Jonathan Edwards on How AI Is Fueling a Surge in Retail Fraud This Holiday Season

Hey guys. Thanks for the throw. We're here with Jonathan Edwards, who's managing director for Key Data Cyber, and we're having a little chat about, well, the impact AI is having on fraud during the holiday season because it looks like there's been a sharp uptake, which means the bad guys are getting smarter about how to use the latest and greatest tech.

Jonathan, welcome to the show. Hey, well thank you. Thank you for having me.

So what is the impact of all of this? There's always been fraud as long as anybody can remember, and it probably got worse with the advent of online, but now we're entering the age of ai. So what are you seeing?

Yeah, you know, it's, uh, it's really twofold. One, it's, uh, from the consumer side, but uh, also from the retail side, right? Uh, you have, uh, you have more and more, uh, people utilizing AI to, to gain access.

And if you're looking at it from a consumer side, you've always had kind of phishing attacks and all those things to gain access into accounts. But, uh, you know, what you're seeing is a lot of, uh, deep fakes or even trying to steal people's phones and, and then gaining, or at least a sim card and gaining access, uh, into, into people's accounts, and then therefore going out and purchasing, uh, mass amounts of, of product, um, through their accounts. And on the retail side, uh, you have organizations that are basically going out and, uh, also doing deep fakes and, and acting as if they are executives or leadership and, and asking them to do things that they normally wouldn't do.

Uh, and you're seeing people kind of take advantage, uh, of those things as well. So coming into the store, say, Hey, I was, uh, was brought to you by, uh, an executive. They told me to do this.

Here's, uh, here's a message. Um, and or, uh, doing it through, through e-commerce sites as well. So definitely seeing a mass, uh, in uptake of kind of ai, generally ai, but also just regular kind of, uh, fraud in general.

So, mm-hmm. Is there something that retailers are doing to thwart these attacks, or are they just kind of sucking it up as, you know, the cost of doing business? Uh, I think it's a combination of the two, right?

I think anytime you're looking at security, there's always a risk mitigation aspect of it. It's okay if I don't do a, B, C, I may have to pay, you know, 1, 2, 3, or something along those lines. And, uh, sometimes you have people who are a little bit, uh, you know, on the side of, Hey, I'm, I, I'm worth that risk, right?

I'm not a big name, so I'll take that risk. Uh, but then you have other organizations that are, you know, in the forefront of it that are building their own AI solutions to com combat other, other bots. Uh, but you're also seeing them implement more security, uh, structure.

So sometimes it can be perceived as adding more friction, but uh, you need to add friction sometimes to make sure that people are, are protected. So you're seeing a combination of the two. I would say the majority of organizations today are not utilizing AI enough or even utilizing solutions enough to, to protect their customers and organization.

Mm-hmm. And how would that work and what's involved in putting that together? Because to your point, the alternative seems to be, you know, I gotta put in, you know, five, six factor authentication and nobody will put up with that and they barely tolerate two as it is.

So what is AI gonna be able to do for folks who in the retail side to kinda identify these issues in a way that customers won't reject? Yeah, It's a great question. That's always kind of, I would say it's the $50 million question everybody's trying to figure out.

And the reality is, is data. You've gotta be able to, to determine trends, you've gotta be able to identify, uh, if somebody is in a geolocation that they haven't been before, okay, maybe that's a reason that they, you should prompt them for multi-factor authentications. An example.

Uh, or maybe they're purchasing things that just don't seem, um, you know, kind of the norm, uh, of what they usually do. So really just building kind of, uh, kind of patterns around a specific consumer, but even taking to a bigger scale and saying, well, if I'm going to this store and all of a sudden I see an uptick of a bunch of people going in and spending a lot of money in the store, there might be something that we may wanna look at and, and use that as a, as a trigger to, um, uh, to authenticator, to revalidate that the user is who they're, um, but it's, it goes the same thing, even from a product perspective. If you have, I mean, bracketing is, is pretty popular where you go and you buy every single size of a, of a, of a, of a shirt as an example, and the ones that don't sell, you try to return, you return them, right?

So it may not not seem like a big deal to a lot of people that costs a lot of money for, for companies 'cause they have to produce those products and then all of a sudden you've get, you get overwhelmed with, uh, with returns. Uh, so, so yeah, I mean it's, it's, it's a combination of a lot of things, but to me it's really about, you know, identifying the consumers, identifying trends at, at the store level, uh, and then building policies around that. There's no perfect solution today, but uh, you know, starting it out in a way that, you know, you consume the data that's out there and available is probably the best way to do it.

Mm-hmm. Do you think consumers are getting a little more wary of where they're shopping and they're kind of narrowing their shopping to places what they perceive have, uh, better security and it's gonna be tougher for smaller companies that don't have that level of security to kinda give that level of assurance? So over time, are we gonna see some changes in behavior because, well, I may not ultimately lose money, I got other things to do in my life besides sorting out all the fraud that somebody perpetrated using my card or whatever it is.

I would like to answer that question, yes, but the reality is no. Uh, the fact is, is people don't like friction and they're gonna go with simple. They're gonna click on the link from Instagram, don't care where it's from, they click, oh, I really like that, let me go there.

They don't check anything. Don't even look to see if it's a a secure website or not, right? They, they just click on links.

So generally I would say no. The answer, the consumers are not educating themselves. They're, I think we do a poor job in, in cybersecurity to educate, uh, people in general.

Uh, but we definitely do a bad job, uh, on the consumer side. So I would say no. But there are, I mean there is, uh, I would say maybe a little bit of an uptick of people who have gone through, uh, the burden of trying to fix credit or fix, uh, some of these things that happen whenever, whenever your identity is stolen.

So generally, no, but maybe a little bit. Are the, the banks and the credit card companies getting tougher about all this and are they gonna put in the measures that will ultimately force all the behave better, Better? Again, I'll answer the same way.

I would love to say yes, but again, they, they're, they're money hungry, they're coin operated, so they want, they want access to as much money as possible. Um, you know, they are putting, they are putting some policies in place and there're making some things a little bit more difficult. Uh, but you have now you've got, you know, buy now pay later, right?

So that to me is a very difficult thing for, uh, a credit card company to be able to enforce anything. Anybody can go buy it now and then if you don't really validate that that person is who they are, you're never gonna get paid. You're never gonna get paid later.

So there are things that are, are happening that, that actually I think cause uh, more attacks, um, because, you know, they want, they want people to spend more money. Um, but yes, I mean, generally everybody's, every company is trying to put more, uh, more things in place. But I go back to my earlier statement is customers want less friction, right?

So, uh, there's a reason why Amazon does really well is because they, they have everything you want. You don't have to go to 50 different places to find it. Um, and it's pretty easy to sign in to validate who you are.

Unfortunately, a lot of organizations haven't caught up to that and therefore they're, they're struggling, right? So who is waking up in the morning and saying, we gotta do something about this? 'cause it kind of sounds like everybody involved is pretty much struggling.

Uh, it's the, it's, it's the finance department. Uh, primarily it's the, I would say the senior executives, the CEOs, the CFOs are probably the ones who are, you know, awake at night. 'cause they're the ones who are, uh, tied to both top line and bottom line.

Um, you know, obviously the security teams are always, that's their job is to, is to enforce security. But tho I would say those are the three people who are, uh, probably not sleeping this holiday season. Um, and I mean, you, the people who are only focused on revenue, they're great.

They're like, Hey, we're close with all the revenue we're bringing in. But the people who are really focused on, you know, signing that, signing over those invoices or having to pay the insurance premiums or, uh, you know, have to deal with, uh, any kind of litigation, those are the people who are definitely not sleeping. And to your point about that, does all this fraud eventually just get hidden or the cost of it gets hidden in the price of the goods?

Because, well the retailers ultimately will decide that, you know, we're gonna pass that cost along and we'll just share it among all the buyers and um, you know, the next thing you know, we're kind of all paying for it. I, I think so. Um, I think if you look at just the history of retail stores, it's always been kind of baked into the cost of the goods at the store.

Uh, there's always loss prevention. There's always kind of, Hey, we, we just assume we're gonna lose 2% of our, of our stock. That number is gonna go up and that's definitely gonna be a cost that is passed on to the consumer.

Um, it's definitely, yeah, so definitely gonna be passed on. It's gonna cause more and more strife. And I think then you'll start seeing the question, you know, why are my, why are my prices going up?

And then you'll get, well, it's because you're not doing 50 things that we're asking you to do to protect, uh, to protect us. And so, yeah, I see there's probably like a little, a bit of a, uh, curve where there will be a spike of, uh, this being pushed onto to the consumer and then there'll be other avenues maybe through like blockchain or other ways that will, that'll kind of balance out that, that increase. Mm-hmm.

What are law enforcement folks doing about any and all of this? I mean, from their perspective, I'm sure they would like to catch a few of these people, but it seems like a, it might be pretty hard and b um, I guess it has to reach some level of threshold before they're gonna go after it, right? Yeah, I think, you know, you look at like all the target as an example, but Target is always kind of, I thought very interesting is they've always been, Hey, you can, you can steal up to X amount and they don't really care.

But they would, they would track you and they would learn about you and they'd say they see this person come in over time and, and when it, when it got to a level, and I don't know if they still do this, but if it gets to a level that is a substantial, then they start to call the police. And I, and I think you're starting to see that the law enforcement do that as well. It's, it's all about, listen, we understand it's gonna happen.

We're gonna track people and once it starts building to a certain level, um, of fraud or, or theft, then, then we'll come after you. Right? And, and they're trying to, they're trying to figure out the networks.

'cause it's not just one person, it's just not 14-year-old in the, in the basement trying to steal. It's, I mean there, there are organizations that have a massive amount of people who are going out and doing this, and I think they're trying to find ways that they can make it difficult for them, uh, but also how to be cracked out on in those larger organizations. So yeah, you're looking at like, kind of like the FBI, like, they're definitely investing a lot in, in fraud prevention and detection, um, versus, you know, kind of local and local law enforcement, not really as much.

Mm-hmm. So just how organized are these rings? Because, you know, we've seen and heard about them over the years, but, uh, are they global now?

I mean, how far does this go? Yeah, I mean, you see, you see both, you see a lot of regional and, and global, I would say they're becoming more global. They're very sophisticated and they are unified.

I mean, you just look at things like, I remember the flash dances and stuff like that that happened on, uh, on Instagram and TikTok, but people, people would get together, they would go, they'd all uni and do something. And the same thing happens in these type of attacks is, uh, they have, they have a plan, they have a strategy, they go after it, and then they disappear and they all come back up a few months later and they go do it again. Uh, so these, these type A strains have been planned out for months.

Alright, so what's your best advice to folks who are trying to thwart these attacks? What should they be doing that's within reasonable cost structure? Because I think a lot of people are trying to always balance the cost versus security equation, but, um, you know, what do you wish folks were doing?

Yeah, just a couple. I mean, be vigilant. I mean, just be aware of, of what you're clicking on.

The links are the or, or the enemy. Like if you get a link from anybody, just, just don't click on it. If, uh, you know, you get, you get a weird phone call or an email or something and they say, Hey, you know, Val, click on this link to validate or whatever.

I mean, go to the website, call, call them directly. It's much better to do that, especially around this time of year. It's safer.

Um, I mean, simple things, passwords, right? Uh, keeping very difficult passwords to, to remember. I mean, use a password manager if you have to, to, you know, have very sophisticated and passwords, don't use the same password across websites.

Um, yeah. And I would say, you know, if, if something just seems off, assume it's, it's better to go find another place to purchase something, uh, then we simply, you feel uncomfortable. It's too good to be true.

It probably is. Hey folks, it's just like shopping in real life. If you went to some part of town where it felt a little sketchy, you might take your wallet, put it in your front pocket and do all kinds of things.

It'd be extra secure just in case. Well, turns out the internet and e-commerce and a lot of these sites, they're sketchy. So be careful out there.

Hey Jonathan, thanks for being on the show. Yeah, thanks for having me. Appreciate it.

All right. And back to you guys and the student.