Identity, Trust, and the Digital Age: Aaron Painter on Fighting Deepfakes and Fraud (MDE678)

Speaker A: Hello and welcome to the Minter Dialogue podcast, episode number 678. My name is Minto Dial and I'm your host for this podcast. So in this episode I sit down with Aaron Painter, business executive, author and CEO and founder of Nametag. We delve into his experiences building trust across cultures and organizations. From leading teams at Microsoft in China, Brazil and Europe, to pioneering high assurance identity verification in a digital world full of risks. We discuss how AI driven deepfakes, uh, are reshaping the landscape of trust, why verification now trumps recognition, and what it means for businesses and individuals to protect themselves from impersonation and fraud. If you care about digital identity, cybersecurity and the future of trust, you'll find this conversation illuminating. Let's dive in. Well, this is the, this is the way I wanted to start this one. Are you the real Aaron Painter?

Speaker B: I think so. But it is good to ask and it is even better to verify often when you jump on a video call with anyone.

Speaker A: Indeed. Well, Aaron, um, we're going to get into this, but my usual way of starting is to ask. Who is, is Aaron Painter?

Speaker B: I am a business executive. Uh, I spent most of my career working on the intersection of sort of trust. I uh, spent 14 years at Microsoft, mostly, uh, outside the US having a chance to work in different countries and geographies where I often didn't look or sound like anyone at the table, but having to earn trust with employees and with customers in those local markets. Uh, and then I had the privilege to run a company that was based in the uk, uh, called Reach. It was helping big companies move to the cloud, um, and trust kind of their critical infrastructure and with new sort of technologies and kind of a new world with what cloud computing brought. And then six years ago I founded, um, a company called Nametag, uh, and we do high assurance identity verification for really kind of high risk moments that employees or contractors or members of a company, uh, often have where bad actors take advantage of those moments typically to commit cybercrime or to impersonate others. And I wrote a new book, uh, that's coming out on October 13th, um, focused on deep fakes. Its title is Deep Faked, uh, Restoring Trust in the Age of AI Impersonation.

Speaker A: Groovy tunes, Aaron. So let's go back to uh, some of your work overseas, gaining trust. Having also learned multiple, uh, languages I have and worked in international. It's different dealing with, uh, internationals and people from a different place. How did that inform your ability to develop trust?

Speaker B: Yeah, it very much, I think is different. There's certain similarities in human nature in some cases and often I find some values can be aligned, but values can also really differ. Culture, uh, to culture and country to country. Um, I had this experience where I would move somewhere new. I had the chance to live in France for several years, in the UK for several years, Brazil for several years, uh, and then with Microsoft at least China for uh, five and a half years. Two in Beijing and uh, two in Hong Kong and then three and a half in Beijing, uh, and then a ton, a ton of travel. And uh, this we thought of as emerging countries and emerging markets in the years in between. And this common theme was that I was someone who often didn't look or sound like the people there. I often didn't speak the language. Uh, when I was at Microsoft in particular, people thought I was almost like a spy sent in from the headquarters. And these were really difficult environments to earn trust in general. Uh, and so that became kind of the focus of many years of my career and learning techniques and ways to do that, uh, many of which became kind of the focus of my first book in 2017. Uh, talking about the power of listening and how listening could be used as a tool, uh, to eventually earn loyalty.

Speaker A: Well, the challenge with listening, I mean as we know there's non verbal communication, there's the, the diction and dialects and, and uh, and you know one word could be different. Anger, uh, could even be differently expressed or shame, embarrassment, um, and those are different words. And, and so trying to put a name on, on emotions, trying to figure out what's going on in front of me. Is it me, is it them? Um, how do I establish that trust when your vocabulary somehow isn't quite the same?

Speaker B: M. Yeah. One of the takeaways I had was that uh, when people feel listened to, uh, they feel respected and respect to me as a fundamental primitive in this sort of journey of earning trust and listening can happen even if it's um, non verbal. It can be, it's, it can be sent with deep intention. When you're really focused on someone, you're really trying to understand what they're saying. Even if the language might be slightly different and you're not getting every word, um, people feel like you're trying, they feel like you are genuinely curious and you have a desire to understand what they are saying. And when they feel that way, even if you're not getting the exact words, um, in my experience they feel respected. And if they feel respected, then they might walk away and feel like this is someone that I can build a trusted relationship with. And so often I'd be environments maybe where somebody would help translate or fill in words. But it wasn't about me just passively waiting for a translator to say a few words. It was about how the person felt. I was listening to them when they were trying to express themselves. And so that was often non verbal, uh, and it was often an emotional response. But so often communication is actually the emotional response and not the substance of the words themselves. And so those were just some of the practical environments I found myself in and some of the techniques I found that were sort of useful in trying to earn trust, particularly in new relationships or in new environments.

Speaker A: And of course you can even have the same challenge when you're dealing with English English as opposed to American English or English culture. And so it doesn't have to be just Chinese versus American. Uh, yeah, this idea of gaining respect and showing that intention, that is sort of that deeply human element. I mean, I write a lot about empathy. And the challenge, uh, with listening, of course, is a can you really understand the person? But then, you know, maybe you can't. But if you reformulate, that helps them to understand that you've been listening. And the thing, Aaron, that it strikes me so often is that rather than listen, the other person will quickly jump on their version of the story. You know, like, oh, last night I had dinner with some friends. Oh yeah, me too. Well, I had dinner with some friends and you know, we completely move the plot over to the other person as opposed to stay, stick with them. And I suppose that that in the end of the day is true listening,

Speaker B: very much so. I, I just draw that distinction between, you know, listening to respond versus listening to understand. And often I do feel like people jump to their instinct as I, they don't want idleness, they don't want quiet, let's say in a conversation, they want to be interesting or seen as interesting. And so, yeah, they might immediately, as they're, as you're saying something, they're trying to process what to say next to keep the back and forth going of a conversation as opposed to a true curiosity and listening to understand. And that is very much one of the distinctions I wrote about in that book. And, uh, I agree with you very deeply.

Speaker A: All right, well, I want to get back, I want to get into your new book, but, um, name tag. How happy were you to come up with that name? It seems like a perfect name available. Uh, you know, finding brands and all that. Tell us the story behind the creation of the Name of your company.

Speaker B: You know, the name change arose out of a challenge, which was that in. In sort of the pandemic in 2020. I had a bunch of friends and family members who had their identity stolen. And I said, I'd be a good friend. I'd be a good family member. I'll jump on the phone, we'll figure this out. We'll get things straightened out. And every company we'd call said, well, before I can help you, I need to ask you some security questions. And that often meant, what's your favorite color? What's your email address? What street did you live on in whatever year? It was either too hard and complicated or to remember, or too easy such that it was sort of readily available information. And what happened is that someone had called before us in that case, and they had answered those questions, and they had taken over their accounts and coupled that with this experience I had had a few years earlier where, uh, my grandmother had, uh, someone call her when I was living outside the US and pretend to be me. They used my voice, they used a little bit my likeness, and they claimed that I was in trouble and I needed money. And, uh, she's the only one who could help me. And fortunately, at the end of the day, just before she was about to kind of give in to this sort of con artist, um, my grandfather overheard part of the conversation, and he recognized some word that I used which didn't sound familiar to him. It was. It's like a nickname

Speaker A: that I used for him. Yeah, Grandfather.

Speaker B: He doesn't call me that. You know, that's not it. And so they, you know, my grandfather convinced her to hang up the phone. And. And then when I went to see her for Thanksgiving, which, you know, sort of our annual rite of passage, we'd always get together. And over Thanksgiving, no matter where I was living, she ran up to me, and she was so just, you know, distraught. And I didn't have no idea why. And then I learned more about what had happened in this experience. And I, uh, realized those years, and then I compared it with what happened at the start of the pandemic. And I said, wow, in today's world, you really don't know who's behind the screen. And with the advances in AI technology, that's only going to get worse. And so the idea was, could we find a way to help protect people by being able to verify who's on the other end of the screen? And then to your point, it was sort of this naming journey. Well, what do you. How do you categorize that and what is the right thing to call that or to call a company, to call a product. And we thought about the physical world. I thought a lot about what does it mean to be in person, you know, and coincidentally you would go maybe to an event or a convention or you know, uh, a new meet and greet of any kind, and people give you literally a name tag, a sticker or something you wear around your neck that sort of says, hi, my name is this. But interestingly, there's often someone sort of at that check in experience, they know who you are, they invited you to that, they maybe they've asked to see your ID or your business card and they're kind of vouching for you so that you know, anyone you kind of meet in that social environment has kind of been verified, they've been vetted and there's, it's sort of safe to get to know them and they're not pretending to be someone else. So you say, can we take that same concept of the physical world and the idea of a name tag and bring it to the digital one so you can have the same sense of sort of trust that might come from seeing someone's name tag, that they have verified who they are and, and that you can therefore trust the phone call or the zoom call or teams call, whatever it might be, or a transaction that's about to happen with someone digitally. So that was sort of the impetus of the idea of name tag.

Speaker A: Well, so I'm thinking with a name like Aaron Painter, there can't be a million Aaron Painters around. So is that a good thing or a bad thing? And then secondly, when you've done so much and been out there so frequently with your voice and your travel, does that also make you more prone rather than be sort of discreet, private, not, not available, don't publish anything. It's, it's almost like this world of distrust is pushing us to want to hide behind John Doe and, and not be public anymore.

Speaker B: Yeah, a large part of me really resonates with that. In fact, you know, a lot of our earliest employees, me included, were really kind of privacy fanatics. And we really cared a lot about privacy and data protection and protecting ourselves and our families and those around us. And uh, you know, so it's a. Something you have to come to terms with a little bit. If you're going to be a bit of a public face and start a company or do things that are meaningful, you by default have to become a little bit more of a public person. But Interestingly, you don't have to be a public person these days to be impersonated. And often it's people that might just have uh, certain access in a company or have an interesting job or role who are the best targets for bad actors to impersonate them because they can use the likeness of them to uh, often get access to their calendar, take over things that are important to them and you might never even know about it. And so it's uh, increasingly this idea of AI being used for impersonation is what I see as one of the greatest risks of this sort of AI age that we have all entered.

Speaker A: The story, uh, that you start with in your book about your grandmother is shocking to imagine. And I can only imagine for you and your grandmom and your grandfather that someone went to this effort to pin down your identity, your voice, and then connect that identity with your grandmother. Uh, that wasn't by mistake, it was very purposeful and that. Did that feel like some sort of major violation?

Speaker B: It did. But what's scary is that this was several years ago and the technology to do it and to find out that information about people has advanced so much. And what's happened is that every day in the news you read about a new data breach or oh, your information was exposed. These aren't even things that maybe you publicly put out there. It's just that other companies have been sloppy or victims in terms of how they were managing your data. And the bad actors now have access to that. And just like if you happen to use GPT or CLAUDE and you know, you feed in information and then it's helpful using that information. Bad actors are creating their own sorts of language models around your personal information. So they're taking the information that's been leaked by others, they're buying it at a low price, often on um, kind of the dark web and information sharing sites. And they're using it to get very tailored profiles of the people that they're targeting with incredibly high quality. And so it's not uh, uncommon for a bad actor to be able to pretend or that they know more about you than someone he might know quite well, all without your knowing and all without you necessarily being an intentional public facing figure.

Speaker A: Yeah. So, but that brings up the issue of being uh, a weird name, sorry Aaron, and, and a higher profile person. And it means you, you know, they, they can zero in on you because if your name is John Doe, it's much harder to sort of isolate you and put you out. So what did that experience this, your with your grandmom, what, what did it reveal to you about trust that typical executives don't get that, you know, no board level cybersecurity presentation ever could represent to them?

Speaker B: Yeah, I think that experience pushed me to really understand the space and understanding how the technology was advancing, how it was being used, such that if you fast forward a couple, couple years, let alone today, what we started to see is just massive cybercrime related to this impersonation technology and people, bad actors using AI to impersonate people who they want to target. And it's many different ways that this can be done, but one of the most visible, um, is it's, it's so low tech, it's almost shocking. But, um, it's the idea that a bad actor can call the help desk, you know, the IT support desk of a company where you work, and say, hi, I am locked out of my email, I am locked out of my account, I can't log in, my multi factor authentication's not working, or I got a new phone, or my password this or that. And it's a very human process. But suddenly this person on the other end of the phone, or Chad or whatever it might be, has to make a very important judgment call. And they have to say, based on the signals that they're getting, is this person who they claim to be, are they the rightful account owner? And that's a very human judgment call because those help desk reps traditionally have not had good tools or methods to verify a lot. Like my example earlier with friends and family at the start of the pandemic where they just had these sort of security questions. And all too often again, these people got in the business trying to help others. They're not there to be identity interrogators or to investigate you. And they often might ask a few questions, but then they default to letting you in. And if they let the bad actor in, the bad actor then essentially has unfettered access to whatever you might have had with your email credentials or your login. And so they can go wreak havoc. It's not cybercrime as we once thought of. You know, we're seeing the movies about breaking encryption and advanced algorithms, and it's literally old fashioned, like being a con artist. But today we call it social engineering. And it means that you have really advanced tools at your disposal to be able to trick that person who's sort of the gateway to someone getting into your account or not. And unfortunately, it's being used at incredible scale and to incredible detriment at Companies all over the world today at enormous speed.

Speaker A: It strikes me that we, uh, that the issue of trust has, or the thing that is causing distrust has changed. Uh, we've had a trust, Trust agents. Chris, uh, Brogan. I mean, there's lots of talk about trust and how we no longer trust our big institutions. We don't trust companies sometimes we no longer trust doctors anymore. There's. Then there was the information that allowed us to go to the doctor and say, well, I know what I'm doing. But it feels like now we've got another seismic undoing of trust through deepfakes. And AI was such that there was already a terrain where we didn't trust anybody, but now it's just gotten exponentially worse.

Speaker B: Uh, I think you're absolutely right. There is this enormous distrust already in so many elements of society. But there used to at least be something that was somewhat pure and that you, you could recognize someone. It's very human sentiment, a very human, uh, way of being. You see someone in person, you can say, oh, nice to see you again. You recognize their face or their voice or the way they came across. Or, you know, maybe there's in a work context, you've seen that colleague before, you've seen the barista at the cafe before. You recognize someone, even if you don't know their name. And fortunately, in the digital world, that recognition concept no longer holds because it has become so easy to use this new technology to recreate someone's likeness, their voice, their video, whatever it might be. So in the digital world, it is even more difficult to trust what you are seeing and what you are hearing. And as so much of our society and our economy and our lives have moved to these digital channels, that is an absolute new level, this crisis of trust that we are already experiencing as a society.

Speaker A: So if you and I were having this conversation in real life, in an office or something like that, or in your backyard, you know, where we could shake hands and, and I could smell you and feel you. What, what proof do I have right now that I'm speaking to Aaron Painter, the real person? How, uh, uh, I mean, it feels like we're now into this point where I can, I could even suspect that you are some digital impersonation, you know, Narendra M. Modi, putting, uh, up some sort of augmented version of you, you know, help, help me through and, and help others think about what, what it is to be real.

Speaker B: You're, you're so spot on, you know, in that in person scenario in the backyard or in an Office. You might not trust what I'm saying. Maybe that's uh, something I say is wrong or I, I'm, I'm, I have a background I'm pretending that I don't have. Okay, fine, but at least you know, you kind of know the person in front of you is real and okay. That person is sort of accountable for, for being there like that. That is an element. Maybe their name is wrong, but at least that person is there. They, you know who you're talking to. In this digital world, it is kind of existential, it's a lot to process, but you actually can't trust that this audio and visual signal you're seeing today is, is me. You get not just to the level of trust of what I'm saying, but you can't trust the identity of the person because it's gotten so easy. The platforms that we rely on teams and zoom and other things have made it so easy to connect, but they really didn't design, they weren't designed to prevent against impersonation. So just like you could choose a different camera or microphone setting. We're all used to that. Oh, I have an external microphone or I want to use a different camera. You just toggle it over and switch. A bad actor can do that same switch and toggle over to a third party piece of software that can create a real time representation of whoever they want to be. So using the technology has gotten remarkably advanced and then the technology itself to create that likeness has gotten remarkably advanced and gets better at this incredible pace, such that now with only a few seconds even of someone's audio or video, you can create a, uh, relatively realistic impersonation of the person you're targeting, let alone if you happen to have a lot of good audio or video material. And so you, you really, unfortunately, again, it's so crazy to think about because we rely on these digital channels so much, but you actually can't trust that you know who you're speaking with anymore.

Speaker A: All right, so your mother had a situation in your book that you talk about where she lost her password or something or other and then couldn't say this is me, and allow access back into the email. This happened to me and I'm going to. The specific thing is minterdialmail.com you know, I had that email, but then I lost the password and there's no way Google's allowing me in. And yet, you know, there are, there is no other Minter dial on this earth. Not that I'm sort of saying I'm amazingly Unique. But that is a name that doesn't come up twice. Aaron Painter the same. And you know, so Aaron Painter gmail dot com. Uh, you know, for me, imagined that the issue is. And so how does a company, I mean it feels like help desks are measured on the wrong kind of metrics. You know, it's about speed, resolution, showing empathy and they no longer able to verify bint or dial as Minter dial. So how does a, you know, if an executive is listening to this, what do they need to do? I mean, and this goes to the heart of your book around verification versus recognition. Uh, what, what kind of things do companies need to be thinking about in order to allow Minter to have his email back or your mother to have her email back as opposed to going through, you know, the log checklist of things that they think is the right way.

Speaker B: But you're, you're right. And the anecdote you're referencing is, um, you know, kind of sad, but actually still a real problem. It was the largest email provider in the world. I will, I will leave them out of it. But um, it was roughly a 14 day process for her to try and get back into her email and it paused her life and all of her commitments and doctor's appointments and nonprofit commitment, everything because she was locked out of her email and they wanted her to fax copies of a utility bill. I mean just absolute like nonsense, archaic things which obviously also wouldn't help ensure it was really her. But it also took 14 days for them to eventually give in and say, okay, we'll let you back into your account. And that's often the norm for many companies today. Um, it's a list of security questions following, uh, a very large cyber attack a couple years ago. Uh, the big casino in Las Vegas, mgm. The best practice became if someone's locked out of their account, you should get on a video call with them. You should have a teams or zoom call and kind of look and maybe have them hold up their ID and see if they're real. But as we've talked about, those channels can't be trusted. So. Well, that's a necessary, it's a, it's a path, it's not necessarily a secure path and people have taken advantage of that. And so now as the technology has gotten better and better, really in person, anyone on those calls, it's just a time consuming effort. It means now everyone is locked out, suddenly has a multi hour delay to schedule a video call and then has to go have this call. It's expensive it's time consuming, um, and it's not secure. And so first thing is I really want companies and business leaders to understand how this technology is being. I want them to understand that a lot of the processes and the tools their employees, let's say at the help desk, might have, are probably not built for this modern era. And then there are solutions. Actually there are better ways to do this. And so one of the things when I founded Name Tag six years ago was to try and create technology, uh, to prevent this. And actually one of the biggest breakthroughs we found was modern M mobile phones. Because modern mobile phones are equipped with a lot of technology and advanced cameras and sensors and which can really help us here and defeat someone who is trying to use a deep fake to impersonate you. It's a lot like the uh, analogy I often make is if you have a physical check and you want to deposit it, you can bring it into the branch or you can use your mobile phone and your secure mobile banking app and take a photo of that check and then the bank processes it. There was never, you know, upload PDF of check to website and hope for the best. That wasn't good enough for the banks, but for this idea of identity verification that was kind of standard until we brought this idea of using the same advanced cameras, phone sensors and other things to be able to ask someone, let's say, to scan their government issued ID like a driver's license or a passport, and to take a selfie. And if we use the advanced cameras on the phone, we can do that in a way that a bad actor couldn't. And that lets us at least know who's calling. So you can imagine that help desk rep, instead of asking security questions, they might send you a link and say, hey, I just need to verify it to you. Uh, the end user then taps that link and they go through a quick flow on their phone and then the help desk rep gets back positive confirmation, knowing who's really there. That basic step alone was sort of some of our earliest technology. We've now taken that to many fun new areas and solving other threats, but also changes the social dynamic because the help desk rep is no longer this one interrogating you. They're now the one that's positioned to say, hey, this other thing's going to verify who you are. Now I can focus on helping you. So it actually uh, help desk people love it because it creates a much better tone and experience in those calls. It also happens to be much faster and it also significantly matters because it improves security.

Speaker A: One of the key distinctions you write about in the book, which took my head a little bit of time to get around, is the distinction between recognition and verification. Talk us through what that concretely means materially, in terms of how a help desk or company can change the way they operate to make sure that the deep fakes don't go and trap, uh, us.

Speaker B: Let's say you're walking into an office building, and maybe you've been there before, and maybe the security guard at the front desk recognizes you. It's one thing to say, hey, it's you. I'll buzz you right up, pass through. And it's another to say, hey, I need to. I need to see your id. I need to make sure it's you. We follow process. I need to verify that you're actually the intended person. That's the concept. And you see it. You know, you talk to, uh, even small boutique firms, you talk to people that have had the same clients for a long time. Ah, uh, I recognize the voice of my clients. I would know it's them in an instant. I know my executive's voice. When they call me, I can always help them out. Those are things of recognition. That is, I recognize their voice. That is, I know I've seen them before. They seem familiar to me. And sort of the theme again is that those elements don't hold up in this digital world. And so what we propose and what I recommend is that we move to this world, away from pure recognition, to one of verification. So just like it's, hey, I need to see your ID before you can enter the building. It's, hey, I need you to take another selfie or I need to see your ID or some related element, um, in order for you to do this important thing, approve this thing, access this thing. Um, that's a world where verification can help us have more confidence in what someone's doing digitally, whereas rekognition alone just, unfortunately is no longer trusted.

Speaker A: You describe a human directory not as another database, but as an ongoing cryptographic thread. Three key moments in someone's relationship with the organization. My wife and I were just discussing. Why don't we have some code words that only you and I know such that if. That. You know, the telephone call from Asia. Mentor, you're in trouble. You know, hey, my wife, I need your help. Send me some money. What is. What are. What are the code words that we can establish to verify that this is you, Mentor. Does it. Is it something that we should all be thinking about is having these Sort of special code words that, that allow us to always authenticate who we are.

Speaker B: I think code words could be great technique for a family or a couple or others personally in a phone call. I think that's a great, um, and like casual, easy technique, um, you know, especially if it's things that aren't known or that aren't public. I think that's a great one. The human directory concept is a bit more advanced and it's sort of the evolution. One of the things we talk about in the book is this, uh, really a lot of the history around trust in these digital channels and directories themselves. If you think of one of the most classic directories was actually a phone book, right? You used to get these printed large phone books of white pages or yellow pages. And if you were in it, you were somewhat legitimate because the phone company came out and they installed the line and they ran credit checks and they helped set up an account. And you kind of an official person or business, you could be reached at a certain phone number. Often there was an address associated with it, let's say, if it's the yellow pages in your business. And so it had this sort of air of legitimacy. In the same spirit, email addresses were that way. In the early days of email, you had an email address associated with a government organization, an academic institution. You went in person, you know, you went to a, uh, information desk and they gave you that email and they knew who they were giving it to. And so if you get an email from someone at Edu, you could kind of trust that that represented a person, probably the person behind that account. And those were, okay, it's efficient. In the early days of digital communications, what started to change was the Gmail address you mentioned earlier or the Hotmail or the Yahoo, whatever it might be. Once it became easy for anyone to create an email address, to create as many as they want and kind of to be anyone they want. Email aside, an identifier kind of went out the window. And as something that we could trust, it's no longer a reliable source of knowing who the person is. So to protect accounts and digital accounts, we added the passwords and then we added multi factor authentication. You know, getting an SMS code sent to your phone or having a rotating code maybe in an app on your phone, things like that were meant to harden, um, the login because you couldn't trust the email anymore for it. And that became sort of the modern way that we do these things. The challenge was that all those different accounts you have, you might have an Account with one provider. If you think of in a, uh, you have different accounts for your medical records and different for your bank and different for your, you know, the newspaper subscription or the food delivery service, whatever it might be. Each are separate logins. In a large company and enterprise, the average employee also has accounts in many different places. They might have an account in the system they use to apply for the job. They might have an account in some sort of Microsoft, um, based directory that stores their information. They might have an account in certain services they use for their job or certain pieces of software. There are all these different accounts. And what bad actors have found is they can go at those gaps, they can say, see, obviously I'm an employee, I'm in the email directory, but I'm locked out of my payroll system and I want to make a change on my debit details files. That's two different accounts and there's a gap in between. And so the bad actor says, we're just going to target that. And you call the help desk and say, well, I'm locked out at this one, but I have access to that one. And again, the help desk agent doesn't necessarily know. So where I see the world going is. And that's this idea of sort of a human directory is that let's think about people and knowing who the human is knowing does their face match, their name, do we have some level of trust in that? And then we can map the different accounts that they might have. And so you have sort of a human first as opposed to an account first view of a person and your environment. And I, to me that just feels like the inevitable path we're on because we all have so many different accounts in our lives, but we're still the same person. You have to be thoughtful on privacy and data security and different ways to structure this and architect it and where the data lives and a whole bunch of really important nuances to uh, get right. But I see a world moving towards this directory of, of knowing who's human and which human that person is. Especially in a world where we have a lot of non humans or AI agents going out and doing things on our behalf.

Speaker A: So Aaron, it wasn't something I was planning, but um, you who have worked in China, Hong Kong, where in that Asian world the super app exists and the way verification and accounts are based more on credit cards than in the west, where we tend to sort of work on emails as our sort of unifying identity, do you feel with your experience that the Asian world that where the, the Credit card is, is so embedded now into the identities that they have a step ahead of us in terms of at uh, the, in the west, where we tend to stick with the email as our identifying unit.

Speaker B: Yeah, it's a, it's a great question. And this really, this is a very developing area and it does change, you know, uh, country to country. The two largest worth noting, particularly in Asia and the Asian region broadly are India and China, just because the population numbers are so high and they both have very different approaches from each other, but also from what we use in many Western European and countries and certainly in the US today. And uh, in China it's largely based on phone number, interestingly. But the government has put in very high requirements for someone to get a phone number. A lot like that example of the white pages we were talking about before. But they've made it, um, a high bar for someone to get a mobile phone number. So when you get a mobile phone number, you can't do it anonymously. They're not the idea of burner phones like you see about in TV or movies or, you know, you walk into the telco store and just get a new SIM card or a new phone, which you can do in the US today. Um, in China, getting a phone number requires a high level proof of who someone is. So therefore then whatever you do with that phone number, um, helps the government have a sense of knowing who's behind it. And then many systems have relied on that. Um, you know, there's sort of micro environments like WeChat and others that are also telephone number linked. And then those private companies have amassed significant amounts of information that's almost like a credit bureau profile built on top of that phone number. So they're also able to make judgment calls on is this person who they claim to be. The sensitivity of where that data lives has been a hot topic in China and China's view of, uh, in some cases friction with some of those private companies because they have their own sort of large amounts of data at this point. In India, it's really quite phenomenal. I mean, India invested in the last 15 years in essentially a digital identity platform. It's called Aadhaar. And it operates a lot like the US Social Security number system in the US except way smarter. And if you think of the US the idea that you have a Social Security number, let's say you call your doctor's office and they ask you for, quote, your last four or they ask you for your Social Security number. The problem is if you know someone's Social Security number. You just say that and that's it. There's no additional steps. The India equivalent is you have your Aadhaar number, like your Social Security number, and you'll see, you type that in. The next thing it's going to do is say, well, we need to get consent from someone that you can actually share. Someone can look this number up. And so let's say they might send you a text message. If it's in person, they might ask for a fingerprint or an eye scan, in fact, to verify that it's actually you and that you consent to sharing the information the government has in its, its identity database with, let's say, the company who's asking or for the transaction that's, that's in front of you. And so this existence of this system is phenomenal. It's at enormous scale. And its scale has actually also become one of its strengths because 99 point x percentage of the population today in India, including rural populations, have an Aadhaar number. And they have these Aadhaar accounts. And that matters because it's not like it's a few people and it's experimental because if it's a few people, someone can't say, tell me your Aadhaar number. Let's use Aadhaar. You say, oh, no, I'm just going to use this other method which is less secure. So the existence and the sort of the strength of that program is partly that it's thoughtful and well designed and works well, but also that everyone uses it. So in the India example, the country has been able to develop its financial services infrastructure and many other things on top of Aadhaar, because it turns out if you know who someone is with high assurance, if you've solved kind of identity, you can move on to other more complicated threats. Now, Aadhaar's got its own challenges in the world of deep fakes. Um, it turns out the system wasn't quite designed perfectly to solve for that. We've been doing some really interesting, some work, um, with those systems to be able to complement it and close some of those gaps as it pertains to deepfakes. But the existence of that system is incredibly advanced. And if you think a very far cry from certainly how things are in the US today, where every state has its own identity database, you can't really query that database and get back a photo of the person to know if someone's using a fake id. Passports are a different system and they're parallel. And yet you've got people from all over the world that might be giving in a state or attending a certain university. It's, you know, we have a patchwork system that's incredibly dated, um, particularly in the US and so it's in some ways the opposite of the infrastructure that India's created today.

Speaker A: M and I'm guessing you are quite familiar with the Estonian situation as well, where they have the singular digital, uh, identity which links with my doctor, my bank and my driving, my credit. Everything is LinkedIn. And we, uh, think we're very advanced in tech in the US but it does feel like the, the way we've configured ourselves, we've leaves us with a lot more of these gaps that you were talking about.

Speaker B: That's absolutely right. Estonia actually has some really great advances. Uh, Singapore has some great advances. You know, there are smaller nations, um, that have done some really smart things. Uh, it is partly the idea of the government thinking of that as an infrastructure that is critical to build trust in a given economy or society. And the EU more broadly is taking steps to try and advance some of that with kind of digital identities. But the identity itself is interesting and it's important, but it's kind of then being able to apply that in these different use cases. So if a government has a great digital identity platform, amazing. But how do you apply that to when you're calling the help desk? Right. Or how do you apply that when you're applying for a job and you've seen some work to apply that to when you're opening a bank account? Right, to your example. But extending that into other really important high, um, risk digital services is, is where we see a need because it's where we see the bad actors targeting today.

Speaker A: So if, if a CEO or someone, uh, at the top of the business is listening and they're worried about whether they are vulnerable to deep fake fraud, what sort of question should they be asking their head of human resources or CISO or customer experience leader in order to discover whether their organization is vulnerable to deepfake or deepfake enabled fraud?

Speaker B: One of the best things actually to ask, how do we verify people, let's say when they call the help desk or when they apply for a job or when we're onboarding a remote hire? Simple things, questions like that often kick off the whole line of, of exploration today, where many companies don't realize that they haven't zoomed in on those processes and they might not realize how susceptible they are when you get to the actual security layer of it. Let's say once you find out how you're doing it today, you want to assess, does that, is that working for you? And you, uh, know the simplest way. I've seen people call, you know, help desk and pretend to be whoever, including being themselves and seeing what the process is like, let's say, to get their password reset or going to apply for a job and seeing what that process is like on their company's website. And in more advanced ways. We see companies often hire, uh, other firms to do what we call penetration tests, you know, where they literally impersonate an employee, they call the help desk and they try and sort of break their way in doing that.

Speaker A: Sort of like white hat. White hat.

Speaker B: Exactly right. Exactly right. It's very typical in other forms of security in the cybersecurity world. You hire like white hat hackers or firms to do these penetration tests to say, hey, try and break into our systems. But this is, it's, it's security oriented and it's, it. But it's kind of the least technical way because again, you're not breaking cryptography or hacking into the company. You're just what we call socially engineering your way. You're kind of conning your way into the company by jumping on the phone with someone who might work there or applying for a job and speaking to a recruiter or the like.

Speaker A: Well, one of the things that you, uh, turned me onto in your book is this fake, uh, hire situation where people are, are enabling their identity or at least their, the, the recruitment to think that this is a real person I'm hiring, the one I've been facing, Aaron, and I suspect you've also had this is, is now the fake recruitment. So the fake recruiter comes and says, hey, Aaron Painter, you're amazingly positioned to fill this job that I have. And they look at, they've scanned my identity and say, well, mentor, you know, you're perfectly suited for this job with your experience and this and that. And they make it look like it's absolutely, uh, you are the, the exact person for this job. And so back to this notion of trust. We basically, we can't trust anything. And the question I have at this point, Aaron, is to what extent are all these deep faking? They're not just killing truth or trust, but they're killing spontaneity.

Speaker B: Yeah, I think you can still have elements of spontaneity. Uh, but I think your scenario you're highlighting is, is a really important one. And it's, it's one we've seen kind of just go wild, particularly, uh, in the last 18 months, you know, there are upward of 30,000 North Korean operatives. It's really what they are, who are sitting in centers and we see them. You've learned a lot about them. It's wild how sophisticated and advanced it is. And they basically just apply for jobs, particularly in US Companies and remote. They say, hey, I'm a remote worker. And they fill out an application, um, they jump on zoom or teams interviews. They uh, use a deep fake creator so they look or sound like someone else, create a fake LinkedIn page or the like to um, have kind of a little bit of track record. Or they target someone who is real and let's say has a real LinkedIn page and it's actually them and they just pretend to be that person, you know, maybe with a slightly different email address. Um, and they, they apply for jobs and often they get hired, which is what's shocking. Most of the Fortune 500 has a large handful of these folks. Um, and they come in and it's. What was surprising to watch is they're not all after, uh, you know, data stealing and data exfiltration and holding the company ransom. Some cases, um, in some cases they might be doing that for later. But many of them are actually just interested in getting paid. They want to exist and they want to be that employee for as long as they can. So they get on payroll, they get paid, that money gets transferred back to Bitcoin, back to the North Korean state. And it's a huge money making operation right now for North Korea and a huge amount of risk, um, for most companies that are employing a sanctionation violation, sort of, you know, OFAC or foreign, foreign controls list like it's a major penalty. So companies are shy about this. They don't necessarily want to talk about it. They're embarrassed. Colleagues are embarrassed because imagine getting to know someone and working with them and then to find out that they're fake or they're a North Korean operative and you had no idea. It's, it's not a conceptual thing. It is happening today at enormous scale. And again, it's interesting because the bad actors are just exploiting the gaps between systems. HR is trying to find people. They do interviews, they hire, let's say you move to hire someone and the next thing you know, most IT people, it, uh, teams send out an email. Dear Gmail user, you know, you just got hired. For all practical purposes, we think your name is this. Welcome to the company. You know, click here to set up your email login and your password and your MFA and Then that person's in. Right. It's sort of this gap between HR and IT that the bad actors are exploiting. And so one of the solutions is to verify, like know who's applying for the job, do verification. Then Gartner, you know, industry analyst firms recommend you do identity verification checks two to three times during an interview process. Make sure it's the same person showing up for different interviews, then make sure it's the same person who you're onboarding. That's the concept and sort of this level of verification that companies are not moving toward to protect themselves in this era of just rife AI impersonation.

Speaker A: That does feel like spontaneity is the risk here. Because if you've got to constantly re verify. Wait a second. Bloody Aaron, this is Minter and uh, I need to move on and we need to be able to trust one another. If we, if everything, we need to double verify. Am I, Is this still Aaron speaking with me? Is this still Minter? Or how, how does, how does trust in reality come through when we're in constant distrust?

Speaker B: Yeah, I don't think it's actually that different than what we do in other elements of society today. It just maybe works better. You know, for example, logging into things, you often have to go find the password or you save somewhere or type in the password and then get an MFA code sent to you and then put in that code in order to be able to log into something. Or every time you open your phone, you do a face ID to make sure that you're the person who held the phone and that's the same face who enrolled in face ID as the one using the phone. I think in many ways in our life we've actually gotten used to reverifying ourselves. It's just that we haven't applied that technology consistently. I can re verify. You know, uh, companies that work with us re verify you with this easy as another face ID selfie. It's just that they're able to compare that selfie to earlier selfies and back to the government issued id. So it's uh, not silly to say, hey, before I can help you with the help desk or when you show up for work today, you're going to take a quick selfie like you would with face ID to be able to access something. We're used to friction. It's just that the friction that's been introduced today is actually not providing the security benefit that it needs to in today's digital world. I think you can do better. And with the Same or less friction actually offer even more assurance?

Speaker A: Well, I don't know, but it seems like a lot of companies don't have it right. Uh, one of my most read blog posts is about Chase Manhattan bank, which is I'm a Chase customer, but the amount of effort that I had to go to to get an answer about my own account, uh, is off putting. And so many other people are having these bad experiences in this notion of identity verification and it's giving a lot of bad customer experiences. So Aaron, if that weren't enough to get someone to check you out, to stimulate people to want to know who is Aaron Painter and name tag, what kind of uh, go to's and uh, links would you like people to, to go to to check out your book, maybe hire you, your company to get better verification and improve this customer experience that is so awash in my opinion, especially in the West.

Speaker B: I, uh, appreciate the invitation. Um, you know, AaronPainter.com has a lot of information about the book coming out October 13th. Uh, it can be great, great way to kind of educate yourself and learn more and share with others. Um, our website is getnametag.com a little more about what more up to it name tag. And then, um, I publish a bunch on LinkedIn and kind of other platforms and really just try and educate people on what I'm learning, what we're learning. Because I feel like the bad actors are gotten incredibly good at sharing amongst themselves and I think as good actors we can do even more to share what we're learning. If we're going to have a chance to defend against those with bad intentions

Speaker A: and just to finish the instinct that your grandfather had, what can everybody lean into, uh, in order not to be nagged or tagged with deep fake and uh, rendered vulnerable. What advice would you have for everybody who's listening to figure out how to make your grandfather's instinct the right instinct for everybody.

Speaker B: I think you need to have that level of curiosity and sort of caution. You know, often, let's say even in personal life, if I think about the context, I think about the channel. What I mean by that is if, you know, I normally talk about sports with a friend and suddenly they're asking me information about our business, I'm skeptical. That context is different. That's not how I know that person. Hey, this is sort of unusual. If I always chat with someone on text message and suddenly they say, hey, let's switch to WhatsApp. Uh, you know, I'm a little bit skeptical. It's a change in the channel that we're used to communicating on. Same thing for things that you see, you know, on the news or online, like what you see and what you hear through digital channels doesn't deserve the same level of trust you might give it to if you saw it with your own eyes. So I think we all need to be skeptical, give it a sense of pause and curious. Then to understand and to your point, take, take the time break through the spontaneity, uh, so that we can build greater trust and confidence and in what we're seeing or what we're hearing.

Speaker A: Superlative. Well, many thanks Aaron, for coming on. I encourage anyone to go get, uh, your book Loyal or your new book which comes out in October on go, uh, visit your site, go visit Amazon because it's going to be out there. Deep faked Many thanks, Aaron.

Speaker B: Thanks for having me. Mitur

Speaker A: so a really heartfelt night. Thanks for listening to this episode of the Minter Dialogue podcast. If you like the show, please remember to subscribe on your favorite podcast service. As ever, ratings and reviews are the real currency of podcasts. And if you're really inspired, I'm accepting donations on patreon.com mentoredial you'll find the show notes with over 202100 blog posts on minterdial.com on topics ranging from leadership to branding, tech and marketing tips. Check out my documentary film and books, including the last one, the second edition of Heart Official Putting Heart into Business and Artificial Intelligence that came out in April 2023. And to finish, here's a song I wrote with Stephanie Singer, A Convinced Man.

Speaker C: I like the feel of a stranger tucked around me Precipitating the danger to feel free Trust is a reason Still I won't toe the line uh, I sit here passively Hope for your respect Anticipating the thrill of your intellect maybe I tell myself there's no use in me lying I'm a convicted man building an urge I'm a convinced man to live and die submerged A convinced man in the arms of a woman I'm a convinced man Challenge my fate I'm a convinced m man Competitions in name A convinced man in the arms of a woman Despise revenges and struggle with deceit Live for the challenge so life's not incomplete what's wrong with challenge? I know soon we all die I like the feel of the A stranger jumped around me Precipitating the danger to feel free Trust in my reason and let me show you why uh, I'm a convinced man Practicing my lines I'm a convinced man? Hearing these gun finds A convinced man? In the arms of a woman I'm a convinced man? Fit to the test I'm a convinced man? I'm ready, firing a red I'm a convinced man? In the arms of a woman?

Speaker D: Sam m.

Speaker C: So convinced, yeah, yeah, You convince me, baby? I'm a convinced face?

Speaker D: I'm a convince

Speaker C: I'm a convinced man? I'm a convinced man? In the arms of a woman

Speaker D: I'm a convinced man?

Speaker C: So convinced, yeah? I'm so convinced? So convinced? So convinced? So convenient, man?

Speaker D: I'm convinced, I'm convinced? I'm convinced? Minter dialogue.