Using AI to Keep Scammers and Fraudsters (a Little More) Honest

Fraudsters and scammers have had a good run lately according to the FTC, which found Americans lost $10 billion to frauds and scams in 2023, a 14% increase over the year before. But victims and law enforcement are fighting back with data and AI, and two startups named Valid8 and Scamnetic are hoping to make a dent.

There are important differences between frauds and scams, and different legal liabilities provide different incentive structures to eliminate them. For instance, if you fall victim to fraud, such as a cybercriminal stealing your identity and opening a new credit card account in your name, then the credit card company bares legal liability. However, if a cybercriminal tricks you into transferring money from your bank account into his, then you have fallen victim to a scam and the bank is not liable.

“With a scam, the scammers are manipulating you to take action on their behalf,” says Al Pascual, the CEO of Scamnetic and an expert on fraud and scams. “They’re trying to get you to send them money or give them access to something. But you’re the one who is logging into the site. You’re authenticating. You control the account, and you’re moving the money.”

Because banks are legally liable for credit card fraud, they invested vast sums of money to enable them to detect fraud in real time. Technical innovations such as EMV chip embedded in credit cards, as well as sophisticated machine learning systems that can detect fraud within milliseconds, has resulted in the rate of credit card fraud falling significantly.

(Source: FTC)

“The criminals realize rather than trying to go out and steal information about you, pretend to be you, and then hope I can get access to things, all I have to do is call you or email you,” Pascual said. “We’re talking tens of trillions or more of communications [per year] that are going out from scammers.”

The world of scams is blossoming at the moment, Pascual said. There are spray-and-pray scams, where the bad guys send out billions of emails, texts, and other messages. There are work-from-home schemes that lead you to become a check-cashing mule. There are spear-phishing scams where bad guys target individuals based on stolen data. Romance scams are popular. So are the grandchild-who-needs-money scams. And then there are the pig butchering scams, where the crooks take you for every penny.

“Some of them are just about kind of turn-and-burn. Some of them play the long game,” Pascual told Datanami. “I don’t know if you’ve gotten some of these texts yet, but they come across as super innocent. It’s like ‘Hey, I forgot, I forgot my golf clubs in your car’ or ‘Hey, I gotta give you that money for lunch.’ You’re like, who’s this?’ And then all of a sudden, you have a relationship with them.”

Since banks aren’t weren’t liable when clients fell victim to scams, they didn’t do much of anything to stop them, besides putting out the occasional educational email, said Pascual, who spent his career fighting fraud and scammers at banks and other institutions.

“When banks tackle these issues, they’re applying all kinds of advanced technology,” he said. “They’re applying machine learning. They’re applying threat intelligence, third party data sources. They’re really doing whatever it takes to mitigate this risk, because the potential loss is astronomical. So they’re very methodical and they’re constantly in the weeds with the bad guy trying to figure out what they’re doing right and then coming up with best practices.”

Pascual founded Scamnetic to build the same sort of system to protect individuals from scammers and scams. The goal with Scamnetic is to build a real-time shield that protects consumers from scammers by identifying when a consumer likely is being exposed to a scam via phone, text, email, social media, or other websites.

“I took the same approach as the banks, which was identifying their MO [modus operandi], their tactics, techniques, and processes, and then identifying how we can take everything that they do, break it down and use it as a source of signals for as to whether or not there’s risk,” Pascual said. “And then once we’ve identified the areas of risk, we can then begin to apply controls to it.”

There are 25 to 30 types of scams being perpetrated in the US and Canada, and Scamnetic uses AI and machine learning to identify when a given communication is likely a scam.

“We know exactly what we need for each of these scams and that’s what we’re focused on. We’re leveraging that to get smart and be able to stay in line with the bad guy too,” he said. “My goal is literally just to kick their ass.”

When it launches next quarter, Scamnetic will be available via banks and telecommunications companies. Pascaul is taking the B2B2C model because it will help him get the product into the consumer realm faster.

Banks are motivated to do something about scams because regulators in the UK and Australia recently began cracking down on scams by requiring the bank that receives a transfer to know who the person receiving the money is, he said. That is driving interest among banks to do something about scams.

“We protect people from scams,” he said. “Are we going to be perfect every time? No, but are we going to be a thousand times better than human intuition? Oh yeah.”

Using AI to Detect Corporate Fraud

Fraud is much more prevalent in the corporate world than one may have thought. In fact, a recently study found that upwards of 10% of corporations are committing securities fraud each year, costing $830 billion in equity.

“We’re in the golden age of fraud, meaning money has been really cheap for a very long time,” says Chris McCall, co-founder and CEO of Valid8. “The tide hasn’t gone out in so long that I think a lot of stuff is going on right now, and it’s just covered up by the positive macroeconomic conditions that we’ve seen.”

Fraud is surprisingly easy to pull off, and it’s usually not that complex, McCall said. The conditions for fraud are ripe when a trusted employee has control over an account and moves money where it’s not supposed to go. “That’s it,” he said. “It’s as simple as that.”

(Tero-Vesalainen/Shutterstock)

But detecting the fraud and then proving it in court can be very difficult, and that’s where McCall’s startup Valid8 comes in.

Valid8 uses AI and machine learning techniques to help clients make sense of financial transactions. The company, which sells exclusively to law enforcement, attorneys, and auditors, basically makes sure that the actual flow of money, as evidenced by data from banks, is consistent with what the corporate records indicate. If they’re not consistent, that’s a sign of some funny business going on, possibly fraud (but sometimes there are other explanations too).

“We base everything on evidence,” McCall said. “The largest category of occupational fraud in the United States is asset misappropriation. What’s asset misappropriation? Well, it’s writing a check to someone and then having it coded to somebody else. So what we do is we would actually go look at the check, find the payee and payor, see the amount of money that was actually taken out of that account from the statement, and then compare it to the check ledger that’s in the ERP system itself.”

The big challenge is that gathering all that evidence is hard, tedious work. Optical character recognition (OCR) technology helps automate the job, but it doesn’t go far enough. Valid8 uses computer vision tech to help it make sense of hundreds of thousands of documents involved in a case. It also uses classification and categorization machine learning algorithms, McCall said.

“Any type of financial evidence–think bank statements, copies of checks, wire details, transaction lists from spreadsheet–we use AI to pull it all in and then we do all kinds of QA [quality assurance] checks to tie everything back to the evidentiary documents,” McCall said. “Anywhere professionals have to follow the money, that’s what we’re designed to do.”

One of Valid8’s customers is Alvarez & Marsal, one of the consulting firms brought in to help clean up the mess at FTX, the crypto bank that collapsed in a giant puddle of fraud. Its software also helped convict a mortgage broker who had raised $300 million from 750 investors. Most of the time, however, there is no fraud, according to McCall.

“We’re providing a lens of transparency, shining a spotlight on this stuff, and a lot of times, nothing’s wrong,” he said. “But in the cases where something is wrong, it’s almost always because no one’s really looked at it and that’s how they’re getting away with it.”

Valid8 has to be 100% right for the data to hold up in court, so there’s no room for mistakes. Things can get hairy when a new set of documents comes in, but they’re formatted a little differently than the first set. Without AI helping to make sense of the raw documents, it would take five to 10 times as much time and effort to assemble a complete record, McCall said. That might make it prohibitively expensive to prepare a case, which just encourages more bad behavior on the part of criminals trying to hide their nefarious deeds.

“How do you take a look at exactly what’s happening? It’s really hard to do,” he said. “That’s where AI comes in. If you can get transparency into that complex data set so you can start seeing things and looking at patterns and trying to identify certain mechanisms or how payments are being made or when they’re being made. All of a sudden you can stop a lot of that stuff. But until you get access to the data, it’s kind of the Wild West.”

Payment Fraud at Record Lows Thanks to Analytics and AI, Visa Says

AMEX Adopts Machine Learning to Crunch More Data

The post Using AI to Keep Scammers and Fraudsters (a Little More) Honest appeared first on Datanami.