Latest / Identity at the Center / #388 - Fraud Reduction Intelligence Platforms with John Tolbert

Transcript

#388 - Fraud Reduction Intelligence Platforms with John Tolbert · Identity at the Center

0:05
This is identity at the center. Welcome to the Identity of the
0:11
Center podcast. I'm Jeff, and that's Jim.
0:12
Hey, Jim. Hey, Jeff, how are you?
0:15
Oh, not so bad yourself. Doing great.
0:17
Well, mind if I start? To smile.
0:22
Something's up. Yeah, Go ahead.
0:23
Rant away, man. This is this is your time.
0:26
All right, my problem is with password less.
0:30
That truly isn't password less. There's damn password behind the
0:34
scenes and it's actually this to me, this is like exactly why
0:40
NIST said don't make people change passwords every three or
0:44
four months. Because when this stuff kind of
0:46
props up and you haven't been using your password, what are
0:51
you going to do? You're going to pick the
0:53
simplest password. You're going to write it down
0:56
and put it in like a notepad file somewhere so that on the
1:00
off chance once every three months where it says, hey, you
1:03
set up, I don't recognize this device.
1:06
You know, we're going to play a safe put in your password.
1:09
I don't remember my password. First off, it was like 852
1:12
characters long with all kinds of different special characters.
1:16
I don't remember. And then you go through the
1:18
password reset and then every time you type in the password,
1:21
for some reason it doesn't match the the policy.
1:26
Oh, sorry, that wasn't 862 characters long.
1:29
Or maybe it looks like a word and our smart software picked
1:33
up. We're going to prove it.
1:34
Then after the three tries, I feel sorry.
1:36
You must be some kind of scammer.
1:38
Start over, call the help desk like it's actually, if you're
1:42
going to set up a process like that, it's worse than actually
1:47
having passwords. Yeah.
1:49
So Grant. So this rant brought to you by
1:52
Jim's new iPad, which we're recording slightly out of order.
1:55
So I think it's like the next episode or maybe it's the
1:58
episode after that I remember where it's the one with Tobin S
2:00
that we're going to have come out where we talk about AI.
2:03
And Jim, you had started off that show saying you got the
2:06
iPad in the mail and it was in a box.
2:09
You haven't like unboxed it at that point yet.
2:11
And so now we're a day later and I'm guessing most of your
2:14
problems are because of trying to set up your iPad, am I right?
2:17
Yeah, well, OK, make your props to Apple, because you set up the
2:22
Apple and then it's like, OK, just hold your phone somewhere
2:25
close to this new device and we're going to bring over
2:29
everything you've ever had. My God, that's like such a
2:32
beautiful experience. Now don't forget if you ever
2:36
have to set up your Apple ID and forget your password.
2:40
I haven't done that in a long time, but my goodness is that a
2:43
nightmare. It's passwords, Jeff.
2:46
Passwords are hell. They are.
2:49
I mean, nobody likes them. You, you know, this, this
2:52
example you just gave is a perfect example of the pain that
2:55
people go through whenever they get a new device.
2:57
It's the same thing every time. You know, I, I have a bit Warden
3:01
password wallet that has like 1000 passwords in it.
3:03
I don't even remember them anymore.
3:05
I just automatically my, my, my workflow is just OK, create a
3:09
pass phrase, get it into bit Warden and then I'm never going
3:13
to remember it. And then just use that going for
3:15
it. So I don't know any of my
3:16
passwords except for the 1 to get into bit warden.
3:18
That's it. Yeah, well, I mean I.
3:22
Definitely can't lose that way because I lose that I obscured.
3:26
Then you have access to nothing. It's like you don't exist.
3:29
Death in the Digital Estate has just caught up with you.
3:33
You know, and that's probably something we should talk to that
3:35
group about because, yeah, what happens if all your credentials
3:38
are stored in something like that?
3:39
Can you set up like a legacy contact somewhere?
3:41
It's like, I think like Facebook does something like that where
3:45
if your your digital credentials can pass on to your next of kin
3:49
or maybe just start putting that into your into your will is, you
3:52
know, I bequeath my bit warden wallet and all associated
3:57
information to my wife. Good luck.
3:59
Yeah, yeah, No, I also got AI got a thumb drive, you know,
4:07
basically a a password key. And I, you know, before I used
4:12
to think that was such a great idea, you attached it to your
4:14
keys. But the only thing I know that I
4:17
have with me almost at all times except when I'm sleeping is my
4:21
phone. I don't always have my keys on
4:24
me, I don't always have my leather wallet on me, but I
4:27
always have my phone. So I I continue to think that
4:31
the phone is the best form factor for me and probably for
4:35
most people. It's ubiquitous.
4:37
I think, you know, the phone is obviously there.
4:39
You've got watch, right? That could be another option,
4:42
still kind of pricey or a ring. There are a variety of things I
4:46
would love to see, you know, more of like a, I don't know if
4:49
it would be Apple, but a smart ring that actually has, you
4:51
know, some of those biometric authentication capabilities
4:55
rather than just measuring my heartbeat.
4:56
And you know, my terrible sleep was last night because I was so
4:59
excited to talk with our guest today about fraud.
5:02
Well, then we should get into that.
5:03
What do you think? Yeah, why don't we do it?
5:05
Because if you've read the title of the show, which you probably
5:07
did, it's we're going to talk about fraud reduction and the
5:10
intelligence platforms going with it.
5:12
So I want to welcome back to the show John Tolbert.
5:15
He's the director of cybersecurity research at
5:17
Cooper, your coal analyst. So welcome back to the show,
5:20
John. Thanks, nice to be back.
5:23
Good to talk to you guys again. So we were prepping the other
5:26
day and I was absolutely, and I don't use this word lightly,
5:30
flabbergasted that it's been 4 years since we've had you on.
5:34
We actually had you back on almost back-to-back, which kind
5:37
of these days is kind of unheard of.
5:38
It's November and December of 2021.
5:41
We talked about customer or consumer identity and access
5:43
management. We talked about fraud reduction.
5:46
And here we are 4 short years later talking to you again
5:49
around again, fraud reduction intelligence platforms.
5:52
We did see each other in Berlin earlier this year at the Coomer
5:55
Coal conference. That was kind of cool.
5:57
So maybe that's why it felt like it was more recent.
5:58
But man, we can't, we can't have another four years go by without
6:01
a, without a dose of John Tolbert on this show.
6:03
I'm just going to say that right now.
6:05
Sounds good to me, so why? Don't we catch up a little bit
6:07
here? It's been 4 years.
6:08
What's new? We already did your origin
6:10
story, so I'll encourage people to kind of go back, but maybe
6:13
you can kind of fill in this timeline gap in the Identity at
6:16
the Center cinematic universe of 2021 to now.
6:20
What have you been up to? Well.
6:23
As the life of the analyst dictates, we do a lot of
6:25
research, talk to a lot of customers, vendors and look at
6:32
what's new out there in the field, try to figure out what
6:34
trends are worth reporting on, and just to try to educate our
6:40
readers. So I've covered a number of
6:45
different subjects. Of course, I have been doing CIA
6:48
for going on 10 years now, fraud reduction for at least six or
6:55
seven I think. Then I also have covered XDRNDR,
7:01
tax service management, a bunch of different cybersecurity
7:04
reports, as well as now we're keeping our eyes on things like
7:09
NHIS and agentic AI and topics that are emerging.
7:13
And, you know, everybody wants to know how can you secure these
7:17
things? John, you just dropped alphabet
7:19
soup on us, OK. And by the way, that is OK
7:23
because that's the industry we're in is you got an acronym
7:26
for everything. But we do have some blisters who
7:28
are newer to the space. So you mentioned CIAM, let's
7:32
start there. What is that and what makes that
7:36
special? Well, you know, I had been for
7:40
the majority of the last 10 years sort of calling it
7:43
customer slash consumer and also it can encompass citizen
7:50
identity and access management. But you know I'm working on that
7:54
report actually today the CIM report and I'm going to go back
8:00
and call this one consumer because I'm really going to
8:02
focus on B to C business to consumer interactions.
8:07
I'm doing a follow up report to that early next year around B to
8:11
BCIM, which it's about business to business.
8:16
Because you know, I think over the last couple of years both
8:19
the requirements that we see businesses leveraging on vendors
8:26
have changed and now the vendors are trying to meet all those
8:29
requirements. And and I think that's good, but
8:32
they're diverging quite a bit, as you can imagine, because the
8:36
use cases are different. Yeah, I'm glad you.
8:40
I'm really started there because, and I'm glad you
8:44
pointed out the citizen angle because I was going to say what
8:48
is CIA customer identity and access management, but that
8:53
citizen angle is interesting as well.
8:56
I, I think what's different is compare and contrast that to
9:00
kind of workforce identity and you know, fraud within the
9:05
workforce for sure. But when I think of like fraud
9:09
related to identity and access management, it's usually that
9:13
external use cases, folks who are, you know, outside of the
9:17
organization are trying to commit fraud through external
9:20
facing application, customer or citizen facing applications.
9:24
And there's this space now within my identity called fraud
9:29
reduction intelligence platforms.
9:32
And that's interesting because I kind of feel like the the, the
9:37
only reason they put the word intelligence in there is because
9:41
they needed a vowel. You correct me if I'm wrong,
9:44
right, but fraud reduction platform would have been good
9:47
enough, but that wouldn't have made a, you know, a word.
9:51
So correct me if I'm wrong, but just kind of walk us through
9:54
like, what is the space all about?
9:57
What? What is FRIPP?
9:59
So I usually define it as a set of capabilities.
10:04
There are six major kinds of capabilities that you need in a
10:09
fraud reduction Intel platform. First off would be identity
10:13
verification, which is something that we all know and love.
10:17
Then device intelligence, you know, knowing about the device
10:24
that let's say a request or a login attempt is originating
10:27
from. And there's a ton of information
10:30
that's available on devices that usually gets pulled through
10:33
SDKS, software development kits or JavaScript.
10:37
And that can be everything from like the the device type.
10:40
Maybe it has a specific device fingerprint, you know, IP
10:44
address, location information, device posture check, you know,
10:49
can you tell whether or not it's has, let's say an anti malware
10:53
program on it or is it exhibiting signs of a malware
10:57
infection? So all this intelligence can be
10:59
evaluated by a trip. Then we have compromise
11:05
credential intelligence. This is using information
11:09
sources from the dark and deep web about whether or not a
11:12
credential has been breached and made available out there.
11:17
Or maybe if you're using shared signals, you might be aware of
11:21
an attempt to use a compromise credential, you know, in the
11:26
recent past and then maybe that presents on your website.
11:29
We'd like to raise the risk flag on that.
11:33
Then we have user behavioral analysis and that can get, you
11:37
know, pretty in depth depending on the platform you're looking
11:41
at. You can look at transaction
11:44
amounts, transaction history, locations where transactions may
11:50
have originated. Is this sort of in line with
11:54
other types of transactions a person who's made in the past?
11:58
So there's a lot of information that potentially could be
12:02
evaluated by a fraud reduction Intel platform just on the user
12:07
behavioral analysis part. Then there's behavioral
12:10
biometrics, which is, you know, how you interact with your
12:14
devices could be typing cadence, or how you use a mouse on a
12:19
desktop or laptop, and then how you hold and interact with your
12:24
phone, touch screen pressure, and then bot detection and bot
12:29
management. And behavioral biometrics
12:31
generally inform bot detection, but there are also other methods
12:35
for trying to figure out whether or not a session is being
12:39
initiated and controlled by bot. You know, so I kind of feel like
12:45
you talked about like the six different areas and they're all
12:50
kind of related, but all kind of different.
12:52
And I kind of feel like sometimes we have to, the
12:56
analysts like yourself have to create a space and include all
13:00
these things because if you don't, you'd have too many
13:03
spaces. So you create 1 space and, but
13:08
most vendors like, correct me if I'm wrong here, they, they maybe
13:11
tackle one or two of these things, but then they'll tackle
13:15
the whole space. Or am I wrong?
13:17
Well, there's kind of a a wide range of solutions here.
13:22
There are point solutions, let's say behavioral biometrics is
13:26
good with there are several companies that specialize in
13:29
that and they do a really, really good job at that.
13:33
They may license their technology or OEM it into other
13:38
platforms. Then we see that can be pretty
13:40
common as well. But yeah, there are quite a
13:43
number of different solutions out there.
13:46
This time around, I think we had close to 25 that do multiple of
13:51
these categories of intelligence gathering and processing.
13:57
You mentioned the identity verification, which we all know
14:01
and love is what you said. And I kind of I smirked when you
14:04
said that because actually I do feel like the space is getting
14:09
better. When I say the word better, I'm
14:12
thinking from a usability perspective.
14:15
I've had some instances in the past where I went to use that
14:19
any verification and couldn't be verified.
14:22
And I'm like, what the heck, I'm me.
14:24
Like I'm not committing a fraud. Why is this saying you can't,
14:29
you can't Now I don't run into that as much.
14:31
And I don't know if the technology has improved or
14:34
they've, you know, widened the lane in terms of kind of letting
14:41
more iffy connections go or what it is.
14:45
What what's your perspective on that?
14:47
Is the space getting better? Is the tech getting better?
14:52
I think it is getting a lot better.
14:53
It's it's certainly more accepted.
14:56
I think we've seen it, you know, it really started probably
15:00
mostly in like the government to citizen interactions or in
15:05
finance, you know, because you want a strong or higher level of
15:09
identity assurance. And then of course, the pandemic
15:12
came along and made it hard for people to maybe go do some of
15:15
these things in person. So that's when we really started
15:18
to see these remote onboarding apps proliferate.
15:21
And I, I do believe they've gotten quite a bit better.
15:26
I mean, many of them incorporate liveness detection, passive
15:29
liveness detection. Sometimes you might be asked to,
15:33
you know, look in a certain direction or blink your eyes or
15:36
something like that to, to prove that you're a real person and
15:40
you're not holding up a photo. But I think overall usability
15:45
has gotten better, too, because they've probably applied better
15:49
usability engineering studies to getting the flow just right.
15:53
Yeah, we all occasionally do these things.
15:55
I did one recently and kind of encountered a hiccup in the
15:59
process too, but fortunately it was able to be resolved pretty
16:03
quickly. So yeah, I do think usability
16:07
has improved, security has improved, but at the same time,
16:11
this has become a major attack vector too.
16:14
So this is another major source of fraud.
16:17
You use the term capabilities that OK Fripp is 6 capabilities.
16:23
I'm wondering about how these capabilities get delivered.
16:27
So do they tend to be products or say like a software as a
16:34
service solution where you have to do the technical
16:38
implementation support or is it like a fully outsourced service?
16:42
So I'm thinking like an ADP versus a work day.
16:47
I'd say by and large it's it's a SAS.
16:50
It's API driven. So let's say I'm running a bank
16:54
and I want to contract with a Fripp service provider.
16:59
Mostly what I need to do is code that into the their APIs.
17:04
You have to of course pass certain amount of requisite
17:06
information to them to get a judgement or a risk score back,
17:11
but it's generally API driven. So it's API driven.
17:14
So you know, the, the, the thing I always think of from a fraud
17:19
perspective is that the old use case like, oh, somebody wants to
17:23
transfer $50,000 and there's some kind of API on the back end
17:28
that's saying, oh, that that trigger some kind of rule and
17:33
that rule now requires you to do something more.
17:36
So I'm kind of thinking of like that RSA type of scenario.
17:41
And to me that's always kind of what fraud is.
17:43
But it sounds like we're talking about the bigger picture of
17:46
fraud, which is preventing bots and things like that.
17:50
So I guess when you look at the space, what kinds of fraud are
17:56
we talking about preventing? And what is like outside of the
18:00
scope of what this FRIB solution or solution set can provide a
18:08
defense against? What kind of fraud can I help
18:11
with and what kind of fraud can't it help with?
18:14
I think a lot of the solution providers in the space are
18:17
trying to address most every angle of it, you know, and from
18:21
the technological perspective, there can be many different
18:25
angles to come from. I mean, just thinking back to
18:26
identity verification, we see, you know, a huge increase in the
18:31
numbers of things like face swapping attacks and use of like
18:36
fake video, injecting video streams into video
18:39
identification processes. So I mean, that's like a whole
18:42
different kind of technology that you have to put into place
18:46
as opposed to if you're in the finance world and you need to do
18:51
checking against sanctions lists and you know, for anti money
18:57
laundering regulatory compliance there.
19:02
There's just very disparate sets of technology that go into this.
19:05
But yes, there are several major platforms that are trying to
19:10
address financial use cases, e-commerce use cases.
19:14
That's why I did two different reports on it, as I see that
19:17
they've kind of, you know, grown apart in both the types of fraud
19:21
that are being perpetrated against these different
19:25
organizations and the technical capabilities required to deter
19:29
it. So that is the distinction.
19:31
Then it's like the identity and access types of fraud, that's
19:36
what gets prevented. Whereas like some of those deep
19:39
finance use cases, those kind of frauds need to be identified
19:44
within the applications. Is that right?
19:49
Well, I think there's several different layers for it too.
19:52
I mean, identity verification you can do as they come in
19:55
through the digital front door. But yeah, I think there are real
19:59
time transaction level checks that need to go on in certain
20:02
circumstances. And you know, another, another
20:05
interesting thing is that this is kind of a union of just what
20:10
we think of pure identity and access management and
20:13
cybersecurity because you do have the bot angle too.
20:15
You know, bots are used. I I think you know slightly more
20:20
than 50% of the traffic on the Internet is some kind of bot or
20:24
another. But you know, you can't just
20:26
say, OK, I don't want any bots to hit my site because a lot of
20:30
the legitimate business on the web is being handled by bots.
20:33
So you've got to be able to figure out are these good bots
20:36
or bad bots or somewhere in between?
20:39
And then what do you want to do with that?
20:40
Once you know that, how do you want to handle that?
20:43
Do you want to challenge them so that we all see these captions
20:48
and get aggravated with those or do you want to throttle them?
20:53
Do you want to redirect them or block them?
20:55
There's there's lots of different choices you can have
20:58
on how to handle bots want you to determine that's what it is.
21:02
But yeah, I mean, you can kind of see that there's this wide
21:05
variety of different kinds of techniques that span identity
21:09
and cybersecurity that are used by fraudsters.
21:13
And you, you kind of talked about there like the majority of
21:16
traffic these days on the Internet is not human, right.
21:19
It's AP is and bots. And you know, I was going to say
21:21
we've got a great system to catch bots, right?
21:23
Just pick all the pictures of a bus or a sidewalk and you know,
21:27
grainy little 9 box that it's like, I don't know, is that a
21:30
bot? I don't know.
21:31
Let's talk about the reports that you wrote back in July
21:35
here. So you had two, one was on
21:37
finance and one was on e-commerce.
21:40
Let's start with the finance one.
21:42
What are some of the trends or challenges that you saw that are
21:46
sort of shaping the way that this RIP space is evolving and
21:49
maybe some of the way they're being used?
21:51
Well, you know, especially in the finance world, scams are are
21:55
make the headlines and they're very problematic.
21:58
I mean, just talking with people, occasionally tell them
22:03
what it might be working on. Everybody's got a story about a
22:06
relative or a friend or somebody that they know that's been
22:09
scammed out of a lot of money online.
22:11
So I think on the finance side now, depending on the
22:15
jurisdictions in which you live and operate, you know, some
22:18
areas are putting much more responsibility on financial
22:22
institutions for trying to help help their customers stop these
22:26
scams from happening. So that too is a takes some
22:31
pretty complex technology in order to be able to detect that
22:35
and then present options to the potential victim about whether
22:40
or not they want to actually authorize A transaction.
22:44
So scams, of course, are are big news and a big problem.
22:48
But you still see lots of Ato account takeover attacks and you
22:55
know, they're just trying to get your account so they can get
22:57
money or something worth money. Now there's new account fraud,
23:04
various forms of new account fraud, where again, it could be
23:09
like a presentation time attack where you try to use, let's say
23:13
the fraudsters picture to get access to a legitimate bank
23:18
account or some other account. There's synthetic fraud where
23:22
you try to take realistic looking but not quite real
23:26
information and assemble an account so you can open an
23:29
account somewhere. So yeah, banks, financial
23:33
institutions are dealing with lots of different kinds of
23:37
fraud, all of which, you know, can result in big losses for not
23:41
only the banks and FIS, but their customers as well.
23:46
Yeah, and it seems like at least here in the USI think at this
23:49
point, everybody's Social Security number has been stolen
23:52
or burdened part of a breach. So, you know, that used to be
23:56
sort of like the unique identifier you could trust.
23:58
But you know, we're moving away from that thankfully.
24:02
But it's things like that, right?
24:03
It's hey, the data is out there. So now it is incumbent on really
24:08
everybody to be vigilant. But at least here in the US, it
24:10
seems like there are some stronger laws or maybe some
24:13
stronger in industry viewpoints or say, OK, we need to kind of
24:17
band together to fight this. Do you see at least in the
24:21
financial space, do you see like a shared signals type approach
24:26
where it's like, hey, if one bank or financial institution
24:30
sort of detects an issue, are they sharing information or is
24:33
it because they're all using maybe a consolidated source that
24:36
they're all kind of benefiting from that like it?
24:38
I guess my my short question is, are these financial institutions
24:42
working together to print fraud or are they going it alone?
24:47
Well, they're not really going alone.
24:49
I think ultimately this shared signal framework thing is a
24:54
great idea and it's going to get more traction.
24:58
But one of the the features of some of the leading fraud
25:02
reduction Intel platform vendors is that they aggregate
25:07
information amongst their customer base and then a share
25:12
that you know, to help prevent attacks throughout their
25:14
customer base. And yeah, there are quite a few
25:17
that are heavily invested in the the financial industry.
25:20
So they are on a more limited scale sharing some of this
25:25
information about fraudsters amongst themselves through their
25:31
Fripp service provider. But I think, yeah, eventually
25:35
where we need to get to is a more open framework where we can
25:38
share signals. But I think we're we're not
25:42
there yet. Maybe I'm just thinking too much
25:45
of like, you know, mob movies in Vegas where, you know, the
25:48
person comes in to scan the casino and then all of a sudden
25:50
all the casinos are aware of, you know, Jim coming in counting
25:54
cards. Sorry, Jim, pick on you.
25:55
But like, you know that that sort of like, hey, we've got a
25:58
known vector, right, a threat here.
26:01
Let's make sure that these institutions are all sort of on
26:04
the same page. Course, there are other
26:06
information sharing arrangements out there and, and I think that
26:10
the they've probably been somewhat successful, but there's
26:15
still always room for improvement.
26:17
I think kind of that scenario that you just talked about, you
26:21
know, especially if it's a smaller company, I don't imagine
26:25
that they have that big of a picture of like what the
26:28
fraudulent accounts are. If they can get information from
26:33
Google, Facebook, Microsoft, the big identity providers in the
26:38
world, that would be a game changer.
26:41
And I would love to see the industry as a whole stop looking
26:45
at security and fraud as a competitive advantage.
26:50
Like, oh, we're the biggest, we have the most logins, so we have
26:53
the most visibility and start looking at it as like for a
26:57
common good being able to, you know, I, I see Jeff laughing
27:03
like, like for the good, like. Common.
27:05
Good. Like I'm speaking a different
27:06
language or something. I mean, you can't make money off
27:09
that, so come on, like. I'm a capitalist by the way, so
27:12
I'm not trying to say that, but like, you know, we have
27:17
hospitals and we have. I mean, I mean, that's like a
27:22
real world example. But what I'm I'm saying is like
27:27
even people in the identity industry, like 2 identity
27:31
leaders from competitors, like 2 banks that compete with each
27:36
other. I've seen it in the real world
27:38
where they talk shop, they talk about what they're doing because
27:43
you getting hacked doesn't like make my bank like more
27:48
attractive. It actually just makes the whole
27:51
industry suffer. So I just kind of feel like
27:56
organizations should stop like taking this data and thinking
28:00
like, oh, we're going to use that for our competitive
28:02
advantage. I, I don't like that.
28:06
That's my, my two cents. That's my rant rant #2.
28:12
Well, you know, thinking about banks, I know a lot of people in
28:17
the banking industry talk about the reliance on still mainframe
28:23
technology, COBOL written programs and trying to figure
28:28
out how to plug this kind of information in I think is
28:31
challenging because each company is different how they built
28:35
their their systems. They may use home grown code,
28:38
they may use, you know, core banking applications made by
28:42
vendors from from years ago. So how do you integrate the
28:48
signals that you may be getting in an ideal world such that it
28:52
can be of use at runtime? Well, it becomes a major rewrite
28:58
of the way that authentication or risk calculation works with
29:01
an organization, right? It's at that point you kind of
29:04
have to treat those as data sources, not as the system that
29:08
is performing the risk check. So you end up in this, you know,
29:12
catch 22. It's like, OK, you know, do I,
29:14
you know, do I have this mainframe sitting in my basement
29:17
and I, I don't have anyone who can maintain it or I'm going to
29:20
lose those people who can maintain it sooner, whether it's
29:23
because they age out of the workforce, they die somewhere
29:27
else, right? There's a bunch of reasons like
29:29
they're going to, you have to start planning for that shift
29:32
over. And so it's like, OK, when do we
29:34
bite the bullet and say, guess what, guys trying to modernize
29:37
the way that we approach authentication and as part of
29:40
the authentication, that means risk.
29:43
So how do we do things like identity verification?
29:45
How do we take all the different signals within our own
29:48
environment and from our external signals coming in to
29:51
really modernize the way that, you know, we do this login so
29:55
that, you know, Jim doesn't have to have a nightmare scenario
29:58
logging in right to his new device, right?
30:00
Or me if I forget my bit word and password and all of a sudden
30:04
I'm and I'm another person going through the unhappy path of I've
30:08
got to call someone and then that's where attacks also go
30:11
after, right? Most attacks are you're getting
30:13
socially engineered, you're getting fished.
30:15
Your help desk would already be guess what they need risk
30:18
signals as well. So things like identity
30:19
verification to reduce fraud. So I, I don't want to lose the
30:23
lose sight of the fact here that like this fraud reduction we
30:27
talked finance, but there's a lot of like entry points for
30:30
this, right? It's not just like a signal
30:32
behind the scenes. It's is this really John I'm
30:34
talking to or is this AI version of John right that's trying to
30:38
scam me. That is also I think part of
30:40
this equation. And I don't know if that's
30:41
necessarily it definitely is finance, but maybe it's also
30:44
part of the e-commerce world where, you know, maybe it's more
30:47
consumer focused. And I know there was a second
30:48
report that was written on that. And so my very long winded
30:52
question is, OK, so we went from one end on the finance and now
30:55
we're talking about sort of like the end user experience of fraud
30:59
and e-commerce companies or at least companies that have an
31:01
e-commerce component also need to address that.
31:04
So why write a second report? What's different about
31:08
e-commerce that's like, OK, we need to focus on specifically
31:10
this versus finance in general? Well, again, I think the use
31:15
cases are quite different. You know, where banks, financial
31:18
institutions are really concerned about or or having to
31:21
do AML compliance, Know your customer, do that name watch
31:25
list screening and they generally have a higher levels
31:30
of requirements for identity assurance.
31:34
So there there's a lot of emphasis that gets put on that.
31:36
On the e-commerce side, you know, there's a whole different
31:39
set of attacks that they face and just think about how we
31:43
interact with online shopping services ourselves.
31:48
They can be concerned about many, many different kinds of
31:51
bot driven attacks. You know, think about ticket
31:55
scalping bots, bots that go out and you know, try to download
32:00
all the information that's available on a website there.
32:05
There can be other cases where you got bots that are out there
32:08
generating comments, generating fake reviews that might affect
32:13
the whole e-commerce experience. And then they have policy abuse.
32:18
They have to worry about two things like we probably all
32:21
encountered, you know, do you want to log in or do you want to
32:23
check out as a guest? So guest check out policy abuse,
32:30
returns, chargebacks, loyalty programs.
32:34
You know, frequent flyer miles is a good example because so
32:38
much money is sort of tied up in loyalty programs of all sorts of
32:45
different kinds. So, you know, trying to gain
32:49
access to somebody's account so you can drain those loyalty
32:52
points and use them elsewhere. These are things that are a
32:56
little bit different than what banks have to face.
32:59
So that's why I thought it would be better to break this into two
33:04
where I could in the first report put a little bit more
33:07
focus on the the name, watch those screening and identity
33:11
verification versus you know, looking for more thorough bot
33:16
detection and more granular bot management capabilities for the
33:21
e-commerce report. Yeah, I was, I I can't find any
33:26
holes in those in the argument. Like those seem to be the top 2
33:31
focuses for most fraud, but I can think of two others.
33:34
So one is the other C for CIA and the Citizen, you know,
33:41
especially for state actors to go in and commit fraud, But I'm
33:46
sure there's other use cases as well.
33:49
And then the other one that I thought of, which I thought this
33:52
is a growing one, is streaming services or any kind of
33:56
subscription services where people want to share their
34:00
account with other people. So I guess, you know, that's
34:04
just kind of like me thinking through it.
34:07
Have you given thought to additional reports to write, or
34:11
do you think there's just not enough meat on the bone?
34:15
I think those are two really good use cases.
34:17
Yeah, definitely two different areas of focus.
34:21
The citizen angle, yeah. I mean, harkening back to the
34:24
pandemic that that happened a lot, you know, when the Paycheck
34:29
Protection Program was going on and a lot of state unemployment
34:33
agencies were hit. I'm sure if they'd had some
34:38
fraud reduction technology in place, it probably would have
34:41
saved taxpayers a lot of money. Many of these kinds of use cases
34:49
can be addressed by well, in the case of like unemployment
34:54
insurance, if you were using better identity verification.
34:58
So a lot of the same vendors that appear in both reports
35:01
probably would be able to help cases for like G to C government
35:07
to citizen interaction and then the streaming services too.
35:10
That's I do try to address that a bit on the e-commerce side.
35:14
That's a a very good and interesting point you make there
35:17
about people who do try to share accounts and then the streaming
35:21
services who don't want you to do that with good reason.
35:26
Yeah. And and so I was, you know,
35:29
asking about, you know, whether or not it was worthy of a paper.
35:33
But another angle is just kind of like, it seems to me like
35:37
these there's some form of those six capabilities that almost
35:41
every industry that is on the Internet needs.
35:46
And I'm kind of wondering also, you know, when you're going
35:49
through this capabilities, just it seems to me there's like I'll
35:54
use the term poor man's version of a lot of those built into ID
35:59
PS for example, or, you know, other Cam technologies where
36:05
it's like, you know, is that really the decision that
36:08
organizations need to make? Like, Oh yeah, I'm buying this
36:11
system to do my authentication. Is that good enough for am I
36:17
good enough just to use their layer of fraud protection?
36:22
Are you kind of looking at that when you're considering the
36:24
e-commerce or is it just looking at, is it just looking at like
36:29
what are the add-ons that you can get on top of your IDP?
36:34
Mostly looking at what are the add-ons because yeah, let's say
36:39
you're an e-commerce vendor, you're going to be accepting
36:42
logins from lots of different ID PS And it's not just the login
36:46
information or what the IDP knows about the person who
36:50
registered their account with that IDP maybe many years ago,
36:53
but what else do you know about that account right now?
36:59
You know, going back to the streaming thing there, that's
37:02
where device intelligence comes into play.
37:04
So what do you know about the device?
37:05
Are they watching on their phone?
37:07
Are they going to are watching on a smart TV or set-top box?
37:11
All those things have device IDs and that can be part of the
37:14
overall risk equation. Same thing was about how you
37:18
present to AE commerce site. Sure, you might log in with your
37:24
regular e-mail address. You've made an account there,
37:27
but are you authenticating that yourself, or are you relying on
37:31
the IDP to do the authentication?
37:34
And what other information do you want to collect about that
37:38
user at that particular transaction time that may not be
37:42
available to the IDP? Yeah.
37:44
I'm kind of wondering also, you know, when it comes to these
37:52
kind of investments always, it always comes down to dollars and
37:55
cents, right? And so maybe if you don't have
37:59
the money or you can't make the business justification, buying
38:02
an add on isn't something that you even consider.
38:06
But if you have enough money to add on, I think the answer I'm
38:13
going to get us, it depends. But John Tolbert, here's the the
38:18
$1,000,000 question, like where do you put your money?
38:20
What's the order of importance? Where do you get the biggest
38:24
bang for your buck in terms of risk reduction and the different
38:29
types of FRIPP? Capabilities.
38:32
Wow. I guess that's why you've got to
38:36
know your own business. You know what?
38:40
Understanding the threats that you've already faced and, and
38:45
where you think they're going to be coming from.
38:47
I think across both finance and e-commerce and, and any others,
38:53
four of the six are, are pretty commonplace and you're going to
38:56
need, you know, some combination of those pretty much at all
39:01
times. And I guess I would say device
39:03
intelligence is really, really important user behavioral
39:08
analysis. I mean, because if you just do 1
39:10
without the others, then you're still leaving an awful lot of
39:15
attack surface at that at that point.
39:20
So knowing about compromise credential usage, if somebody's
39:26
had their credentials leaked out on the dark web, that's
39:29
certainly important. You'd, you'd certainly want to
39:32
increase your risk score because of that.
39:35
If you're in a place where you really need higher assurance,
39:40
identity assurance levels, then identity verification is going
39:44
to be more important. So I don't think I could give
39:46
like A1 size fits all answer. It really depends on what
39:50
business you're in and understanding the threats that
39:53
you faced before and and how to most effectively reduce those.
39:58
I think that's a great answer, John, because Albert is going to
40:00
say it depends. The consulting answer right it
40:03
where you know. Where are you?
40:05
Where? Do you need the most help?
40:06
Because not everybody is on a playing field where it's like
40:08
everybody's starting at 0. You might already have some
40:10
capabilities in place and you have to kind of start whatever.
40:12
That's no different whether we're talking fraud or we're
40:15
talking an IGA deployment or a privileged access deployment or
40:18
authentication just at large. So I'm curious that when we talk
40:21
about these capabilities you talk about like identity
40:23
proofing and verification, credential intelligence, device
40:26
intelligence, behavior analytics, right, bot detection,
40:30
right, kind of all these different things.
40:32
Where does where do those capabilities tend to fit?
40:36
Jimmy, you kind of alluded to the authentication platform of
40:40
the IDP, but talk to me a little bit about like where do you see
40:44
these coming in? Because I don't think it's just
40:45
one product that does all this, right.
40:48
It's a mesh of things that need to kind of provide the full
40:51
solution set to have an effective fraud reduction into
40:55
intelligence platform. Again, I think it, it, it sort
40:59
of depends on what you've already got.
41:01
I mean, if we go back to the bank situation, a lot of banks
41:04
have already written their own fraud detection routines and
41:10
they're, they're running that alongside their other banking
41:13
application. So maybe they just want to get
41:17
better identity verification. In that case, you might just
41:21
look for discrete identity verification services or if
41:26
you're looking to sort of totally upgrade all of your
41:30
fraud prevention capabilities, then yeah, you might want to
41:32
look for a platform that has some of all of it.
41:36
And then many of these can be augmented.
41:40
You know, this is, it's more of an ecosystem kind of things.
41:43
So you will find that even in this Fripp space, there are
41:48
partnering arrangements amongst the vendors in some cases like I
41:52
was talking about with behavioral biometrics, some of
41:55
the other platforms will OEM in the behavioral biometrics piece
42:00
and and use that or they may automatically or have you know,
42:04
contracts with other service providers so that they're
42:07
bringing in say device intelligence feeds or IP
42:11
reputation information from third party sources.
42:14
So it really is an ecosystem and you can which one do you want to
42:20
be your front end if you're trying to augment your own fraud
42:26
detection capabilities? It's it's again very specific to
42:32
the organization that that needs it.
42:35
So for this to work effectively, there's got to be some sort of
42:38
like automation or integration and I'm taking off, you know,
42:43
larger platforms that tend to be within, you know, a large
42:46
organization that might need this type of solution, something
42:49
like an identity governance solution.
42:51
So I'm thinking of like a sale point or a savior or maybe a
42:54
privileged access management solution like a cyber Ark or
42:57
Delinea or Beyond Trust, right? Those are just kind of leaders
42:59
sort of in those spaces. Is that where, you know, the
43:03
information sharing between your fraud platform is saying, hey,
43:07
not only don't authenticate, but kick over this thing into your
43:11
IGA platform or your Pam platform to do some sort of
43:14
thing? Like there's got to be
43:15
orchestration that takes place behind the scenes, right?
43:17
Like what does that orchestration layer look like
43:20
and where does it come in? Like what is the driver for
43:22
that? Is it the risk platform or is it
43:24
just a signal and somebody has to do something about that
43:28
signal? I'm glad you use the O word.
43:31
It's it's a very hot topic everywhere in identity
43:34
orchestration. It's many of the platforms that
43:39
I looked at do have really good orchestration capabilities and I
43:42
think that's key to making it adaptable to what, you know,
43:48
many organizations already have. So you probably already are
43:52
using let's say for example an IP reputation or a device
43:55
reputation service and you just want to sort of Plumb that into
43:59
your flow. We do need a good orchestration
44:01
engine and a good, you know, graphical workflow designer
44:05
ideally to help you figure out how to do that just right.
44:09
That is something that I think is pretty much absolutely
44:13
required, the ability to orchestrate amongst existing
44:17
services that you might use. And then also, you know, a year
44:20
from now, two years from now, after you do this
44:22
implementation, you might find you want to swap out and use a
44:26
different point solution for an intelligence source than to.
44:31
John, it wouldn't be an episode of Identity at the Center if we
44:34
didn't bring up AI. So I mean, obviously AI is
44:39
touching everything and it's touching it so fast and it's
44:43
changing the game where, you know, new vendors spin up
44:47
solutions and they can do things that the the vendors that kind
44:53
of are the incumbents and have been doing this for a dozen
44:56
years can't do. Where do you see the impact when
45:01
it comes to FRIB? I mean, are you seeing it
45:03
already with like vendors starting to use AI to multiply
45:08
what they can do? Yes, I mean, I guess it depends
45:12
on what we mean by AI. I mean, ML has been around for a
45:15
long time. It's sort of the silent hero in
45:18
the background that's been helping us in multiple areas of
45:21
cybersecurity for, you know, more than a decade.
45:25
And that's very true in in the fraud reduction space.
45:28
Do you think about the numbers of transactions that are going
45:31
through, you know, any, any customer facing organization and
45:35
then all the different data points that they have to analyze
45:38
around like identity analytics? ML is a big help right there.
45:43
Just because there's such a large volume of data.
45:46
You need something to be able to look for anomalies, look for
45:49
normal traffic, classify it and then, you know, alert the human
45:53
fraud analysts to go take a look at it.
45:56
So M LS been around for a while and it's it's it's doing a great
45:59
job. I think when it comes to Gen.
46:02
AIII see some implementation of Gen.
46:07
AI like in the fraud analysts interfaces.
46:10
I think that can be very helpful.
46:12
But I'll say the same thing about that as I did for, you
46:17
know, cybersecurity solutions that are starting to embed Gen.
46:20
AI. And that's I'm curious about
46:23
who's doing the, the quality assurance on on the output
46:27
there. Because yes, you can take in a
46:32
big amount of data. You can have it create a
46:35
narrative to feed to a junior analyst that get them to be able
46:39
to take a, you know, a particular action that I think
46:45
it would be nice to understand what the the level of quality is
46:48
on the output of that. Some are also working toward
46:54
allowing business people to write policies in, you know,
47:00
what we would call natural language and then then turn that
47:02
into a machine executable language.
47:05
I think that's ongoing in some areas too.
47:09
But I think the biggest area of course, where AI has had an
47:14
impact on fraud is helping the fraudsters themselves,
47:18
unfortunately. Yeah, that that is the
47:21
unfortunate punchline to every one of these discussions.
47:26
You know, I always want to make sure that we're coming away with
47:30
actionable tips for the identity practitioner.
47:35
So in this case, I'm thinking the identity practitioner that
47:38
is evaluating some of these trip platforms.
47:42
And I think with as much whiz bang stuff there is as there is
47:48
here, it's easy to kind of like, get lost in some of the glitz
47:52
and glam. But what I'd want you to help
47:58
with would be like, what are some things that people need to
48:02
make sure they're asking when they get a demo of a solution?
48:05
How do they ask smart questions that are going to get to, yeah,
48:09
these guys can really, you know, mail my use case or not?
48:13
That's a good question. I can just think of the
48:15
questions that I'd like to ask the vendors themselves and I
48:19
really want to understand what part of the solution are they
48:23
contributing themselves and where are you depending on
48:27
others you know, And this is bigger than let's say a use of
48:32
open source code kind of question.
48:34
But if your solution is depending on, let's say a third
48:38
party for behavioral biometrics or some third party service that
48:43
collates dark web intelligence, then I think having that
48:47
information transparently presented is is very useful for
48:51
somebody that's looking to buy a platform, buy access to a
48:55
platform. How how do they do they have
49:00
SDKS is another one. You know, many organizations are
49:06
trending toward, you know, going completely API driven, but there
49:10
are lots of different SDK environments.
49:12
And maybe if you're in an organization that's already
49:15
built, let's say a big, you know, web presence and you've
49:19
got mobile apps that you're really proud of and you're happy
49:23
with the SDK environments. Make sure that whatever you're
49:26
looking for supports all of that.
49:32
And then trying to get information about false
49:35
positives is always very useful. Trying to get objective
49:40
information about false positive rates and what techniques do
49:44
they use to help mitigate that. And in a few very rare cases,
49:49
there are a couple of these vendors out there in the fraud
49:52
reduction space that offer things like warranties or
49:55
chargeback guarantees. So if that's important to your
49:59
organization, I'd say ask about that because it can save you
50:03
money in the long run. I, I don't want to get into the
50:06
financial implications of a chargeback, but you know,
50:09
hopefully it's not something where it's like, OK, it's a
50:12
nickel per check, we will refund you that nickel that said that
50:15
this transaction of $5,000,000 was, you know, was, you know, a,
50:19
a flow enough risk that you could ignore it.
50:21
I'm going to assume that there is some better contract
50:24
structure around that. Most likely, yeah.
50:28
Well, John, it's been a great conversation.
50:30
I want to wrap things up with a little bit of music talk here.
50:35
So we were talking yesterday as we were kind of getting prepped
50:38
up for this and you mentioned you've been to a couple concerts
50:40
recently. And one of the things that I
50:43
want to find out from each of you is what is a musical act,
50:48
band, you know, performance artist, whatever you want to
50:51
call it, right? That you have not seen yet in
50:54
person, but you would absolutely, you know, go out of
50:58
your way like it's your Mount Rushmore of this is the person
51:01
that I want to see or band or group or whatever.
51:03
Like what do you? What do you most want to see?
51:05
Well, what I would have liked to have seen would be Pink Floyd.
51:09
I've seen Brit Floyd a number of times and Aussie Floyd a number
51:13
of times and they, they, they do a great job.
51:17
But I think it would have been nice to to see the real Pink
51:22
Floyd at least once. So why Pink Floyd?
51:26
Is it the dark side of the moon? Or is it you just celebrate
51:29
their entire catalog and you just want to be part of it?
51:32
Oh, I think I like it all. Yeah, I like it all from the
51:36
early days through the the Gilmore only era.
51:40
You know, in general, I'm a fan of progressive rock and
51:45
everything that came afterwards, so I've gotten to see most of
51:49
the progressive rock bands that I like, but not the real Pink
51:52
Floyd. But not a grunge fan, as I
51:56
established yesterday and being from Seattle.
51:59
Yeah, not so much. So I'm a big like Alice In
52:02
Chains fan and you know, Nirvana, Pearl Jam, like that
52:05
kind of stuff. But I got there's so many
52:07
different things that go with this one.
52:09
Let me think about this for a second, Jim, what about you?
52:10
Like who is the band or artist or whoever that you would love
52:14
to see in person? They have not yet.
52:17
Well, I feel like I have to comment on Pink Floyd because
52:21
Pink Floyd, like Dark Side of the Moon is such an epic album
52:25
and I listened to it the other day.
52:27
It's like if you get into a long drive in your car, just tell
52:31
Siri, play Dark Side of the Moon album.
52:34
And it is just like 45 minutes of insanity.
52:40
And I didn't have a chance to go see them in probably the early
52:46
90 or early 90s or late 80s. But at that time, it was like
52:51
$300 a ticket. And it was already like, insane.
52:57
And, you know, they were known for putting on a huge show with
53:01
like, laser lights and everything, all the stuff they
53:03
used to do at concerts that was like, so cool.
53:06
And you look back at it now or So what they have at concerts
53:10
today and it's like a joke. It looks like you're watching
53:15
your grandparents TV or something.
53:17
So OK, so Part 2 of what I wanted to say.
53:20
So there were two bands that I really wanted to see I'll never
53:24
hit to see now. And I should have just pulled
53:27
the trigger when I had the opportunity.
53:29
Grateful Dead with Jerry Garcia. So I wanted you to see them
53:33
actually the summer that he passed away.
53:36
And I didn't like have tickets or anything, but it's like 94
53:41
ish 95. And then Nirvana, right before
53:45
Kurt Cobain passed away, he actually did Lollapalooza #1.
53:51
I went to Lollapalooza #2 or not?
53:53
What's the Lollapalooza? I think so, yeah.
53:56
Lollapalooza. Anyway, I didn't get to see
53:59
Nirvana or I've gone to a lot of concerts, a lot of concerts,
54:04
hundreds of concerts. So I've got 2 that now.
54:09
This is Part 3. This is the direct answer to
54:11
your question. So one that will probably
54:15
everybody can understand would be Metallica.
54:18
I miss like going to a real deal Metallica concert, but I would
54:23
still go to see them. I still pay the 300 bucks to go
54:27
see them live even though I know it wouldn't be prime Metallica.
54:32
And then a current act, which I very well could easily get to is
54:37
Post Malone. But it's like one of those
54:40
things like that's why I didn't go to see Nerf Honda was like,
54:43
I'll definitely get to see them. I'll just wait till next summer.
54:46
Next summer might never come so. Just watch on YouTube.
54:51
Well, that's I've got that for life, man.
54:53
I can see Jerry Garcia on the YouTube all the time, all day
54:56
long. So this was a chance to make
54:58
John jealous because you saw Pink Floyd live.
55:03
I've seen Metallica twice, at least twice live.
55:06
So now I can make you jealous. And they put on a great show.
55:09
I saw them in early 2000s, late late 90s.
55:13
I think it was the Load Reload album tour that they were on.
55:18
So it was great. Saw them at the Rosemont Horizon
55:20
in Chicago. Now it's called like Allstate
55:22
Arena or something like that. And I saw them at Lollapalooza
55:25
when they did that, I think it was like 97.
55:28
So I've seen them live a couple times, a band that I have not
55:33
seen that I would love to see, but it's probably too late.
55:37
And I would like to see the maybe a decade ago is Megadeth.
55:41
I'm a huge Dave Mustaine fan and I think the guys just a
55:44
brilliant guitarist and I would love to see prime Dave Mustaine
55:49
out there. Just whaling baby.
55:53
That's that's what I want to see in here.
55:55
And now I'm going to listen to Megadeth after I'm done while I
55:58
you don't work on editing this the show.
56:00
That was, you know, another one that I could have gone to see in
56:03
the 80s was Rolling Stones like way already way past their
56:07
prime. The funny thing was, I mean,
56:09
they were touring as of like within the past decade.
56:13
I think it's like. Just a few years.
56:17
Definitely you missed. You can, you can watch the AI
56:23
version of it. You know, there's the holograms
56:26
that people are doing now for some of these shows.
56:28
Like, you know, it's, it's an interesting world we're living
56:31
in now from a technology standpoint where we have
56:34
recordings, right, audio now, we got beta recordings.
56:38
And now we're serving this next generation of like, yeah, what's
56:41
stopping somebody from making a virtual version of any of these
56:44
acts and doing something brand new with it?
56:47
I think that's part of the, you know, the part of the battle,
56:49
right, that a lot of like artists are having right now is
56:51
how is their name, likeness and content going to be used in the
56:56
future after, you know, they've moved on.
56:59
Have we ever asked? And maybe we'll just do it real
57:01
quick. What's the first concert you
57:03
went to? First concert for me was
57:06
Offspring 1994, the smash album at the Aragon Brawl Room,
57:12
downtown Chicago. What about you, Jim?
57:15
Harry Chapin, My parents took me when I was a little kid.
57:20
OK, well, that explains a lot, yeah.
57:22
What do you think, John? What's your your first concert?
57:25
First concert was Yes and I went up to see them about 30 times
57:29
all together over the SO. Definitely a yes, man, yeah.
57:33
Definitely. Yeah, I'll never forget that
57:36
first concert. It's such a great, I don't know,
57:39
memory, I think for everybody, right, No matter who you go to,
57:41
kind of go and see. Maybe I don't know, Jim, I don't
57:43
know about you. Maybe.
57:43
I don't know if you're a fan. It was a great, great experience
57:47
and I'm like, what's that smell? Never mind, Jim, never mind.
57:54
Don't worry about that, little Jimmy.
57:58
All right, let's go ahead and wrap it up for this week.
58:00
John, thank you so much for coming back.
58:02
Looking forward to see you in Berlin in 2026, hopefully at the
58:06
European Identity and Cloud Conference.
58:09
Right now, Jim and I are planning to be there.
58:11
Hopefully you'll come back sooner than in four years.
58:13
Maybe as you put out some new research and things like that,
58:15
you'll come back and kind of update us so we can, you know,
58:18
tease people to go out and get the report and kind of, you
58:20
know, see what what's in that big brain of yours that you're
58:22
willing to share with with the Internet at large.
58:26
I'll have I'll have Lincoln or show notes for people to connect
58:30
with you on LinkedIn. I'll have links to both reports,
58:32
the e-commerce and the finance version of the Fraud Reduction
58:36
Intelligence platform report from Cooper Cole.
58:39
And then for Jim and I connect with us on LinkedIn, like and
58:42
subscribe to all that stuff. For us that helps us outgrow the
58:45
channel, get great guests like John and others to to join us
58:47
and spread the gospel of I am and identity at the center.
58:51
So with that, we'll go ahead and leave it for this week.
58:54
Thanks everyone for watching and or listening and we'll talk with
58:57
y'all in the next one. You've been listening to
59:02
Identity at the Center. We hope you've enjoyed the show.
59:06
Make sure to like, rate and review, and we'll be back soon.
59:10
But in the meantime, hit the website at
59:13
identity@thecenter.com. See you next time on Identity at
59:19
the Center.