Combating Fraud, Waste and Abuse Before It Happens

All right, happy Good Friday, everybody. We're back for another episode of In Case You Missed It. Good to see you, Joe.

Happy to see you too.

Outside of the, uh, the normal day-to-day Zooms, today we are talking, uh, combating fraud, waste, and abuse. I mean, as we think about some of the largest-scale challenges that agencies have, really of all sizes, it's taking these large mission-critical systems that they have and that they must service and kind of administer and finding ways to, you know, deal with the fraud, waste, and abuse dynamics associated with it. So when we started thinking about this as a topic, we knew exactly who we had to interview for this. And you can see the man, the myth, and the legend, John Kost, the CEO of Plum Identity, on. John, thanks for carving some time out to dig into this issue with us today.

Thanks so much for having me.

So, you know, you're a veteran to this space, so I'd love for you to maybe just shed a little insight on your background and kind of prior work in the public sector to start.

Sure.

Let me start with a question though. Does veteran mean old? Is that what that means?

We'll put an asterisk on that. So, okay.

So, uh, yeah, I live in the Sacramento area, um, with my wife, the artist behind me, and a dog who you might hear at some point today, and a couple of kids. And I've been doing government technology now for about 30 years. The past 15 of them or so are strictly around this problem of fraud, waste, and abuse, and Prior to my current company, I started a company called Pondera Solutions back in 2011, and it was acquired in 2020. And its sole purpose was fighting fraud, waste, and abuse in government programs. So been around it for quite a while now. I've actually started 5 companies, and I'm happy to talk about 4 of them anytime anyone wants to talk about them.

That's great. We're both in the Sacramento area. And, you know, one of the things that we saw over that course of the pandemic was some serious flaws and problems in some of our government's largest benefits programs. And you didn't have to look further than here in the state of California with our Employment Development Department that, you know, unfortunately paid out billions of dollars, right, to scammers and those that had really bad, bad intentions. How big is that problem and why was it allowed to happen?

Yeah, I mean, it's a big problem and I think most people know that, but the numbers get so big it's It's sort of hard to wrap your head around it. I actually really appreciated right at the end of the pandemic, the GAO came out with a report sort of showing the size of the problem. But what really hit me was that it's been going on forever. And obviously it increased during the pandemic, but every year sort of today going forward, you can expect between $175 billion to $250 billion a year in fraud, waste, and abuse. By the government's own accounting, right? So, and you only find what you can and what you look for. So it's likely higher than that. And, you know, the real problem with it is the money doesn't go for good, right? It's stolen and then it's used for human trafficking and gun smuggling and drug smuggling. And to put the numbers into perspective, which I think is helpful sometimes, that kind of money, if we could redirect it every year Could build 1,200 schools, operate 450 hospitals, or I should say, and build an extra 7,000 miles of highways around the United States. I mean, that's every single year. So it's an incredible amount of money, a huge problem. And, you know, Jodi, your second question, why is it allowed to happen? I think it's a complicated question. There's a lot of factors at play. Frankly, I have a lot of empathy for government agencies. You know, They're continuing to be pressured to put services online. If not, you know, then they're criticized for being old-school government and not taking care of constituents. They have prompt payment penalties. There's lots of money coming through government, which obviously makes it attractive to fraudsters. And maybe most importantly, they have a real fear of false positives. You know, if your credit card is cut off, for instance, on a legitimate purchase you made, you just get a call from the credit card agency. You say, yeah, that was my, you know, that was my legitimate purchase, and then they turn you back on. Well, government can't do that because somebody might miss a housing payment or a healthcare appointment. It has real dire consequences. So all of that combined with, you know, antiquated systems and the fact that government's main purpose is to, you know, provide these services, not fight fraud, just is, is a pretty potent cocktail for fraud.

So, you know, the pandemic ushered in record amounts of money and some new rules and complexities that may have contributed to that, uh, that fraud. But how has it changed since the pandemic?

Yeah, so it's been interesting, sort of. I think the move into the pandemic, the pandemic itself, and then the move out of the pandemic's been, been really interesting. I actually, um, Joe, personally, our— my last company, Pondera, was acquired right at the beginning of the pandemic. in March of 2020. And then I stayed on with Thomson Reuters, our acquirer, through sort of the 3rd to 4th quarter of 2022. So I got to see a lot of it. And then I decided to step away from the business a little bit. And I feel like I'm a boxer. I just keep coming back out of retirement to get beaten up one more time. But I came back because of the changes that I saw. And I saw a couple of really big things. One was Criminals are getting way better at what they do. So they have, you know, their stolen identities and their ability to do that and then trafficking it is incredible. I mean, every year it's about 400 million sensitive records being exposed in the United States alone, 400 million. We've all been, you know, exposed multiple times and they're using the dark web to traffic in it and that sort of thing. They're using technologies to scale their businesses and bots and headless browsers and IP spoofing software. And now they're using AI, right? Right? So I saw all this occurring. That was frightening. And then honestly, some governments' responses to it was frightening to me as well. So they started using biometric solutions. They started really increasing their use of PII. And in really dire cases, they just started delaying payments. And so I saw these 2 things coming together as government needed to move away from pay and chase and into prepayment. And, you know, I got concerned about the direction we were heading and the fact that we were starting to lose the battle to the fraudsters.

So, you know, as a veteran, or let's say, let me think of another word for that, and professional expert to the fraud, waste, and abuse—

Thank you.

Thank you, Dustin. You know, in the public sector, you know, you're now approaching this fight differently. You're getting proactive, you're getting ahead of it. I mean, there's like government apparatuses that are built around investigating things that have already occurred. You're trying to prevent them from happening through Plum Identity. So tell us a little bit about how you're doing that. Yeah, happy to.

And I should say too that we, we only do fraud prevention at the time of application. So, you know, things we don't do are things like a legitimate applicant comes into a program and then starts to behave outside of program rules. That's not what we do. So those apparatus that are in place today need to stay in place and continue to look at those things. But what we do is we are— and I call ourselves the first truly built-for-government prepayment behavioral analytics fraud prevention solution. I know that's a mouthful, so let me kind of tell you how we work. When someone goes to a government site, say, to apply for unemployment insurance or Medicaid, they are leaving a digital footprint as they're interacting in their web sessions with the government, literally tens of thousands of data points as they're typing in their information. And it's really kind of in 3 areas. One is information on themselves, obviously their first name, last name, address, etc. The second is information on their device itself. Where is it coming from? What type of device is it? Has it seen before— been seen before? And then the third is their actual behaviors. Are they cutting and pasting? Are they typing faster than a human can? Are they clearly trying to vary their speeds to obfuscate who they are? Are they going backwards, forwards? Are they tabbing? Are they using a mouse? All of these data points, we call that a plumprint, 'cause it's bigger than just a thumbprint. It's really a 360-degree view of a person. What we do is we gather all that data at the time of application and we run it through a series of models that look for things like synthetic IDs, stolen IDs, super synthetic IDs, bots, drop houses, mules, all of these fraud methods that are being used to defraud government programs. And we do that at the time of application and return a risk score to our customer. So very, very effective. Like I said, it doesn't cover sort of post-application fraud, but that large majority of actual dollars being lost to fraud are on that application side, and that's how we address it.

That's great. I love the Plum print. That's pretty cool. You know, that move to combating fraud before it happens tends to make people think that that's gonna require government to infringe on their privacy rights. Do you agree at all? Do you disagree? And do you think a balance can be maintained?

Yeah, I mean, Joe, that's really the reason why I started Plum. You know, I, I was concerned with some of the directions that I saw this fraud prevention going. I'm not the only one. To your point, we've seen a lot of bills in state legislatures that are starting to address privacy, especially when it comes to applying for government programs. But I do think that there is a balance that we can achieve, and that's really my goal. I mean, we built the company from the ground up with just 2 things in mind. One is to stop fraud at the time of application, and the second is to protect citizens' rights to privacy. And I think that's critically important. So I'll give you one really, I hope, illustrative example of how we do that. We use— we're making great extent of hashing, so we're using that very much in what we do. So when someone enters their data, first name, last name, address, etc., It gets hashed before we see it, an irreversible hash. So we literally just see a random string of like 100 characters. So I don't know anything about you if you're applying for your program. I don't know your first name, your last name, where you live, the color of your hair, but I know if someone's pretending to be like you, and I can pass that information back to the government. And to show you how secure that hashing is, this is the estimate on what it would take if you had a million computers. That could do a trillion hashing algorithms a second, and you started to try to break our hash when Earth began 14 billion years ago, you'd just barely be scratching the surface of hacking this. So we're a very, very secure system, and we don't use that data for advertising or anything else. It's literally just to help prevent fraud. and to protect citizens' rights to privacy. So I'm glad you asked. That's how I think we're gonna achieve that balance. And I think it's important for all of us to keep that in mind, whether we're with government or whether we're dealing with government.

Love that. So as you think about AI, you mentioned it earlier, and this space has continued to evolve, right? Just like the internet, when that first started coming out and agencies started modernizing systems, there was the good and the bad, right? They were able to put things online, they were more accessible to the public, but then that same infrastructure was used against them. against them, right, to try to disrupt them, to try to, you know, get them to, uh, you know, have some of these episodes. So as you think about AI in the context of this world today, you know, where do you see that going? How do you think it's going to impact the fraud, waste, and abuse space? And, you know, what would you kind of tell those agencies to pay attention to here?

I was hoping you were going to tell me that. I remember when the internet came out, I remember they talked about the 3 S's: sports, stocks, and sex. And no one knew just how huge the internet was going to be. And I do feel like we're kind of like that space with AI right now. And I certainly can't do an amazing prediction of what 10 years from now holds, but there are a couple things that I do know. One is that fraudsters clearly are making extensive use out of it, and they're on the cutting edge of using AI to defraud government programs, banks, all types of systems where they can get money. That includes obviously fake audio files, fake video files, faking documents, more advanced ways to obscure devices. It's really pretty scary out there. The second thing that I think I'm worried about with AI is that— I guess it's 2 things. I'm worried about companies like me that force-fit AI into a solution. Just so they can go to investors and say, look, I'm using AI to fight AI. And I don't believe that that is always necessary, although we have to stay aware of ways to use it constructively. But I really, really fear a world where, say, government uses AI in eligibility determinations. I just, I don't like the thought of it. I think there's some serious implications to it. And I'm actually very heartened to see government holding really important conversations about this because a lot of people seem to feel the same way I do. And companies like yours, I think, are bringing it to the forefront, this sort of law of unintended consequences. So I am really focused on how to stop AI from defrauding programs. That is my singular focus. And I'll do that any way that I can without violating citizens' rights to privacy. That's our goal.

That's great. So for our audience of public sector practitioners, what are some things that they should be thinking about when it comes to combating fraud, waste, and abuse today?

Yeah, well, the first thing I'd say is that anybody that comes into your organization and says that they can stop fraud or that, you know, they're the only company that you need you ought to just throw them out because it's, it's not true. And, you know, it's a very complicated issue. Fraudsters continually get better. We talk about whack-a-mole, right? Like, you developed a way— you develop a way to stop fraud, and fraudsters don't all of a sudden get good and go, oh, I guess I can't defraud a program anymore. They think of new ways to defraud it. So we see that all the time. Like, you know, now to get around, like, multi-factor authentication, we see things like session hijacking. And to get around, you know, public records checks, we see a lot more trafficking and stolen identities and the use of bots to make sure applications are filled out properly and accurately. To get around a sort of traditional device recognition, which I'm sure you guys have followed for years, we're seeing the use of headless browsers and agent string modifications and IP spoofing software. So it's gotten much more Complicated. And I guess maybe it's a little self-serving to say, but while I think these sort of larger, more traditional companies in the fraud detection space play a part in, you know, detecting and preventing fraud, I think it's important for people to look at smaller companies like us and others that have more nimble ways of addressing really specific solutions, because I do think it takes a quick And when one, you know, method of detecting fraud gets discovered and bypassed, hopefully you can rely on one of your other vendors. And then hopefully you've picked the right vendors that are constantly improving and staying forward. It's just not a set-and-forget-it space. It just, it can't be because our competitors, the fraudsters, just continually improve.

As you said, it's constantly evolving, so you have to stay on your toes. So, You know, the easiest question for you today is where can our audience go to learn more about Plum Identity and the work that you're doing in the public sector?

Yeah, so thanks for asking, obviously, but our website really does have some pretty good information, plumidentity.com, which I think will do a pretty good job describing what we do and how we do it and why we do it. We're also fairly active on LinkedIn and we try to post new fraud methods that are coming forward, maybe some misuse of some of the traditional ways, you know, that might be violating privacy standards and, and sort of help keep our followers on track. And then I'll do my final little self-plug here, is if you're interested in learning a little bit more about my history in this space, I'll be coming out with a business memoir here in the next month or two. It's called A 10-Year Overnight Success: The Inspiring Story of a Business You've Never Heard Of. So I think it sort of dives into, uh, not just what it takes to start a business in this space, but also history of fraud, waste, and abuse in government programs, fighting it, sort of some of the challenges government faces and that sort of things. I hope you too will buy it, by the way. Please, come on.

We will. We'll look for— looking forward to it. Maybe I have to have you come back on to do some, uh, some promotion there.

That'd be great.

But John, we, we thank you so much for taking a little bit of time out of your day to join Dustin and I on In Case You Missed It.

Thank you, really appreciate it and appreciate the work you guys do.

Thanks, have a wonderful weekend, everyone.