3 Questions with VeriDas's David Stauffer and Simon Marchand

Hello, credit union friends. Welcome to this episode of 3 Questions. I'm Greg Miklug, President and CEO at CUinsight.com, and it's great to be joined by David Stoffer, Director of Sales for North America, and Simon Marchand, independent fraud expert at Verdas. David and Simon, thank you both for being here.

Yeah, thanks, Craig. Happy to be back. Looking forward to the conversation.

Yeah, thanks for having us.

Absolutely. It's good to, uh, good to have you back, David. Nice to have you on board with us, Simon, and I'm sure our audience is eager to hear from the both of you. So let's start with you, Simon. In your recent work, you've noted that many financial institutions and enterprises are fighting modern AI threats with tools that are designed for the past. So when implementing biometrics today, you talk about adding an entirely new layer before traditional workflows even touch a file. So why is this layer so critical, and what exactly does it filter out?

So I think the biggest change we've seen in the past, say, 3 years, uh, since we really started to see ChatGPT being adopted in those big you know, LLMs and generative AI models being used, there's been a transformation in the types of tools that fraudsters have access to. So when I started working in the biometric space around 2019, producing a deepfake was the work of, you know, taking tens of thousands of images, hours of audio, and knowing how to run the models and process it yourself on your own local machine. It would take several hours to get a good result and it, the result would still be kind of janky. So fraudsters really were not doing that. And for many years, fraudsters were not really doing that. We saw some, you know, celebrities and personalities being impersonated for scams and things like that. But what we started to see in the past couple years is now you don't really need as much. You can really create a voice that's going to be good enough for the human ear in just a few seconds of audio. A minute is more than enough. And for a face, you probably just need a photo. So that really shifts the type of protections you need to have in place. It cannot just be that you need to verify that my face is my face or that my voice is my voice, but you also need to make sure that you have all the extra layers that were not necessarily as important, you know, a couple years ago. So making sure that there's no presentation attacks, there's no, you know, recordings being presented to you, making sure that there's nothing injected in the video stream, and very importantly, making sure that it's not an agent, an AI agent in the back that's kind of acting as a puppeteer and just doing the whole onboarding for a human. And that's really the biggest shift. Fraudsters do not have to be involved anymore. They can very, very easily steal identities, collect the information they're missing, look on the web, look for some OSINT, and then generate fake IDs and fake video assets, all by letting an agent do it for themselves. And that really changes everything. It's not, you know, 10 attacks an hour you're going to see, it's hundreds or even, you know, what I see in my practice, thousands of attacks in a single hour. So now you need those extra layers. You need to make sure that it's not just looking at my face, but also making sure that it is really my face and not a copy of it. And, you know, more importantly, you need those biometric systems in place because now if you're relying on humans, for sure they're going to be fooled. Deepfakes today are good enough to beat and fool any human. So, so we need these new layers in our organizations for sure.

That's amazing. And I, I know we've all seen it, right? You see the AI that's prevalent online and it's getting harder and harder for the layperson to just see it. But then even the experts, you're telling me, it's becoming more and more of a challenge and you need those layers that you're talking about. And David, you know, Simon's point about generative AI attacks matches what you discussed at your recent ACU event in Austin, just regarding that sheer scale of the threat. So with billions in synthetic losses circling the industry, Why are leadership teams finding themselves in a legal and operational trap when outsourcing these defenses?

Yeah, it really comes down to the core of credit unions. Credit unions are member-led and service-led. They want to provide the best experience to their members. And we're seeing a lot of the times these credit unions are trying to get ahead of it by providing education. Don't take these calls. We will never call you. If this person or someone calls asking for information or sends you a text, Don't respond because we're not going to do that. But it's really hard to educate your entire member base at scale, right? Because members inherently are going to look to the bank to get transactions done. So if they feel like they are, you know, hurt or inflicted in any way, they're going to look to the credit union, especially when fraud or identity loss or something happens that negatively impacts them, right? They're going to focus on the credit union versus their own false or their own services. So the credit union sometimes feels responsible for some of these things or sometimes incurs extra cost for some of these things. So it's really important that they are protected across every single channel with technology that they can trust. Right? So if we look at what TransUnion said, have been in 2025, 2026 data breaches in their report, over 1.6 billion consumer records are exposed. So more than likely, then some of your credit union members are exposed and their information is out there. So if you have technology that you can trust, right, no longer to fall back on hopefully educating your members at the end of the day, you can focus on protecting those channels and having an algorithm and technology that you can trust that's consistent across all of those channels. So if someone calls in, they can verify their voice, right? That helps to create a first moat that makes it hard for fraudsters to get through. Let's say they get through that and want to conduct a higher-risk transaction, right? Then, like, changing a password, for example, right? You can trigger a step of authentication with biometrics. This helps to protect the member, helps keep them more secure, but helps to create more trust and enables you to kind of look past some of those hurdles that you might see internally when having to think about using biometrics or the question of PII data that comes up or question that comes from your members, right? Because at the end of the day, the goal is to provide a better service for your members. So it starts with better protection and more consistent protection that can be used across all of the touchpoints that your members engage with on a daily basis and making sure that those touchpoints don't increase friction, can actually minimize friction for you.

Yeah, there's a— I mean, there's a lot going on and you've both highlighted a critical tension in all of this, and it's that financial institutions often treat biometric security as a technology purchase rather than a strategic partnership. And while credit unions, and you touched on this, David, they're They're in a service-first culture, and that can also create exploitable vulnerabilities. So how can credit union leaders strengthen security without sacrificing member experience and those things that set them apart in that area?

Right. It's about creating something that, one, you can create trust with your members at the end of the day. From research that we've seen in the industry, it's that Members are willing to take on a little bit more friction if they feel like they're going to get some sort of benefit at the end of the day. Right? It's going to help them protect their assets or protect their, you know, their status at the financial institution. But ultimately, you want to add as little friction as possible. So making sure you work with a vendor that, you know, can actually sometimes reduce authentication time in a call center, removing those friction-laden question-answer formats that a lot of credit unions rely on right now, or being able to implement a voice solution that is streaming flawlessly while someone is talking and can authenticate them as they're going through once they're already enrolled, right? The idea is creating these touchpoints that help to reduce those average handling times, but also creating different ways to re-enhance that value. So you enroll with your face once, being able to reuse that authentication piece later on for other touchpoints helps to create that more value out of that biometric. They can protect users at every single touchpoint, and they get used to it at the end of the day versus clunky, more outdated, like knowledge-based authentications or sending an SMS to your phone every single time that you want to do something.

Simon, I know there's 3 questions here, but I'm going to give you an opportunity to answer that third question as well. What are your thoughts on that?

You know, I think for the past 20, 30 years, we kind of put the responsibility of keeping members safe. We've put that responsibility on the shoulders of agents and call centers, right? Like we ask them to play the police. We're telling them, here are the security questions you're supposed to ask, and then you're supposed to determine if the person that's giving you the answers, if they're really the person, right? Because in the end, that information, like David mentioned, is out there. Virtually every single person in the US is compromised. And I think now when we look at security, it's not just because we need to raise security, but it's also because we need to remove security from the shoulders of human beings. I was mentioning it earlier. Every AI-powered tool now in the hands of fraudsters is good enough to fool any human. So it's a great opportunity to say, Okay, we need to raise our game to what's really a threat today. And at the same time, we can remove that burden on the shoulders of agents. Like, if I'm calling in a credit union that uses voice biometrics, I'm gonna say, hey, I'm Simon. I'm calling to change my address. That's it. We don't need any more audio than that. So the person on the other end that's handling the call can focus on what they're actually hired for, which is to solve a member's issue, right? To provide them great service. And especially when you're talking about people working in a call center where they're going to handle a lot of issues. You're already frustrated as a member, maybe, right? You're calling in because you need to solve an issue. The last thing you want is for that flow, that conversation to be stopped by someone asking you questions. And in some cases, questions to which you don't have the answer. You know, who knows what's their biweekly payment for their car? Who knows how big is the loan on, you know, X, Y, or Z? We don't know that. So by removing those security questions, by moving to something more secure, like voice biometrics, for example, or facial recognition, you're not only preparing against future threats like the ones I mentioned, but you're also making it easier for your agents and you're making it easier and more seamless for your members. So it's a win-win-win situation. And I think that's really the key. We don't have to see higher security as immediate higher friction. Like I think nowadays we have security that can switch things a little bit, that can really raise one without affecting the other. And I'll add as a Last comment here. When we do use biometrics like that, it's not just an authentication measure. Uh, it's a fraud prevention measure. It becomes an investigation tool. It becomes a tool so you can track down the bad actors, so you can find the person that's trying to rob your members, that's going to affect them. So for your internal teams, for your teams of experts, you're also giving them the tools to do a better job at recovering the assets, at investigating, at preventing future attacks or future threats. So I think really it's the type of technology, if you're not considering it today, looking at the threats that we're going to be faced with and that we're already faced with, it is more than necessary right now to make the move, start planning for it, and start looking where exactly it's going to be deployed, how it's going to be deployed, and how it's going to be used, because it's now kind of expected by anyone.

Yeah, this has been very informative. Appreciate you both joining me on the video interview today, and appreciate Veridas continuing to bring this message forward through these, through these interviews and through other content on CUInsight.com. Thank you to both of you, David and Simon Marchand, for joining me.

Thank you, Greg.

Thanks.

And thanks to everyone who tuned in for this 3 Questions video interview. We'll see you next time.