

So, we can now have more powerful hardware to run more sophisticated algorithms. And we are bound by costs. Businesses do have to manage their costs. We don't have this unlimited array of machines that we can run whenever we want forever. We have to do it within a certain cost. But the transaction monitoring fraud, that's been there, and it's been around for a long time.

But what we've been more iterating on if things like voice recognition. That was the second thing to come in the UK, and everywhere else has been around for quite some time, and started utilizing that natural language processing elements of, again, this technology to identify trust, which is important.

Is it Sean? Do I recognize him? Is it a voice I recognize from our previous calls? So, then also identifying the risk. And this is then from trained behaviors, that we're then seeing as you mentioning here. We then pivoting that across into the predictive side, the future, predicting the next transaction, and then assessing; is it against our next prediction?

We predicted Sean is then going to buy some new trainers. Were they trainers? Were they not? Was it a cash withdrawal in a different country? We're moving forward with that, but then you've got to think about the operational side of things. You hear a lot about the use of this for efficiencies. I mentioned scale earlier and the industrial size scale. Because of that scale for us to keep on top of the volume and the attacks we're getting, it'd mean that we'd have to scale our operations to handle all those cases, handle those customer calls, handle those interactions, bring down those bot emails or fake websites that we're using. So, for us, the future is utilizing this now, again, in a more diverse way, similar to the fraudsters, across our entire ecosystem of fraud management.

What can we do in operations? How can we utilize it there for call management, our chat functionality? When we're trying to get money back and retrieve the money for the customers through the merchants, through the schemes. Can we automate those things? That enables us to put more personnel, more people into the front of the fight, running those analytical models, working with Alberto and the team and Troels and Co. That for me is the future. Automate where you can, diversify the use of this technology across your channels, so you have an interconnected strategy and management to fight this.

Søren Winge: A lot of things are going on under the hood and the data pools are growing in size. And, of course, it increases the knowledge based on which we make these decisions in a split second or in a millisecond, but how do we manage all that data?

Alberto Danese: If we get down to the nitty gritty, we are dealing with more than ten million transactions per day in all the countries where we are present as Nexi and Nets.

So, it's a huge volume of transactions of authorization that takes place in a regular day. I'm not talking of the Black Friday or the days where we have even a higher load. And we have to be able to process this information quickly, as I mentioned before. So, I think when it comes to machine learning models, there are a lot of technicalities.

If I have to highlight just a few points, we have some information of the authorization itself. That's, by the way, a standard, an ISO Standard, because it allows transactions to be made everywhere in the world, thanks to international schemes. So, we have a lot of information like the amount of the transaction, the merchant, and so on and so forth.

But we have to be able to integrate this information of the transaction itself, of the authorization itself, with historical behavioral data on the card. For instance, on the merchants, on previous iterations of the cards with that merchant. And so really the challenge from a machine learning engineering point of view is to be able to do this very effectively and integrate information in the authorization itself. Let's say behavioral patterns, then really represent the data that is used as a training data for a machine learning model, and then is used in real time to score a transaction, because at the end of the day, we want to give a score, a risk score of a transaction.

So, I think this is the challenge, using real time data, but also incorporating historical behavior. And I mentioned multiple times the technological challenge, but another important aspect, actually a statistical one. In statistics, we consider every event that happens in two percent of the situations or less to be a so-called rare event.

And when it comes to frauds, actually, we are way lower than that. I will tell a funny story. I interview a lot of graduates, and I recently did actually a round of interviews, and I often ask some questions that are not part of the technical assessment or stuff like that. And I asked them to give me an estimate of what they expect to be a ratio, the fraud rate, let's say.

And obviously I know the reality of things. And some people think that frauds are maybe around ten percent of all the authorization. I had a guy tell me 20%. And I was blown away because it's incredibly far from reality. Now I won't go into the exact numbers for obvious reasons, but if we take a look at the European PSD2, that's the Payment Services Directive, it talks about all stuff related to payments, including frauds.

And when they speak about frauds, they measure frauds, and they also provide some thresholds in basis points. A basis point is one case out of 10, 000 transactions. So, we are talking of 0.01 or 0.0 something percent of transactions that are actually fraud. So, we're in a very challenging environment also from a statistical level because we have a few, let's say, attempted frauds in a world of genuine transactions. And this is really the second challenge that we face besides the technological one.

Søren Winge: Even though fraud is growing, it's growing for a very low starting point.

Alberto Danese: Exactly, I think our business would not be sustainable with a much higher level of frauds, to be honest.

Sean Neary: And you've got to think, when you say it's growing, but so are the genuine transactions. Percentage is not changing.

Søren Winge: So, where do you think AI will take us from here? What is the next kind of frontier that we'll see?

Sean Neary: Where will AI take us from here? I think there’re still limitations in AI. You heard Alberto say, we're not ready to hand over the reins. I think AI is going to take us in a more scalable fashion for what we're doing.

As I mentioned before, so we'll be able to utilize it to do a lot more operationally, specifically. It's a tough one to answer right now, Søren, just due to the rate of change that actually happens in industry. But for me, we're doing a great job with what we have today. If I'm honest, if you apply it correctly and you apply time to it correctly, we're able to output fantastic results, utilizing AI, specifically in the transaction monitoring space.

As I've said before, I think it's more about where we can apply it elsewhere in the ecosystem of fraud management. What other channels or what stages in a payment can we then utilize that in? Or specifically what use cases can you do it in? So, scams, for example. Scams, we haven't really touched it just yet on here, but we've spoken predominantly about general card transaction fraud.

Think about scams, that's a genuine person making a transaction. You can have all the history in the world in your model and it can tell you that it's genuine because it probably is because it's the customer clicking yes. And you have things such as signals, trust signals, attributes that identify, did they authenticate?

Scams is, yes, they have authenticated. Well, I think the future could be is more that in depth behavioral understanding of a spending pattern of a person and Troels mentioned it. We've got more access to data now. We've got more insight to what a person looks like. Yes, we've got some challenging laws on actually data rights and data privacy rights.

But at the same time, I believe there is so much data out there that we can start applying it in areas which were really hard to predict and use a predictive model. And go more into a true behavioral model. And that's what we're seeing with the advancement of these ChatGPT models and deep learning algorithms that we're seeing being utilized in our organizations today.

So, I think that's more of the future, is putting it to those use cases that were probably deemed impossible to be beneficial in using this technology.

Søren Winge: Thanks for putting on the light on this, so to speak, and talking about how you see the future. Maybe, as a few closing remarks and takeaways, Alberto, how do you see, what are the key takeaways seems from your point of view, in terms of AI and fraud?

Alberto Danese:  I think that for people like us with a passion for data, for algorithms, for technology, we are living amazing times. Technology, AI is not only running, but it's accelerating. We have advancements, huge advancements in smaller timeframes. Every month, every week, actually, we have new advancements. And it's just great because as Sean was mentioning, we can scale to in the countermeasures that we put in place.

I think the key challenge and also the key takeaway is that we have a lot of opportunities, a lot of technology, a lot of hype on AI. We have to be great at what we do in understanding which parts of the AI advancements are actually useful for fraud prevention, because at the end of the day, what we care is providing a safe, a good experience for our customers. And I think AI can help us a lot in this.

Søren Winge: Sure. What about you, Troels? How do you see it?

Troels Steenstrup Jensen: Let me start with a small anecdote that I was listening to when I first started working with fraud. I was told that the very, very first fraud prevention measure that were put in place, basically immediately after a new card scheme was launched many years ago, that literally consisted of a matrix printer that would print out every transaction on a long piece of paper.

And then at some point, an analyst would take a look at it and evaluate if some of that looked fraudulent or not. I just thought that was a bit of an interesting historical perspective at how it started. And then maybe continuing what Alberto was also saying, that there have been huge advancements on what's possible. And I think it's simply such an interesting area to work with. It's an important one where we're keeping cardholders safe. We're using technology to do that. And the technological landscape is continuously improving. Computer is increasing data availability, also cross channels is increasing, and the algorithms that can be employed are also getting better.

It's really fascinating to see every year there's something new you can do and still keep to those millisecond requirements that are really hard requirements, because you as a cardholder want that transaction to go through quickly. So, I think it's simply an exciting area to work with where you constantly are on the verge of what's actually possible to get up and running in production in order to reduce fraud even further.

Søren Winge: And Sean, maybe, you have a perspective in the end?

Sean Neary: Yeah, my key takeaway, I think that the first thing is for everyone to recognize that they may hear about the fraudsters having these tools, but they must understand that we have them too. And we have to say, we do have the same access. We have the same skill.

We have the same investments that we're putting in. So that's, I think that's a clear takeaway and we're continuing to do that. We adopt a similar rate to the fraudsters do. That's important for everyone to understand. But the second takeaway is we must all recognize that AI machine learning is not the silver bullet to this specific domain.

You've heard throughout this whole episode, there is still the need for us as humans to be involved in this. There is still that requirement for us to then work in tandem, alongside this technology, and take advantage of the powers that it gives us to fight against fraud. And as long as we work together, in harmony, we are going to win this war against fraud.

Troels Steenstrup Jensen: I think that's actually quite relevant. What you also said, Sean, that we also have access to those tools, similar tools, but there are also some things that we have access to that the fraudsters do not. We have access to the full card transaction history of the credit card, so that’s why we can actually say if something is normal behavior, according to this card or not- that information that a fraud will not generally have available. They might just have a card number available. They don't know necessarily what does normal behavior look like for this card. That's really what gives some of those weapons or insights that can be used against the fraudsters that you can really say, this is the normal behavior for this card.

And if the fraudster tries to commit fraud or something using some means that is not normal for that card, then we'll catch it and stop it.

Søren Winge: That's about it for today. In the next episode, we'll hear from a leading bank about how fraudsters are using tools and techniques, including AI, to perpetrate phishing, vishing and smishing scams, which generate millions for them, every year. In the meantime, for more information, visit nexigroup.com or connect with us on LinkedIn.

Thanks for listening, and we'll see you next time!