Ep. 140 - Fraud, Regulation and Digital Identity: Europe's 2027 Countdown, with Mitek

Justin Hanna (0:05)

Welcome back to The Payments Shed Podcast live here at Fintech Meetup Europe in Lisbon.

Right now, we are joined by Marc Sabadí, Identity Innovation Lead from Mitek Systems. Marc, thank you so much for joining us. Firstly, give us a little introduction about yourself and how you got into this industry.

Marc Sabadí (0:20)

Well, thank you very much for inviting me. I'm very glad to be here. I work in Mitek Systems.

What we do in Mitek Systems, basically, is helping our customers, banks, fintechs, financial industry, to protect what's real. And this is what we do every day.

Justin Hanna (0:40)

And when we talk about AI, of course, everyone talks about AI right now, how is genitive AI reshaping identity fraud from presentation attacks or digital interjection?

Marc Sabadí (0:53)

Well, it changed quite a lot, you know.

We can say that the economics of fraud have changed in the sense of that we typically in the past we'll get more of presentation attacks, meaning someone trying to fool the IDV process in front of the camera. For example, wearing a mask or showing a screen replay or an image to try to impersonate someone. That requires some skill and some time. Whereas now, with GNI tools, so accessible to everybody, some very realistic synthetic documents and fake faces can be created very quickly at scale.

We are seeing a shift towards injection attacks. What does it mean? It's not trying to fool the IDV process, but trying to fool the whole capture process and injecting directly an image which can be synthetic and very, very, very realistic. And that goes straight to verification pipeline. So if you get this first step wrong, everything that goes through all the additional checks can get wrong as well.

Justin Hanna (2:05)

Do you think we've got a point where we've got AI trying to attack and AI trying to defend?

Marc Sabadí (2:10)

Say it again.

Justin Hanna (2:10)

Do you think we've ever got to a point where it's AI trying to attack, but also AI trying to defend and it becomes AI versus AI?

Marc Sabadí (2:17)

Absolutely. Absolutely. This is a race that the good guys need to win.

Justin Hanna (2:24)

How does and why does liveness detection remain that first line of defense?

Marc Sabadí (2:28)

Well, that's crucial because in a typical ID verification process or digital onboarding process for the Fintech industry, for the financial industry, every single step after liveness assumes that what comes, what is being verified, being a document or a face, has been captured by a genuine, real human being. If you get that wrong, then everything, the further steps that you take, they're just built on sand.

So, if you don't, and this is, and life is what protects this assumption, this authenticity. So, if you get this wrong, you can get to verify it perfectly, well, look in the fake. And then you just do all the database checks, you just do all the face match, and you just do all the document authenticity checks with this bad element that go through your systems.

Justin Hanna (3:32)

And how do you stop fraud without frustrating customers?

Marc Sabadí (3:36)

Well, this is always a triangle, a trilem, I would say, between low friction, conversion rate, high security, stopping fraud, and compliance.

And each entity needs to find their equilibrium, I would say here, their balance. So, this is with good technology, with intelligent technology that happened in the background, this is how we can overcome this trilemma.

Justin Hanna (4:04)

And when we look at the introduction to AMLR, how does that replace today's national AML rules?

Marc Sabadí (4:12)

Well, three things are going to change.

Well, many more, but let's point to three basic ones. First, with AMR, there's going to be a standardization across all the 27 EU states. Now we have different flavors of AML and KYC processes. This is going to be a direct, applicable regulation, not a directive that will be interpreted by the different regulatory bodies. That's the first thing. Second thing, the hierarchy of the methods of ID verification is going to change.

Cryptographic methods, deterministic methods are going to be prioritized. What does it mean? It means all the ecosystem of AOID wallets and then electronic documents. That's going to be a priority. Then it's going to come optical ID verification processes. The ones that we use now, physical document onboarding with a selfie and liveness. The third thing is going to change is that the standards for security are going to be raised, and friction is going to be lower, especially from some markets like Germany with Buffin, Spain with Sepplack. Now you need the human being in the loop to get the higher insurance. Whereas with the new regulation, you can do a fully automated process with the highest security standards.