Fraud Defense 2026: The Industrialization of Fraud
SPEAKERS
Brandon Nowac, Kolt Bell, David Maimon
Brandon Nowac 05:08
We'd like to welcome everyone back for our ninth annual fraud webinar. This year's topic was shaped directly by feedback from each and every one of you, our clients, on the threats that matter most to you and your businesses. Fraud has evolved from opportunistic crime into a structured technology-enabled industry. Today, we'll walk you through how that transformation has happened, what it means for your organization, and the specific steps you can take to protect yourself and your businesses. We've planned today's session around three key questions every business leader and finance professional should be asking right now. First, we will look at how AI has fundamentally changed the way fraud is conceived and executed. Second, we will show you the real capability fraudsters now have access to, and some of the sophisticated ways in which they're engaging around fraud. And lastly, and most importantly, we'll close with concrete, actionable ways in which you can protect your organization and yourself. I'm joined today by two of my esteemed colleagues here. I'm joined by Dr. David Maimon, who is at Stentilink and runs fraud strategy, but also is a professor at Georgia State University. David, thank you for joining us. You come in from Atlanta.
David Maimon 06:15
Thank you so much for having me. Yeah,
Brandon Nowac 06:16
thanks for being here. And then similar to last year, my colleague Kolt Bell. Kolt runs enterprise fraud for Key and also comes in from Atlanta. So Kolt, great to be with you again.
Kolt Bell 06:25
Glad to be back.
Brandon Nowac 06:26
And I'm Brandon Nowak. I sit in our commercial bank here at KeyBank. So we're going to start the conversation talking about broad industry trends. I think it's really important to talk just you know broadly about what's happening across the industry, how fraud has evolved, certainly ways in which you know you as business leaders, finance professionals, can help protect yourselves and your business. But then we're going to get specific into four areas of which we're seeing real trends happening across our commercial client base. But Kolt, why don't we start with the first topic? Let's talk about broad industry trends, things we're seeing out in the market, and help folks understand again at a broader scale what we're seeing out there.
Kolt Bell 07:01
Sure. Let's start with the numbers. The FBI publishes the IC3 stats, and while these numbers are representative, I don't think they're definitive. We can all agree that these are probably underreported. But just to show context, from '23 to '24, there was a 33% increase, and from '24 to '25, there was an additional 26% increase. So we're now over a million complaints and over $20 billion. If you think about maybe one in 10 victims actually respond to this, you can start to see the scale of the problem.
Brandon Nowac 07:29
Well, interestingly, to add another stat, you know, every year, twice a year, actually, we publish what we call our middle market sentiment survey, and in most recent results, over 700 business owners indicated that 92% of indicated that they were going to increase spend in cybersecurity for their business over the course of the next 12 months. So it shows you that you know it's very real and relevant for for everyone watching here today. AI has eliminated the traditional red flags of fraud such as awkward phrasing and spelling errors, the FBI warns that generative AI is specifically being used to correct these human errors. So employees must verify all information every single time. As a business, you must test and audit your procedures and your team's execution of them. David, you know you've said that fraud is changing quite frankly on a daily basis, can you give us an example of a recent trend, maybe in the past several weeks that you've seen?
David Maimon 08:25
Yeah, for sure. I mean, so to go to Kolt's point, I mean, the increase we're seeing in the volume of trend is the volume of fraud is essentially the increase use of criminals in AI technology, and so you know, on a daily basis, we're seeing those criminals finding more and more ways to come up with new tools and new ways to use the AI tools that they have out there. Recently, and by recently I mean a couple of weeks ago, we were able to find fraudsters advertising the use of a tool called Kiki. Kiki is really interesting because essentially it's a jailbroken cloud, ChatGPT, DeepSeq, all those LLM models that are available for us all to get access to. But while we try to get access to those tools and engage in criminal activity, and the tools will block us, Kiki will not. And so, what we're seeing on the screen right now is essentially concrete details that Kiki sent us followed a prompt from one of our team members to essentially tell us how to bypass know your customers' solutions out there. As you guys can see, the prompt was fairly simple, and we get a very detailed list with respect to how you you will be able to bypass those technologies out there. So this is just one of the most recent tools we are seeing out there. There are more, but you know I think that's a great example how developed and how advanced the the ecosystem is.
Brandon Nowac 09:59
It's incredible to see. How Kiki has taken these LLMs-a simple prompt of explain to me how to you know bypass Know Your Customer KYC and create this highly detailed step-by-step instruction manual on how to do so.
David Maimon 10:14
This is just one of the things that we did with it. You can also write ransomware. You can produce images of individuals, you can produce documents to different level of you know succeed, success and accuracy. But this tool essentially allows you to engage in fraud and provides you with the content to to facilitate it.
Kolt Bell 10:34
So, David, you're showing just some of the tools, but we're going to talk today of how like fraud has really become a business, right? We're going to talk fraud as a service, and I think a lot of the business owners will be able to reconcile or understand that you started as a kind of a startup, and you're going to show how fraud has basically evolved into a big business.
David Maimon 10:54
Yeah, one of the things that I do for a living essentially spend a lot of time with fraudsters out there, and when I talk about spending a lot of time with fraudsters out there, I do spend some time with them in the physical environment. But most of what I do involve me sitting with them on the online fraud ecosystem, where we're seeing them communicating with each other. We're seeing them teaching each other how to engage in fraud. We're seeing them selling all kind of tools and tutorials and recruiting individuals to their teams, and one of the interesting things we were able to discover fairly quickly once we started working on this line of research is the very sophisticated supply chain that you have out there. Very sophisticated role that different actors have across the supply chain, which essentially leads us to believe that we are talking about organized crime syndicates out there, which fuels what the IC three is reporting, what what folks are reporting in the FTC and you know other organizations that collect fraud reports in our society. So we are seeing criminal networks operating in in the ecosystem, we are seeing a lot of tools, a lot of tutorials, a lot of recruiting efforts that essentially lead us to believe that fraud is now a service that you can purchase on these on this ecosystem. The concerning thing is that there is really no real barrier right now between anyone who wants in fraud and and those who do not, I mean, all you have to to do is just go on your smartphone and find some of the markets out there and and start engaging in fraudulent operations and with individuals who can plug you in this ecosystem, which again help facilitate some of the fraud trends that we're seeing right now,
Kolt Bell 12:43
and I think it's important for us to to come out of the gate, saying we're going to show you a lot of stuff behind the scenes. It's not to be a tutorial of how to commit fraud, but how to understand what's happening.
Brandon Nowac 12:51
Well, I think the big takeaway there is, you know, this went from you know you say a startup, but this is an industry, an end-to-end industry has a low barrier to entry, it's low cost with significant upside, you know, and I think that's why you've seen this massive trend of growth, particularly over the past several years.
David Maimon 13:07
And I think it's important for business owners to be aware of what we're seeing out there right now, because at the end of the day, those criminals are constantly looking for targets, and they shift gears constantly between different types of targets that they try to victimize, and so it's important to be aware of how easy it is, the ecosystem that is available out there, in order for us to be in a better spot in terms of preventing and mitigating these types of fraud in in our organizations.
Brandon Nowac 13:38
So, what are you showing on the page here?
David Maimon 13:40
So, yeah, I mean, just just to make sure that we're all on the same page with respect to how easy it is to find those markets, I wanted to make sure that folks understand what the darknet is and how you access it. So to access the darknet, all you have to do is just go to Google, type in Tor, and then you'll be able to get a link to a Tor browser, which essentially will open a door to the online fraud ecosystem. For those who have never been in those markets, this is a typical layout of a darknet market. On this specific example, we're seeing the vendor offering for sale a bank account, a drop account. This is another example of another market where you can purchase identities and fake driver licenses, fake social security cards. You know, all all is accessible through the darknet through through the Tor browser.
Brandon Nowac 14:34
It really is amazing. I mean, it's it's it's like a it's like a traditional online marketplace for an everyday consumer.
David Maimon 14:40
That's exactly what it is. I mean, and the only difference between these markets, the the darknet markets, as well as legitimate markets, is type of commodities that being offered for sale there. Another very important resource for fraudsters out there on the darknet are forums. Like in the Clearnet, we have forums of people exchanging all. Kind of useful information in the context of their life. The forums, the darknet forums, are very useful in the context of exchanging information that will support your fraudulent operation, which actor you want to be engaged with, which ransomware group you want to pay attention to, where is the most recent data leak available? Of you'll be able to find all this information on the forums, and we see more and more people joining those forums and consuming some of the materials that are available.
Brandon Nowac 15:26
And you had mentioned through Georgia State University, you and your students, you'll actively monitor some of these chats and forums and messaging for the fraudsters.
David Maimon 15:36
Yeah, we're fortunate enough to have our own network at Georgia State University with our own labs, and so that allows us with the opportunity to essentially go and monitor those darknet markets and forums on a daily basis. Try to infiltrate some of the groups, get access to secretive groups out there, and collect all the information that we believe is relevant for understanding the online fraud ecosystem. You've been doing this for years, and we've been doing this. Yeah, we've been doing this since 2018. One interesting thing that we need to understand is that while the darknet is definitely a resource for fraud markets to to draw upon, text message applications, which we're all using on a daily basis, are also great in terms of getting some resource, if you want to engage in fraud, what we're seeing more and more, starting 2019, are criminals using text message applications such as WhatsApp and Telegram and Signal and QQ and other applications out there to essentially create group chats, invite all their criminal groups to the group jets. Invite other people who are interested in their commodities to those group jets, and then start selling and selling the commodities and teaching people how to engage in fraud. We see a lot of guns markets out there. I mean, criminals are creating guns markets over those text message applications. We're seeing them creating counterfeit product markets. We're seeing them creating drug markets, and and by drug markets, we're not talking about weed and cocaine. We're talking also prescription drugs. So we see a lot of Ozempic and testosterone and other types of of drugs that you would need to have a prescription to get access to, and of course online fraud markets, markets which support the sales of identities, fake driver licenses, stolen checks, stolen debit cards, all the all the commodities that are required to.
Kolt Bell 17:32
So you're showing two on one slide, but really it's targeted markets that they have. They specialize in it. They're they're very good at selling the product.
David Maimon 17:38
Targeted markets that essentially help sell the product, but also recruit individuals to those fraud rings, teach them how to engage in fraud, and essentially facilitate fraud in our society. The last important platform that we're seeing being used more and more by fraudsters to facilitate fraud is the Clearnet. So we're seeing them using the internet that we're all using to open shops of stolen credit cards, stolen identities, but also use social media platforms such as Facebook, as we're seeing on the screen right now, and Instagram and TikTok. So on this Facebook group, as you guys can see you can purchase bank statement and pay stubs to go along with a stolen or synthetic identity you are putting together and try to work with in the context of defrauded operations.
Kolt Bell 18:30
So this isn't all underground like you think. This has come up to the surface.
David Maimon 18:33
This is all over the place on the internet that we all have access to.
Brandon Nowac 18:37
Well, and then on the physical location side, when we were talking earlier. You'd mentioned I'd always had this assumption. A lot of the fraud, the organized fraud, was happening internationally. But you've been boots on the ground physically, domestically in the United States, and seen these organized crime rings happening here within the U.S. as well.
David Maimon 18:57
It's it's mind-boggling to look at the infrastructure that these guys are putting together and how quickly they adjust to law enforcement and as well as the financial ecosystem operation. Yeah, I mean we're seeing here domestically. We're seeing a lot going on here domestically. We're seeing, of course, a lot coming in from from you know other countries, but we are aware of many many gangs within the United States, who essentially shifted gears from moving drugs to engaging in fraud. Hey,
Kolt Bell 19:27
let's shift gears and start talking about trends that we're actually seeing with our business customers that we're seeing across the industry. Let's start with business email compromise. So, business email compromise has evolved. We used to talk about imposter emails that clients might get. We'd tell you to look for the domain, and instead of an I, there might be an L or an O or a zero that might be there. It's really evolved now, and David, you're going to talk a little bit about this of where the frosters have actually gotten access to email accounts, and you're interacting with who you think maybe your vendor. But as we get through this, this starts to work into payment. Manipulation. You're going to start seeing vendors sending you information, saying there may be a new account that I have, new payment information to a new bank, new routing number. So we're going to talk about some of these tips and tricks. But David, you're going to show us how this looks on the backside from your research.
David Maimon 20:15
Yeah, I mean, one of the things that we're seeing out there is how this types of fraud is being fueled during the last couple of years or so, right? I mean, so so there are a lot of markets out there which offer for sale a lot of the tools that you will need in order to engage in business email compromise. Remember, when we talk about business email compromise, we're talking about someone taking over your inbox, right? And so there are some tools that folks are required to use. There there there are markets for that, so you can purchase those tools out there. Once you're in the account, once you're inside the computer, you can collect a lot of information using some of the tools that the criminals have access to. And what are we seeing on the screen right now? Essentially, some of the tools that the criminals are offering for sale. One of the interesting things that we're seeing more and more in those markets are evidence that these guys actually have access to the businesses' inboxes and also try to sell access to those inboxes, which is quite alarming. From our own research, what we're seeing is that these guys spend a lot of time on the business inbox collecting and harvesting a lot of the information that is required for them to, at the end of the day, launch the business email compromise request, or the fake invoice request, or the or the CEO request, right? With with a request from the chief fraud, the chief financial officer, to send some money to an account or a vendor that they desire, and so we're seeing them harvesting all the information. We're seeing the criminals harvesting all the information. In some of the posts we've seen out there, we're seeing criminals showing how they spent six months or harvesting the emails to six months earlier, downloading information, downloading Excel sheets, downloading PDFs, understanding the business, understanding the business customers, understanding the relationship even between several business employees, trying to take over as many inboxes as possible within the organization. And once they have all this lined up and and they have all the details they need. They simply use the business legitimate logos and documents to send invoices, but with a different bank account number to some of the customers out there.
Kolt Bell 22:34
And I think it's important about this. It may not be your network that gets infiltrated. It may be one of your vendors that you do interactions with, and it may not just be one email account that they've got, but they may have multiple. So whenever you're seeing that email communication, and it looks like there's two or three people from my vendor, it's got to be legit. It's going to be very clean. You're not going to see this, and they've set up rules like we do to manage like where do I want this email to go, and those inbound emails that maybe coming from you to your vendor get siphoned off to a folder and nobody sees it except for the criminal that's in there.
David Maimon 23:06
It's an operation, right? I mean, it's very detailed, very sophisticated, very organized operation, and we need to be aware that this is happening inside our.
Kolt Bell 23:14
And how are these emails being compromised?
David Maimon 23:16
I mean, oftentimes what we're seeing are phishing, right? I mean, we're seeing phishing, successful phishing attempts that these guys are launching. So people clicking on the wrong links, criminals taking over the computers, and then they have access to the inbox.
Brandon Nowac 23:29
What I find you know fascinating is I think you hit one point. A lot of our clients think that it you know is only their email that could be compromised. Many times it's it's their vendor, and then when the vendor has a compromised email, it's the 236, months of the fraudster just monitoring and learning and watching all the email traffic back and forth, seeing documentation, seeing flows, seeing payments, and I think the big takeaway here is you know this is a big industry, is almost $3 billion in 2024, but the watchout red flag point is the change of bank account, and you you hit that. We talked about it. That is the triggering event to say, huh, is something off here? And that's when you don't pick up the phone and call the number on the signature line. That's the fraudster. You call the vendor, the person you know, the number you know, and then you make sure you have that conversation with them to validate that the account and routing number associated to the new bank, you know, account is is correct.
Kolt Bell 24:30
I think that's a very good best practice. Go through your accounts payable, see who those vendors are, make sure that they tell you, if we have payment information, who do you want me to call? So you have that on file, and you're not trying to figure it out as you go. And every single time, there's payment information. You have the protocol that you were calling that number, not emailing somebody else at the company saying, "Hey, we got this. This is okay. It's got to be a phone call. And this is where, very and David, you're showing it like a lot of technology can be defeated by a very simple. Process that you could execute every time.
Brandon Nowac 25:02
It's very sophisticated in the way they conduct, you know, the communications, the marketplaces, but the simplicity of just finding that red flag is actually not too complicated.
Kolt Bell 25:05
You can save your business millions.
David Maimon 25:09
You can. Something should be said also about some solutions that are out there that, at the end of the day, maybe will allow you to flag the fact that you have an unwanted guest on your network or inside your inbox.
Brandon Nowac 25:25
It's a very friendly way to say it. Yes.
Kolt Bell 25:28
All right. So let's talk about account takeover, and this one's really at scale now. And we talk about this all the time. A lot of this is going to be phishing or smishing, and we see a lot of phishing sites. And the technology, again, it's not high powered. But if we talk about fraud as a service or fraud as a business, our businesses are they're trying to get to the top of the Google search page, right? How do you do search engine optimization? And we see the fraud community basically hosting fake websites for banks and login information, and they'll actually use that search engine optimization to get those to the top. So as we talk about this with business owners and and companies, we really one of the best practices we can ask you to do is to bookmark that site, Keynav, bookmark that. Don't search for it because it can come to the top. So David, you're going to show how some of the criminals actually use this information almost in real time here.
David Maimon 26:19
Yeah, I mean one of the interesting things that when I started working on ATO, I was fascinated about is the fact that those accounts, those compromised bank accounts, have been out there for sale for a long period of time. And we were talking about when we started talking, we started working on this online fraud ecosystem in 2018. Like day one, we were able to see compromised bank accounts available for sale out there, but you know, during the last three years or so, something happened, and that is AI, and we see a dramatic increase in the volume of compromised bank accounts out there. And so, just to make sure that we're all on the same page with respect to what we mean by compromised bank accounts, we're talking about folks using phishing emails and smishing texts to try and lure you to believe that if you click on a link, you will be able to restore access to a bank account with with a bank that you have businessmen. So what we have on the screen right now are just two example of phishing email and smishing texts that you know we're able to find out there. Once you click on the link, oftentimes what the victim will experience is what we're seeing on the screen right now, on the right side on the screen right now. They will be able to see a scam page, which obviously they will not know they're looking at a scam page, where they're going to feed in their password, their username, some other details that the website will ask for them, but you know what they're not seeing is what happened on the left side of the screen, and and that is how the criminals are harvesting all the information using Telegram bots or other types of technology, and then stack it in in text files and then use them in the context of the fraudulent operation. So, you know once once they have all this information. They have access to 1000s of accounts, and simply, simply, and they can't access all those accounts on them on their own. What the criminals are doing is they post all those accounts for sale on the online fraud ecosystem we monitor. So I got I got your account. I can't access it because I don't have the resource. I will post it up for sale. And essentially, what we're seeing on the slide is the type of information that go along with a compromised bank account. So, other than getting access to the account and the password and username, you will be able to get access to you will be able to get information about the victim, so name, date of birth, address. You will be able to get information about the IP address from which the victim essentially is connecting to the bank account from, and most alarming, you'll be able to get a remote desktop protocol access to the victim computer. So, in other words, you will be able to, if you purchase the compromised bank account that we're seeing on the screen right now, you'll be able to access the victim's bank account from the victim's computer or smartphone.
Kolt Bell 29:09
We talk about this. You started this with, it's a link, right? So we talk about this all the time with text messages that you may get from your bank. We have people ask like, how would they know who I bank with? Some of that information is public information. PPP loans-that information is public from the government. It'll tell you who you got your PPP loan from, which is probably who your bank is, or if you use a debit card or credit card, the first six digits of that account number-it's a bin number. It'll tell you which bank it belongs to. So sometimes that information-you put that in there-is enough to be able to get like sourced someplace, and you start to aggregate this, and I think you start to see that with AI here. So you're going to show us once they get access to remote desk what they can do.
David Maimon 29:49
100% And what we're seeing on the screen right now is essentially an example of a business account, which the criminals are essentially demonstrating their access to and their use of remote. Auto desktop protocol to that business network to log into that account, right? So it's really important to understand that this is not science fiction. I mean, this is this is happening on a daily basis, and we need to make sure that we we do our best in order to you know make sure that we do not click on phishing link and we have the appropriate protection on our networks. One of the interesting things that we started to see in 2023 is the dramatic use of AI in the context of creating the phishing pages, the scam pages, as well as the phishing email and the and the smishing text. But you know, and that and that definitely is responsible for the increase we started to see in ATO starting 2023. But more and more we're seeing tools being introduced to the online fraud ecosystem, which support ATO operations. What we're seeing on the screen right now is one of those services. This is a website called Shebyte. If you go on Shebyte and you pay $300, you will be able to create your own sort of scam pages using AI. According to the admins, you'll be able to start sending smishing and phishing text automatically. And the cool thing is that you will not be doing it on your own. These guys will be doing it for you. So all you have to do is just take the information that they provide you with and start working with.
Kolt Bell 31:22
So this is fraud as a service.
David Maimon 31:24
This is fraud as a service.
Kolt Bell 31:26
All right. So let's show this page here, and we want to show what this looks like. This is an actual phishing site that was put up. If you type key navigator, the very top one through search engine optimization is going to bring this to the top. We keep talking about this, like whenever you're doing your day to day and you're trying to log into KeyNav, you're not thinking, "Am I about to get scammed? Am I about to do something that I shouldn't do? You're thinking, "I need to log into my banking application and do some work. So these are the things that we're talking about. Make them routine. Make them best practices. Bookmark that site. Don't search for it. We have our cyber teams that are constantly trying to find and take down these sites, but they come up instantly, and they're up for a couple hours, potentially a couple minutes, and then they're down. So it's really a game of cat and mouse that we play here. So just use those best practices. Make sure that you're bookmarking your your keynap site.
Brandon Nowac 32:12
Well, and interestingly, you know, Kolt, what what we see is just like any business, these fraudsters pay Google, Bing, search engines to to be top of the list. It's worth it to them, right? So if you type in KeyNav as a search engine, you're gonna have paid advertisement for all intensive purposes from the fraudster saying this is top of the list, the most you know common link.
Kolt Bell 32:33
And listen, we keep coming back to how this is a business, right? This is how they treat it. It's not some knucklehead kid in the basement anymore. It's like big business here. In these two sites that you're seeing, that's duplication of our sites, right? And these are ones that we saw on the web. But with the technology that we talked about with AI, it's very, very clean. The classic marks that you talked about, misspellings, fonts looking off. It's going to look exactly like the regular website,
Brandon Nowac 33:01
and I think this goes back to you know having the appropriate procedures documented in place for your business for your employees, train them. It's not a one-time event; it's an always-on thing, and then test the environment. And you could do internal testing. There's third parties that will come in and test, but you got to start with having the appropriate procedures in place that your team can follow and execute flawlessly.
Kolt Bell 33:24
So, David, the next couple slides that you're going to show us here is whenever a victim or a target actually clicks on these sites of what happens on the back. Yeah, I mean,
David Maimon 33:33
So you gave away all your information, so to speak. You went to a scam page and you gave away your password, your username, you know, all the information that they ask you to, but then the question is, what if I have a one-time passport, right, or multi-factor authentication, on on my account? I mean, will they be able to get access to it? And and the the the answer is unfortunately yes, right? Because starting in 2023, we are seeing a lot of technology these guys are using in order to essentially place phone calls to their victims, and then simply harvest one-time password or multi-factor authentication authentication passwords that the bank are sending them once the criminals are trying to log into the victim's account. And so, what we're seeing on the screen right now, and hopefully we can we can hear as well, is is a proof of concept. This is essentially a tool that was offered by one of the fraudsters we we follow on Telegram for sale. He's offering the tools they develop for sale. The 'You' phone is the criminal's phone, and essentially what the criminal is doing is he placing he's placing a call, and if you guys can see with a click of a button on the 'You' phone, you'll be able to ask any type of information from the victim. You'll be able to ask for the password. You'll be able to ask for the one-time password. You'll be able to ask for social security number. All with just a click of a button. This is mind-boggling. Just to see that, but this is a technology that the criminals are already working.
Brandon Nowac 35:03
So the fraudster, you know, is hosting this fake website, bank website. You've put in your username and password. Most have multi-factor authentication. Many instances, it's pushed to text on your phone. The fraudster is calling the target and saying, "Oh, give me your one-time passcode, you know, so I can effectively help you, and that's how they're getting past not just the first step in the process of using a password, but multi-factor authentication as well. That's right, and that's not just consumers; that's businesses. That's businesses. You know, accounts payable. That's controllers. Yep. I think just the big learning. It's simple, but we've all said it is bookmarking the website, right? I mean, we use key navigators, key banks, you know, front door for our commercial clients to conduct their, you know, online payments, and don't go to Google or Bing and type in, you know, key commercial payments. Bookmark key navigator, and that sounds very simple. Just like business email compromise, look out for the change of bank information. Here, it's bookmark the email as the front door to your bank portal. Because if you don't, these look just like the banks themselves, and that's where you know folks tend to get hung up.
Kolt Bell 36:14
All right, so David, I'm going to have you kind of talk about this because it's one of your subject matter expertise of synthetic identities and what we're seeing in the ecosystem with that.
David Maimon 36:24
Yeah, I mean we're seeing, unfortunately, more and more criminals using synthetic identities to engage in what what we call bust out operation, meaning criminals taking loans and then running away with the money, or trying to get access to rental apartment or new apartment, we're seeing them trying to lease new new cars with those synthetic identities, and and the major thing they're trying to do with these identities is essentially wash their credit, wash their their negative score or the bad their bad credit score, and get access to a lot of the financial services that are available out there. So before we do that, I think it's important for us to understand the difference between a stolen identity and synthetic identity. So you know, we talk about a stolen identity. When we talk about identity in general, we talk about a combination of name, date of birth, and social security number. And so, when someone is using your name, date of birth, and social security number without you allowing them to do that, then it means someone stole your identity. When we are thinking about synthetic identities, we're thinking about two different types of identities. It could be that I'm taking my name and my date of birth, and then I'm using call social security number to try and onboard with a financial institution, or trying to get into an apartment, or trying to lease a new car. That will be a case of first-party synthetic. But this this means that person exists, right? But he's using a mix of you know different combination of name, date of birth, and social security number in order to facilitate fraud. Another interesting case of synthetic fraud is essentially a completely bogus identity, a completely bogus combination of name, date of birth, and social security number. Now, because coming up with this information bogus as well as legitimate is fairly easy, the most of the time that the criminals are working on or investing in synthetic identities is creating the public records around that. So they do a lot of work trying to create accounts with retailers to those synthetic identities. They will try to buy fake documents to go along with the identities, fake bank statement, pay stubs. They will manufacture or create fake driver licenses for those synthetic identities. And then the most important thing, in order to look legit, what they will do with those identities, and they will try to attach a trend line to those identities. They will try to have the identities to be reported on an existing credit card, trying to create history, you know exactly in order to increase their credit score, have a credit score out there. And once financial institutions, once retailers, once you know apartment complex lease managers seeing all this information that looks legit, they are saying, "Yeah, this is the type of individual I would love to have business with, and they allow them the opportunity to create a new bank account, take a new loan, or get into the apartment they're trying to get access to. Unfortunately, at some point, the criminals run away with the loan they took, or they don't pay the rent or the lease that they were supposed to pay. One of the things that we're seeing more and more out there is the availability of markets, which allow you to buy the synthetic identities, the source security number, date of birth, and name, along with the public records around them. So public records as well as credit scores around them. Those markets are. On the clear net, so you don't need to have access to the dark net. You don't need to have access to text message application. You just need to go on the internet we're all using, go to one of those markets, and then choose between different packages that the vendors offer. The more expensive packages come with higher credit score and credit balance, as well as more aged trade line. But in addition to individual CPN or synthetic identities, you can also buy synthetic business identities, as we see on the screen.
Kolt Bell 40:37
So, what does CPN stand for? The
David Maimon 40:39
CPN is credit pro. The acronym is credit profile number. When we talk about CPN, we're essentially talking about nine-digit number, which is like a social security number that folks are using. And when you're purchasing, you're essentially purchasing the number along with the public record and the credit score around it. So we're seeing we're seeing that being offered for sale on Clearnet. We're seeing this being offered for sale on Facebook, and we're seeing that being offered for sale on text message applications out there. Unfortunately, there are a lot of vendors out there who will offer this service for sale, and it's all about trust because it's all about trust in this ecosystem. We are seeing a lot of people bragging about the fact that they were able to use those synthetic identities in order to get access to financial institution, in order to take loans, in order to get into a new apartment, and that's essentially what we're seeing on the screen right now. The young gentleman in in the image over Facebook bragged about the fact he was able to get a synthetic identity, create profile number from a vendor out there, and get access to an apartment. I think it was in Houston. We know that this is legit because we saw that the guy was actually using the identity in order to get and try and connect the apartment to a utility company a day after the post went live. And this is really important because in addition to getting access to financial services, getting access to apartment buildings, buying, taking mortgages, buying apartments, buying buying property, we're seeing those identities being used more and more in the context of trying to secure position with Fortune 500 companies and any company out there, pretty much, what the criminals are doing is they take pictures from LinkedIn and then start using them in the context of their attempts to secure position with companies out there.
Kolt Bell 42:33
All right. So Brandon, what's the takeaway?
Brandon Nowac 42:35
Yeah, I mean, I think the takeaway here is very simple, like the other two examples. It's in this instance validate the individual that you believe you're interacting with, whether it's someone renting an apartment from you, applying for a job. Validate that that individual is what you think they are. And there's tools and resources and solutions out there in the market to be able to effectively help you validate the individual. Do you agree with that, David? 100% So why don't we move on to the last trend, Kolt? Why don't you walk us through business identity theft and vendor payment fraud?
Kolt Bell 43:10
So we talked about personal identity theft, the name, address, Social Security. What we're seeing the last couple years is an increase in business identity theft. We talked last year a lot about check fraud and mailing checks and those getting intercepted. What we're seeing is bad actors, and we're going to call them criminals. That's who they are, right? Is they intercept these checks and they're made out to a certain payee. Maybe you put the check in there for your vendor. They've intercepted that. We're starting to see, not starting. We've seen it for the last couple of years, where criminals are going to the state. They're registering. They're going to the federal government, getting EIN numbers for these businesses. Everything looks legit, and then they're taking those checks. They match up to the business entity that they've existed. They're putting them in there. The other thing that we're seeing, David, is full-blown identity theft for businesses that they just take over the credit history and whatnot for existing businesses. So this is becoming a trend that we're seeing, and you're going to show some of the stuff that you've been able to find with your research.
David Maimon 44:06
I'm going to show how easy it is to get business fulls out there, right? I mean, so
Kolt Bell 44:10
And whenever you say fulls, what's that?
David Maimon 44:11
When we talk about fulls, we're talking about complete information, right? About full, complete, yeah, complete information, complete personal identifiers of either an individual or a business. When we talk about individuals, we talked about it: name, date, birth, social security number. When we talk about a business, we're talking about the business name, we're talking about the business owner's name and social security number, but also the employment identification number. And unfortunately, at this point, all this information is available for sale in Clearnet market. We're looking at the clear net market here for $20, as you guys can see on on the slide, and so once you have the business information, you have the business owner information as well available for you. All you have to do is just find that person page page over LinkedIn or over Facebook, find the picture of that individual, and start working with it. You can use. Some of the tools out there in order to create a passport for that individual, verif ID and only fake are few of the resources out there which will allow you for less than 10 bucks create a passport or a driver license for the person you you're trying to steal their identity and their business identity. Once you have that, you can use some of the tools out there to take that person you're trying to steal their identity with their business image, as well as with a fake driver license or fake passport image. Bring it together to some of the AI tools we talked about earlier. Kiki will be one of them if you have access to. Unfortunately, you need to get an invitation to use that tool. But you don't have to use that. You can use Gemini. You can use ChatGPT to simply bring those two images together and ask the tool to produce an image of that person holding that passport or that driver license in order to verify their identity. If you want to create a video of that person identifying themselves, you can go to a tool called Cling AI, feed in the picture you just created, and then ask the tool to create a video of that person turning their head right and left while holding the picture of while holding the passport or the driver license. And so everything you're seeing on the screen right now, this is AI, right? I wasn't standing there and you know doing what the character is doing, but it's less than five minutes. You're able to produce.
Brandon Nowac 46:29
Bringing this back to two points that we've talked about: one, you mentioned Kiki, so Kiki being the step-by-step instruction manual of what we just saw here, and then the application of this fraud is either a stolen check to deposit money into a fraudulent account, or it could be to get a loan and then walk away with you know money that's been lent by you know a financier or a lender.
David Maimon 46:53
100% I mean, you can use those documents in order to take over the business and create a bank account for that business you're trying to steal their identity, and and unfortunately, a lot of criminals out there are very loud, and you know they talk about their ability to bypass some of the know your customer verification solution out there simply by taking those videos I just showed and injecting them in the computer cameras or the smartphones camera, while authenticating themselves as the owners of the businesses out there.
Brandon Nowac 47:30
So, what's the takeaway? Just pausing for a moment on you know our audience, 1000s of business owners, finance professionals. What's the takeaway, similar to the other topics, of what they could do to protect themselves and their business.
David Maimon 47:42
I think the important thing is, in the context of our identities as well as businesses, is to make sure that we have our credit scores frozen all the time. We also need to make sure that we have an identity theft protection plan, both for ourselves as well as for our businesses. We need to make sure that we are willing to pay those amounts because you will be able to flag. I mean, those those progsend will be able to flag the fact that someone is using your identity illegitimately. And once once you know that, you'll be able to respond to that. So that's the second important thing that you need to do. You need to be vigilant. You need to make sure that if you get some mail you're not familiar with addressed to you from a bank you're not working with, or from a retailer you're not working with. You know, there's some strong signals that someone is using either yours or your business identity, and yeah, these are the important things we should we should be doing in that context.
Brandon Nowac 48:37
And if you find you know any of that information, you can reach out to local law enforcement, the FBI. Those are resources that are there to you know help you think through: is it fraud or is it something that was just a mistake that came to you? Yep. All
Kolt Bell 48:51
right. So let's touch on deepfake. We we touched a little bit about this last year as well, but some of the things that we're seeing, and we talked about the AI. And David, you just showed that image. That's really clean. We used to talk about you're going to see kind of chunky kind of images, pixelated. Like that's we're past that now. Like it's going to look very clean. And if there is some sort of pixelation, you can almost say, "I'm sorry, I got a bad connection. Right? You can talk through some of that. So the things that we want to talk about here is this is an emerging technology. It is a real issue. The video that we're doing here is more than enough content for people to be able to mock us and be able to create an image. If you have your executives that are doing sound bites or on Facebook or on LinkedIn doing any kind of post, that information could be there as well. So that impersonation piece becomes real. So the things that we want to kind of talk through here just have everybody in the in the company understand who has authority to do what, and if you get a request from the CEO or the CFO to buy gift cards, and that sounds kind of silly, but we see that, or to send large dollar wires, that you already have a protocol and. We keep coming back to this. Already have a playbook established of what are we going to do each and every time one of these scenarios is going to occur, or if it occurs, right? And it doesn't happen every day, so you need to be able to test that. You've talked about that quite a bit.
Brandon Nowac 50:14
Yeah, I think you know all these come back to having the appropriate controls in place, which starts with documented procedures, training as a program, not an event, but training your employees, your staff, your teammates, and then testing. And again, through that life cycle, you can develop it all internally. There's also third-party resources, businesses that can come in and help you do that. But that is, you know, tied to all of what we're talking about: is starts the procedures, test them after you've trained on them.
Kolt Bell 50:42
Yeah, and the other part that we kind of show on the screen here is like break whatever the channel that is that you're in communication with. We talked about it with the business email compromise. Break that channel and go to a different channel of communication. And oftentimes, we see this with some of the scam activities like grandma scams, where my son's in jail. If you simply picked up the phone and called the number, the person on the other should be like that's not me, right? So I think that's a good takeaway. All right. So we talked about a lot of these things of things that you can look for for warning signs. As much as we have this on here, I really want to stress is the warning signs are becoming less and less obvious with the technology that we're seeing. So stuff we talked about here, you know, emails with slightly altered domains. We've talked about how they can get around that stuff. The glitchiness, the pixelation. I do want to say that there's a couple on here that are really good. The bottom three that we're talking about, right? Sudden changes to payment information. That's going to be probably your one key on business email compromise that everybody needs to understand. Like that's going to be the key, and there's probably going to be some sort of plausible explanation that occurs with that, like, oh, we just had our checking accounts hacked. You're going to feel bad for your vendor whenever they tell you that, and you're like, man, that's terrible. Okay, that's plausible of why they might have new banking information, but make sure you got that protocol on there. All right, so just some of the the fraud mitigation tools that we offer, and if you're not familiar with these, reach out to your relationship manager. We're happy to talk to you about these. None of these products can stop all the fraud, but there's a lot that you can do to be able to be proactive off this. We talk about the solutions at this page here, but some of the ones that we talked about last year, if you have checks, make sure you're using Check Block, or if you don't use Check, use Check Block. Use Positive Pay. Use Name Pay Evalidation. There's a lot of tools that we have for ACHs, and then again with the business email compromise, and we just talked about this. Like make sure that you're doing some of the basic stuff. It really will help review your statements. Make sure you're logging into your your online banking. Monitor your activities and set up alerts. There's a lot of alerts that you can set up inside of your bank that will help you over a certain dollar amount. All right, don't do this type of activity. Alert me on that, or certain transactions on your credit card. We also have resources online at key.com/businessfraud that can help you with education as well, and for your teammates and your employees. And then we have a lot of client education opportunities that we'll start to focus on this. And listen, you talked about this. This is our ninth year of doing this for our clients. We have a passion to be able to put the information in the hands of our clients to be able to help protect themselves, and that's a big part of this as well. This really is an ecosystem working against like good actors. Good actors need to work together as well. It's not just about the bank. It's just not some of your frontline teammates. It's not just the people that have keynav access. It's all of your employees understanding what the environment looks like, and how to protect themselves. All right. So David, we've talked a lot about these things, and I just kind of want to skip to kind of what you're seeing here of over the next 12 to 24 months, and we talk about the frontier horizon of of crime and cyber criminals. What are you seeing?
David Maimon 53:47
I think what we will continue to see is fraudsters' use of AI tools more and more. But I think that one of the things that I'm worried most about is fraudsters' use of agentic AI tools. And in that sense, it's really important to make this distinction between AI and agentic AI. When we talk about AI, we're talking about tools that, at the end of the day, will allow you to produce content like context, like texts, like images, like videos. But you're sitting with the tools and tell the tool what to do. When we're talking about agentic AI, we're talking about tools that you define a goal to them, and then they will be able to find a way to accomplish that goal. And one of the things that we are aware of, based on a lot of you know popular media advertisement about that, is that many of the tools out there have some deviant tendency to them. We know of some of the models out there cheating. We know some of the models out there hacking without no one tells them. We know some of the tools out there extorting people without anyone tell them to do that. So this this kind of a tendency will be used by criminal. More and more, so this is definitely something that we need to pay attention to. Another very important thing we need to pay attention to is the the reliance of agentic AI and tools like Kiki, which at the end of the day will allow you to automate a lot of the fraudulent operations that normally we will need to have a slew of individuals engaging in, so you know one of the things that my students and I were really interested in trying to automate was the pig butchering type of fraud. Now maybe you want to talk a little bit about what pig butchering is?
Kolt Bell 55:34
Yeah, just for those that may not know about pig butchering, it sounds like a pretty gruesome term, and it really is. And it's how criminals start to gain trust and confidence with a victim or a target, as you kind of talked about, and gain trust, and over time be able to fatten them up to be able to get the most amount of money out of them from an extraction. We typically see this with like romance scams or investment scams, those types of scenarios. So I think what you're showing here is how they're actually using AI to make those.
David Maimon 56:02
So, so we know that this type of activity takes place most commonly in South Asia, right? I mean, in scam compounds that the fraudsters are putting together. Then, I mean, there's a lot of human trafficking going on there. But at the end of the day, they need people who will be able to communicate with the victim and then get them into a position where the individual will agree to invest or send money to to the fraudsters. So we were interested in trying to figure out whether you can automate that process. And what we've done was we experimented with some of the tools out there. What we've done was we took content that was available on Reddit with people complaining or explaining or describing their victimization to pig butchering, we fed it into one of the LLM models out there, and we essentially asked the tool to automate the activity. And what the tools spat at us a couple of minutes after was pig butchering 2.0. It created a diagram with all the different agent, all the different operation we will need to have. It created or produced a code that all we had to do was essentially click and and launch the tool, and the tool will probably start engaging in this type of activity. It created the people, like the character, for us to use in the context of this online romance fraud and sort of engaging in this type of activity, so I predict that we will see more and more criminals using those tools to try and automate the activity simply because the LLM models allow them to do that. And the last thing that I think it's important to emphasize is the fact that you know the industry in general, the financial industry, retailers, pretty much anyone who has businesses online is experiencing a very troubling and concerning issue, and that is individual using agentic model to discuss and create accounts with with those businesses, the criminals obviously will take advantage of this and will start creating accounts, synthetic accounts, right, on all of all the retailers, right. I mean, using some of the information that is already available out there, and they will be able to do it in a completely different scale than the scale that we've seen so far. And so, what we're seeing on the screen right now is just an example of one of my students using Python script to essentially tell one of the models we're using to create accounts with one of the retailers out there, and you know we were able to create accounts for a significant number of synthetic identities that essentially the tool produced without us telling it how to giving it any identities or giving it any instruction,
Kolt Bell 58:46
You're seeing the the characters entered on the screen. That's not your student entering them one by one.
David Maimon 58:52
No, this is the tool. This is the script.
Kolt Bell 58:53
And it's not flying through where you would detect that it's a a bot or something like that. It's going intentionally slow to try to mimic human human being exactly,
David Maimon 59:03
And that and that that's very troubling because if you think about bot attacks that we we are familiar with and that we have way to sort of detect at this point, this is this is not that. No, this is a tool mimicking a human behavior and just bringing this type of fraud to a different scale.
Kolt Bell 59:19
And David, as we talk about this, I know we've we've shown a lot here, and a lot of the research that you've done over the last number of years, and what your students have done. I just want to stress, like as much as we're showing what the bad guys are doing, there's a lot of good guys that are working on these problems as well. So I want to make sure that there's some hope here of like, oh no, but we do have a lot of brilliant minds across a number of industries, fighting back on this, so there's a number of good guys. But it's really a collective, it's really a network, and we need everybody that's a white hat, so to speak, working together to be able to help defeat the criminals.
David Maimon 59:52
I agree with you 100. A lot of good people are working on finding solution to these issues, but in order for us to find solutions, we need to be aware of them. Yes, that's absolutely one of the reasons why we. Describing this one, what we're showing what what's available and what what is is possible nowadays.
Brandon Nowac 1:00:05
Well, I think you know, here's a takeaway slide of best practices. A lot of this hasn't changed, quite frankly, over the past nine years. The sophistication of the fraudsters, the speed, the scale, the industry they've created is at a totally different dynamic and level. But the best practices are honestly very similar to what we've talked about over the past almost decade now, and not to read the the slide and every word on it, but it's things like monitor your accounts, establish procedures. Once you've established procedures, train your employees, test your environment, create this like it's a functional part of your business, it's no longer should we consider doing it? How do we think about it? It's a must-have, and the must-have requires real infrastructure and you know mindshare. I think you know never share your login credentials with a third party. We talked about particularly in business email compromise, where your vendor may have their email compromised. Don't call the number at the signature of the email. That's clearly the fraudster. Call the number you know, right? And then maybe one last point, and then I'd open it up, David, to you and Kolt of additional best practices would be bookmark your website for your bank portal. Don't use a search engine. We saw the examples; they're real, and that's how you can get caught up in you know putting in credentials, whether it's personally or professionally within your organization. Anything else you guys would add?
Kolt Bell 1:01:28
I would say this about scams, and we're going to talk a little bit about what to do if you find that you've been a victim of a scam. Whether this is business related or personal related, slow down. Everything on a scam is going to be a sense of urgency. We need you to react. They are master manipulators. I cannot stress that enough. Like that is their job is to manipulate your emotions and your thought process and lead you down the wrong path. So just taking that time, like slow is fast. Sometimes just slow down. Understand what's happening. And we say this, and I'm going to say it over and over again. If your bank contacts you, hang up, contact your bank, contact relationship managers, contact somebody you know. Bank impersonation is a growing, growing trend because it works, right? So we need your help with that as well. So here's some of the things you can do if you've been scammed, if you've been exposed to fraud, immediately contact your financial institution, let us know what's going on, see what we can do to help. If there's money that's been moved, we can start to try recovery processes. I'm going to be honest with you: prevention is the key here, not recovery. So we want to make sure those controls are in the right place. If you are a KeyBank client, you can contact our KeyBank Fraud Client Service Theater immediately at 1-800-433-0124 or dial 711 for TTY, and then preserve all the evidence. If you're going to have some sort of criminal investigation to be able to give to the FBI or your insurance company, you're going to want all that information. And then file a complaint at theic3.gov. We talked about this. It's an underreported problem that we have. We need to understand what this truly looks like, and whether this is for your business or personally, don't feel ashamed of this. You are a victim if this occurs to you. But report those, and then if you have cyber insurance or an umbrella insurance policy, contact your insurance provider as quickly as possible so you can start to get that process working. And then engage your response teams and any kind of internal teams that you may have to be able to clean sweep. We talked about some of the things that might happen, and then post mortem, after everything's done, take some time to go back and debrief and understand what was the root cause. Like where did we not have the right controls that we might have failed, and then update your prevention procedures. And we keep talking about have those documented now, and then keep working through those and test them out and see if they're up to snuff and make sure that your employees understand what it is that they need to be doing in these circumstances.
Brandon Nowac 1:03:49
What one you mentioned this, but I think it's just so important to reiterate is speed. You know, we we see attempted fraud a lot with our clients, unfortunately, and those that operate with speed and can let us know that there may have been a fraudulent payment that went to a receiving bank, the faster you can notify, you know, your your bank, key bank, the faster we can take action, you know, in the industry to hopefully revoke those funds and bring them back to you. But timing is your enemy in this instance, and the faster you operate, the more likely you are to be able to revoke your funds. So, in closing, and first and foremost, Kolt, David, want to thank you for being here. I thought today's conversation was excellent. I mean, clearly, the sophistication and the way in which fraudsters have evolved, even in the past year, particularly with the use of AI, is quite frankly phenomenal. To see the the speed and scale in which that this industry has become a real real threat for for businesses of all sizes, we want to thank you, the 1000s of you who joined us today. For those of you that have provided questions through the Q and A chat, first of all, thank you. We've gotten many many questions, and we appreciate that. Please note that in the next. Couple of days, we will send an email with an answer to your question. But thank you for engaging with us. And then, Kolt, David, thank you for being here. I found today to be extremely productive and valuable. So thanks for joining us. Thank you.
Brandon Nowac 1:05:17
Key has compiled this information from sources we believe to be reliable and is subject to change, we assume no duty to update this information in the event of changes. This material is provided for general purposes only. Particular situations may require additional information or actions. This session is not intended as an offer, solicitation, recommendation, or advice of any type. If legal advice or any other expert assistance is required, you should consult a qualified professional. We may collect information about attendees of this event, including name, company affiliation, email address, phone number, address, and in certain instances, IP address, as well as any other information you choose to provide to us. This may be combined with information we already have about you.
Watch the replay of our October 7th webinar to learn about the latest fraud threats to businesses and how you can put protections in place.
Webinar topics
- Get an in-depth overview about the quickly changing landscape of fraud and its impact on business.
- See how fraudsters are using the dark web and AI to buy business profiles, purchase stolen identities, and create advanced scams at unprecedented speeds that impact businesses.
- Explore how AI has amplified today's most significant threats, including Business Email Compromise (BEC) and synthetic identity fraud.
- Learn strategies to build a more fraud-resilient business.
