Card-not-present fraud: Solved?

Speaker A: Card Not Present Fraud is something that happens when you lose your bank card or your credit card or it gets stolen or it gets skimmed by some nefarious individual behind some counter somewhere and they use your card information to go and buy stuff online or to make a phone call and order stuff without needing to be physically present with the card. It's a massive issue. It costs people billions of dollars every year and it happens all over the world. Apart from one group of people in the Republic of Ireland, for the last year or so, they've been using something that has reduced the incidence of Card Not Present or CNP fraud from lots to zero. None. No fraud has happened for these customers of this particular bank using this particular tool. Now, the founder, uh, and CEO of SafeCipher, uh, the man behind this rather dramatic result, joins us on the Node podcast today. Welcome to the Node podcast, Ben. Today we are going to be talking about what on the face of it, seems like a really simple idea. Although I know it's not necessarily simple in execution. But to um, Luddites like me, it seems like something that should have been true for decades. Um, the issue we're talking about is fraud, card fraud in particular, and uh, a solution that you have developed to stop a lot of it happening. But before we get into all of that, um, tell us a little ah, bit about yourself and safecypher, the company that you've co founded and are now the chief executive of. But what's your background? I understand that you go back away in terms of this particular topic.

Speaker B: Yes, I mean, uh, so first of all, uh, thanks Romney for asking that question. I started life as a very dyslexic child at the age of 10, not being able to read and write. And I think uh, over the years, as my mother said, my late mother said to me, you seem to have progressed well. Um, so, um, I think actually in a strange way dyslexia, uh, helped me overcome and became a very much a solution architect, looking how to find simple solutions for complex problems. And often in all my career that's what been what I've been doing since when I was working with ExxonMobil, uh, and then BNP Paribar and various other companies until I started this company in 2022. Yeah, okay. So, um, my background is unusual. I'm a qualified chemist as well, just to boot in there on me. So uh, I can make up the medicines when you're ready. But essentially um, how did this, you know, how did I come around this idea, what caused me to think about it? And what made me set up Safe Cipher? I think that's what you're trying to find out. And um, basically I'd been caught with fraud and uh, on my credit card. And um, I was in London doing a conference and I suddenly realized I've got suspicious transactions on my account. This was in the days prior to banking app. So somebody phoned me up from the bank and said, you know, we've got a problem with uh, some transactions, we're not releasing them. And then of course my natural inclination was this is a scammer. Uh, but it wasn't. I phoned back the bank and then realized it was true. So at that point, that was my first time probably about 20 years ago that I had a fraud like this and I started to realize it was happening and then some other experiences in life. I was uh, fortunate enough to go and be seconded, uh, to work on some of the uh, fraud areas in Europol. So uh, for about 10 years I was working in that environment, I started to realize that fraud was a big problem. Yeah, whichever way you looked at it, fraud was happening and in particular uh, credit card fraud. At that period of time, you're talking 15 years ago now, there were transactions on the Internet, but they were few and far between and effectively it was the dawn of online shopping. Yeah. And uh, at that time the criminals hadn't got into bed into that area yet. They hadn't worked out how they were going to do it. But within the 15 years, of course, everything had changed and that whole marketplace had changed. It's a very big area of, of transactional volume. And the criminals got into that very quickly and realized that there was money to be made. So cardholder not present fraud, which is what we're talking about on the Internet, not fraud in general. Yeah, because there's all sorts of fraud, but Internet based fraud, where you're putting your card in to buy something, is probably one of the single biggest frauds out there that takes place and still is growing. It's not, it's not retreating, I should

Speaker A: think just to, just to interrupt your flow slightly, just to uh, be clear about what we're talking about. So um, I should think a lot of people that are uh, listening or watching to this have probably encountered this. And this is very simply the fact that if you've got a card, credit card or debit card or whatever, it's got a card number on it, it's got all the information you need to just go and use it, uh, online. If somebody else has got your card, you flip it over and you've got the CVV number on the back and off you go. All you need to. You've got the basic information, you need to go and do it. It's an obvious thing for any kind of. Would be opportunistic criminal to do. That's the issue we're talking about. Right.

Speaker B: Yeah. And it's a great point you make there. And 80% of, uh, credit cards in circulation in the US are compromised.

Speaker A: Compromised in the sense they've been skimmed, or. I beg your pardon, Compromised in the sense that they've been sort of skimmed.

Speaker B: They know much of the detail about that card, so they'll have details about, uh, the card number, the expiry, the cvv, perhaps even your home address, your mother's maiden name. This compromise. Yeah, and that, you know, those are, those are shocking figures if you think about it.

Speaker A: Well, it's.

Speaker B: And then you also think about 150 million Americans every year have fraud committed against them.

Speaker A: Wow. Yeah.

Speaker B: So, you know, I always like to say, you know, it's the scale that's enormous. Yeah. And, um, and then you think about sort of America as a general thing, because that's where I'm looking at at the moment. 46% of all fraud takes place in America on credit counts.

Speaker A: 46% of all of all fraud. Fraud.

Speaker B: Yeah. On credit cards there. And, um, and it's. So it's such a big problem for the American payment industry that they do, they throw money at it to try and solve it, but at the end of the day, every time they, they find some sort of solution. Yeah. Or some sort of way of tackling it, the criminals find something equally as easy to find out, you know, to, uh, you know, weakened areas of ingress into the payment industry. So it's a massive problem. It's not going away. Um, people often, just to get some UK context in this, it's half a billion within the uk. Uh, if you add in the cost of managing fraud, it's 750 million every year that we lose just in this country.

Speaker A: Wow. Okay. So we understand the scale of the problem and also the obvious nature of the problem. Um, you don't need to be clever to commit this kind of fraud.

Speaker B: No. And in fact, you don't. You're absolutely right, Romney. You do not need to be clever. You just have to be tenacious and know where the weak points are.

Speaker A: Yeah. So that brings us on to your solution, which seems as neat as it is obvious to me. Not, um, only is it. It's not just an idea. We're not talking about some kind of quirky little startup that's solving a problem. This is uh, if you may allow me to butter your parsnips somewhat for you. This is a solution built on decades of experience for you personally, but a keen understanding of the actual problem, but also uh, understanding of the uh, another layer of the problem I suppose, which is why hasn't this been done before? So tell us what safecipher is, what does it do and then we can talk about the way you've demonstrated it.

Speaker B: Yeah, it has been done before. So dynamic cvv and I'll explain what that is in a second. Has been done before. But the problem with it was cost and flexibility. But there's no doubt that changing the three digit number at uh, the back of a card. Yeah. Every time you use it is clearly something that will stop a criminal. There's no question about that. Because they don't know it. Yeah. Everything else is knowable. The card details, the expiry, the static, the fixed one printed on the back is known to them. Yeah. But I think the key here is uh, why does dynamically generating it help? Yeah, how does it help? Well, it's the one thing they can't know. And when you've done three tries at it, the banks tend to lock you out and ask you to phone customer services. They don't want to do that, criminals don't want to do that. And criminals, as we discussed previously, Romney, go for the easy option. The point of least resistance is the place they go for. Yeah. So uh, it is a simple solution. You're quite right. And the other thing of course is you do it before you start the payment journey. So when you, when you're on the web and you're putting in your details, you look on your app and it gives you the number and only you can see that number. Yeah, it's biometric, the two factor authentication. Only you can see it.

Speaker A: Yeah.

Speaker B: So if only you can see it, only you will know it. And you only know it for five minutes. Okay. So it's almost impossible. The statistics are against them being able to do it. Not that they couldn't do it wrongly, but they're going to go somewhere else. Yeah. Okay.

Speaker A: Yeah.

Speaker B: So um, what is true where anybody's ever used Dynamics, uh, solutions is that the fraud rate goes to virtually nothing and that's uh, on file in the public domain where people have used it. The problem was cost and flexibility. Right. So our products different than other people, we use the same Principle of dynamically changing the number which everyone knows works. Yeah, okay. But then we've made it so it's really easy for people. So for instance in our app with the issuer in Ireland. Yeah. And post, they effectively all they do is have a button on Manage card section, press the button. Yes, I want to go dynamic. And from that moment onwards the card number on the back, the three digit number is no longer valid, doesn't exist and only they can see what the number is. And it literally is as simple as that. And they put it in, it goes through all the normal legacy systems of payment and then the processor, if you will, reaches out instead of going to the static one which they have on file, they come to us and we say yes or no. Yeah. It's either right or wrong. It's binary. And I think we discussed previously, Romney, that what's the difference between our product and say these AI driven and machine learning uh, products that are out there, the software, the simple fact is that they are risk analysis tools. They are a percentage risk. What's the likelihood of this not being the cardholder?

Speaker A: Yeah, yeah.

Speaker B: Ah, in our case our product says there is no likelihood. You're either yes or no. It's binary. You're either it is you or it isn't you. Yeah, you can't say. So the benefit of the product is it's very cheap to effectively deploy. Really cheap. I mean you're looking at something like for a bank, around about $85,000 for them to deploy into their app and test and take 60 days type thing.

Speaker A: Right.

Speaker B: But the other issue is that when it's in use, it's cheap as well. And there's an old adage that we discussed before. What, what do people fear most, friction or fraud? I can tell you categorically it's fraud. M so the friction element has always been an area of contention. Why would you know, you go to the app and get the number? It's because anybody who's had fraud committed to them and there's at least 150 million Americans last year who had it. Yeah. Will testify. It's a really problematic experience because you've got to change lots of things. You feel a compromise yourself. So in that sense the product is really simple. And you asked a very good question. Why hasn't anybody really gone about this? I think it was because the technology, the ability to have it at a price point, make it flexible, allow you to put it into the banking app. Yeah. Easily. Um, was not available without cloud systems. M and various Changes in the way we bank today, like for instance, biometrics, two factor authentication and things like that, they weren't mainstream, they are now. So that's the reason for it.

Speaker A: Right. And you've managed to coalesce around these relatively new emerging technologies to make this easy and cheap. So just to recap slightly, I'm just making a casual assumption that people are as faintly dim as me out there. Um, uh, safecipher isn't a separate app, somewhere that you can go and get. It's integrated with your banking provider, with the people that you've already got an app somewhere for.

Speaker B: Yes.

Speaker A: Uh, in the wild right now that is up and running with Anpost, which is for anyone who's not in the Republic of Ireland, that is the, uh, uh, the National Post Office, post office, who also offer banking services and so on, they have an app you can use that you can go in there, flick a switch and suddenly that annoyingly obvious and visible CVV number on the back of your card no longer is. And in fact what you now do is use the app to complete that transaction with a unique number every single time. That's about it. Right?

Speaker B: Yeah.

Speaker A: And it's dead simple for the bank, it's simple for the users and it's really, really hard to breach if you're a. Would be criminal. So I get that. Yeah. And then, and then of course, the AI driven alternatives that we were talking about, I think we were having a previous conversation. What we were saying is huge amounts of time and money has gone into trying to develop other ways of identifying fraud as it's happening.

Speaker B: Correct.

Speaker A: After the fact.

Speaker B: That.

Speaker A: And that's when your card gets blocked and you get a phone call and it says, uh, oh, we think suspicious activity is happening because probabilistically our AI has told us that maybe this isn't typical of you or something. It's a really complicated way of solving the same problem. I think I'm getting that. Right. Whereas you can just say, actually no, let's just turn the switch.

Speaker B: And what's really also true and in the public domain, which I can talk about because it is now in the public domain, um, since Inception, uh, the issuer in Ireland and Post for activated customers, so people who've activated the service, not a single fraud has taken place online, not a single one. That's over 10 months of use, hundreds of thousands of transactions, uh, thousands of users actively using it every day and not a single one has taken place on activated customers. And that is a tremendous statistic. It's not One I have to justify. It's one that they have recorded in their submissions to regulators and compliance people over in the regulator in Ireland. So not a single one has taken place. They've seen, uh, absolute positive nature in the use of it. Customers are delighted with the use of it. It's simple. What I always believe in, it comes back to my dyslexia, I suppose, is I like to solve problems that are easy, complex problems, as you said, easily done. There's no real user journey change. And the other thing that came out from it, which was you only get to know Romney when you actually do it, is in a customer questionnaire that came out, customers were saying to them, we really like this because we, we no longer trust OTPs, texts or pushes. They could be the scammer, but if we're doing it ourselves, it can only be us. And so they're in charge now of their fraud management. And that was a real surprise to us that people want to be more secure in their transactions online. So, in fact, what's happened with Ampost, um, is the number of cardholders has grown recently. And I can only assume part of that is new markets where customers have said, this product is safer to use on the Internet than others. And in fact we saw some very interesting statistics again in the public domain where customers prior to activation and post activation are using the card three times as much. And the only thing there that you can say when you do the questions to those customers say, why do you use it more? Why are you using the card more? Well, I've stopped using other wallets because they're not as secure as this.

Speaker A: Right.

Speaker B: So that's something that came out from doing the job, if you will. Yeah, um, uh, in Ireland.

Speaker A: But it's an obvious and easy claim to be able to make if you can say, well, actually since implementation there's been zero fraud through the system. Um, is it safe? Is it a reasonable piece of marketing, for example, for us to say, well, that's probably because it's safer? Um, that's fairly good evidence for the fact that that's true. And so much of it is in the fields as well, isn't it? Whether we are. We're just inundated now with digital wallets and ways and means of subscribing and paying for things. It's coming at us left, right and center. None of it feels particularly trustworthy. In particular, you're right, the SMS thing, I've very nearly come across, um, uh, on that myself and I think I'm reasonably clued up about these things. So, yes, I can understand why it feels a lot safer, especially when you're using a biometrically opened app that you're familiar with. Right. And I guess we're used to doing that.

Speaker B: In a way, you're trusted. Yeah, yeah, right.

Speaker A: Because you're trusting yourself as much as anything else. No one's cloned your fingerprint or your eyeball.

Speaker B: Well, that's the theory. And what's interesting, recently we've been talking to people about, um, you know, uh, this area of fraud and you know, just talking about it and obviously what are what further results are. The post office in Ireland, when they've come to a year, they're going to be doing a new app in October and potentially changing some of the things. Like for instance, activation will be a norm going forward potentially. So you won't be allowed not to have that service, but you could switch it off if you don't want it and there will be always people. But at the moment the retention rate is 80% Romney, which by any stretch of imagination is good. So they're looking at now making it given the evidence they can supply to their cardholders. This cuts fraud. If you don't want fraud, do it this way, um, then they're happy. And the other thing is that they're always happy about is, is sort of saying that their fraud, uh, department, their management of fraud, are delighted with the product because it's meaning they can talk to their customers about other types of fraud, like app fraud, you know, uh, uh, authorized push payment fraud, which is a big problem, you know, for people. And so I think overall, uh, the demonstration of this in a very restricted marketplace, which is the eu. Yeah. You know, European Payment Directive is a tough one to get through. Compliance and regulation means that when we go. And you were asking me before, I think in a conversation we had previously, where is this product going? America. Because America has, you know, three times, you know, if you're looking at say Europe, uh, it's 3% is the average sort of, you know, fraud rate. America's twice that. Yeah, it's just twice. Right. And you know, they are, uh, the American issuers out there that we've spoken to over the last year are keen on this product because it's easy for people to understand, easy for them to deploy. It does have some weaknesses. Like for instance, one of the questions comes out all the time is what about the older people who aren't using a smartphone and things like that? And what I say there is this. Unfortunately, some services Some products in life require you to make the next step and if you can't make it, the banks are there to support you and legislation's there to support you to get your money back. Yeah, this is for the newer generation and unfortunately that's the case. I'm not happy about it, but it's the only way I can deal with it.

Speaker A: That's the inevitability of, well, I suppose just digital full stop, if you see what I mean. The digitalization of our lives ultimately leaves a gap between those people who can just run with it and those people who are slightly befuddled by it because they're a generation too late. This is a problem in all areas of society, not just, not just financial services, obviously digital onboarding now and the

Speaker B: government and everything like that, trying to make it more digital to get costs down, to make things more speedy, etc. I get it, yeah. But it does leave the digitally disenfranchised to some, some degree. But at the end of the day I can't solve everyone's problem. The other thing I would just like to say on future is we're about to sign a big deal with a major global processor. Um, probably happening in the next month or so. Um, that will be our point of distribution to the industry in America. And there'll be other processes where we will talk to and are talking to about our technology. It's uh, some parts of it are going to be patent protected. We've applied for patents in both US and the uk. Um, and hopefully, uh, the main thing for me is get it out into the marketplace, prove to people in America. If we get one or two banks in America and Canada and Latin America using it very quickly, they'll realize that this product really helps them. We know that now. We don't need to sort of say we think we know. Um, and hopefully given uh, the responses we've had from the American issuer market and processors, uh, this product will become mainstream for a while now. Will it solve the problem forever? Omni. No, it won't. Right. We've just got to be honest. Um, the fight against fraud is a fight where you're constantly changing your tool set. Yeah, that's the important thing.

Speaker A: Well, you either uh, take big strides like this to keep up, uh, or you just give up, which that doesn't seem like an option. So this seems like a very positive first step. It sounds like exciting times indeed for yourself. And safecypher is relatively, uh, young organization, company idea and so, and such an, obviously such an obvious problem. And to be able to solve that problem so neatly and to be able to demonstrate that, um, is quite, it's quite a thing. So would it be, um, fair to say that within the next year or two we might be seeing dynamic CVVs, uh, everywhere and it will become a new thing for us all. Is that.

Speaker B: When will I see it? Uh, definitely in North America and South America. I think Europe will, will lag ironically behind a little bit because they feel that the infrastructure they've got with various regulations about how transactions take place somehow insulates them. But I always point out, look, if you were that good in Europe about it, why have you got one and a half billion worth of fraud going on still today? Yeah. Okay. So, um, but I think there's always, um, I think America is good because it has a very high level of fraud and it wants to solve it. And also America has something else. Vast majority, about half the population in America bank with credit unions. Yeah. And credit unions by their very default, effectively are owned by their members.

Speaker A: Yeah.

Speaker B: They have something of interest in making sure they don't have fraud. So I think because of the unique natures of America, you'll find America is the place for it initially. It will then migrate to Latin America and it will come back into Europe. Uh, you know. But whilst the regulator, uh, doesn't, um, wants to try and see lots of different types of technologies. Yeah. Improve it. There is some resistance within the issuer banking area to do too much at this stage because they've already invested in lots of compliance and regulatory tools to try and make it work for them. We saw this change about, um, who's liable for app fraud now in the uk. Well, since October of last year, it's you, the issuer bank or part of. So there's lots of things that are different in Europe. India is another good place this product would be good at, and the Middle East. So there are places where it will be good. Um, I think, um, to sort of wrap up my views about the product, there are some things that we've discussed with issuers that we didn't understand when we first started the journey. And there are other uses for this particular type of product which I can't talk about at the moment because I'm restricted. But I would say it was a surprise to me and I suddenly realized, how did I miss it? Yeah. Um, but banks are keen to do. And in fact one of the things we'll be doing in America shortly is a trial of using our technology in a slightly different way, which I'LL come back to you at some point. Romney ON When I'm able to sort of talk about it a bit more. But it, it really is, you know, uh, there are some real benefits to this and they're all around identification of people to make sure you don't get a fraud.

Speaker A: Right. Well, I think that's just about said it all for today. It's an exciting journey and it's really interesting to talk to you at the kind of beginning of it. It's not the very beginning, obviously. You've already improved the lives of countless.

Speaker B: I had hair when I started the

Speaker A: beginning, but I can see it exploding from the Emerald Isle and helping out, uh, the rest of the world eventually. Even maybe those of us in the UK who are somewhat. It feels like we're on the back end of everything these days. It'll happen. It'll happen. Maybe one day other people will decide what the regulations and rules need to be and then eventually we'll. Well, okay, we'll pick and choose which ones we want to take. We're not going to set any rules ourselves anymore. Might be being a bit cynical. Um, but yeah, thanks very much for sharing news but we'll, we'll put this on the Node website obviously. We will put lots of links in there to, to you guys, uh, and we'll splash this around on LinkedIn, etc. So hopefully lots of people will engage with it and uh, uh, engage you in further conversation as well. It would be brilliant to touch base again a bit further down the line if you're up for that because.

Speaker B: Yeah, yeah, back end of the. This year would be great in as the Americas would say, the fall. That would be a good time normally to fall, regroup.

Speaker A: Yeah, yeah, yeah. Well, let's make a date and we'll, we'll do that because it's going to be a rapid, a rapid ascent. I'm, I'm certain of it. But in the meantime, thanks very much for joining us today.

Speaker B: A pleasure. Thank you very much. Take care.