Navigating the Complex World of Identity Verification and Fraud Prevention with Josh Read

You know, too much information can be a bad thing and too little information is a bad thing because people will fill the gaps. So I think there's a balance that we need. People need to be informed, they need to feel secure about what they're doing and why they're doing it, they need to be valued, but then there's sometimes information that's just unnecessary.

Josh Reid, welcome to The Mentor List.

Thank you, thanks for having me.

Great to get you in the studio. So Josh is the Chief Operating Officer at IDverse, so really looking forward to finding out how you ended up in this industry, in this business. So maybe Josh, just give us a little bit of a, um, sort of a background, and then we can get an understanding for some of the some of the things you're involved in. So I'm looking forward to digging into that.

So, okay, yeah, sure. Um, started out work life in telecommunications technology, IT&T, uh, very much in terms of consultancy around telecommunications, and that sort of led me through a number of technology companies. Uh, from Telstra then sort of branched more into looking after the banks and got into more of the financial technology through KPMG. And that sort of fast-tracked me through to Vida Equifax, where I had various roles. But one of the roles I had there in particular was looking after the fraud and identity portfolio.

Right.

In that space. And we had technologies that helped people identify themselves through data matching at that point in time. And it's through that process that one, I got to know the IdiVerse team. I negotiated a partnership with them for Equifax at the time. Leaving Equifax after 8 years, I then went through a startup that I helped scale up, a group called Yellowfin BI.

And just on Equifax, so for those that aren't familiar with, I guess, what they do and how big they are, do you want to just give a quick—

Yeah, sure. So Equifax is a multinational, big multi-billion dollar business in data out of the US, and they've expanded over the last sort of 20 years into other countries and regions, predominantly they run credit bureaus. So these are large databases that monitor people's credit rating.

Yeah.

And so when people apply for credit, they'll access that database in the country to see what your credit rating is. And then a range of other things such as, are you fraudulent? Are you who you say you are? And are you a good bet for me to loan money to? And then Equifax bought Vida, which was the Australian credit bureau. And that got absorbed into the Equifax business.

So effectively, if I don't pay AGL or Yarra Valley Water on time, does that go into a score or—

It does.

Yeah. Yeah.

In a short version. So usually you have to be well past due for it to be an adverse impact to your score. What came into play a couple of years ago in Australia was comprehensive credit reporting, which is both the positive side of things. Which is significant more data from a data point. So that's all of your payments on time. So if you have a credit facility, you make payments on time, then that goes in and that's a higher indicator of someone who's got a better ability to maintain their credit. So a negative is I missed a payment or defaulted and they're bad. But with comprehensive, the positive side of things, there's much more information available.

Just add a quick point. Pure curiosity. Someone once told me that if you have an Amex card or a Visa card and you pay it over so it's in the negative or in the positive, sorry, it games the system so you get a better Equifax score and you can get more money from Macquarie or whoever.

I don't know about that. I think certainly if you are a good payer, you know, within reasonable time, on time all the time. I mean, if you have a mortgage and you pay that off every month, then You're going to have a great credit score.

And if you don't have a credit card or things like that, then you kind of get out of the market with having a score, or is that—

Well, that's an interesting thing. I mean, that's talking about people inclusion for people that may not necessarily— the non-banked part of society or young people. And how do you get a credit score to start with? So, you know, there's a point there that you need to sort of start. So taking out, you know, personal loans, opening bank accounts and so forth, is, you know, obviously a good way to start your journey. But that's why often it's quite difficult for younger people to get access to credit.

And speaking of journey, I'll take you on a tangent. But we're— so I've gone through telco, now you're working at Equifax, and you just mentioned Yellowfin. So let's keep going on your journey.

Yeah, so look, I guess the journey started way back in telecommunications, a company called Lanes, and that was a large consultancy group here in Australia. They were acquired by Ericsson Australia and joined that group, and that actually brought me to Melbourne. Uh, and that journey then traveled through Dimension Data and eventually at Telstra. At Telstra, I was looking after the National Australia Bank accounts, and which was a brilliant time with Telstra, and we renegotiated a new master partner agreement with them for a couple of billion dollars. That led me through KPMG and then into Veda and Equifax as we spoke. 8 years with Equifax. At the end when I left Equifax, I was responsible for the Australian Credit Bureau.

Wow.

The fraud and identity business, the partnerships business, and I was also managing the integration of our acquisitions. So it was a fairly large portfolio. We looked to consolidate that and I had an opportunity externally with Yellowfin, which was a great Australian sort of success story. It was a business intelligence business. Looking to scale up. They'd been in business for about 18 years. They had close to 40,000 corporate clients around the world. It was embedded technology. And so we scaled that up over about a 2-year period with a very successful exit. Um, found myself on gardening leave for a little while, which was really enjoyable after that period of time. And when I was at Equifax, I negotiated the partnership agreement with OCR Labs, which then rebranded to IDverse. And I got to know John Myers, Matt and Dan, the founders, John Myers, the CEO, really well, and they're amazing teams. So fortunately, they just finished their Series B funding and John asked if I could come and join, and it's been a 24-month journey. We had 50 people when I joined, we've now got close to 200. We're in the US, UK, Middle East. In Australia, we have about 70-80% of the financial services market for our capabilities and certainly a dominant player here. And we're seeing that really pick up through Europe, UK, and America.

Wow. And so I know Adrian Critchlow, your group chair, as you're a member here at Mastermind, he'll be asking you about your Series C round. Is that still going or?

It's been the longest funding cycle I think I've ever been involved with. It actually genuinely is closing in the next few days. So John's in town at the moment. We were just having a chat before and it's likely to close in the next couple of days. And I look forward to calling Adrian and saying it's finally done.

Well, by the time we get this one to air, you'll be flushed with cash and onto your next strategic initiative.

Let's hope, yep.

So thank you. That sort of sets the scene around identity and maybe, so you've sort of talking about a couple of different companies there, telco, you know, prof services, banking, quite a, I mean, probably the industries where identity is crucial. Although when I say that, I don't know if there's an industry that isn't crucial. But maybe tell us about the identity industry. Is it growing? Is it—

Yeah, I think that's really important to understand and differentiate. So traditionally what we've done with the old 100-point data check that I think most people are familiar with, uh, is we check people's data credentials— name, date of birth, street address, driver's license, passport— and we sort of type that data in and it gets checked against a government database or a database from, say, one of the data providers like Equifax or Illion and so forth. And that was sufficient in the past for the services being provided, but the problem we've got is twofold. One, we've had significant breaches in Australia Medibank Private, Optus. There was the eScripts one as well that occurred and others. So that meant that 19 million people's data associated with their identity is out there on the dark web for acquisition.

So 19 million people globally or 19 million in Australia? There's only 20-odd million people. Like, so everybody's data.

Whether it's 19, 15, or 20, I don't know. But I know that the majority of all adults' data is out there. Yeah, right, from those, from those breaches. So then you couple that with the rise in artificial intelligence and deepfake creation. So we have deepfake videos where people can then mimic the liveness of someone else, and so you need technologies to be able to pick up on that. You might have seen there was one recently where a group did a deepfake pretending to be the CEO and actually asked the CFO via a Zoom— I think it was a Zoom link— to transfer $25 million to a bank account.

Yeah.

Which they did, and it was gone, lost, right? So that's concerning. And then the second thing we're seeing is the creation of deepfake documentation. So this is taking those credentials that are exposed, turning it into a real or digitized identity document, and then providing that as proof of identity.

Right.

Okay. So you're seeing organisations, those that are regulated like the financial institutions and others that are particularly exposed to fraud, they are providing services or they're lending money or selling cars to people that are providing these false documentation and using deepfake technologies to mimic others. So the key point there with, with what we do is we scan the document. So a link is sent to the customer by our service provider to your mobile phone. You then use the mobile phone technology to scan the document, right? And what's happening at that point in time is, uh, you're actually— we're actually looking at the document from a document fraud analysis point of view. So we can see the document is genuine and it was issued by the government. The second thing we're doing in the next stage is actually videoing that process. So then we start using our deepfake prevention technologies. I'm taking 100 frames a second in that process, 2 or 3 seconds. I've got 200 to 300 frames of that documentation. I can see the blood flowing through the person's hand. I can see microexpressions occurring on that hand. And I'm also looking at the document and using our deep document fraud analysis to ensure the document is genuine. So this is the first part of our flow.

When you say you, you're referring to a technology, or do you have actual—

Our technologies.

Yeah, this is what I do. Picking these things up.

Yeah, so that's the first 2 parts of our engines. You've got an optical character recognition engine and you've got a document fraud analysis engine, and that's the first 2 components in our flow.

And is it still 100 points? So if I go and get I don't know, a new mobile phone? Is it just 100 points that they want, but now they're validating it better?

So 100 points has been changed, you know, it's now different aspects of that. But it has traditionally been, you know, sufficient for KYC to use a data check. But the problem with that is with these deepfakes coming through, you can no longer rely on the actual data. So what we're seeing is a shift in the legislation, and the government's certainly leading the way, and a lot of the Big Four consultants are sort of heading down this way, is that it's likely that next year it'll be no longer sufficient to use the data to confirm someone's identity. So for a KYC process, know your customer, it is likely that next year you will need to do some form of additional identification such as a biometric. So that'll have a massive impact on those providers in the industry that are just relying purely on data checks.

And there's a biometric, um, can you explain what biometric is?

Certainly. I mean, that's the second part of the flow. So in the second part of the flow, you then do a selfie video, and in that selfie video, um, you're doing 2 things. Firstly, you're confirming that the person is live and present. So again, I'm taking hundreds of frames per second. I can see that people's Blood is flowing, microexpressions. I can see all of the geometry of the room using computer vision. So I'm saying that that is an accurate and correct image. I can see whether it's a deepfake or not by things like pixelation and other technologies to confirm it's actually a real image and it's not a deepfake injection. And then ultimately I have a biometric engine that we've trained using generative AI. And the benefit of that is we've managed to remove bias as much as possible from that, that engine. So anyone, race, color, creed, background, age, all pass through our biometric environment. And in test conditions, it's shown to have almost no bias, which is a very, very difficult thing to do.

So if I was manually doing it as a human being, I'd have my— okay, but I'd bring a bias in and I might racial profile for whatever reason.

Oh, so there's 2 parts to it. So the problem is that by generating the images that we train the engine on, Yeah. I can have a complete sample set, right, of any color, race, color, and creed. When you actually train an engine using real images, you've got 2 issues. Your sample will be biased, therefore you end up with a biased engine, right? So a society that's predominantly white is going to have a white sample, you know, similar in the opposite areas. So you will have bias in those, in those databases, in the engine. The other problem you've got is, were those images ethically sourced? Did you give permission for my image to be used in the training of your engine? So none of my people in that circumstance that we're training the engine on actually exist. But it also means that we inherently know what deepfakes are going to look like.

Right. It makes me think of ANZ Bank, and I'm not sure what the other banks do, but when I use their banking platform, I've got to ring up and then I've got to confirm with my voice. I've always thought that was pretty high-tech. Now, uh, so is that obsolete now? Are they— would they be worried that I could—

So in the middle of my career, uh, where I was in voice biometrics, uh, and actually implemented a similar service into National Australia Bank, and the team that were at National Australia Bank then went to ANZ and implemented that technology there. And certainly at the time that it was put in Brilliant technology. But now with the deepfake capabilities, it is possible to mimic people's voice. So it would be potential, and I'm sure ANZ are doing other things. I'm also an ANZ customer and they're also a customer of Id-Vers for their originations. A great bank, very, very technology and security focused. But yeah, it would be interesting to know how secure that now is.

Yeah, because my understanding is you can get— I could call you, you could not answer, and I can record your voicemail, which will give me a profile of your voice, which I can go and get an online SaaS offering, not even on the dark web, which we'll get to. And I can create an avatar of your voice and call your wife and tell her you're coming home late.

Well, I think in that on its own, it probably wouldn't be secure enough. But don't forget, you already had to log into your accounts before you chose to do something that then has another layer.

Right.

So, with all these things, you're having multiple layers of technology. So, you would have had to get through the account to start with before you could then do that. So, I think it's always important to understand in fraud prevention that there's layers in the prevention process. So, you wouldn't just use one thing on its own. Our process is obviously multi-layered. It's out-of-band. It's using different stages in terms of the document, the deal 2FA, the liveness, and the biometric. It's sent from a secure point by the, by the, uh, the customer, say ANZ, who do use IDverse for their mortgages in the, in the core bank. Um, but similarly in a call centre, right? So I could call a call centre up and, and, you know, mimic your, your image if you're doing a video call, or, uh, the voice call as well. So if you were calling the call centre and you relied purely on a voice biometric to authenticate yourself, Then that would be concerning.

Oh my God. Okay. All right, so let's talk about, you mentioned KYC, which was obviously, I feel like that was born out of regulation and maybe you have a perspective on that. But what's happening with regulation and legislation? Who's actually responsible for having the dataset that can't be breached or that is right. If Medibank's now been put out there and is no longer reliable, are there other examples you're seeing in other countries where people are standing up the government, for example? And I don't know, where do we—

where's this going? Yeah, I mean, you see different circumstances. So the Australian government has its Document Verification Service, DVS, and it also has a facial verification service as well, which is not yet available external to government. Biometric databases is certainly one area that's quite prevalent, but you also create, I guess, what we call a honeypot. And that's not my area of expertise, but in that sense— but so governments are doing that, and we're working with, you know, governments like the Indonesian government, for example, has a great central biometric database that enables them to accurately identify their people. I think the fundamental point is that you can no longer rely on those data components to identify someone. You must also use additional things, such as our biometric flow, to confirm that the person is live and present at that point in time and that they actually match the credentials that they're putting forward as their government identification document.

Right.

Otherwise, you're just confirming that someone somewhere in the world with those attributes exists. But not necessarily the person that's transacting right now.

Yeah, I recently did a— I assume this is a form of biometrics, the Ancestry DNA where you spit in a cup and then they make you sign a release.

Did you see the little note down the bottom saying they now own your DNA?

Well, yeah. Would you like us to dispose of it? And I thought, I think I ticked no. So which might make you squirm a little bit or I don't know, like, is that just As you say, a honeypot. But I mean, imagine that gets breached and everybody's DNA or—

Yeah, I mean, that's a different area. And I guess the ethics regarding that is if that, if your DNA sample has indicators of, you know, health issues and whatever else, and then someone else accesses that information to decide whether or not they'll give you a life insurance policy, you know, that's always been a An ethical dilemma, but that's way outside of my realm.

Fantastic. Fantastic. Okay, maybe we can talk about some of the pinnacle strategy at IDverse and maybe sort of looking at sort of into data sharing and where does the actual exposure come from? Is it something that's sitting there or is it in the cross-sending of information? Maybe if you could—

Well, I think let's look at what we're trying to do with some of the changes in the legislation. So at a very high level, you've got TDIF, Trusted Digital Identity Framework, with IP1, IP2, IP3. They're different levels of security and usage and certification. IDverse is the— at the highest level of IP3 certification. And in a very general sense, that suggests that an organisation using our process to identify someone correctly and accurately and that they're live and present, can then redact all of the PII data, the personal identifying information, from that process, from that certificate, so that all you have is effectively that I was identified correctly and they have some sort of reference number.

Yeah.

The actual information can be redacted, the images can be redacted, and theoretically that means I've now met my compliance. But we do have some conflicting legislation coming from AUSTRAC around the KYC/AML, anti-money laundering, counter-terrorism funding, that says that those images and that information needs to be stored for an extended period of time for them to meet their compliance.

So 7 years or something?

Yeah. So we have some conflicts, you know, in our legislation, and therefore that creates the confusion. So an organisation theoretically that needs to retain that information for their current customers therefore has to store that somewhere. And if you don't have your security in place, you end up with an Optus and a Medibank type circumstance.

Yeah, because I— so if I'm going to go and get $100 grand from— we'll pick another bank because we are maybe Macquarie and they've done my—

Another great client of ours.

Great. $100 point check. that I've done the live video to them and your technology said that, yes, this is Dave and his documents are not fake. And that's referenced against your sources. But now they have to hold my date of birth, passport number, and all these things because I've made a loan application for 7 years.

Hmm.

Which, yeah, I just feel like an executive sitting on Macquarie Bank who has a Who becomes responsible if that data ever gets breached or sent out? It feels like, you know, what are the— data is the new asbestos. Is that kind of— is that the ticking time bomb?

Well, I mean, we've seen, you know, some massive fines for breaches in AML standards. There was the commercial one with Commonwealth Bank that was in the hundreds of millions of dollars of fines. We've seen you know, Westpac, and I think they've all been, been hit with, uh, with AUSTRAC fines, um, for not meeting compliance. So there's certainly a huge concern, and there's no doubt that, you know, AUSTRAC takes it very seriously with the massive fines that they do hand out. And it's important that we do prevent money laundering and the illicit use of funds for, for bad things, because it is used for very bad things. But we also need to find a way to protect our clients personal data. We also need to ensure that the person we're actually dealing with is who they say they are and they're real and live and present and match their credentials. And we need to do this in a user-friendly way, and we need to do it in a way that the person controls and maintains their identity so that you're not giving that up.

Yeah.

Which is, I guess, coined self-sovereign identity, you know, is a term that people use. So using technologies, using mobile technologies, using technologies such as ours helps to facilitate We don't complete the KYC process. There's other attributes are part of that process, but we certainly ensure that through that KYC process that the person that you are onboarding or giving services to is real, genuine, live, and present. So you establish that highest level of trust from which services flow.

Got it. And so effectively in that scenario, we could just rely on you to say that you've— IDverse has validated that it's real and therefore we can burn or dispose of this sensitive personal information. But yeah, we have to hold it for 6 years.

Yeah, look, theoretically, so if we jump onto the current legislation that's been debated regarding the restriction of access to social media for under-16s, yeah, there's 2 views on age. There's age estimation and age verification. Now we focus very much on verification, so we will verify that that person's date of birth is beyond the limit, so they are 16 or above. We'll do that by matching them against their identity documents. But in that circumstance, the other part of that legislation is none of that data should then go to the social media business. So what we will do is we'll go through our flow, A link will be sent to their mobile phone. They'll go through the flow and identify themselves. And then what we can do is say, this person, we have validated that they are 16 or older.

Right.

We won't tell the media company their actual date of birth. We won't tell them any of the details about who they are and what they are, only that the person opening the account is matching the account credentials and that they are of age. The second part of that is what we call face access, which is the ability to then come back and use a quick selfie, not the technology on your phone, back to the core engines and revalidate that you are who you say you are with kind of a 3-second selfie. Again, that's at the highest level of security and authentication, but it means we may well have circumstances on those social media accounts where mum and dad opens the accounts, they're of age, and then, you know, the child under 16 uses that account.

Yeah.

The question we need to ask ourselves is, do we care? I think we should care. about that, because if you bring in legislation to protect our children, then you want to continue to ensure that they're not gaming the system. So therefore, you want to enrol the child, 16-year-old, they get access to services they should. If they're not 16, they should be restricted and obviously not get access to it. So when they come back to log in, they don't use mum and dad's password, they have to do a quick validation.

Validation.

And it'll say, yeah, okay, that's John, He's 17 and it's okay for him to have access to this account and that's his account that he's accessing.

It's interesting actually. I'm sort of getting the theme that there's a continuous validation and a multi-factor validation strategy that's at play and sounds quite— it sounds a bit like almost an art form. It's not just the initial upfront validation. If we take that very simple $100 grand from Macquarie loan application. If you thought about the use case that you just sort of went through there, it's like, okay, at a point in time I was good to borrow the $100 grand. So I've been validated. It's me. Here's my financials. Here's my position at a point in time. And then we talked about the parent could come in and things change, then the kid's using the system. But in 6 months' time, maybe I'm not Good for the 100 grand.

Well, I mean, that's part of responsible lending, right? So the account management of someone who's taken a loan out that you need to continue to ensure that that was, you know, that they are fit or you were fit to give them a loan. So you end up with a responsible lending obligation there to ensure that they can continue to service the loan and they're not in hardship. And there's a whole regime around that. In terms of people coming back and accessing services, So if I come back into my app and again I use the same authentication process, now that biometric is not being stored as your image. That biometric is being stored as a hash string, if you like, and that can't be reconstituted back into you in any way. You couldn't steal it if you tried, but if you did, you wouldn't be able to do anything with it. So very important to understand that that technology is very, very secure. But the convenience of it is you are again at the highest level of trust confirming that that person is who they say they are in a very convenient way. I haven't had to go through that full onboarding cycle, which again is only 30, 40, 50 seconds, but now you're doing it in 3 seconds. So when I come back into my institution, let's say it is the bank, and I call the call centre and I say, oh look, I want to open up a new service. So instead of that call centre agent then having to go through a whole lot of wallet questions, which they do at the moment. And we know with the breaches and social engineering, most people can get through that. Uh, I think one of our, uh, members of the mentor list, uh, the head of security at NBN, you had on the other week.

Yeah, Darren.

Darren.

Yeah.

And he talked about scattered spider attacks, which was great, um, because that's a perfect example. And thank you, Darren, because I wrote a paper on that about 10 seconds afterwards. But, uh, So using that social engineering to hack the call center, uh, and, uh, the way that we can prevent that is you simply come in and say, I'd like to do this service. No problem, I'll send you a link to your mobile phone, do the authentication. Great, Josh, how can I help you? And there's no way of getting around it.

Okay. Okay.

Similar to that with opening an application, you go into your app. Okay, I've authenticated and I can access my services. I can transfer funds, I can change my PII data such mobile phone numbers and email addresses without concern of account takeovers and so forth.

And how is it sort of, for example, you mentioned sort of no way of getting around it, which is fantastic. So there's sort of like this, is there a balancing scale or do they kind of just coexist around convenience versus security? Is security highly inconvenient to get to the nth degree that this is true versus, you know, don't worry about it, just flow through?

Just talking about the balance of of friction in fraud prevention and the balance with sales. And often sales will say, you're creating too much friction in the process, the person's walking out. You know, classic is a mobile phone store, Vodafone, Telstra, Optus, right?

Yeah.

And the sales team is getting commission based on the number of new accounts that sign up and the number of handsets, particularly in Australia where we do postpaid, policies, which include handsets that are often, you know, thousands of dollars, you do need to go through a credit check and so forth. But they will do fairly light checks in the past. So they might take a copy of your driver's license or something like that.

Yeah, remember that.

Yeah. So the point there is that with deepfake, all those driver's licenses are fake and you've got teams of people going around cleaning up these devices. Vodafone TPG is a very good client of ours. And so they also had that conundrum of the friction between sales and the fraud department. But they've sort of since come to an understanding.

Give me another example, Josh. Like, I'm trying to think of the rationale. Maybe this is my— maybe I don't have the criminal mastermind developed yet, but I'm going to go get a phone which is $50 a month. I'm going to do it with a fake account. But if I'm not going to pay the account, then they're just going to switch it off anyway.

Yeah, but I've taken a mobile phone with me.

Oh, you get it.

Yeah, it's not about the account, it's about the $2,000 brand new Apple phone.

Okay.

Yeah, that's now shipped offshore.

Which is now the secondhand market. Yes, exactly right. Yeah, yeah.

And they go and get 20, 30, 40 of these at a time. Or they do it online, right? Because you can do it online as well, right?

Got it. Okay, thank you.

So our process will prevent that online or in the store. But yeah, finding that balance. So if the sales team is also held accountable for the fraud and the losses, and that gets taken off the sales number, then all of everyone's in the same game together, right?

Yeah.

So if I'm a salesperson, I don't want to waste my time with a fraudster online or in the store knowing that if that phone actually gets stolen, then that's going to come off my sale.

Yeah.

Yep. So then it becomes a joint game of, okay, well, I need to identify you so that we can go through this process because if it's a genuine person, I've got a genuine sale and I'm going to get my commission.

Yeah. Yeah, that's a good example of an incentive program. Yeah. Being recalibrated.

Well, I think in the past we built in losses into the product costs. Okay. Certainly with lending and other products. When the fraud goes exponential from things such as deepfake enabling it, all of a sudden it becomes cost prohibitive to do so. So you need to prevent that fraud at that point of sale.

Yeah.

The second thing from a competitive advantage, and I was talking to a lot of the auto finance people Last night we had an Equifax Christmas party that I was fortunate to be invited to, which was great. I was talking to a lot of the auto finance guys and, you know, a car stolen's $50,000, $100,000, $200,000, right?

Yeah.

So it's a big deal for them.

Yeah.

So the convenience of confirming someone's identity online or in the dealership as part of that process means, you know, an AMG Mercedes worth $300,000 doesn't get driven off down the street.

Wow.

So it's massive for them.

So just maybe changing, we're talking about sort of real life examples, physically going to stores, whether it's a car or a phone.

Well, online's the massive part, right?

Well, maybe tell us about online. Yeah. Idea of the dark web.

Well, I think we can bring the two together. So even if you go into a branch or a dealership and you have your credentials, the fact that they probably are generated by AI, a human can't actually pick up that their fake documents. That's the problem, right?

So they're that good? Yeah.

And same thing in the brokerage space as well. NextGen's a big customer of ours across their broker network, and they use our technologies to help with all the mortgages and so forth. So you've got that issue there. And, you know, the broker that's sitting in Newcastle on the corner that knows the couple that's going to come in and refinance their house, that they have dinner with on a Friday night at the RSL club, they're like, why do I need to do this? Well, you know, it meets compliance. But for the person that that they've never met before, you're preventing a fraud circumstance. Online, different circumstance. You can't actually meet the people. And some of the fraud that we see coming through, because we're obviously recording all of this now, the data is all owned by the company that's using our products and services, and they redact it and delete it and so forth under their control. But when we have genuine cases of fraud, we do review that and feed that data back into the engines. It's a, it's a learning environment. Some of the things you see of what people are doing is quite crazy. I mean, it's quite obvious that, you know, they're holding a piece of paper up or the person that they're trying to pretend to be doesn't even remotely match them. Or where it's a bit more concerning is when they start holding it up in front of elderly people's faces who don't actually realize that they're using their likeness to take out services in their name.

Oh, wow. Yeah. So preventing—

deceiving handicapped elderly people and so forth, you know, it's It's quite concerning. So there's prevention in that space as well. But with the online side of things, you know, for a few hundred dollars you can get a fake document created. Human eye will not pick up that that's a false passport or a false driver's license.

Where would you go to get— sorry, my curiosity, like, why are you asking? But like, for a few hundred dollars, what, like, do we— are we Googling Fake identity and their suppliers online?

Yeah.

Oh my God.

Yeah, they literally are.

Yeah.

Yep, they get printed and sent to you. You just upload your, the data and, you know, your image and it's literally getting created. Wow.

Well, certainly makes it very accessible.

Oh, it's hugely accessible and it's not cost prohibitive. It's not like you're forking out thousands of dollars for these things.

Yes. Yeah. Okay. Um, so we mentioned sort of dark web. What are some of the other, uh, things that you've come across knowing that you're in this sort of field that we wouldn't be across?

Oh, look, I think the extent of, of my— I've never accessed the dark web myself, but, uh, uh, I think the, the point is that the data is available.

Yeah.

Out there for, for purchase and, and misuse. And that's the point that The data itself is exposed. It's no longer sufficient to just do a pure data check to meet certain levels of compliance. Still balance the service with what you're trying to do. You know, we're talking about taking out financial products and services, insurances, buying cars, and getting services of high value. We're not talking about perhaps access into a venue and so forth. So we've got to get the levels, but that's important as well. I think the social media bill is going to really change that. I think in the past, were we too concerned that underage people were doing certain things? Now we have the ability to prevent it. It's whether or not we have the appetite to enforce it.

And, and if I was sort of, you know, listening to this conversation and thinking I probably need to take some steps or maybe I might ask the question, Josh, what would the first thing I'd do to maybe have a bit of identity health or take control of making sure I'm secure?

Well, firstly, never ever take photographs or photocopies or scans of your identity identification documents and send them to anyone. Just on that, if you have done that, hypothetically, I would call that institution up and ask that they have destroyed those documents and so forth. But you're also going to get caught with what we talked about before, which is the need to store. So, you know, you need to ensure that that bank is looking after it. But now in our modern age, if you were taking out a new mortgage through a broker and your broker was not using technology like ours and they said, I'll just photocopy your driver's license and send it through, I would say, no, I can't do that. that or refuse to do that, you either need to use one of these services or you need to find yourself a new broker.

So I've certainly done that multiple times with multiple brokers and we all have those types of things. So now that it's already out there, I've already done these, like maybe going forward. Okay. Yeah. Josh mentioned not to do that. So in the future, picking a broker that is a bit more technically savvy.

Well, there's 2 points to that. One, they will keep you safe, but they're also keeping themselves safe. Okay, so that's, that's the combined benefit here. By adopting these technologies, not only are they meeting their compliance and preventing fraud and so forth, but they are also keeping their client base safe.

Yeah.

And you should respect organizations that have your interest at heart in keeping you safe.

And apart from sort of not, you know, not getting the information out there, any other tips? Or is there a way you could see if you have been breached or things like that?

Yeah, there are services out there that you can check and see if your data's been exposed. Certainly do that. There is also a service that we'll have to follow up on, I've forgotten the name, that can help you if you have had identity takeover and help you recover your identity. We actually provide them our services free to help recover people's identity in there.

Yeah.

So, yeah, certainly if you are breached and have your accounts taken over, there are services that can help, but it's immensely difficult once it occurs. So I highly recommend you don't let it happen.

And it feels like the onus is on the individual. Like whilst there is a law enforcement agency that you could report these types of things, it does appear that self-driven by the individual, is that—

Well, that's the difficulty, isn't it? Because if you want to get access to these products and services, you have to give up a lot of your information. If that information is then not responsibly held and it's breached in the case of Medibank and Optus, So in that circumstance, your genuine driver's license was breached. The driver's license you have in your pocket is still real. It's still you. It's still a genuine government document. So in that circumstance, the Government Document Verification Service added a flag to their service that said that this, this, this document has been breached. But they didn't indicate it had been breached. They just said it's been breached. set a no match or thing, was a DD flag. So if I go to a branch or to a bank and I apply for something and I provide my genuine document that's in your wallet and they check that against the DVS without using any of my technology, it would come back and say, sorry, no.

Yeah.

Now there's actually nothing wrong with your document, but your data, through no fault of yours, was breached by Medibank, Optus, etc.

Yeah.

DVS has now put a flag on it, says, nah, can't use it. How's that your fault?

Wow. And so you're disadvantaged now in the—

Due to someone else's breach.

Yeah.

So you now have to go down to the driver's license place, get a new driver's license issued, a whole range of things, etc. So very inconvenient for something that wasn't your fault.

Yeah.

And that's when you come back to the concept of self-sovereign identity, which is the the ability to effectively confirm that my identity is real and live and present without actually giving you any of my attributes.

Yeah, fantastic. Well, thanks, Geoff. I could certainly pepper you with curious questions all day, but maybe was there any questions that I didn't ask just before we get into some more shorter form questions?

Look, I think it's going to be an interesting year in 2025. I think it's going to be a massive year of change. We have seen a 66% increase in the use of deepfakes in the last 12 months, which has had an exponential impact. At the moment, we're doing an IDV every 3 seconds in the world, and next year we'll do—

ID verification.

ID verification, yeah, digital identification verification. So next year, I think that will go to probably 1 every second through our systems, which is, you know, massive growth for us. In Australia, we've prevented in the last 12 months $63 billion in fraud in this space, and it's only growing. So, you know, one hand there's a compliance need, but there's another hand, there's really an important need to prevent fraud through this space. So with the legislative changes, the potential changes on the AML laws, in particular with the social media age restriction I think we're going to see a massive shift next year.

And anything on the horizon around a centralized ID? One of the Scandinavian countries implemented something like that from memory. And I don't know, are there any murmurs you can—

Well, look, there's identity exchanges and the concept of the Australian government with MyID has got the centralized database. That's the DBS. And also the facial database as well. And, you know, they're continuing to refine their services. I think each of the states are also looking to implement similar services with the digital driver's licences. And there's been some, I guess, false starts in that space as the technology matures in mobile and digital driver's licences. An ISO standard is still being ratified. I think the Queensland Government in particular is following that standard as much as possible. What we need in mobile driver's license or digital IDs is the ability for one, it obviously to be secure but interoperable. And what we're finding in some of the instances that have been brought out is it's not interoperable. It doesn't necessarily have the level of security that's required. You know, there's one state in particular that in 10 steps you can actually hack it and create your own mobile driver's license. And we actually brought that to their attention. So With that coming in play and when those security standards are in place and the interoperability and the ISO standards are met, it's going to be hugely convenient for everyone, right? So we don't have to walk around with a piece of plastic in our pocket. And in that flow, what will happen is you'll do the secure handshake, you'll confirm that that's an authentic government-issued digital identity.

Yeah.

And then we'll go through a second part of our process, which is you alive and present through the video, your biometric matches the imagery on the on the digital driver's license or identity document and we'll be off and racing. It'll be very convenient and again, secure.

It's funny you mentioned the physical plastic card in your pocket. Do you still carry a wallet?

I don't. In fact, I was over in Adelaide for my father's 80th and I've left my wallet in Adelaide and I'm perfectly fine. It's all right. I did actually have my driver's license and credit card in my pocket and so that That was good and that managed to get me through. But yes, I've got a Victorian digital driver's licence that will let me pick things up from the post office, which is great. And apart from that, everything's on my mobile phone.

Well, yeah, I had just my wallet out on the table recently and someone who was 2 generations younger than me said, what's that? Why do you carry that stuff around?

What is that for? Yeah.

And anyway, I've just been curious and the more people I ask, the less people are carrying around an extra thing in their pocket for the wallet, that the phone is superseding all of that.

I think we also need to balance what we're talking about here. We're not talking about perhaps some of the things that happened in some of the retail stores recently with the biometric tracking of people and things like that. We're not talking Minority Report, right?

Yeah.

We are talking about you authenticating yourself when you want to authenticate yourself to get a service that you want to get.

Yeah.

Yeah.

Fantastic. Well, thank you, Josh. So next question is around, was there a quote or a saying or something that sort of stuck with you that you'd like to share?

Look, I think there's one I like in particular. I think it's a slight change on a George Bernard Shaw quote about the illusion that communication has occurred. I always find that and remind myself and any of the teams I'm looking after that don't assume that just because you had a conversation that everyone actually understood exactly what you were talking about. And in the current business, we operate in the US, UK, Australia, and the Middle East, and we're all speaking English. But it's really crazy sometimes you'll have a conversation and people go and do the complete opposite of what we all agreed. So to me, that one— don't assume that communication has occurred.

It's interesting, it came up at a mastermind in Brisbane this week where Malcolm, one of our chairs up there, was talking about in each level of communication. So you have a conversation with someone and they take 60%, and then they'll have a conversation with the secondary, and by the time it's to the third person, it's like less than 50% of the messages.

And it's also that you're looking at it from your lens or your point of view or your frame of mind of the conversation, and you're interpreting how you want to interpret that conversation.

That's true.

Which gets accentuated with Slack chats and everything else. So I can't even see your face when I'm in the conversation.

Oh, great, great quote. And what advice would you give to your younger self?

Don't sweat the small stuff sometimes unless that's, you know, the particular role. I think it's the other one is It's always easier or better to understand the other people's points of view and understand why they're coming at that. So, so conflict, while sometimes necessary, is not necessarily going to get the best outcome. So I think that trying to work and understand with your teams or your clients or your businesses or your family and understand their points of view, I think certainly helps in, in, in far more productive interactions than than going straight to conflict. So yeah, I think that's really important to, to really understand what it— what people mean from their point of view.

Great, thank you for sharing that. And anything you've picked up and read that you think, um, had an impact on you?

Look, I'm reading through Principles from Ray, um, and I'm finding that, uh, immensely interesting, particularly understanding, uh, all of the commodities, uh, in the early days, uh, before certainly we had you know, digital exchanges and, and so forth. So, uh, and then just understanding, I think, principles, uh, you know, your character, your principles, your values are very, very important, uh, and never more so when you're in a leadership role, uh, when you get, you get challenged on a regular basis, uh, from people's insecurities, egos, and arrogance. So I think, uh, referring to that and understanding his journey and so forth. I think it's been— I'm only halfway through it, but I'm finding it quite a rewarding book.

Great. That's Ray Dalio, isn't it?

Yeah.

Yeah, he once shared something. Well, I was at an event once and he shared that. So they used to record, I'm not sure if it's in the book, but they would record every meeting and every meeting was available to anyone in the company. It was just completely transparent, the model.

It's a very high level of transparency. Um, what do we say at the moment? So John Myers, who's our exceptional CEO, very, very good people person, and he says, you know, too much information can be a bad thing and too little information is a bad thing because people will fill the gaps. So I think there's a balance that we need. People need to be informed, they need to feel secure about what they're doing and why they're doing it, they need to be valued. But then there's sometimes information that's just unnecessary.

Yeah. And probably true in the process of identifying someone's identity.

Yeah, very true.

Helping corporations with that. Well, great. Thanks, Josh. Been a fantastic conversation. I've got 60 seconds where I'm now going to pepper you with more questions.

Awesome.

Just in case I haven't already taken up my share and I'll see how many I can get Within 60 seconds, I'm gonna start my timer. Are you ready to roll?

I am ready to roll.

Cool. Okay, so it's one or the other. License or passport?

Passport.

Same password or system generated?

System generated.

Cash or card?

Whoa, that's an interesting one actually because we're all getting pillaged on our card fees at the moment. So I haven't seen cash in ages. What's cash?

That's right. Fraud prevention or data privacy?

Both.

Biometrics or passwords?

Biometrics.

Data sharing or data protection?

Data protection and sharing of fraud data.

Dark web or corporate security breach?

One results in the other. How about we just don't have a breach?

Can't win there.

Yeah.

Social media regulation or self-control?

Oh, I think social media regulation for underage is very important.

Early stage startup or established company?

Well, I've just done back-to-back startups. It's been a lot of hard work, good fun. Both have merits, but I'm enjoying the ride.

Identity verification or payment security?

Both.

Convenience or security?

Both.

Manual fraud checks or automated detection?

Automated.

There we go. I had about another 40 actually.

Happy to keep going.

Oh, there was liveness detection or document verification?

Both.

Open banking or traditional banking?

Open banking.

Cloud-based security or on-premise?

Cloud.

There we go. I could keep going, Josh, but I know you've got another Christmas party to go to. Beautiful.

Yeah, got to get there at some stage.

But no, thanks for coming in today. And it's just such a topic that really does touch everybody personally. And obviously if your business is large enough, then yeah, you'd be either using you guys or having a system in place.

Whether you're a broker on the corner that needs to meet some compliance and keep your clients secure, or if you're a massive bank like ANZ and Macquarie, then yeah.

And no doubt, I mean, facing into 2025, whilst you say there's lots of change, I mean, it is an industry that is obviously booming given everything's going digital. So great place to be. So congrats.

Thank you. Yeah, it should be a big 2025.

Awesome. Thanks, Josh.

Brilliant. Thank you.