Episode 224: Fleet Fraud Is Getting Smarter (Here’s How Fleets Fight Back)

This is the Fleet Success Show dedicated to helping you and your fleet succeed using the experience of fleet professionals and Hall of Fame fleet legends. The show that explores how the pillars of stakeholder satisfaction, intentional culture, resource efficiency, and risk management all combine to lead your fleet to success.

We're glad you're here.

Now let's get into the show.

All right.

Welcome back for another episode of the Fleet Success Show with your host, Josh Turley. And joining me today, I have Will Fitzgerald from WEX. A little background on me, obviously been the Fleet Success host for over 200 episodes and run the company over here at RTA. Big focus on technology, fleet, and the intersection with, with business and culture and leadership and how it all comes together. Will, for our listeners who aren't familiar with, with your role and what WEX does, you know, maybe a quick intro into WEX and then specifically what you do with them.

Yeah, great. Thanks for having me, Josh. I appreciate it. So I'm with Wolf Fitzgerald. I'm with WEX. We have several lines of business covering payments from fleet fraud to corporate payments, health and benefits, specifically fuel cards, but then also open loop purchases like that. So all kinds of payment solutions, virtual cards. As far as me, my, my team covers the entire gamut of fraud and financial crime. So all of the operational and strategic functions that you would think about are on my team. We also do some compliance and regulatory stuff that's required in that space. And my background is almost exclusively fraud. I spent a few years on the business side earlier in my career. Like most fraud people that started, they didn't mean to start in fraud. They just got asked to do a project and then all of a sudden you're the fraud guy and that sticks with you. So that's certainly my career path. It's just always been what's the next fraud problem? And, uh, it's been a great ride. It's been fun.

Well, what was it about fraud that you just got into and you're like, man, I love this, this is amazing?

That's a great question. I mean, actually, an interview manager told me this, this answer got me a job one time, so I'm going to stick with that. All right, seems to work. It's very adversarial. So when you're, when you're investigating and fighting fraud, there's a— it's not ambiguous. There's a human being on the other side of that equation trying to beat you, and, and you're trying to beat them, and, and while you're not on the phone with them or standing face to face with them, you know that somebody is trying to outsmart you and you're trying to outsmart them. And it's just really energizing and exciting and it's constantly changing. You're not— 6 months ago is a completely different job than it is today, and I can't even imagine what it's going to be 6 months from now. It's, it's always new and exciting. So it's, it's a hook. I've had a lot of people try to leave the fraud space like, hey, I'm going to go do— I'm going to go to the business. And they come back because you can't get that feeling of fighting fraud anywhere else.

Well, and there's something to be said too about an enemy that's constantly evolving, you know, is like that. You said, you said it right, it's the adversarial nature of it. But it's, you know, it's not, um, it never just status quo, right? Because they're always getting smarter and it's always challenging you to like, I've got to bring my A-game every single time, uh, because if they catch me snoozing or something like that, it's like, oh, you're constantly learning. Which is, it's a fascinating industry for me, just seeing it on the outside.

It is. And it's a profitable industry for the fraudsters. We have to constantly keep that in mind. And when we talk to our leaders, senior leaders, executive leaders, and business owners, they're making money. And every time you try to stop them, you're hurting their pocketbook and they don't like that. And so they are highly motivated to beat you. And so you have to stay in front of that.

And every time they win, it just funds the next venture, right? And it keeps— it's like an addiction for them. You know, it's like, hey, how can I go do this? And then I win, and then I go do more. And then it's, you know, it's definitely self-sustaining. If it wasn't lucrative, they wouldn't do it. And so—

That's right.

You know, if we talk about that, that's a good little pivot. You know, we're going to talk about a whole range of topics today. But as you think about that, that financial motivation for them, right? They're investing in themselves, constantly learning and growing. As you're talking to your senior leadership, how does that translate to your message for them? I know for me, how I kind of position it, but I'm curious from your perspective, how do you position that to senior leadership? Like, hey, they're investing in this, we need to be doing the same.

Yeah, that's a great question. Never let a good crisis go to waste. That's true in the fraud industry. When you have a really bad fraud event, everybody's willing to throw money at it and they're like, whatever it takes, just don't let that happen again. Once that pressure goes away and you kind of get into a BAU space, that, that pressure, that tension to spend kind of goes away. And so the conversation has to shift from fraud losses. It's not just about the loss. There's reputational risk, there's silent attrition, there's very vocal attrition when there's fraud issues. And so if you're not When we're building business cases for fraud solutions, whether it's internal build or we're going to buy something, we have to think about all of those things because just the fraud loss, that's a percentage, it's a big percentage, it's only a percentage of what you're actually losing. And so that's the message to the fraud, to the executive team when we're going in front of the CFO and asking for money for a new platform. Hey, we're not just going to reduce our losses X dollars per month. We think we can stop, you know, we think these customers left because they had a fraud event. So we can prevent that. We have a reputational risk. There's competitive advantages to being able to manage fraud. So we have to bring all of that into the equation and then quantify it. It's not just— it can't just be anecdotal. We have to put money in dollars to it. And so that's how we think about it. And if you're not, it's so easy now to show the advancement of fraud and we just pull up a video of some CEO that shipped $50 million offshore because a guy on a video looked like his CEO. You know, like, it's— you can ask ChatGPT and get 100 examples of that today.

And so that's an interesting point too. We talk about the evolution as, you know, fraudsters are getting smarter and smarter. The technology is also getting incredibly invasive as well, right? You know, we thought deepfakes were a thing, and now you've got these full AI videos that are even better than that. Yeah. We know that there's tools out there like Happy Robot that you have like a full voice. You know, we're hearing fraudsters calling up and saying, you know, they've got the, like, the voice of your grandmother and trying to scam you out of money, right? And so as you're dealing with that, like, how do people, you know, prepare for that? How do they, you know, fight against just these— it seems like they've got unlimited resources.

Yeah, it's a good question. It's somewhat reactive to some degree. I mean, we can, we can try to predict what they're going to do, but, you know, they're innovative people and they're well-funded, and we've talked about their motivations. So they iterate very quickly. They also don't have the regulatory and compliance obligations that a business has. And so if I go to my data scientist and say, hey, I need a new model to predict application fraud and I want to segment high probability fraud. To put that into a production environment, I've got to go through model risk management, compliance is going to want to check it for bias. We're going to have to prove that it doesn't bias over time. Like we've got a long road ahead of us. The fraudsters just flip the switch and they're like, let's try it and see if it works, right?

So— Did it work or not, right? That's their only test. That's their only regulatory pass they got to go through.

Right, yeah. There's no, there's no fraud guy on Reddit like checking for model bias when the bad guys create those schemes. So, so yeah, it's somewhat reactive in that space. And so then it becomes how quickly can you iterate your systems and your strategies? And so that becomes about platform, like what's your infrastructure look like if you're on legacy systems that take, you know, 4 months and the one guy in the company left that knows how to code on that system. You're never going to catch up to them. And so we've been focused heavily on modernization, getting the right infrastructure, getting the data structured correctly, and then getting onto a platform that enables quick iterations with AI. And so that's what we're focused on.

So with AI, what kind of changes are you seeing from the threat landscape, right? Different threat vectors that you guys are running into with the, obviously, the proliferation of AI, you know, in the space. How have you seen your work change based on that?

Yeah, as far as the threat vectors, everything is so good now. We don't— you don't get the Nigerian prince trying to escape his country in a horribly worded email anymore. It's specially targeted typically to an individual. They've got your email or they've got your LinkedIn data or they've got your, you know, Facebook or TikTok, whatever you're on. They've aggregated all that data using AI and then used AI to create compelling, convincing, authentic information. To then target people. Beyond that, we used to rely on document authentication. Like you could just ask a fraudster for a driver's license, right? And some third party, the ones that AI is producing are spot on. They're almost impossible to detect visually. Apply that across every imaginable document that you would ask for, bank statements, articles of incorporation, DOT docs, 30 seconds, you can have one that's absolutely perfect. And so that's how we're seeing the threat landscape change. Everything is just getting more difficult to detect. From our perspective, you know, we're deploying against that with the same things. How can AI detect that? How can we aggregate data across lines of business, across transactions, application, account access, and then build predictability in features, and that's where that AI platform comes in handy. If you're, again, if you're on legacy systems, it's really hard. But if you're— we've built a layer in between our customers and our data that can use essentially every data point to create predictive models. And now we can start thinking about things as this is 30% likely to be fraud, this is 70% likely to be fraud, and then we can make strategic decisions on top of that. How to handle it. Precision, you know, false positives are the priority, like especially in fleet, man. You get some guy that's just trying to go do his landscaping job and his card gets declined and, you know, he's 20 minutes late for a job. We just can't tolerate that. And so we're using AI to really boost that precision using those predictive indicators.

Yeah, false positives definitely are a hindrance to the business. And that's always the delicate balancing act that we have between enforcing security and making sure that the business can still run, because just being in business introduces risk. So the idea is like you step out your front door, you're now at risk, but you can't eliminate all the risk, otherwise you don't operate. So how do you balance those two? And it's just a very fine balancing act between the two of them, which I'm sure puts you in an interesting position. When you think about—

It does.

Fleet in general, right? So obviously WEX does fuel cards, very much like a Voyager, Comdata, Uh, you know, there's a number of them out there now. Road Flex.

Because no one goes to school for fleet management, chances are you were never formally trained on how to successfully lead a fleet. That's where the Fleet Success Playbook comes in. The Fleet Success Playbook is your guide to building a safe, reliable, and efficient fleet that provides exceptional service. Learn all about the 4 pillars of fleet success: stakeholder satisfaction, intentional culture, resource efficiency, and risk management. Get nearly 100 years of combined advice on common challenges, practical solutions, actionable tips, and real examples from fleet industry experts who have been there and done that. Visit www.fleetsuccessplaybook.com to request your free copy today.

When you think about fleet and, you know, specifically from a cybersecurity standpoint, what are some of the things that you've seen in in fleet fraud, or different things that fleet managers listening to the podcast should be aware about, should be incorporating into their kind of thinking and mindset?

Yeah, that account takeover piece is brutal right now, and it's coming in a lot of different ways. We have, well, you have your plastic, right? The plastic, a lot of fleets leave it in the vehicle. They have a car card versus a driver card that they keep with them. And so that introduces a tremendous amount of risk, because the card, moves across people and now you can't, can't target behavior by a driver right now. So that becomes somewhat of a risk. The account takeover, that comes a couple different ways. A driver could click on a link and, you know, put their credentials or their card number in so they could get popped that way. Uh, the other thing that we're seeing is third-party mobile apps where legitimate apps are asking people to put their card number in to activate pumps or pay for hotel rooms or, you know, any other number of things where you're storing a card. Well, every time you store that card in a mobile app or a web app, now the credentials of that thing become a gateway to the card. And so, um, we're seeing a lot of that where our app or the, or the, the, the Fleet's app is fine, they didn't get compromised, but the drivers put their card into a fuel app because they get a couple extra cents, you know, off and they don't set up multifactor, they don't check the multifactor box, or they have multifactor going to email and their email is compromised. And so it just starts to unravel and it becomes, from our perspective, the technology perspective, you're well outside of our perimeter. My perimeter is perfectly safe, but you're outside our perimeter engaging with somebody else. That's impossible to protect. And so that becomes about education, convince, control, saying, hey, you're not allowed to put these cards in these other apps and then consequences for doing so. So Yeah, there's just so many layers that get compromised now from a security perspective. It's not just your own environment. You're dependent on other companies that you're not affiliated with to protect your information.

And that's even something, you know, we talk about Apple Pay or like Google Wallet. Very, very common, very popular. But especially if you've tied it to your personal account, which, you know, we talk about the difference between, say, a small business, midsize, or enterprise. A lot of these small business owners, their personal account is their work account. Yeah. And once that's popped, it's popped and everything there is exposed, including all your Google Wallet stuff. Something that we've seen, you know, especially as we talk about spear phishing or just in phishing attempts in general, is the— even if you have separate accounts, is when those lines get blurred and all of a sudden you are, you know, you've got a Google password manager and it's tied to your personal Google account, but then you're saving work emails into your personal Google password manager. And so having proper IT security controls to prevent that, even at just the very least having policy to prevent that. But sometimes it's unenforceable. It's a password manager, you can put whatever you want to in there. Yeah. And so that's— Yeah, go ahead.

I was just gonna say, we take for granted at the enterprise level, when you talk about large organizations, we have information security organizations, you know, 50, 60, 100, 200 people, whatever. And their whole job is stopping what you just described, like like filtering emails, not allowing copy and paste, USB drives don't work, like all these really intricate controls. A small mom and pop, 2 or 3 vehicles or a small, like, they don't have InfoSec. And so it gets even more difficult to protect them. And so then it becomes about education and helping them find the tools and settings in Gmail. Like we talk to, we do a talk in conferences sometimes about how to secure Gmail. Passkeys are good, email's not good. You know, some dos and don'ts for securing your account. But we definitely take that for granted at enterprise levels that it's just kind of done for us.

Yeah. And it's one of those things that you almost resent it to some extent and you find like workarounds and all that. But you know, every time you do that, then you're just creating another threat vector to get in and then you are the threat vector, right? So you have to be careful with that. One of the things as we, You know, we look at the different types of transactions. I know in the past I've seen fraud. Obviously fuel fraud is one massive area. You guys probably deal with this a lot. I was like, hey, I'm going to use this card and I'm going to fuel up vehicles that, you know, it's not the same vehicle, or I'm going to roll in and have my buddy fill up behind me and we'll just keep the pump open while we're doing this. What are things that you do to prevent that type of fraud? And then we'll get into some of the other, other areas that we talk about, you know, as open loop, closed loop differences between those.

Yeah, first-party fraud is obviously the most difficult to detect because they know— we were talking about this earlier— they know your environment, they know your controls, they know the systems, they know what you're looking at, what you're not looking at. So it gets very difficult to detect. For me, what I, what I found very useful in that space is data and behavioral data. So first, looking for those anomalies and a good reporting system is critical for that. That shows you, hey, here's an outlier, this person fuels up more on Tuesdays than they do on Thursdays or whatever. And so start having a reporting mechanism that can generate those outliers and alerts to go look at. And then the other side is controls. The more— it's just like the spend controls I was talking about. If you can all— if you know they're in a 30-gallon, you know, diesel truck, F-250 or whatever, we shouldn't be letting them put 200 gallons a day in that truck, right? We should be saying they use this much fuel, bump it 10%, 15% or whatever, and that's their limit. And then you can start to put guardrails around what they can get away with. And then again, the same thing goes for inside. You know, we see fleets that have— that let them go in and get, you know, whatever oil or whatever for the equipment. But then if it's network, if it's open loop network transactions, you can't really see those transactional level things. So when you have a closed loop of Level 3 data, you can say they're allowed to shop inside, but they can only buy oil and whatever, I don't know, refrigerant or antifreeze or whatever. They can't buy beer or tobacco products. You can shut those off. And so those controls become critical in stopping that.

So when you talk about open loop, closed loop, For those listeners who aren't familiar with that, I guess, you know, walk me through the architecture there. Like, how do you know between— is this a closed-loop transaction versus open-loop transaction? How do I know who closed-loop vendors are? Is it, you know, like, what's that look like?

Yeah, so I would describe closed-loop as an agreement between your processor, in this case WEX, and the merchant. So we have an agreed-upon technical integration between the two. And so we don't use Visa network Discover, American— we don't use those networks to move money around. We're moving directly between the merchant and the processor or the issuer. That's again, WEX in that case. Open loop is when you're going on a network rail. And so you can use your card. Every card you have in your wallet is probably open loop, right? You can go spend wherever you want as long as they take Visa, MasterCard, American Express, whatever the other one is. Typically on closed loop, it's going to be restricted. So you're allowed to fuel here because we've negotiated that connection with that merchant. And then further beyond our negotiations, the fleets can say, I only want you to fuel at gas stations A and B. And so they can even further restrict where they want their fuel spend. With Open Loop, you can restrict MCCs, merchant category codes. Like you can say, I don't want you to be allowed to shop at big box retail stores, but that becomes really difficult because what if, what if you break down and there's a Target and that's the only thing you can get your, a new battery at? And so, well, okay, now I gotta allow merchant category code for Target. Well, what can you buy in Target or Walmart or Sam's or Costco?

Like, it's all or nothing.

Yeah, so it becomes very difficult to restrict those things. So we've, we see it a lot even with like hotels, hotel master category codes. Merchant category codes. Weird things that you wouldn't think would be in that category fall in, or they can go down to the bar in the hotel and purchase, you know, food, alcohol, whatever, and it comes up as the hotel, and so it's allowed. And so it's so hard to control those things when you're on a room charge, and then it's completely transparent. Yeah, your room was $1,900.

That's weird. Uh, so is he And so we talk about closed loop. Like these are, you know, as a provider, these are technical integrations. You guys can see the details. It's not just, hey, there's a charge at this random target for whatever. It's like, oh no, we actually know what exactly you bought. We know line by line what was spent where, and we can block even down to the— I'm not going to call it UPC level, but, you know, almost SKU level of this is what you're allowed to buy and what you're not allowed to buy or categories of stuff. Right. And so you have a lot more control as a fleet manager over what your team is spending as a fleet in general. You know, it's an operational expense you have to go through, but you can make sure that it's being spent the way it's supposed to be spent. And that helps limit a lot of that first-party fraud. And then if the card is stolen, now you're eliminating the third-party aspect of it as well, right?

That's right. Yeah, we see it manifest with HSAs, healthcare cards. Um, you just don't see as much fraud on HSAs because How much can you fence a bunch of Band-Aids for, right? So there's no point in stealing that card because you can't really buy anything with it. Just apply that same logic across all fleet cards.

Yeah, it really limits like the, just the exposure of what you can actually get with it. And you're not going to go buy an alternator, right? It's very difficult to turn around and sell an alternator on like Facebook Marketplace or something.

Yeah, 10%, 20% of value.

Yeah, versus a, you know, you go get one for like a MacBook or something that's high demand. That's where they really want to hit you, right? And so as a fraudster, you're going after those high-ticket, high-demand items that you know there's a market for.

That's right. Yeah. If you're seeing Apple spend, it's amazing. They fence over value. So you see them buy a MacBook for $2,000 and they got them on eBay or whatever for $2,300. It's crazy. So yeah, you're exactly right.

The Apple is like the only one I think you can get away with that on, by the way.

It is.

There's just— and I have my own judgments on this, right? You know, apologies to all the Apple listeners, um, but the fact that, you know, you can only do that with Apple blows my mind. But then again, they're also the ones that charge $250 for a sock that you can wear your phone in, so, you know, more power to them.

There you go.

I haven't seen that one yet. Oh, it's totally a thing. We have a whole discussion on it. You should go look it up. I think— what do they call it? The Apple Pocket or something like that. And it's literally a tube sock that they've somehow stretched into a, like a wearable vest kind of a thing. And so you can just put your phone in and at $250, no joke.

So I'm in the wrong business.

We are in the wrong business for sure. So what are some things that fleet managers can do? Right. So we can talk about implementing controls, right? Getting, you know, somebody with a closed loop network, somebody that has a lot of these spending controls in place, they can, you know, really lock down the exposure there. What are some other areas that you would tell your fleet managers to invest in or your companies to invest in to help make sure that they're staying safe out there?

Yeah. Number one, pay attention. Pay attention to how your cards are being used. If you're looking at it only, you know, at 15 or 30 days when it's time to pay the bill, so much damage is done in that, in that time span. The sooner you catch a suspicious transaction and can get that card locked down, the less fraud you're going to you're going to see. So I would say have a strong operational cadence of reviewing transactions and looking for outliers. Again, it's in that reporting. And so I know our reporting suite has, and I'm sure this is available in other places, but you can really tune it to say, I want to see anything over X, or I want to see any purchase that falls in this category. And if you have somebody looking at that every day, man, you're catching the bad guys and the fraud really quick. 'Cause there's some big spend limits on these credit lines on these cards. You could really do some damage in 15 or 30 days. So I would say pay attention to that. The other thing, one of the biggest controls that's so easy is some kind of PIN, some kind of factor that you have to use. We run constant reports looking for the easily, we call them easy guessable PINs, 1234, 000, 1995, whatever. 2026 just became a really popular one. Can you believe it? If you're using those as your PINs, just don't bother. It doesn't carry any value. So think about, yeah, people are going to forget the PIN. I'm going to have to look it up for them. Yes, there's some operational, but if that card disappears, you're protected. Nobody's going to guess a unique 4, even just a 4-digit PIN is tremendously valuable if you're not using that. And it can't be a number that's, you know, in 60 font on the side of the truck. That can't be your PIN. You know, you have to think about—

Don't use the vehicle number.

The vehicle number is not a great PIN.

Don't use the plate.

Yeah, no. License plates are terrible. Back in the day, they would ask drivers to use their social. That's how far I go back in fraud. But they would have the social as the PIN, which is somehow worse. But yeah, so think about if the card disappears, how can I stop this thing from being used? A PIN, a very unique PIN that's not easily guessable, is not printed on the truck or written on the back of the card. We see that in vehicle cards a lot. They'll write the PIN on the back of the card. That's going to save you a ton of headache if that card disappears.

It's the, it's the old like putting your password on a Post-it note and then put it on your computer, right? It's the same exact thing.

Yeah, we had somebody, well, I wrote it backwards. Okay, one extra layer of protection, probably still not good enough, right?

I know one of the things I always push is training, you know, something we do here internally, um, you know, and I don't know, I'm sure there's a bunch of companies that do this, but one of my favorite features, we use a company called Wiser Uh, and it's just like online videos, super cheesy and corny. But what I, my favorite feature about it is that not only do our employees get access to it, but their families can get access to it. And so they can have their, their spouses take security training and they can have their grandparents and their moms take security training, which you think about, you know, especially like the spouses, you can train the employee, but if they're sharing an account, uh, then their spouse's account gets compromised. Then all of a sudden, like your workforce gets compromised because of something an employee's spouse did. You know how hard that is to enforce? And so like the best proactive measure is just teaching people about different threat vectors and giving them real life examples. That's why I actually really love the Wiser training is there's— it's super cheesy. They've got a bunch of actors, but they're telling real life stories that have been submitted and it's like scary, some of these stories that we hear.

And I think I've seen those. It's kind of— I think I saw like— and they kind of read a dramatic version of what happened. I think I've seen that.

Yeah, those are really over-dramatized. It is super corny, but yeah, I like those.

I like the, do you guys do the email? They try to get you to click on the link and put something in.

And that's a huge piece too. Exactly, like internal, it's a, you know, we call it like white hat, right? Where it's internal and then they trick you and they get like some little spoof message is like, ha, I got you. Take this security training course, right? And it's pretty like tongue in cheek, but it's one of the best ways to help educate people on what a good phishing email looks like. And how easy it is to fall prey to that.

Yeah, we had our Taylor Swift tickets was a big, big one for us that caught, busted a lot of people. I was talking about it at a conference recently and theirs was right around like their annual performance. And it was click here to get your bonus and merit increase. So they got them to click on it, put their credentials in. I think those are great. You don't want to be on the list. It kind of becomes a game a little bit and tongue in cheek a little bit like, hey, gotcha. But it makes you slow down a little bit. It does make you think at least, is this too good to be true? Is this— this doesn't make sense. The days of— I will say the spoofed emails, not only the email structure and how it looks is almost indistinguishable today, but even how the emails are structured and the spoofing of the structure of the email address is phenomenal. And then when you get to the websites, we're seeing that a lot too, where they're cloning websites like a gas provider's website and they're going on there putting their email and password in. It prompts a two-factor, it goes to the legit guy. He thinks he's on a legit website, so he puts his multifactor in, bad guy gets it and they're in. And they— it's— people are like, well, how do you, how do you know? And I'm like, I just don't click on links. If I want to go somewhere, I type in americanairlines.com into the web browser. I don't, you know, I guess that's where we are today. You just can't, can't trust even the most legitimate looking things. Yeah.

And they might be legit, but it's always better to be safe than sorry. We say that all the time. And that's one of our big things that we'll tell people in fleet especially is like, hey, you know, somebody needs this order. Call them, call them at a number you know, not the number they listed in the email. That's, uh, just like verify it face to face if you can, or, you know, call them at something you're aware of. Don't respond to the email, go type their email in specifically, you know, like, hey, I just got this request, want to validate it. Um, if you reply to the email, like, they might have a different reply-to address, the email spoofing like you said. Uh, sometimes they can actually— and this is why I like calling, because we've seen this personally, um, is they've taken over that email account and they're sending emails as that person and it is legitimately coming from that inbox. But they've no longer— they've got filters set up where the person doesn't know they're compromised. And so they're just working along like normal. They haven't alerted anybody. They're totally unsuspicious of this, but they've got a filter set up that any inbound from, you know, like me as the hacker, I've put in my own rules. Okay, I'm targeting Josh, I'm targeting his EA, I'm targeting this person. But if they respond to me, I don't want my compromised account to see it. So I've got a filter that actually routes it to a different folder. It'll forward it to a different address and nobody's the wiser. And so that way I just know and then I come back in and I respond as you. And so you have to be careful of that stuff. So it's always just like, I'm going to pick up the phone here, right? We'll see people try to change direct deposit information, you know, and it's super simple. But all right, well, let's just go take an extra step. Pause, a little breath. And go validate that they actually wanted this request, that it came from the person we think it came from and not just this digital copy that we're seeing in an email.

We see the pay, don't pay us here anymore, pay us, it comes from what appears to be WEX, pay this account number from now on, don't pay this account number. The other thing that we've found is just telling, especially frontline folks, people that are picking up the phones, saying you're not going to get in trouble for calling, for saying, hold on, I know, Mr. C, I know, Mr. CEO, I know I have to pay this thing via Apple gift cards. I'm sorry, I got to call my boss. Right. They're under a tremendous amount of pressure. You think about some guy that's been out of work or some woman that's been out of work for 3 or 4 months. They just got a job. They don't know the C, they don't know anything. And so just telling them, hey, you're never going to get in trouble for questioning this goes a long way. And you got to keep reiterating "Hey, I'm monitoring that." As a matter of fact, if you catch one, here's a little bonus for you. If you stop one, here's a little extra for you. Empowering them goes a long way.

Yeah, we've definitely had that happen. Somebody pretending to be me, I think every employee here has probably gotten that email from me at one point, right? I've never sent it, but they always get it as, "Hey, I'm at this conference and I need you to do something for me real quick." "Oh, yeah, anything. What do you need?" Hey, I need you to go buy, you know, $100 in Apple gift cards. I'm going to give them to some customers or something like that. And they're, they're really good at these emails. We did have one of my assistants fell prey to it. I think she'd been on the job maybe for a month, and that was her— like, she went out and she did it, and then she responded, and then I stopped responding to the emails. And so she texted me and she's like, hey, did you get those gift cards? And I says, what gift cards? I'm like, oh no.

Oh no.

And she paid with it with her own personal credit card because she didn't have a company card yet. Right. And it was just one of these, you know, very painful learning moments for her is knowing like how to spot a spoofed email and then also making sure that, you know, she's checking and authenticating in other channels. You know, a simple phone call or a text message is like, hey, are you sure you need this? Like, why can't you just go do it real quick? You're not at a trade show right now. Like just something like that, you know, would be just a quick—

And her feeling comfortable shooting a text is huge. So important there. She feels like she's going to get in trouble or you're going to be like yelling at her, ask for this, like just do it, right?

Yeah, if you have that type of environment. So you need to make sure your people have a psychologically safe environment as well.

That's right, that's a great way.

So as you've gone through and done this, you've obviously seen probably a lot of stuff. What's been, you know, you talk about the adversarial nature, what's like one of those moments you're like, man, that was just a thrill, I remember that feeling, uh, one of your favorite stories in your career, as much as you can share obviously.

But yeah, I won't, I won't use the current one. We had the worst at the time was they figured out that Google Merchants are relatively easy to come by. So you can spin up a Google Merchant and you can charge people money for things, whatever, businesses, services, whatever. Well, they figured out that if you— it was under a certain amount, $2, $3, $4, $5, $9, something like that. That it would escape most radar of both the merchant, the issuer, the acquirer. Like, it kind of fell under everybody's radar. And so they distributed that purchase across millions and millions and millions of merchants that they had set up over. And so tens of millions of dollars walked out of issuer and acquirer accounts in a matter of days. And here's the kicker, the thing that makes it really bad. In order for an issuer to get their money back, they have to file a chargeback, right? So we charge, we say, you know, Josh's Landscaping, whatever, that was fraud. I want it back. It cost me $15 to file that chargeback with MasterCard. So it's— if I file a chargeback and get my money back, I lose $6. And so the fraudsters figured this whole thing out and then the The second stage of the attack was on FDIC-insured funds. If you file a fraud claim, the bank's obligated to pay you that money back if it proves to be fraud. And so like 30% of their money came back through chargebacks. And so they took the money, they got the chargeback money, and a lot of the issuers never got their money back from the— from those merchants. Wow. So that was a terrible scaled one. The one that I think is Maybe the most brilliant that worked so well is recently— you may— most of your listeners may have gotten this one. They sent out— they set up GoPro cameras at toll booths and started recording license plates and then used AI to get address information on cars that had gone through it and sent out snail mail reminders for past due, uh, like, hey, you didn't pay your toll, you owe us $6 or whatever, scan this QR code. And millions of people. I mean, it's a snail mail, like, you, your guard is completely down when you open your mailbox.

And it looks totally— yeah, it was, I was at that toll booth and it looks like I missed a toll.

It's your card, right?

Yeah, yeah.

They've had the pictures of the car, so you're like, God, you know, I think I paid that. Are you gonna go— you're not gonna go look for a $3.25 charge a month ago, right? So you just go, and when you pay it, you're putting your credit card details in, so not only are they getting the $3, but they're going to go drain your account or pop your credit card. So that was a— they're smart and they will go to any measure.

Highly incentivized.

And they're not afraid of— yeah, highly incentivized.

Yeah.

No margins. They don't have to worry about margin. Right. It's all— it's 100% margin. So— and there's a— the other— the last thing I will say about that, there's a human toll to this, like the mules that move this money around. It's not Once you get the money, you got to get the money out, and that, that turns into money laundering. And that's— there's a real human toll there, not just on the victims but on those, those people that they employ. It's a horrible industry.

Well, and then with the proliferation of crypto as well, we're seeing, you know, more and more— I don't know if you've been following this, uh, this, you know, Savannah Guthrie case with her mom Nancy. Oh yeah, right. And like, just the, you know, they're trying to follow this crypto account, they just can't touch it. So That adds a whole other element to money laundering that just didn't exist even 10, 15 years ago.

I've been seeing a lot of— this is probably a little off topic, but I've been seeing a lot of stuff on social media about like people saying, oh, you can't get your money out of the bank. So like their, their whole video is they go try to pull like $50,000 out of a branch, and of course the branch is like, no, you can't. So then the narrative becomes they don't have the money, and it becomes like this digital run on a bank, and And when you talk about balancing controls, where is it? As a consumer, I want my money. That's my money. I should be able to get it out. But money laundering has to be addressed. You can't just let it. And so that dynamic is in and of itself just a whole podcast episode, probably. Just that balance is tough.

Well, we'll kind of wrap it here. Any last parting thoughts, right? As you think about our listeners, right? These are fleet managers across the country. Anything that you want to leave with them as saying, hey, like if you just do one thing, start here?

Yeah, I think it's those controls, not just spend controls. It's look at how your accounts are accessed. Do you have multifactor setup? Do you require phishing-resistant multifactor passkeys? Even SMS is better than email. So I would say just take a few minutes, use AI through ChatGPT or Gemini. Those are great tools to say, Here's my current setup. What can I do to improve that? And just spend some time investing in creating an environment that's as controlled as you can make it. Because like we talked about, the, the smaller that perimeter, the safer you are when the perimeter— or you don't have a perimeter fence— spend controls, access controls, authentication. When you don't have a fence, it's, it's the Wild West for the fraudster. So I would say start there, make sure you've got the right controls in place.

Yeah, I'd echo that. As you know, something I learned recently You know, if you're relying on, let's say that you're using Amex and using like AtWork or something and you've got everybody with their own company cards, there's no spend controls on that. You know, everybody gets the same limit. You can't go into card by card and say, well, this card has this and this card has that. It's no, it's the full thing. So implementing something like WEX, I know RoadFlex does this. I don't know about Comdata and Voyager. I got to imagine they do too. But implementing just that level where you get the access and the benefit of a closed loop transaction network That you can have that control card by card, PIN by PIN, making sure that people are following the policy and that they're spending it where they're supposed to be. Number one thing in my mind, just start there. Then education and training. Just learn. The more you learn, the more you're investing in your own security. You'll benefit from this personally because you're not going to fall prey to these fraudsters because they want to come after you too. But you'll protect the company and you won't be the reason why the company suddenly lost $10 million in a day. I don't want that on my plate or on my resume.

But that's right.

I think there was one more story, and that tone gets— yeah, go ahead.

Sorry, the last thing I was going to say, that tone gets set no matter if you're a sole proprietor with, you know, you and your spouse, but that tone gets set from the top. If it's a priority for the C-suite and enterprise, or, you know, the owner, it filters down. If you got a guy that's responsible or a woman that's responsible for fraud and everything falls on them, your environment's exposed. That tone needs to be set from the top down.

Yeah, and that urgency and the just, you know, reminding everybody. We have a monthly shame list for those people who don't, you know, take their security training, and you just don't want to be on that list, right? And so if the owner's showing up on that list, it's, you know, not a good thing. That means they're depending on everybody else to do it, and that's, you know, it doesn't apply to them. So yeah, all right.

Yeah, that's a really good point.

Well, Will, thanks for taking the time with us today. Hopefully, you know, everybody listening to this episode, you guys got something out of this. I learned a lot talking to you. So thanks for being here and being a resource for our listeners. I would go, you know, if you guys are on LinkedIn, you know, go look for Will, connect with him, you know, go check out what WEX has to offer, go invest in some of these controls. And thanks for joining us today.

Yeah, thanks for having me. This was great. Thanks so much.

All right. With that, till next time. We hope you enjoyed the show. If you'd like to help support the podcast, please share it with others, post about it on LinkedIn, or leave a review. Want to learn more about our fleet management software Fleet 360? Check us out at rtafleet.com. If you want to learn more about having your fleet evaluated by our consulting team, go to fleetconsulting.com.