Account Takeover: Why Your ATO Controls May Not Be Enough Anymore

Hello and welcome to the IntelliCheck podcast. This is a show where we delve into the news and issues around identity verification, identity fraud, and the tools needed to combat it. I'm Charles Goldberg, your host for this episode, Why Your ATO Controls May Not Be Enough Anymore. This is a follow-on episode. The first one is account takeover, what the industry is getting wrong. However, if you haven't listened to that episode, no worries. You can still learn a lot from today's episode and listen to the previous episode later. So I'd like to welcome back my guest with all the answers, Brian Lewis, the CEO of IntelliCheck. Happy to be back. Thank you, Charles. Yeah, thank you, Brian. I know your time is very valuable and appreciate you returning for this very interesting topic. And in our last ATO episode, we discussed the scale of the problem. Javelin Research said it was a $15 billion problem impacting 6 million people. This is just US stats and had an 18% growth rate year over year. We also established that the problem is now bigger online than ever before. And TransUnion reported that digital ATO grew 37% year over year from 2024 to 2025. So what are the controls that companies are relying on today to stop fraud? Well, yeah, and I think it probably makes sense to talk about why the fraud keeps going up, right? AI is making it a lot easier to have way more attempts, you know, in the digital world. So, you know, the tools that people have been relying on still to this day, you know, are a lot of it is knowledge-based authentication, right? Answer a question about where did you live? What was your first car? You know, so much of that is now, you know, you can find it on the web. So the tools that people are using, I think are somewhat antiquated. You know, I even, you know, I laugh when I go into a bank sometimes and what they want to do is, you know, take that black light pen and shine it at my driver's license. I have stacks of fakes on my desk that we have from customers. Every one of them will have those black light things shining. So you've got to get smarter. The bad guys are really smart. They know what they're doing. They're using AI. And that's why I think we're seeing this rise. They're, you know, they are defeating the tools that most are using. Okay. So what should companies rely on before giving someone access to an account? Like, the ability to transfer large amounts of money between accounts, even though they've never seen those large money transfers between those two accounts before, but they're like, okay, you know, we'll transfer your HELOC loan over to this. Okay. And then they're going to be able to transfer it to another account. Or even more so last episode, we were talking about how once people reset passwords on social media accounts or email accounts, I mean, that's it. You got the kings to the kingdom, because that's also your second factor often is. So what is the right process? I think there's like two ways you can go about this, right? First is, one is very deterministic. And the other is, is data driven, right? Now, first, when I say deterministic, it's like, you know, it would be, can you prove with near certainty, is the document that somebody is presenting you to prove who they are? Is it real? You know, and that's part of what we do, you know, at IntelliCheck, right? We know what's in the barcode and all the hidden security features for, you know, right now in circulation there between Canada, the US and all US territories, about 250 different barcodes. And they're all, they're all different. All these stacks of barcode, of fakes I have on my desk, they all scan and they match the front. Doesn't mean it's real. And I think people confuse scanning with reality. But no, you need to know what are the hidden security features. And then there's also what can we do with data? You know, and I'd say about half the adult population in US and Canada goes through our system every year. So we, we know, we see anomalies. Like, this doesn't make sense. You know, Brian has never done this before. And how do you flag that? So, you know, I think it's a, you know, a little bit of both using data, but also using something that's very deterministic. Because if the first step in the process is like, this piece of plastic is fake, why waste all the downstream money, right? Start just pressing that person now. And I guarantee they walk away because they know they've been caught. Yeah, and then once that fake ID goes through, so there's, it's usually synthetic IDs. So maybe some of it is the real customer name, but then very important parts of change, like the portraits change. So instead of being, you know, the picture of the 65 year old whose social security check you're trying to go in, it has, you know, the other person's picture, or the address has changed, because you're looking to get, you know, retail products shipped to a different address. So, so it's hard to catch. And it's garbage in, garbage out, right? The whole point detection system is being based on that synthetic information that you let through. And you have to be careful about a lot of it, because the data will often match, you know, we look at a lot of the fakes, you know, and it's simple enough, you can go to certain websites and find out, you know, is there a Brian Lewis at this address when we look at the fakes? And yeah, it all matches, right? And then, you know, UnitedHealthcare, I was part of that hat. They had pictures that were hacked of driver's licenses, right? So it means I can create a fake that will match everything on the driver's license, the document discriminator, the, you know, the DLID number, I mean, all of those things are going to perfectly match what is in a database already. But what they can't do is match what's in the barcode for that jurisdiction, for that data issuance, and all the other things that are in the database. So, you know, it's hard to catch. Right. Yeah. And like you said, all that real driver's license data is out there. I was just reading an article that reported in June, a company in Buffalo, I won't call them out, but they lost driver's license numbers, social security photos of driver's license for all 50 states, like they had some data from licenses from every state. And Yeah. Right. Earlier this year, it was, you know, kind of a big article within the realm of just how much is on the dark web. And there was an auction that started at $10,000 for a collection of DMV licenses. And the, you know, the marketing for it was over 90% of this stack of licenses they were selling, I think it was 54,000 licenses were not expired through 2026. Right. So, yeah, that data is out. Yeah. And you combine that, you combine that with everything else that's known about you, right? Social security, phone number, email, where you have credit, where you don't, where you have a mortgage, where you have a HELOC, you know, all those things that is available. And you combine, you know, organized crime, knowing who you are and able to replicate, your identity, you know, with any one of these, you know, bajillions of fakes that are easy and cheap and really good. They know where to go to rip you off and make one heck of an ROI for them. Because honestly, it's about 60 bucks, 20 bucks to get all your information, about 40 bucks to get one of these fake licenses. That's going to fool almost everybody. Okay. So I think the in-person it's really easy. It's easy to picture how to check for a license properly. You know, human looking at the license, that's not proper because the fake IDs are so good. Using most of the traditional ways of digitally looking at a license is not good because they use OCR optical character recognition. And they're just essentially being faster than a human in looking at the license. They're looking at the templates that laid out, right. Just like a human does, but it's, you know, AI knows all that too. And it's creating these high quality licenses. So it's passing those systems, visual checks, just like a human visual check, right. So you need this secret information in the barcode like IntelliCheck has. And you know, you explained all that with the 250 formats that are active today and how IntelliCheck is really looking at that security information to differentiate. And AI doesn't know that, right. And that's very secret information. Okay. So we understand that in the physical world, but how does a company add that into their digital experience since that's where ATO is exploding? You know, basically your phone gets turned into the device that is going to be used to, you know, authenticate you and the license. Now, I will say, you know, we can do barcode, we can do OCR, we can do facial recognition. We allow our customers to decide how much friction they want to put into their customers' lives. And that's what IntelliCheck is all about. It's going to allow process. They choose, right? You know, one through three steps. The vast majority of of our customers do not go past just the barcode because they see each step you put into the process you will have card abandonment you know unless you know you know we do have somebody you know some customers are doing you know subprime and all that and people want the money they're going to do whatever you ask them to do but you know i don't know about you know you or me but you put too many hurdles in my point i'm like i'm done i'm not going to do it anymore so the majority of our customers rely on just we turn the phone into a scanner scans the barcode we parse the data we give them everything they need to fill out whatever the downstream process is and we give them an indicator of whether it is a valid invalid or valid but expired and then they can make their decisions on their end but then you know you put too many hurdles in my point i'm like i'm done i'm not going to do it anymore also if people do want we ocr front to back and again facial recognition if they want to make sure that you know we prove that the plastic is real and i in fact are you know i'm holding it right so it's it's it's me doing this this process but it's really you know we definitely see card abandonment the more you put in place so our customers are looking at you know the accuracy what we do in first step is it worth losing the ltv of this amount of clients uh and most they know you know that so they won't put in a ton of hurdles yeah you know so um i just had this experience myself i won't call out which credit card but it was an airline credit card and they had one of those um promotions where you add a second person they spend a little money on that second card and you know you get a bunch of points so i'm like hey what the heck you signed my wife up for the credit card and i'm like okay credit card i'm paying her bills anyway i might as well get some extra points out of it so um she got her card uh called to activate it she accidentally put my last four social security numbers she missed you know her what they were asking for not hers and it was very unforgiving once she blew it one time that was it yeah sounds like maybe good security i called and said hey this is the situation and they're like okay card is activated like i was like in my mind really like yeah i could have been anybody like they didn't like what should have they done what would have been a much better process for that call center agent to prove i should have charles yeah they should have authenticated you and we're in a ton of call centers and it's super simple person asks for your phone number text sent to your phone scan your license boom we know it's charles okay we're gonna go do it um because that is part of it right again the amount of information known about all of us makes it easy to impersonate you particularly nowadays with what a i can do even with your voice right you see the amount of people who are fooled um by ai you know voice you know creation it's scary yeah i've been seeing a lot of articles uh very recently about those uh you know spam calls whatever you want to call them when someone calls and then if you actually do pick up you don't hear any response and they're just it's ai making these phone calls to record your voice and record voices so if it decides to use you it doesn't take a lot of words anymore for ai to very accurately pick up someone's accent tone and voice and inflection speed all of that correct yeah it's not hard and you know so many people put stuff out um you know even what we're doing here today right this will get published i think it's going to take a lot of time to do it and i think it's going to take a lot of time to do it and i think it's going to take a lot of time to do it and i think it's going to take a lot of time to do it and i think it's going to take a lot of time and that's how it is so easy to replicate who and that's how it is so easy to replicate who and that's how it is so easy to replicate who you are oh maybe next webinar you and i could you are oh maybe next webinar you and i could you are oh maybe next webinar you and i could just be ai avatars and just be ai avatars and we could go out for breakfast while ai is we could go out for breakfast while ai is we could go out for breakfast while ai is making this next podcast making this next podcast making this next podcast might be better than us so we'll see might be better than us so we'll see might be better than us so we'll see nah nah nah hi um hi um hi um so let's so let's so let's switch gears a little and and switch gears a little and and switch gears a little and and talk about you know the in-person talk about you know the in-person talk about you know the in-person experience we just talked about digital experience we just talked about digital experience we just talked about digital so so so what are the controls today what are the controls today what are the controls today you know why are they failing like what can we we why are they failing like what can we we why are they failing like what can we we do about that do about that do about that i think so many controls are i think so many controls are i think so many controls are you know really relying on the human you know really relying on the human you know really relying on the human being to look at it and you know being to look at it and you know being to look at it and you know you know you know you know i travel with i've got a couple of fake i travel with i've got a couple of fake i travel with i've got a couple of fake licenses from the state i live in and i licenses from the state i live in and i licenses from the state i live in and i pull them out of my wallet and i show pull them out of my wallet and i show pull them out of my wallet and i show people the real one and the fake ones people the real one and the fake ones people the real one and the fake ones and say pick tell me which one's real and say pick tell me which one's real and say pick tell me which one's real no no no you know you know you know people maybe get it right 30 of the people maybe get it right 30 of the people maybe get it right 30 of the time and then you look at it and then you look at it and then you look at it and if you're gonna be comparing how and if you're gonna be comparing how and if you're gonna be comparing how that license looks that license looks that license looks to you know maybe a template a portfolio to you know maybe a template a portfolio to you know maybe a template a portfolio of templates that you have that that of templates that you have that that requires rather expensive hardware requires rather expensive hardware requires rather expensive hardware one of the reasons i believe that our one of the reasons i believe that our one of the reasons i believe that our customers like what we do for them customers like what we do for them customers like what we do for them no new hardware the thing that rings up no new hardware the thing that rings up no new hardware the thing that rings up merchandise in the store so if you're merchandise in the store so if you're merchandise in the store so if you're doing you know a new new credit card doing you know a new new credit card doing you know a new new credit card opening opening opening or um an account look up or um an account look up or um an account look up you know the same scanning gun that reads you know the same scanning gun that reads you know the same scanning gun that reads merchandise we'll read the barcode and merchandise we'll read the barcode and merchandise we'll read the barcode and we can tell you good bad or good but we can tell you good bad or good but we can tell you good bad or good but expired same thing you know you go into expired same thing you know you go into expired same thing you know you go into a bank a bank a bank uh the device that can read and deposit uh the device that can read and deposit uh the device that can read and deposit a check that's all we need so it's a check that's all we need so it's a check that's all we need so it's always just like configuration changes always just like configuration changes always just like configuration changes and i think that's one of the reasons and i think that's one of the reasons and i think that's one of the reasons you know and i do like you know to you you know and i do like you know to you you know and i do like you know to you know know know to our own horn here um we make it simple to our own horn here um we make it simple to our own horn here um we make it simple easy easy easy and very inexpensive for people to cut and very inexpensive for people to cut and very inexpensive for people to cut their fraud losses and and more their fraud losses and and more their fraud losses and and more importantly importantly importantly protect people right um protect people right um protect people right um because the thing that i found out about because the thing that i found out about because the thing that i found out about you know it's through talking to our you know it's through talking to our you know it's through talking to our customers customers customers pull money out of your heloc uh pull money out of your heloc uh pull money out of your heloc uh you know i as the bank i'm going to make you know i as the bank i'm going to make you know i as the bank i'm going to make you whole you whole you whole i is the bank and not the victim of crime i is the bank and not the victim of crime i is the bank and not the victim of crime the only person who can now report the the only person who can now report the the only person who can now report the crime is the person whose heloc got crime is the person whose heloc got crime is the person whose heloc got stolen really that majority of the time stolen really that majority of the time stolen really that majority of the time they won't do it because they've already they won't do it because they've already they won't do it because they've already been made whole right so these guys the been made whole right so these guys the been made whole right so these guys the bad guys know they're sort of in the bad guys know they're sort of in the bad guys know they're sort of in the wild wild west where okay wild wild west where okay wild wild west where okay no worries i got my money and i'm not no worries i got my money and i'm not no worries i got my money and i'm not going to get prosecuted going to get prosecuted going to get prosecuted that's interesting you think when the that's interesting you think when the that's interesting you think when the problem is a six billion dollar problem problem is a six billion dollar problem problem is a six billion dollar problem um yeah um yeah um yeah i guess that's an online end in person i guess that's an online end in person but still it took a lot of money that but still it took a lot of money that but still it took a lot of money that um um um yeah they would yeah they would yeah they would be more aggressive in trying to prosecute be more aggressive in trying to prosecute be more aggressive in trying to prosecute because it's usually a few bad apples because it's usually a few bad apples because it's usually a few bad apples right that are stealing a lot of money right that are stealing a lot of money right that are stealing a lot of money yeah well it's all organized crime yeah well it's all organized crime yeah well it's all organized crime there's no doubt about that you know and there's no doubt about that you know and there's no doubt about that you know and a lot of the digital stuff is coming a lot of the digital stuff is coming a lot of the digital stuff is coming pretty low pretty low pretty low yeah well you know what it does yeah well you know what it does yeah well you know what it does sound like it's pretty easy to catch a sound like it's pretty easy to catch a sound like it's pretty easy to catch a fake id if you have the right solutions fake id if you have the right solutions fake id if you have the right solutions you know a modern you know a modern you know a modern way of looking at even something as way of looking at even something as way of looking at even something as simple as the barcode um simple as the barcode um simple as the barcode um there's a lot of there's a lot of there's a lot of security and secret information in there security and secret information in there security and secret information in there for a reason and if you could leverage for a reason and if you could leverage that it really makes all the difference that it really makes all the difference that it really makes all the difference and uh you know companies that do want and uh you know companies that do want and uh you know companies that do want to protect their customers and reduce to protect their customers and reduce to protect their customers and reduce fraud that's an opportunity for them to fraud that's an opportunity for them to fraud that's an opportunity for them to look at that look at that look at that um but yeah so um but yeah so um but yeah so i think we're running out of time again i think we're running out of time again i think we're running out of time again um um um and uh i think this conversation between and uh i think this conversation between and uh i think this conversation between um you know everything that could go um you know everything that could go um you know everything that could go wrong is wrong is wrong is going to leave our listeners with as going to leave our listeners with as going to leave our listeners with as many nightmares as a wes craven movie many nightmares as a wes craven movie many nightmares as a wes craven movie but uh you know we can make a movie you but uh you know we can make a movie you but uh you know we can make a movie you know look out for the invasion of the know look out for the invasion of the know look out for the invasion of the identity snatchers but the good thing is identity snatchers but the good thing is identity snatchers but the good thing is intellicheck has to be the hero in that intellicheck has to be the hero in that intellicheck has to be the hero in that episode episode so that's all the time we have today my so that's all the time we have today my so that's all the time we have today my guest on the intellichek podcast has been guest on the intellichek podcast has been guest on the intellichek podcast has been intellichek ceo brian lewis and we've intellichek ceo brian lewis and we've intellichek ceo brian lewis and we've been discussing why your ato controls been discussing why your ato controls been discussing why your ato controls may not be enough anymore so be sure to may not be enough anymore so be sure to may not be enough anymore so be sure to check out the show notes and description check out the show notes and description check out the show notes and description if you didn't see the first episode uh if you didn't see the first episode uh if you didn't see the first episode uh you'll find that very interesting as you'll find that very interesting as you'll find that very interesting as well so you know you could find that in well so you know you could find that in well so you know you could find that in the same place you found this episode so the same place you found this episode so the same place you found this episode so that's all that's all that's all for this week and thank you for for this week and thank you for for this week and thank you for listening and stay safe thank you again listening and stay safe thank you again listening and stay safe thank you again brian brian brian thanks charles i appreciate it