AI’s Role in Payment Fraud with Visa’s James Mirfin

This is Techstrong tv. Hey everyone, welcome back here to Techstrong tv. Uh, we have another guest here to introduce you to.

I wanna, uh, introduce you all to James Murin. James is the VP Global Head of Risk and Identity Solutions in Visa. Visa as, as in the credit card visa, not as in the traveling around the world visa.

Um, James, welcome to Techstrong tv. It's a pleasure to have you on And thanks very much for having me. It's great to be here.

A pleasure. Um, James, you know, visa is, I guess a company that our whole audience is familiar with the brand, you know, it's one of the leading, leading credit card brands in the world, and along with that, of course, is a, a, a high burden, a high degree of, of, uh, expectations around security and risk. Identity, of course wrapped up into that.

So I imagine this is a big, big, you know, piece of, of the, of the, uh, ball at Visa and, and handling that. But before we get into it, you, you know, you're VP of Global Head, uh, VP Global Head of Risk and Identity Solutions there. Why don't we, if you don't mind, share a little bit of your own story with our audience?

Sure. So I lead the risk and identity solutions here at Visa. Uh, I've been here for just over a year and, uh, lead a team of product experts, technologists and data scientists that are thinking about risk and identity and fraud every day, and how to protect the ecosystem, how to deploy technology at scale to try and protect payments around the world.

Uh, and it's something we take very seriously. As you say, visa is known for consumer payments. Many of us have got those cards in our wallets and, and a secure way to pay.

I mean, you talked about big, we've invested over $10 billion in technology over the last five years. So it gives you a sense of the scale. And, and a lot of that goes towards security and, and trying to prevent fraud.

You know, we, we have to have a, a platform that's got six nines of availability, and we have thousands of people that are looking at cyber every day. So this is a big topic for us. It's something I'm personally passionate about.

I wake up in the morning thinking about how to protect payments as to my team, and, and we need that because there's a lot happening from a technology perspective. And unfortunately, as you said, the bad guys are getting their hands on this technology as fast or faster than the good guys. So it's a bit of an arms race out there at the moment.

Absolutely. And it has been, it has been, uh, you know, I've been in security myself for about 25, 30 years, and it, it used to really upset me that so much of security was reactive. It was like the classic cat and mouse game, and the cat gets a mouse now and then.

Right. But the mice get overrun, you know, there's so many mice. Um, you know, I I, I saw an interesting article the other day, James, not to go down a rabbit hole, but it was about JP Morgan Chase, you know, the largest bank here in the US I guess, and, uh, one of the largest in the world.

Um, they defend, it's an insane amount, like something like 43 billion attacks a day or potential, you know, attempted intrusions and attacks a day a day. And they're spending billions of dollars every year on, on risk and identity and fraud and all of this. I mean, I don't know, even, even though we're all familiar with Visa and Visa's, obviously a very large organization, I don't know if our audience truly understands the scale of what it takes to, to defend such a network, such a, a, a, a honeypot, if you will.

The, you know, the ultimate honeypot. I, back in my days when I, I started a, helped found a security company. We were, at the time, we were, uh, working with what they call the NMCI, the Navy Marine Corps internet.

This was one of the largest private networks in the world, probably four to 600,000 nodes. They were defending, I don't know, I think it was six or 700,000 intrusions a day, which to me was mind boggling. Six, 700,000.

Then compare that to 43 billion, I'm, I'm assuming visa's gotta have a, a like amount or a similar amount in, you know, in terms of scale of of, of, you know, potential attacks. It's crazy. It is crazy.

I mean, if you think about the scale of the Visa network and the payments that we process successfully, we process, you know, hundreds of billions of transactions a year. Trillions of dollars of commerce goes through our network. You, that's the good things that go through.

So you can imagine the, the, the scale of the attacks that are hitting us, but not just us. We're a network. So it's hitting our customers, people like Chase, and it's hitting merchants.

So everybody, um, is, is facing this onslaught. And, and the technology's just making it quicker, you know, generative AI topic at the moment, everyone's talking about it, but that's put tools into the hands of the fraudster to take tried and true techniques, which they couldn't do at scale. And then, you know, bring those forward.

So whether it's phishing, you know, and doing, doing more and, and better phishing attempts, or if it's social engineering or romance scams, like these things just accelerate and it, it just, the surface area has got much broader and wider. So yeah, we are dealing with the same kind of scale and trying to bring our expertise to bear on that problem and trying to stay ahead of the fraudsters and the criminals as they go and deploy technology against it as well. Absolutely.

And you know, you bring up a thing that, again, being in security for as long as I have, I I, I'm well, well aware of it, but for our non-security folks in the audience, and there's some, you know, what you gotta realize is that all of these great new technologies as they come out, a lot of times it's the bad guys who leverage them faster and better, then the good guys do. Right. It, it was, it's always, it's been true for as long as I've been in technology and it's still true today.

So you take something like this gen ai, you know, there, the, the whole dark web and black hat, whatever you want to call it, that, you know, chaos Inc. Organization. I mean, they, they have real structure.

They're really set up to leverage the, these kinds of technologies as well as you are or we are. And, and Excuse Me, I was gonna say, I would completely agree with you. I mean, typically they do move faster and certainly I know organizations I've worked with in the past, they've been slower to adopt some of this new technology.

The one thing I would say about Visa is I think we're taking a very balanced approach to try to protect the core infrastructure and stability that everybody expects, but also thinking about how we can deploy things like gen AI faster. I mean, we've not been talking about gen ai, gen AI at scale for very long, but already we're using it within Visa. We're using things like GitHub copilot to accelerate, you know, um, code deployment and testing.

Mm-Hmm. We've got two products that were built based on gen AI that are already live. We're thinking about how can we use large language models to look at transactional patterns and create large language models out of those so that we can suggest, you know, new rules to our customers to optimize author rates and fraud outcomes.

So I think we're trying to embrace this stuff quickly 'cause we know that we need to, but doing it in a way that we can still maintain the stability of the network. I mean, to give you an example, we're running a hackathon across Visa currently. We've got over 6,000 of our employees participating in that hackathon.

It's the biggest one we've ever done. And it's a gen AI hackathon. So, you know, we've got developers, technologists, product people, customer facing representatives in there.

So I'm really excited to see what comes out of that because again, we, we have to be on front of this given that we're seeing what the criminals are doing with it. And it's, I mean, it's quite worrying when you see how they are using it and what's happening impacting consumers around the world. Absolutely.

You mentioned some of the ways they're using it. One is making their fishing better. My God, I don't know.

I didn't realize how many McAfee solutions or, or, you know, other things I've bought from the emails I've received lately about, you know, here's your receipt and here, here, you know, it's a phishing scam where they want you to click to see why, how the hell did I spend $799 here? And, um, you know, those have gotten a lot better. They're the, they're just more ingenious.

I'm, I'm afraid to click anything. Right? Yeah.

That comes in, I, I give everything the once over now or more than that because it, it's crazy. It is. I mean, I think the big worry when I think about where we are seeing generative AI in particular show up in the fraud space, is it's breaking down trust in things that you've historically trusted as a consumer.

So whether that's a phone call that comes through that you think it's from somebody, you know, or from a local county sheriff's department, which is what I had yesterday, no joke, really telling me that I had failed to appear for a court appearance last week. It was a Texan accent on the call. Everything was there to socially engineer me into the fact that I thought I was gonna get arrested and I needed to pay a fine.

And, you know, so they're using inherent trust voice, you know, caller id. Um, the thought that one of my family members could call me on video and I could see them and hear them, and it's not actually them. That's quite scary.

And that's the kind that, That is. So that is, that's cutting edge, right? That's the kind of stuff, if you haven't seen it yet, we're going to see it soon.

Sort of this deep fake kind of stuff. It's, It's happening at scale, you know, these guys have got factories that they're creating this, the template, they're using your compromised data, which they can get off the dark web, and then they're using the technology to, to convince you and to lure you into to paying them. So we're obviously thinking about how we can use the technologies that we have at Visa to protect people against that and to also protect the payments that they make.

And, and that gets even more challenging in an environment where payments are getting fragmented. Yeah. It's not just using Visa cards, you know, you've got real time networks and peer to peer payments and people may not realize, but we're also looking at those at Visa and how we can protect those more broadly, not just on our network, because, you know, we've got a lot of experience here.

We've got 30 years of using AI to protect payments, and we want to, you know, protect the payments ecosystem more broadly. So that's the kind of things that my team are looking at every day as well. I'm sure.

I mean, we've been getting, we've been getting here tech sunk, for instance, smishing, right? That's Ms. Phishing people are getting, uh, text messages purportedly from me with numbers spoofing and everything.

Yeah. You know, asking them to do me a favor and go buy some gift cards Yeah. And, and stuff like that.

Um, and then take a picture of the back of the gift cards, right. So we had to go through a whole education thing here. No, I'm never gonna ask you to buy a gift card for me.

Yeah. Um, but it, it, it gets worse and worse. And I, I, I don't mean to be a penny handy, sky is falling kind of person, but I think we're just scratching the surface of how they're gonna be using.

I mean, the deep fake stuff is, is one example that's scary stuff. I don't know how you, I I don't know how you're gonna be able to, you know Yeah. Diagnose that It's, I mean, we, we look at all of this in, you know, as I say, we're spending a lot of technology and on data science, we look at it as, as, you know, data analysis, patterns, analytics, bringing AI to bear on, on what we can see and trying to identify fraudulent transactions and, you know, nefarious transactions.

We've become pretty good at doing that. But as the patterns change, obviously you've gotta keep investing to keep up with it as well. Um, obviously, you know, we have authentication for payments running across our network, and that works well, you know, thinking about can we do things around authentication for other types of transactions?

Because at the end of the day, if I'm gonna send you money, I want to know it's actually you and that I've, there's a trust in that relationship. That's something we've done on the network for, for a long time. But, um, yeah, it's, I mean, we, just to give you a sense, we prevented $30 billion worth of fraud on the Visa network in six months last year.

That was known, known fraud that we managed to prevent. And again, just putting these models to, to bear at scale, but that gives you a sense as of the prize that the fraudsters are going after, they don't have to get too many of these Right. To make a lot of money.

No, no. And and that's the other thing. I mean, you know, $30 billion, a crazy big number, but, you know, for a lot of these organizations, if they raise, if they were able to get just a, a couple of million of that, it's been a, it's a really good year for them.

Yeah. Well the guy, the the person on the end of that call yesterday was trying to get $7,000 out of me. You know, that would've been on Sunday morning.

Yeah. That Would've been a nice morning's work. Yes, it would.

Cra it's just crazy, man. Crazy. James, how do we, do we ever get out in front of it though?

Or is it always a catch up game? I think it's always an arms race and it's, you know, the one, I think when I think about payments in particular, and I think about what we're talking about this, this topic, one of the best ways for us to get in front of it is collaboration. It's information sharing, and it's, it's working as a, you know, a collective as an industry and industry participants.

And that that goes across, you know, regulators, law enforcement networks like Visa participants on the network and technology firms. And I think you're starting to see examples of where that's happening around the world. I think there's an urgency to that collaboration to really make a dent in this kind of problem because it's multi-party in the way that it's enacted.

It's multi-party in terms of the victims. And I think it needs to be multi-party in the, the way that the solutions are deployed. And so that's something that we're trying to lead in markets around the world, and I think that's critical.

That to me is the single biggest factor in how we get ahead of these guys. And a lot of that's around information sharing and collaboration. Yep.

Um, James, for people maybe who, you know, either A, are fascinated B or scared to death or c just wanna learn, um, where can they go to find out more information about what you and your team are doing at Visa? com. Um, we've got information that our experts in the fraud and risk space put up onto things like LinkedIn and onto social media.

Um, we'll make sure we share information and they can reach out. Um, but there's a lot of content out there that we've put, we, we put information out for consumer. com and online as well.

So there's, there's a lot of content out there. There's a lot of information and we've got a team around the globe that are willing to help. Um, so just, just reach out and we will be keen to help where we can.

Absolutely. James, thanks, thanks for coming on the show. More importantly, thanks to you and your team because all Kenny has said you guys do yeoman's work and keeping that system secure and afloat and, and consumer confidence.

You know, we don't worry too much when we use our visa cards, so thank you. Thanks for all you do. Thank you.

Thanks for the opportunity to come on. Not a problem. James Murphy, VP Global Head of Risk and Identity Solutions at Visa here talking about the evolution of AI enabled technology and how it's unfortunately enabling the bad guys as well as the good guys.

We're gonna take a break. We'll be back on tech drunk TV in a bit.