The Power of Voice Biometrics in Today's Fraud Risk Landscape - Simon Marchand - Episode 166

Hello and welcome to Fraud Talk, the ACFE's monthly podcast. I'm John Duffley, and in this episode, we're diving into the world of biometric data and advanced anti-fraud technologies with a leading voice in the field. I had the pleasure of speaking with Simon Marchand, an independent fraud expert specializing in external fraud risk, identity, and biometrics. Now, Simon is a certified fraud examiner with more than 15 years of experience. And during his career, he's held senior leadership roles at GeoComply and Nuance Communications, which is now part of Microsoft. He's advised organizations worldwide, testified before the Parliament of Canada, and is a recognized voice on fraud prevention strategy and the ethical use of technology. Lately, Simon has been advising various technology providers such as Veridos, a global firm specializing in digital identity and biometrics, specifically voice biometrics, a technology that he has covered extensively in the past few years. In our conversation, Simon and I discussed the evolution of voice biometrics, how AI and technology are reshaping fraud, the layered defenses behind modern biometric systems, balancing innovation, trust, and privacy, and why human oversight and strong governance remain essential as AI becomes more embedded into fraud detection and decision-making. But first, we have a short ad from Concentrix. Fraud moves fast. Manual ops don't. In that gap, it's costing you time, money, and customer trust. When AI and humans work together, investigations are faster, chargebacks drop, and teams can finally breathe again. No hype, just results. Download their whitepaper at the link in this episode's description or visit concentrix.com/fraud-dispute-whitepaper. All right, Simon, appreciate you joining us today. This is, I think, a homecoming of sorts. We'd first kind of connected, you know, a few weeks back and went back and listened to your original episode on Fraud Talk back in 2019 on biometrics and voice biometrics in particular. So we've come a long way since then, but it's great to talk to you and have you back.

Thanks for having me. Happy to be here.

Yeah, so right out the gate, you know, I think one of the first things I wanted to kind of just set the table for our audience a little bit, your first exposure to get this biometric data, voice biometrics in particular, and this type of technology, and what your initial impressions of it were when you first were exposed to it.

Yeah, I think my first exposure was in 2019 actually when I started working with Nuance, right? That company that doesn't exist anymore, it's now part of Microsoft, but you know, you know, I had been spending most of my career in fraud prevention, running fraud prevention teams in banking and in telcos. And then this company approached me with an offer to start talking about what voice biometrics could do, but I hadn't used it before. So it was a shock for me to see that new technology back then, because you know how it is, right? You work in banking, you work in telcos, it's, you know, shoestring, bit of duct tape, you try to make what you can with, you know, a few Excel reports. Back then we still had paper applications and then we had this great technology coming to say like, oh, well, with 3 seconds of audio, we can tell who you are. And with a few more seconds, we can find you like in a bank of fraudsters. So 2019 really was a revelation for me. It was like that brand new technology from a fraud perspective that I had never seen before, never seen in practice, never seen in production. And yeah, slowly but surely, I started discovering what could be done with it, who was using it, you know, very, very popular in the UK, for example, some big, some Some big banks in the US were using it, some in Australia. In Canada, it really hadn't made its way yet, or not quite in all the big banks. And, you know, 6 years, 7 years later, you can see that it's kind of everywhere now. It's very ubiquitous. So yeah, it was a shocking experience, but a very, very thrilling one. Because then you can see a technology that's not just allowing you to find the fraud, but actually allows you to find a fraudster. Behind it. So it kind of shifts how you approach fraud, your investigations, your collaboration with law enforcement. So yeah, it was a really, really exciting couple of years discovering that.

It was interesting, you know, kind of as, you know, from a layman's perspective, kind of my exposure, early research into biometrics for our conversation. You know, I'd read an article that you'd written some years back about the value of it, not just being specifically for, you know, fraud teams or companies, but also for customers and kind of creating like frictionless authentication, being able to protect their information and understand that it's protected. So it certainly seems like it has that inherent, you know, benefit, not just for like to, you know, what we'll talk about today, the fraud examiner, but also, you know, the folks who are engaging with these companies and has their data protected behind these sorts of systems.

And that's how it started, right? Before we started thinking about how you could use it for fraud detection and actually finding the fraudsters. The first application was to make authentication easier. You know, in the 2010s, we were starting to see those big data breaches, tens of millions of records being compromised. So typical security questions that most big organizations were using were not relevant anymore. Date of birth, mother's maiden name, everybody has that. All the fraudsters have that. So that's why it became kind of a customer experience concern saying, well, we can't keep asking more questions. We can't ask you to go confirm a one-time password on your phone or on an email because it kind of breaks the flow. So that's where the voice became kind of a natural next step for authentication use cases. And with time and as the technology developed and we got down to that 3-second kind of audio sample that you need to authenticate someone. So basically you're calling, you're saying, hey, I'm Simon, I need to change my address. That's good. That's all I need to know. No more security questions. Let's go straight to that. Through that interaction, then we started to have technology that was robust enough that you could apply it to fraud detection. But really, it was, you know, originally speaking, reducing friction, making it easier in call centers, going straight to solving customer problems. And, you know, when COVID hit in 2020, it became even more important to have a very reliable, frictionless experience that did not rely on two-factor authentication, or that did not have the same kind of friction or barriers in the interaction because you could not tell someone, well, you failed authentication, go to a branch. You need to bring a piece of ID with you. So security questions, the kind of stuff that you can forget sometimes, especially when you go out of wallet questions, like what's your biweekly car loan payment? Nobody knows that. So it became even more relevant from a customer experience perspective when it came to like moving everything to fully remote types of interactions. So yeah, it came from a customer experience use case that was the original need. And eventually the tech evolved to, okay, how can I find that fraudster? Like, do I know that person that's calling? If it's not Simon, is it a fraudster I've heard before? And, you know, it evolved from there.

Yeah. So kind of on that thread, Simon, I wanted to ask, going back to the, let's say the building blocks of biometric data and voice biometric in particular. You know, when, what, what, what does a company who employs this type of technology, you know, how do they use voice biometric data? And you mentioned it there, that short snippet that creates the biomarker that tells the, the system, this is the person you're talking to, right? How does a company in the technology actually differentiate, let's say, you know, the person who's speaking like myself versus somebody who maybe has cloned my voice, created a deepfake of myself. How, how does the system recognize that exactly?

Yeah, there's— I think it's good that you raise it because there's more than just ensuring that it's John, you know, talking on John's account. When you look at biometric information, let's take voice biometrics, but the same applies to facial recognition, right? You have the core biometric system that tries to identify, is this John that's speaking to me or that's being shown to me? That's one thing. But you have additional layers of technology that will be there, right? You have Liveness detection. Is John actually there talking to me? Is he live talking to me or is he present in front of the camera talking to me? Is there any kind of artifacts I can use to detect that there's an injection? So like a recording, for example, or audio being pushed from a synthesizer straight to the microphone or a virtual avatar, a deepfake avatar being injected straight into the camera stream. So that you have that layer and then you have an additional layer. Do you have deepfake indications? So not just do you inject something because you could be injecting a recording, but are you presenting me something that is inherently false, that has been synthesized from a sample, from a very large sample, from extrapolation on, you know, a base model? All of these approaches are layered. So from a user's perspective, you know, when you call in and you say, I'm Simon Marchand, okay, we've identified you with your voice, we move forward. It seems very, very easy and straightforward. The The reality is behind the scenes, there are multiple checks being performed in parallel. You might have very complex models, or you can have layers of different models all working at the same time. And that's where very often biometric technology can have kind of a bad reputation or bad press sometimes, because you'll have a journalist that manages to break into a particular system using a deepfake voice, for example. The question is always, well, were they trying to detect? The deepfake voice. And very often, it's hard to make that differentiation between deepfake detection and voice biometrics, or deepfake detection and facial recognition. You need to have everything enabled, and you need to be looking for those if you need to detect them and stop them.

It is a fascinating technology, the multiple layers. And you mentioned it earlier, Simon Marchand, the traditional authentication was, you know, what is your grandfather's middle name, kind of these basic questions that you know, any fraudster who has access to some of your data can track some of this stuff down, and they have all those things. So I'm curious, you know, kind of thinking back to last time you were on Fraud Talk, so 2019, so it's been several years, you know, what is the biggest change that you've seen in how organizations approach biometric data and identity verification as part of their fraud risk management programs?

I think there's two big aspects to it. The first is, it used to be very exotic to use biometrics. It was kind of the high-end technology that the big organizations would have, very large banks, very large government services, you know, that kind of stuff. While now it's more of an expectation. You know, more and more we even have consumers that are saying, well, you're still asking me those questions. I, as a consumer, know that my information is out there. It's been breached. So the knowledge that consumers have really drives adoption of these newer technologies. It is so much easier also to deploy. Back in the days, you needed to have professional services come in. They needed to make a modelization to your demographics, to tailor the deployment to your particular speakers. Now you can just take, like, if you have a very good technology, it will work well out of the box. It's a lot more tailored towards a DIY deployment. So small organizations can now afford to do it. While before it was, like I said, big organizations only. So that's kind of the first big shift. It's now everywhere. The second shift is there's now a real concern around deepfakes. So when I talked in 2019, you know, that question came up like, okay, what's the threat of deepfakes? You can now synthesize a voice. And in 2019, my answer was, well, it's not a threat for the foreseeable future because of the complexity of generating a voice. And back then, you know, generating a face would require tens of thousands of photos or video snippets. Same was true for voice. I think with time, especially in the past 24 months, we started to see that technology evolve so rapidly to a point where anyone now can use it. So you don't need to build your own model. You don't need to know how to code. You can just go on an open platform, use your voice, use a couple recordings, few seconds. Typically you can use 3 to 5 seconds if you want to do something functional. 30 seconds, you'll get a voice that sounds really, really like the person that you're copying. So now the concern that these tools can be used nefariously against organizations is also shifting how they position themselves. So now they're not just looking for voice biometrics, they're looking for deepfake detection. They're not looking for just facial recognition, they're looking for injection prevention, presentation attack detection, deepfakes as well, liveness. All of that kind of becomes that used to be, again, very exotic and kind of a theoretical threat becomes a more concrete threat for most. So yeah, that's really shifting what solutions really fit the requirements now versus what was, you know, enough a couple of years ago.

Yeah. And we'll talk a little bit about this a little bit later is that, you know, the tool selection process and understanding, you know, like, like to your point, what, what, what is actually right for the organization? What's right for our unique circumstance, our budget, right? There's a lot of concerns there, which I know we'll talk about a little bit, but kind of on that, that point there about the evolution of the technology, you know, as we were preparing for this time, one of the things that had come up is this notion of the language barrier essentially being eliminated because of, you know, deepfake technology and voice cloning and being able to not just copy and replicate someone's voice, but do that across borders and do that in different instances. So I'm curious how you see this particular evolution impacting fraud teams and just like how they're able to verify potential threats and verify like the validity of these when it comes to that additional layer of complexity of the language barrier?

Yeah, there's no barriers anymore. It comes to what I was saying earlier where, you know, before if you had, let's say, people speaking English and Spanish in your customer base, well, you needed to create models that would fit, you know, English speakers, Spanish speakers, which meant that for a very long time in Quebec, for example, where we all speak French, it was not really a threat not really a concern because most models were built around English speakers. So if I tried to enroll with a French voice, I didn't have the right sounds to make it a convincing English voice. And with an English model, you couldn't make a convincing French voice. Nowadays, language is not at all a factor. A good voice model will work across any kind of languages. So you can work in any country or across multiple countries. Which means that yes, it's a bigger threat because fraudsters can now target speakers of all languages, but it also means that the technology is a lot more powerful. It's a lot easier to deploy. So from an investigator standpoint, when you deploy biometric technology like voice, well, you can deploy it across every single branch, every single geography where you operate. You don't have that concern that, oh, I can only use it in English-speaking countries. You can put it everywhere. And because the technology is more accurate, you know, with time and with the research and the evolution of algorithms and the new models that we're using, it also means it's more accurate when you do investigations. So when you take the voice of a suspect, for example, and you want to look at the past 30 days of calls across your entire organization to find the other calls that were placed by the same human, well, now you will accurately and more reliably get those calls surfaced to, to, to, relevant to you so you can do an investigation that will not require for you to listen to 100 calls. You'll go straight to the 5, 6, or 10 calls that are relevant to your investigation. So language is not a concern anymore. At the same time, it means that the system has evolved, it has become more accurate, and it means that from a fraud perspective, you also have better performances, you get your results faster, and you get better results in general as you investigate with, with VoiceBio.

And it sounds like fortunately there is certainly no limit to the amount of data, right? If a fraudster is going to perpetuate a scheme multiple times, maybe it fails once, comes back again and tries it again, you will have that on record, right? So to your point, you can scan all these calls over a period of time and, you know, you may not have to worry about coming to it, you know, a second time because you do have that, you know, proof now on record that this is the person who, is trying to defraud us and we have their voice earmarked.

And because it's also so much easier to deploy and so much cheaper, right? Much cheaper today than it was 10 years ago. It also means that you can protect every single channel. What we used to see, you know, before is a company would say, well, most of my fraud is happening in the call center for personal services, let's say, and it's account takeover. So we'll just deploy there. So fraudsters would pick up on that. They would adapt and they would start creating a new account or go on the business line. Or try to do some internal attacks, you know, target directly an employee, pass as a fake IT representative to do some ransomware, you know, focused attacks, things like that. So you always needed to find a new attack vector, then decide if it was worth deploying, so on and so forth. Now, it's so much cheaper and so much easier that you can protect virtually any possible channel. So if a fraudster has been identified at any given point, they're quite literally barred from your organization. They will not be able to call anywhere else. So if they're creative and they try to attack, you know, different types of employees or accounts or business, it doesn't really matter anymore. They need to go to another organization. So it makes it very, very costly for fraudsters to attack certain organizations. It shifts the way they operate. And obviously, I'm sure we'll talk about it, but obviously looking at how LLMs have transformed how fraudsters attack and how AI is driving attacks in a different manner. Makes it quite the race. You're kind of always looking for the next way that they'll try to synthesize a voice, the next way that they'll try to socially engineer someone, but at least you can now deploy the technology at every possible point of contact. So you have kind of that safety net.

One of the things too, Simon, we kind of spoke about before is, you know, this idea that these attacks happen, right? But identifying legitimate proof and evidence when it comes to deepfakes is, Maybe not always so clear. You know, we, we've talked about stories of CEOs who have their voice cloned. You know, it, it rings up in the news. You mentioned this before, you know, journalists can kind of replicate this and see it happens. But, you know, I think the reality is, is that, you know, when it comes to the type of scheme, CEO fraud happens all the time. I'm sure everybody listening has received a phishing email from someone pretending to be the CEO of their company saying, hey, I need you to send me the credit card. I'm on a business lunch. I need it now. So the technology isn't necessarily creating new frauds, it sounds like, as much as it's making them more effective, if nothing else. And then to your point, the systems are now forcing fraudsters to these other channels and different vectors to actually execute the scheme that traditionally we have signs of, we kind of know what they are.

Yeah, I don't think AI has really invented any new fraud vectors or new fraud schemes. Like you mentioned, right, CEO fraud's been there for 30 years, maybe more. The question I always ask myself when I see a story in the news about CEO fraud using deepfake and impersonation and all, like, do they really need deepfake to really perpetrate that? And when you start looking at those stories in more details, very often, like there are some cases and stories where they were proofs and they were, you know, screen captures that can prove that there was some deepfake involvement, but very often a bad phone line and a bad imitation is enough. Same goes for elder abuse, right? The fake grandchild calling in and then you'll see sometimes in the news, "Oh, they must have used a deepfake attack for this." Most of the time, good social engineering is more than sufficient. What we start to see happening though, more and more is that the synthetic voice item is just an element of a more complex problem. So now what we start to see, which is a real threat, is not necessarily CEO fraud, but it's the orchestration of very complex attacks where you have an LLM, you have agentic AI all being layered together to, for example, at scale, go create accounts. And as they create accounts, they have agents that will generate deepfaked IDs, and they have the generation of a deepfake avatar. And all of that is done without human intervention. So that we start to see more and more when we talk about deepfakes and AI, it's mostly that today. So it's like scaling an attack. Same goes for phone calls. You can be a fake representative, but you can only make as many calls as you humanly can take in a day. If you can have a good convincing synthetic voice, then you can make 10,000 calls at the same time without any kind of humans being involved. So that is the kind of use cases where we see synthetic voices being used. And the same goes against call centers. If you can start scaling your attack and have those synthetic voices being generated automatically, very specifically against banks that don't have voice biometrics, you just want to talk to an agent, you have personal information, they will be asking you security questions. So you can just synthesize the response. That is a real threat, a real immediate threat. That's something we should be worried about. So lots of organizations that still don't have VoiceBio, for example, should be looking at Can I at least detect that my agents are interacting with a synthetic voice? You might not know that it's Simon's voiceprint. That doesn't matter. It comes with legal considerations, but at least make sure that it's not a robot talking to the agent and using all of the stolen information in a complex orchestrated AI-powered attack. So yeah, AI has really transformed the attack. It really allowed to scale to go to some industrial level of attacks, I don't think we still see so many of those complex CEO fraud using deepfakes and all, because it's a lot of effort. It's a lot of investment. You can probably do something much easier if you attack smaller fish.

Yeah. So you brought up an interesting point there, that kind of, you know, frontline awareness, frontline employee training. You know, when you're speaking with the clients, Simon, you're, you know, they're very adamant about integrating AI into their fraud prevention strategy. They want to make the tools available. They want to make everybody have knowledge, training, things like that. You know, I'm curious, what, what's some of the first questions that you're trying to answer for them? You know, what are, what are organizations who are maybe at the, the very early stage of, of this technology, but understand maybe the value of it? You know, what, what kind of questions are, are you trying to answer for them to understand how it can most positively impact them if they wanna bring this in?

Well, the questions, you know, the questions you get the most are like, can you help me bring AI into business? My, my C-suite, told me I need more AI. Truth is AI has been out there for 20 years. There's different types of AI. It could be machine learning. Back then it was leveraging big data with some automated machine learning processes. It's really about taking customers away from the solution, which is I need an AI-powered solution, and going back to the problem. What's the issue you're actually trying to solve? So you don't get kind of caught up in just evaluating a small portion of vendors because you think that their features are going to solve your issue most effectively. And sometimes it's just helping them take a step back and be like, what are you trying to solve? It's an authentication problem? Okay, let's not talk about specifically AI or specifically one-time password or whatever it is. And let's look at the problem. Let's map out the risk. Let's see exactly what the flow is like. Let's see what one particular solution can bring in terms of new vulnerabilities. And yeah, really take a step back. That's the most important thing that you can do as a trusted advisor when you talk to a company that's really coming to you for technology, because the solution will not always be biometrics. It will not always be defect detection. It will not always be many things. And then when it comes to the next step, which is I want to bring AI not as a frontline defense system, not as a layer of defense, but I want to bring it in my operations. That becomes a very interesting conversation, right? Because it becomes a conversation of what are you as a company or as an organization willing to let AI make in terms of decisions? And it's not just having AI give you a risk score on which you can make a decision, but literally letting them act on a particular account, a particular situation, decide what the next steps are. And once you start kind of decomposing the potential impacts of letting AI make decisions for them, A lot of them are not so comfortable. I think we all still want some level of human interaction, which I think is healthy, especially when you're going to, you know, deny service or cancel an account and might have some impacts that could lead to, you know, lawsuits or things like that. So, so very two different aspects. And I think from a fraud perspective, there's a lot of appetite to bring more AI in, in the prevention layer, maybe in the detection layer. When it comes to management and making the decision, we're not there yet. When we start decomposing the risks, there's a bit of, uh, of concerns around that.

Yeah, it's a great point you make there about, um, the autonomy that we provide AI. I feel like that's something I've seen a lot recently of, you know, how much access do we want the AI to do? How much liberty do we want to give it to make decisions, to make determinations? You know, and obviously prompting with LLMs is a big, you know, consideration of, you know, you have to ask the right questions, the input. Will serve you the output. So you have to be able to understand that. When it comes to like evaluating, you know, biometrics and kind of the implementation of AI, you know, what do you think is the right way to think about trust and ethics? And I guess specifically when we talk about biometric data and voice biometrics, when it comes to protecting the data and then the technologies that organizations are vetting, it seems like that's, you know, kind of a natural thing that we have to consider, especially in the fraud profession is trust and, ethics and reliability. But how do you think about it when it comes to, you know, determining to what you mentioned earlier, like where in the areas of the business we want to implement this, how much access we need to give, and then also building the trust with our customers that their data is secure behind all these layers.

Yeah, I've always said, and that's, that's, that's my personal but also my professional opinion, like full transparency with your customers is essential for it to work. And you will see some vendors that will tell you, well, if you just use it for fraud prevention, you might not need to disclose it because it's for the greater good. It might work, you know, according to certain laws and everything. But the truth is, especially in the United States, where you have some very, very strict regulations in some states, right? In Illinois, in California, in Texas, you have some very high levels of standards to reach. And transparency is always at the heart of those legislations. I think with With users, you need to be transparent, full thing. You need to tell them exactly what you're doing, why you're doing it, what it means for them. When you do so, from experience, typically you have very high adoption, right? Like 90, 95% of people will respond very positively when you tell them that it's going to be easier, it's going to be faster, it's going to be more secure than asking you security questions. Okay, just take my biometric print, right? Because we're used to biometrics, we use it on our phones every day, we use it on our computers. So if you explain why you're doing it, it's good. Now, you need to be very, very careful in how you're going to handle that information and manage it. It's not just about, you know, being transparent if something goes wrong. But also, like, you need to make sure that you're always constantly reassessing your own internal governance rules around biometrics. We've seen some very public cases with government entities that had created biometric prints without following proper steps around consent collection, for example, and they were forced to get rid of millions of biometric prints created over months and years to start over. So I think, you know, internally, you need to have someone that's accountable for biometric governance, someone that understands what are the implications from an authentication perspective, but also from a fraud perspective, because it's not going to be used the same way. You need to make sure that there's clear guidance as to how it can be used, how it can be exchanged, how you share data across different organizations, if you do share data at all, depending on where you are in the world. And yeah, so again, I think full transparency with clients, you need to disclose that. You can never do that secretly. But on the other side, clear internal guidance. And I think it cannot be too restrictive as well. You know, we might be tempted to say, you know what, like, let's put all the guardrails in place. Let's be super, super careful and not use it for, you know, anything more than just authenticating someone. I think it's going too far the other direction, because it does have great, great, great value in being used for fraud detection, which means you're going to be looking for people that did not consent. Obviously, a fraudster does not consent to having their voice enrolled. So you need to navigate that with your legal counsel, you need to make sure that you're you're doing it the right way. But I think prohibiting it completely in the organization is just making a big disservice to fraud prevention because it is so, so powerful when you start using it for that.

This is a great segue. You know, I think the, let's say, the elephant in the room, if you will, when it comes to this is the question of who owns identity, right? This idea between individuals and their self-sovereign right to their identity and their information, organizations to point at the enterprise level and being transparent if they're implementing it with their customers. So, you know, you mentioned it there a little bit, is making sure that from the legal aspect, you know, your consent, your, you know, your privacy requirements, everything is there. You kind of check that box from a legal perspective. But I'm curious how you see that changing in the coming years as inevitably, like you said, biometrics are already part of every day. When I look at my phone, it scans my face and opens it. So it's already happening. But I'm curious, as you say, more companies and more of this data sharing, and to your point, like here in the US, you know, cookie policies changing and how web use is changing internationally. Now I'm curious like what else you see kind of evolving when it comes to biometric data from that, through that lens of, you know, data privacy and consent of user.

We're in an interesting moment here in some countries. There's two ways, right, to handle biometric information. You can have something that's completely on device, completely under your control. So when you have, for example, your fingerprint enrolled in your phone, it is on your device. And if you lose the device, you need to enroll in the next one. So a bank, for example, that you unlock, your bank app that you unlock with your thumb, they never know who you are really. They just know that the phone has validated that the phone owner has used their thumb. When you talk about biometric in the way we've discussed it up until right now, we're talking about server-side biometric. So the organization holds your biometric information. And they hold it in their own environment. So your voiceprint, for example, with Bank A will not work in Bank B. You will need to re-enroll, but the bank still owns that voiceprint. And if you call from your phone or from a friend's phone or landline or Zoom call, it will always work because they're the ones holding it. It's not tied to the device. So I think that raises enormous concerns for a lot of people. When we start to see how certain governments and certain organizations are talking about sharing information, sharing cameras, for example, right? Like they do private cameras that can be shared or create a network that could then help prevent crime or find a lost dog. I'm sure we've all seen that. It obviously raises concern as to, okay, well, at what point can I be sure that this biometric information will not be used by entities that I did not explicitly authorize to have access to my biometric information. You have countries that are very, very heavy on public surveillance, where China is a great example of a country where I would not feel comfortable sharing my biometric information with any organization, because ultimately, if you do that, it means the government gets access to it. So I think we're in an interesting part in history, probably for the next couple of years, where it will really depend on how governments will put in the laws in place to ensure that there's a solid wall between private organizations that use it for fraud prevention and for authentication, for security, and government, so that there cannot be any kind of exchange of information. I think if we are unable to guarantee that separation between private and public, we'll see the adoption of biometrics, at least on an enterprise kind of environment, we'll see a drop. So yeah, I think countries that are adopting rules that are a bit more strict on that— European Union is a great example, right? I think it's going to make them a great service as they move towards digital identity, as they move towards EIDAS and these kinds of protocols. I think it will help them. I think on the other side of things, if there is a sense or a doubt that this information that you're giving to an organization could permeate to government or to an organization to which you did not consent to give your biometric information. Yeah, there's going to be, legitimately so, there's going to be some preoccupations around that particular technology. But I do think that it is relevant and it is useful and we cannot go fully self-sovereign identity. The main issue with that is, if I have 10 phones on which I enrolled 10 times, under 10 different identities, there's no way to tie these identities to a human being because every phone holds the information and the enterprise at the top with which you're interacting does not know if Simon is really Simon. So I think there's always an application where you need to certify that yes, the identity that's being provided to me is Simon's identity with the right biometrics with everything.. And that comes with a good healthy mix of self-sovereign identity, which I completely control, and some biometric factors that I will have to share with organizations with which I'm doing business. That was a big answer. I don't know if I might have gone too far with this one. But yeah, it's a complex issue.

It is. And, you know, I think I want to also bookend— I really appreciate your thought there. The negative, I don't believe is outweighed by the positive impact. It certainly seems like biometric data as a protection, as a, you know, fraud deterrent is very clear. I think it's pretty obvious, you know, and again, just in the short time that it's been implemented, relatively short time, let's say, as a protection mechanism, it's terrific as an internal control. Again, like to your point earlier, if the frontline is trained on it, if the system protects the data, it's, positive applications can, are, are very easily felt, it seems like. And, you know, I, I was wondering if you could just speak a little bit to that, because obviously you've worked with a lot of organizations who have implemented the technology and are, have seen the value of it. Um, just like anecdotally, you know, kind of some of the positive impact that you've seen across different business types. And, you know, obviously financial sector I think is the obvious one, you know, protecting customer data from the banking and financial services. But I'm, I'm sure that this technology has found its way into a lot of different areas that, again, has seen real positive change.

Yeah, I'll give you, I'll give you one example, right? So we know from the FBI's IC3 that about 80%, 83%, they say 83% of losses are tied to identity, identity-related fraud. So fraud becomes an identity question. When this technology is deployed, and I'll take an example from a company called Veridas that does biometrics, that's their core business. Where they deployed, they have observed that 1 to 6% of new applications is fraudulent with deepfaked identities or with something that didn't match, but it was showing signs of fraudulent IDs being presented. So like I said, could be a fake ID, could be an altered ID, could be a deepfaked face that was trying to match with it, but 1 to 6%. So imagine like the world we're in where most of the onboarding, most of the account creation that we're trying to do is going completely remote, completely virtual. If you don't have the technology and 1 to 6% of new customers coming in are using fraudulent information in some way, shape or form, I mean, you're just letting in huge, huge amounts of fraudulent accounts, which might not hit you today. You know, they might be there to be aged and to make sure they can build trust and they might hit you just one year down the road. Fraudsters are patient. But yeah, so imagine now like that we have, like we said, right, AI-powered attacks, LLM-powered attacks, orchestration and agentic AI leveraging all of these deepfake tools. It's not going to be 1 to 6% for too long. It's going to be 10%, 15%, 20%. You know, I've talked to organizations that have told me that in a given hour in the middle of the night, they can see up to 3,000 accounts being attempted to be created. So 3,000 accounts an hour, that's an awful lot of accounts you're going to have to look at. So yeah, like 1 to 6% accounts. I think that's my key number here. You need to have a solution to make sure that these can be detected effectively. And data validation, or looking at the ID itself with nothing else, it's not sufficient anymore. I've discussed it with ACFE a couple of times at the Canadian conference and in different chapters. You can generate a deepfake ID, very, very convincing deepfake ID that will be sufficient to fool any human reviewing it. So if you're only using the ID itself, the account's getting through. If you don't have any deepfake detection, I can guarantee that a good deepfake avatar, it's getting through.

Today.

It's going to be— if you don't have, you know, any kind of ability to detect injection in the camera feed, it's going to get through. So yeah, we need to move, we need to move very, very quickly, because every single company that closes that gap and implements that technology, whether it's voice bio in the call center or facial recognition, you know, in remote onboarding, they're closing the gap but they're also pushing fraud towards the other organizations that are yet to adopt these solutions. And I've seen it in the past, right? In the UK, for example, you were talking about concrete example, when voice biometrics was deployed in a big UK bank a couple years ago, they've seen their fraud in like 30 to 60 days just drop completely, nearly zero in the call center, because it just didn't make sense for fraudsters to keep trying. Once they figured that they were, their voice had been detected, it went from, if I recall correctly, 10 to 15 attacks a day, 10 to 15 calls, to zero. We have also seen in another bank in the UK, some criminals that were brought to justice and put behind bars because they were able to bring 400 cases together, 400 fraud cases under a single person. So that's also a very powerful outcome of it, right? It's not a $1,000 credit card fraud and another $1,000 credit card fraud case. No, it's half a million in credit card fraud, 400 victims, one fraudster, one criminal, who you can find a lot more effectively once you have biometric print for that individual. So there's benefits to everything in reducing the attacks, in speeding up your investigation, and making sure that you're not opening accounts that you don't want, but also in pursuing those criminals more effectively. And that's the best deterrent. Once you see that there's a threat, you know, as a fraudster, as a criminal, there's a threat or a risk in operating against a particular organization, you move to something else. And that makes the biggest difference, you know, on a day-to-day basis.

That, that story there, I think kind of, it's the perfect encapsulation. I know we're running short on time, so I just want to make sure we call that to light is the scalability from a fraudster's perspective is clear. The scalability from an organization's perspective, to your point, being able to capture all these frauds and understand that they are from a single person. With speed, with precision, with accuracy. Again, like going back to the original point here is the positive effects certainly outweigh the negative. And it's terrific to see that that's already happening. And I'm sure we'll see many cases of that as kind of the, the tech continues to unfold a little bit. Simon, so I have a couple of just quick ones, quick lightning round here to end it. Just a couple of things I wanted to kind of pick your brain on. So one misconception that you think anti-fraud professionals in particular have about AI. Either for good or for bad?

I think they see AI as all-powerful. And the biggest misconception is if AI is good enough to fool a human, it's good enough to fool a system. So, you know, Sam Altman made the comment, right? We can now synthesize a voice that's going to be so good, there's no reason to be using an obsolete system like voice biometrics. There's a difference between making a voice good enough for the human ear in making a voice good enough for a high-end, up-to-date voice biometric system. And, you know, if any breachable system became an obsolete system, we wouldn't be using our phones or computers or security questions or credit card because all of those have flaws. So I think, maybe not from all fraud professionals, but there's that kind of mix-up between what's good enough for human versus what's good enough for a system. The reality is, even though most deepfake technology today can fool any human, it is not clear that it can fool so effectively a good, like I said, up-to-date, recent, cutting-edge biometric system.

Yeah. Okay. One control or practice that you think, regardless of technology, will never go out of style?

I think what will never go out of style is you need a human to review it. So you have systems now that allow, like I said, to bring all the fraud under a single person and you can say, well, this is the human being that I think is committing those frauds. You still need a human to verify it before you push a new rule because you could have different rules that are leveraging voice biometrics. I think you cannot have a system that's fully autonomous. You still need like maker-checker. You still need someone that designs it, someone that pushes it to prod, someone that controls its performance. I think this is never going out of style. Whether it is a very basic rule, if this then that, or a very advanced AI model, nothing can let, cannot be running loose. You need someone to control it. You need someone to make sure that it's not discriminating, that you're not introducing any kind of pollution or bias into your model. So yeah, I think that's never going out of style, even though the technology is evolving and it's getting increasingly powerful and it it's also abstracting a lot of the factors that we're looking at. We don't really know what the AI is finding sometimes more and more. But I think it doesn't mean that at any point we'll be able to just let it run without ever checking. And we've seen examples of this in some financial institutions where some systems were just let to operate without supervision. And after a year or two, it started introducing bias slowly but surely because it would use, for example, the output of investigations and decisions into its decision-making, which didn't account for the potential inherent bias that investigators might have. So eventually it led to an algorithm that was kind of polluted by the decisions that were made from that algorithm's output. And that just becomes a very, very nefarious cycle. So yeah, I think those controls, like having proper governance, looking at the performance, having someone that's accountable for each algorithm's performance, that's never going away regardless of how advanced the technology is going to get.

I don't know that we're anywhere close to AI policing itself. And so I think to your point, that human judgment is so critical.

Let's hope we never make it there. I think it's always good to have a human in the loop.

That's right. Okay, last one, Simon. So one new development when it comes to biometric technology or technology in general, like one development or potential use case that you're watching for, maybe have started to kind of see bubble up, let's say?

The one thing I'm really, really looking at is how effective agents will become at self-improving, at, you know, trying to run an account opening, for example, generating the ID, generating the avatar, injecting the audio stream, and figuring out why it doesn't work. And then trying to improve by picking a different model to generate an ID or a face from, and eventually being able to self-improve on that particular model and just run the improvement itself, retrain the model itself, go find other information that can be used to build it. I think that's the thing I'm really keeping an eye on. We already know from some providers and cybersecurity teams that what used to take a few weeks, when a new security patch would come out, adapting to that would take a few weeks. Now we're looking at a few hours. So we're already there where AI is really, really pushing us against the wall and very quickly finding the new vulnerabilities and new flaws. We're not quite there yet for biometric and deepfakes, but I think we'll get there very, very fast with models that can understand the flaws of our systems as soon as it's fixed. And then try to push a new version of themselves against our systems. And because inherently organizations are more cautious and they're not pushing those fixes without proper checks in place, it will eventually create a gap that we'll need to address between the speed at which we're pushing something, the new vulnerability is found, and then the new fix can be found and pushed to prod. So yeah, keeping an eye on that for the next 18, 24 months for sure.

Well, with the speed of it changing and going back to the very beginning here, with the speed in which it's changed just since you've been on the Eston Frog Talk, I think, um, keeping a thumb on the pulse can be really important. So Simon, I really appreciate you taking the time today, sharing some of your insights. Obviously you're well traveled, well spoken. Um, obviously people I think can get connected with you on LinkedIn if they're interested. Um, anywhere else people might be able to, to get in touch with you? I know you'll be on the speaking circuit here coming up. Um, but anywhere people might be able to catch you?

Yeah, I'll be talking with the ACFE Chicago chapter. I'm doing some work with the ACFE DC chapter if I can, looking at ACFE New Jersey in the coming weeks as well. So I'll be closely involved with many ACFE chapters talking about the threats of deepfakes again and the value of voice biometrics or biometrics in general. So yeah, if we don't connect in a big organization or a big conference, maybe we'll connecting a small conference close to, to close to you.

Absolutely. Well, Simon, I appreciate it. And obviously I appreciate everyone listening today. You can find every episode of Fraud Talk on acv.com, Apple Podcasts, Spotify, wherever you listen. For Simon Marchand, I'm John Duffley. We're signing off.