Brian Stone 0:04
Hello, and welcome to “The Buzz”, a Bank Automation News podcast. My name is Brian Stone, and I’m the Associate Editor at Bank Automation News. Joining me today is Ajay Amlani, Senior Vice President at iProov. Ajay discusses the difficulties banks have with malicious synthetic users and separating them from real users, how generative AI has made identifying synthetic users a more challenging process, and the scale at which these fake identities are issues for financial institutions.

Ajay Amlani 0:36
I’m not sure if actually people understand even what the definition of a synthetic identity is, either. I think what what people need to understand is actually synthetic identity is is beyond what most people associate as identity theft, right? It is considered to be identity fraud, which is a different category, it’s a bigger category in general, that that is encompassing a lot more. And what it is it basically allows you to be able to create a fictitious identity, using PII kind of in the publicly available domain, but then be able to manufacture that over over a series of activities, to then build a reputation around that identity, and then use that fictitious identity to be able to conduct illegal activities. And what what is important to realize here is that just because it’s not, you know, identity theft, see, specifically taking one person’s identity and then being able to steal it and receive the benefits or whatever value that has is tied to that individual. There. It just because it’s not identity theft doesn’t mean it’s not a victimless crime. Right. And it’s, it’s a crime that’s committed by fraudsters, against financial institutions or other entities that they’re trying to derive value from, that does have a price tag to itself. And it does end up costing, you know, average consumers more money at the end of the day, because value is being taken from the banks that the consumers themselves actually work with, or the entities that they bank with, or have services from. And so it leads to additional costs in the overall system, and forces institutions to put in place additional hurdles, and more challenging regimes, for consumers to be able to properly identify themselves as a real life human being. So how big of an issue it is, it’s It’s massive. It’s currently accounting for for a whopping 80 to 85% of identity fraud, according to a recent IDC analytic study. And it is posing a significant threat and challenge, because now these synthetic identities are really residing within, you know, not just in the banks themselves, or the institutions that the fraudsters are working with. But even they’ve started to show up in, in back end, credit reporting databases. And that becomes a massive issue in terms of being able to carry that forward.

Brian Stone 3:23
Getting into specifics, would you be able to talk a little bit about the major challenges as far as banks face in trying to identify a person that doesn’t really exist? What specifically makes it so difficult to sort of separate them from real users?

Ajay Amlani 3:43
Yeah, well, it’s interesting, right? Because some banks actually do have synthetic identity, individuals that are conducting legitimate transactions, and they’re paying their bills on time. And they’re, they’re actually considered to be really good high value customers, they just use fictitious information in the first place to be able to set up their account, right? Not dissimilar from like, let’s call it if I’m enrolling in a loyalty card program at my local local grocery store. And I’m asked to fill out a form with all my information instead of putting in, you know, my name Asia money, and, and my actual real address, I’m putting in Mickey Mouse at 123 Disneyland way. And instead of paying $5 for milk, I’m paying $4 for milk, right? Why do I want the retailer to actually have all my personal information so that they can mail me a ton of stuff so that they can sell my data going forward? So there’s actually sort of like the segment of synthetic identity fraud or synthetic identities in general, which people have understood is actually somewhat acceptable, and it sounds weird, but it actually is somewhat acceptable because it does drive legitimate commerce and a lot of ways. You know, it may not provide them with the value that they’re trying to achieve. Like, as a retailer, you’d want to understand who the shoppers are, where they shop, what are their options, and what stores they want to shop at and, and be able to target them with relevant offers. It doesn’t, it doesn’t give them the insights and analytics. But it’s not actually done necessarily by by true fraudsters at the end of the day. But there’s a significant amount now that’s actually being done, where they’re recognizing that you know what I’ve invested in this fictitious identity. And now all of a sudden, I can apply for a credit card at that retailer. Right. And maybe I didn’t use a name mickey mouse, or maybe I could change my name from Mickey Mouse to, you know, Jack Smith. But I already have a reputation with his retailer. Now when they’ve seen good purchases, now I can actually apply for a credit card. Now we can do other things like that, to be able to expand out my my ability to make purchases until I’ve overextended myself, right. Now, all of a sudden, I can just bail on that identity, or I have to actually pay it off. Because it’s not even me, there’s nothing tracking that identity back to me in the first place. So there’s all kinds of different ways that this is actually carried out, but it started relatively small. And over time, it’s really expanded into something that people spend an inordinate amount of time investing in to have multiple fictitious identities and synthetic identities, and be able to manage that, you know, across a plethora of different use cases,

Brian Stone 6:27
and institutions. So, from a technology perspective, has GE has the prevalence of generative AI made it made the process of identifying fake individuals more difficult? Or is it still, you know, sort of removed from the synthetic identity process? Sure.

Ajay Amlani 6:51
There’s, there are always kind of two sides to every coin, right. And I’d say with, with the generative AI, new sort of revolution that’s happening right now, I would say that, it opens up opportunities to be able to analyze whether or not something is actually a fictitious identity or not. So it can be used to help defend against it with the information that you now have available, and the analysis power that it does provide on its own. But it also allows for fraudsters to leverage the tool to create more identities at scale. So instead of only having three or four identities, now, if I automate a lot of that work, maybe I can have 200, or 300, or even more. And if I find holes, if I find victims, if I find establishments that really don’t have the right protections in place, I can leverage that at a scale now where I myself can maybe do 10,000. And, and I can share that amongst multiple people, right with the communication tools that are available that I know that are, that are also in that same area, or as I work as a group, to try to exploit systems, once I find that kind of exploitation that can share that on a much broader scale. And deal with regards to identity theft, as opposed to synthetic identity. Normally, because there is an individual victim at the end of the day, that’s, that’s, that has had some form of suffering, whether it is a bill that showed up that show that they owe a significant amount of money or their credit rating has been impacted. Typically, there’s a phone call or a complaint of some sort that, that comes into an entity where they can do the investigative analysis to find out that the that this, that they have been hit by an attack of identity theft, in this case, without that instigating call, you know, from a consumer, it becomes very hard for people to detect that this fraud has actually even occurred. And, and the damages could be much greater, as you can understand because it’s given that synthetic identity longer and longer time to be able to live and establish your

Brian Stone 9:12
reputation. So one thing that’s become more prevalent, not I mean, it could be factored into to synthetic identity, but just broader. I mean, you know, it felt like a couple years ago, when I guess deep fakes became became a thing, being able to superimpose someone else’s face on someone else’s body. And now one of the things that has come out with generative AI is the ability to voice mask like if you have enough of a sample of some an individual’s voice, you can record an audio file and then just superimpose their voice over yours and make it sound like they’re saying things they’ve never said. Do either of these things factor into synthetic identity, you know, does Is this something that banks should be concerned about moving forward?

Ajay Amlani 10:04
Yeah, um, you know, it was interesting, I just gave a speech yesterday, where I was showing the audience all of the functionality that is built into just your standard Snapchat app for being able to look a completely different way. And real time in front of the audience, I was speaking, you know, as, as a woman as a, as a different demographic. Look, making myself look very realistic, I made myself look much better to be honest with you, and quite a few of the ways because I was able to touch up so my facial features to look very attractive. And and I also gave a demo where I’m able to mimic on the different stars on TV or other things. And so really understanding what’s real and what’s not is going to become an even bigger challenge in terms of generative AI because generative AI can be used to, to fake images in terms of what you look like, even to the point where it would be it would pass basic biometric recognition algorithms as well, at scale. And then in addition to that, obviously, the mimicking of the voices, you heard something about a woman who thought that her daughter was, I think, kidnapped, because of a recording of a voice that was played. And it just recently, and that was, that was a massive issue. And then you look at all the data and signals that banks use and other financial services companies use on the back end, generally, they I can now mimic a lot of those signals that are received to verify let’s say that that device that someone is holding, isn’t that their device, you know, it does have all the characteristics of the location data, etc, of where that device is supposed to be from. And all of those signals, as you start to understand the feeds of those signals can actually now be artificially created at scale using generative AI. So and these are off the shelf tools now, right like I can, I can create about 10 apps right now today that I can actually download that I can use to merge my face with Leonardo DiCaprio is face so much so that I can actually know pass Leo’s, you know, facial recognition algorithms. And so, voice recognition systems now can be tricked without what’s called liveness. And biometric systems can be tricked without what’s called liveness. But how do you actually now detect that it’s a not just a real life human being on the other end, but it’s the right human being, and they’re actually there at that point in time. And that’s now become a significant challenge in the industry. What we do is we focus in on on the biometric matching itself, we actually have and use the ambient lighting, from the screen that you have in front of you, whether it’s a desktop, or a cell phone, you know, to be able to reflect off of your face and back into the camera. So in an ambient fashion, it actually reflects off of your face and back into the camera in a way that only a real live 3d human being with pores on your skin, that have oils and sweat. And hair follicles can actually reflect light back into a camera. We have PhDs that have been studying this for the last 12 years, that have really been able to come up with phenomenal algorithms to verify that a live human being in front of you at that time. So if you can imagine on a video call, even if you needed to be able to jump on a video call to verify someone’s identity, they could be able to trick that is well real time on but not with our tool, right with our tool with the light reflection, if verifies and it makes sure that you actually have to have a real live 3d human being at that point in time on the other end, could it be tricked everything? You know, at the end of the day, we highly sophisticated fraudsters would never believe someone if they told me that any tool can’t be tricked. But we we have a full operation center that’s monitoring all the threats globally real time and we’re constantly seeing people trying to attack our systems. Because of the high value use cases that we work on.

Brian Stone 14:17
You’ve been listening to the buzz, a bank automation news podcast. Please follow us on Twitter and LinkedIn. And as a reminder, you can rate this podcast on your platform of choice. Be sure to visit us at Bank automation news.com