The Data Diva E192 - Michael Roche and Debbie Reynolds

Debbie Reynolds, “The Data Diva” talks to Michael Roche, Founder, Executive Partner, and General Manager of Fintechnology Group (Authentication, AI, Fintech, Fraud). We discuss his expertise in authentication, AI, fintech, and fraud prevention. Throughout the podcast, Michael emphasizes the significant role of artificial intelligence in enhancing fraud detection systems in financial services, drawing parallels to data structures seen in healthcare.

Michael shares insights from his ongoing Executive MBA at MIT, focusing on AI's burgeoning impact on media and its pivotal role in fraud prevention. He narrates the origin and evolution of Finn Technology Group from a cloud consultancy for banks to its expansion into developing sophisticated financial technology solutions. The conversation shifts towards AI's current and potential applications in banking, particularly in improving mobile banking security and fraud detection through advanced machine learning techniques.

Privacy concerns linked to mobile and digital banking, the regulatory landscape in the EU compared to the US, and the implications of GDPR are thoroughly discussed. Michael and Debbie also explore the challenges and risks associated with data breaches and the increasing sophistication of AI-powered fraud schemes.

The podcast concludes with Michael's thoughts on AI in banking, emphasizing the need for robust security frameworks to combat the dual-use nature of AI in fraud and security. We ponder the societal impacts of AI, reflecting on cinematic portrayals of technology and its ethical dimensions, underscoring the need for continued vigilance and innovation in the face of evolving digital threats and Michael shares his hope for Data Privacy in the future.

Transcript

30:45

SUMMARY KEYWORDS

ai, people, bank, fraud, movie, data, authentication, technology, call, artificial intelligence, good, person, happening, humans, privacy, companies, years, device, rules, give

SPEAKERS

Michael Roche, Debbie Reynolds

Debbie Reynolds  00:00

Personal views and opinions expressed by our podcast guests are their own and are not legally wise or official statements by their organizations. Hello, my name is Debbie Reynolds. They call me "The Data Diva". This is "The Data Diva" Talks Privacy podcast, where we discuss Data Privacy issues with industry leaders around the world with information that business needs to know now. I have a very special guest on the show all the way from Ohio, Michael Roche. He is the founder, executive partner, and general manager of FinTechnology Group. Welcome.

Michael Roche  00:40

Hey. How are you doing everybody?

Debbie Reynolds  00:41

Yeah, your specialty is authentication, AI, FinTech and fraud, right?

Michael Roche  00:47

Yep, you nailed it. Forces you to put that in there. Yeah, that's where I'm at for this week. Maybe I'll change it next week.

Debbie Reynolds  01:00

Well, right. We met on LinkedIn. I think I had done a podcast, another identity podcast, and you saw the podcast, and you reached out to me and I listed your profile. Oh, cool. Oh, we need a fraud person right here to talk about data and stuff like that. So I'm happy that you were able to join the show. But why don't you tell me about your trajectory your career, and why this particular area of fraud and authentication and AI? Why does that interest you so much?

Michael Roche  01:30

I think, in general, I've always been driven to crime prevention. There's a good guy versus a bad guy. My family comes from a military and police force background, or lawyers, my father's a patent lawyer, which is a little bit different than actually, like jury trials. So I've always had that in my blood that I have to fight for something, or I have to protect somebody. That's always been important to me. Likewise, I've always seen that there's this bad guy, and for me to understand that there's someone to go after logically, in my head, gives me a purpose to do something and connecting those dots on how to stop that person has me jump out of bed in the morning, and I'm not only going to stop somebody, I'm going to help somebody too. I'm going to help a lot of people. So that's what makes me tick. But the way I got started within this is through a company called Carnival Commerce. I started off in authentication. I was a very early-on employee. We focused on 3d Secure, which you might know of. I was there for 15 years until Visa bought us, and that was fun. Then, I was fortunate enough to take some time off because of liquidity, and during that time, Technology Group, which has always been our garage project, that's what it's always been, was a group of individuals that wanted to get together to understand the financial cloud. Way back in the day, almost 10 years ago, it was very new for businesses, especially banks, to migrate to the cloud. Amazon was just coming out with AWS or just, it's like two to three years old, and passing the test as a solution architect or whatever was extremely hard, and we were more of a study group, and we didn't even have a name, but we were just studying it, and we're going through this, and we just by chance, knew some people that would like to know what we're learning right now, and so we share that information more on an education standpoint, I was the fraud guy. I came in to help design their fraud platform. We had a back-end ops guy, DevOps. We had someone and myself was working on a payment network. So all of those clients, that's how it started, but it stopped. Then, pretty quickly, I went into full employment, and somebody else did. We're all friends, but after Covid, and actually just probably this year, I put a lot more time into it, the reason being is, first and foremost, I'm pursuing my EMBA at MIT, and what I'm pursuing at MIT, I think, is relevant. It's on Artificial Intelligence and strategy and Artificial Intelligence goes hand in hand, I think, with stopping fraudulent behavior. You got to be a smart cop. You have to have good tools, and artificial intelligence is here. So I wanted to focus on it. I wanted to have my brain in learning mode. But definitely my comfort zone is working for a big bank and stopping a lot of people, and so that's what my career trajectory is. A lot of people want the fancy startup. I've done that before. I want to go to a bank. I want to go through the processes and procedures. I want to go through all that's involved with it, and I want to start off and build up their AI platform and allow people to understand it, just like we did with the cloud almost 10 years ago, and look at it now. It's not mysterious anymore. It wasn't cloudy, but now this whole AI thing is very cloudy, so that is how I got here and talking to Debbie Reynolds, "The Data Diva".

Debbie Reynolds  05:32

Well, thank you for that. That's a great story, I think, a trend that I see, or a thread that I see in people like you who are coming to these technology spaces; you're fascinated by the area, you take your own initiative to actually study, and learn in that area and figure out where your skills are best suited. So that totally makes sense.

Michael Roche  05:54

Yep.

Debbie Reynolds  05:55

Talk a little bit about just banking in general. So the Internet that we know today, I guess Internet 2.0 or whatever, it was created for sharing. It was not created with security in mind, and so I think banking to me is at the forefront of what's happening in security on the Internet because you have to stay ahead of threats. Banks are always changing their security posture. They're already trying to learn, and as you say, leveraging AI even more so than they do now, can definitely help some of those fraud things. But tell me how that all comes together with your education in AI, and what do you think you see for the future in banking?

Michael Roche  06:40

Where banking has gotten right now is very sophisticated. Their number one branch, they'll tell you, is their statistics. I think it's like 80% or 85%, close to 90% of people with a bank account have the app. They use it. That's a large amount of adoption. There's some people that have never walked into a branch. Capital One is a perfect example of that. So, I'm a Capital One holder, too. So the app and the site are very important, and what they're holding is very important, the desktop, their mobile phone, and that's able to provide a tremendous amount of data to the bank to allow them to make sure that this is really the person that says it is. If they do think it's suspicious, they could do another form of multi-factor authentication. But what's gotten so much better these past couple of years is the device data that we're able to get in our ability to use it, and the mobile networks, how they're improving, how technology related to GOIP, there are so many great new services right now and now, what AI does, let's say that there's if we still haven't got there, let's say that there's the no brainer use cases that you could just do with rules. Don't take a transaction; if A equals B, don't take it. Okay, let's say that there's, in total, 100 rules. The ones that you just make rules for you is about 20. Now, what you get into further out there, of the majority they had, 70% are going to be rules that are going to be managed by machine learning, where they're going to look for patterns, and those patterns are going to adjust themselves, and the machine will adjust their rules and how it does learn. So it learns in session, or it could be taught based on synthetic data that it's given, but it's constantly learning. Now, what happens is, with the last 10% that's where AI really comes into place. Using synthetic data using machine learning, it's able to look for transactions that fall outside of the curve and put those into action immediately on the website. So right now, it's not like fraudsters coming in and they're trying to do 50 transactions in a row at a website. That's not what they're trying to do. They're very conservative. They're coming in really sneaky. If it's just somebody that wants to buy something, really, they're not going to force it through. So the AI is really going to help manage all of that, the majority of those transactions, and make it a lot simpler for us as humans to improve upon that actual technology that goes into it and create more rules on the other side while getting more clever and intelligent about the rules that we give it, so the features of the device information will continue to improve. How we provide it to the engine will continue to improve, and that's how the Artificial Intelligence platform with machine learning will evolve at every single bank. The more you throw at it, the better it gets; the more data, the better.

Debbie Reynolds  10:07

Yeah, that's true. So when you talk about mobile devices, so when I think about mobile devices, I guess I think about privacy, because you're sharing a lot more data with banks or institutions than you would if you were walking into a bank and just transacting on that analog level. So there's just a lot more data there. But what are your thoughts about that and privacy in general?

Michael Roche  10:32

Yeah, that's a good question. If we go over to the EU there's GDPR, and that's a lot different than the States. That comes to the point where that is a good privacy question because the device could give you a tremendous amount of information about somebody, and if the bank is using it truly the way that they're supposed to use it, is that good or bad? Just because it could be used for bad? Should we not do it? Because we're America, and that's freedom. It's a hard line in the sand. We can do what we want and forget about it, even if it's bad. So the privacy, obviously, you're going to have less of it with a bank; you're going to disclose more information to them. They're going to know more about you than anybody else in the world, but the only thing they're not going to know about you is your health record, so they could know everything and anything. I mean, they'll know a tremendous amount of information about you, and they use that in order to provide better services to you as the client.

Debbie Reynolds  11:36

I think banks are very interesting, and banking and finance are very interesting. Obviously, if someone goes to a bank, they trust them, so you have a first-party, one on one relationship with the bank. But then also, banks have other companies they work with, and they want you to have their services, so that means they're sharing your data with other companies. That's fine. I mean, I typically don't have any problems with that, but I think one of the things that we're seeing in the news is a lot of these data breaches and stuff like that, and people are really concerned. The good thing about banking that I found is that if they see that something fraudulent is happening or you contact them, they jump on it right away, so they don't, definitely don't let it linger. But just what are your thoughts? What do consumers need to be thinking about in that data breach space? Because we get so many of those notices, I think people are desensitized to it now.

Michael Roche  12:29

Yeah, all the big banks have a CreditWise or a TransUnion running in the background that'll do a soft credit check that doesn't hit your credit score because they want to consistently increase your balance or let you know that your credit score is going down. Okay, what these services also do is they're checking the dark net for people that have put your email out there, your name, your social security number, they're doing that for you, and it's just out there. I had my email address and three passwords that I used to use. I actually had one still being used on Leonardo. It's an AI image site, and I knew exactly where that password was used, but they had six other passwords that were incorrect for that one email address. So you could take action on those, and that data breach could have come from anywhere. We don't know, but the places that they're looking are limited, because why those were found is because they were being exchanged for money on the Dark Net. Now, what happens when we see foreign players acting as organizations doing the same thing, where they're not exchanging it, they're not even using the Dark Net or using closed networks? They're using the same privacy that a bank would use in order to manage that stuff. They get in, they grab it, they bring it back, and then they do what they need to do with it, and then they go out clean, they wash it. The data comes in. It's like washing money. The data comes in, they wash it and they put it back out in the market. So whenever you hear people like, you've got to wash the money, embezzle it, yeah, that's what they do with data.

Debbie Reynolds  14:13

Data embezzlement, yeah, yeah. I think that's true. Tell me a little bit about the effects of AI on fraudsters being able to do more fraudulent things for AI. So I know that you're talking about, and you're very well versed in and going in the direction of, let's use AI to make banking better and safer and reduce fraud. But then we also have these same criminals who get the same AI that you do. They probably are in your MBA program, for all I know, and they're trying to figure out how to do bad things with AI. What do you think about that?

Michael Roche  14:53

That is true with every type of new technology; you're going to have someone try to use it for bad and so on. Who's going to use it for good? We'll see that. Luckily, we've seen everybody in the financial space really jump on the opportunity to deliver AI systems. So we got a lot of people stepping up, throwing in the ring. They're ready for the fight. So we're gonna have to see how it's going down, and I'm sure there's a lot of people looking at ways that AI could be used in order to commit fraud automatically. So that would probably be where exploiting a fraud system with AI could be very complex, depending on what you were looking for and what you're trying to do. I don't think we really have it spelled out right now, as opposed to what we have in the fraud industry. You can't pick up a publication or say there's not a core strategy for it, a core solution for it, or a core subset of solutions. This is your device-fingering company. Here's your fraud analytics company. There's AI companies too that are in this space, but they're not AI companies that stop fraud. So, there's two different flavors of each bucket. So it's hard to say that. Who's going to do that? I'm hoping I'm rooting for the person that's going to say, oh, we got that, and I checked every publication every day, and I hope there's someone out there.

Debbie Reynolds  16:24

Well, these threats will just continue to happen, so we just have to be vigilant, and hopefully people are coming to the table with new solutions. But one of the things that I'm noticing I want your thoughts on this is that you watch these movies about a bank heist or something, and the very elaborate schemes and stuff like that. So what I'm seeing is more people using AI to trick people who have access to get them to use their access. We're seeing that OpenAI has a voice cloning thing now. So, if a bank or different institution is using voice as a factor for authentication, that could be easily spoofed if that person has additional information.  I'm very concerned about that because if someone's spoofing your grandmother, they have her information; she has all the right answers to be able to get access to her bank. So what do you think about that?

Michael Roche  17:19

That is a real problem, and it has to be addressed by AI because the way it's done right now if you've ever seen the movie Beekeeper, it's an action movie, but the bad guys have a call center that gets people to wire their money out of their bank account to them, but it's got to be a person on the other line that coax them through the collections. So what they're doing with AI is those sessions can only go out in the movie. Occasionally, they'll get one person on the hook, and then they give it to the boss, like a stock deal. Now, with AI, as they improve it, they're able to go out to everybody over the age of 65 in Brecksville, Ohio, who banks with DNC, and they will send them by mail, something, they'll give them a phone call, and they'll also provide them with an email. So they're going to get those to come online. Now, they're going to do one Brecksville; they'll do 400 cities across the world. The only thing that's going to stop them is how well the AI works in terms of language barriers and accents. So that is a very real threat. Thankfully, I've seen a lot of deep fake programs that are coming out. I'm actually a part of initiative right now that's trying to set some goals on it. Deep. Faking is an issue, and especially is an issue when it's looking for people's information and to use them as puppets like that. Because if it goes to a million people, I bet you, if you did it to, we should probably have some research done on this. How many people would fall for this? I bet you over the age of 65 break it down by demographics; I bet you one out of every 10 people would fall for this. Email, phone, you send them something in the mail, you'll be like, I'm going to call you on this day. Send them my email. I'm going to call you on this day. Here's the name of your banker. Those go out. The day comes up, 20 million phone calls go out. All that money just goes into one bank account overseas in one day. Can you imagine that? It's one out of five people do that. It would be like being an apocalypse. 100%, and that's exactly what my example provided, but it still is in an automated fashion, using AI, and it also is the same situation that comes out in "The Beekeeper", the movie that's happening all over the place today. It's happening right now. There are millions and millions of people on planet Earth who don't understand technology, but they have technology in hand. They have a computer to look at Facebook and their grandkids. They have smartphones so they can call their grandkids. Do Facebook, do all of that. So FaceTime, but they haven't caught up with the fact of what security, what's bogus, and what's not and they don't search the Internet. They're not on the Internet looking for things. They're not using ChatGPT; it's FaceTime. It's an app like, oh, I like to play crosswords, and they don't search, so they don't understand, and they're not looking at anything that's going to teach them that, and they're not interested in it too. So that's a whole generation of people, I'll tell you, even I fell for it. Once I got something in the mail, I just bought a new car, and it's for car insurance. It looks exactly like my dealership, and I called the one 800 number, and I almost fell for it. So even I could get duped by these things. So that's where we're at. They don't understand the technology behind it, but they have it. So it's almost like there's a big target on their heads. They're the ideal people to go after. It's like, how do we protect them? Because they work their whole lives and what's in their bank, and they just want to pass it along when they pass. So that's a really sad story to hear when they get ripped off because sometimes it doesn't come back.

Debbie Reynolds  19:37

Yeah, totally. A guy told me he just called his Mom; hey, Mom, how are you doing? She lives in a different town than he does, and he just called her randomly: hey, what are you doing? I'm on my way to the police station. It was like, what happened? She said, oh, I got a call. Said they're gonna cancel my Social Security something if I didn't give them money, and they told me to meet them outside the police station. So she went to the bank and took money out, and she was on her way to meet the guy at the police station to give her some money. I think education really is key, especially very much for younger people and also older people who may not understand. They just don't want to be in trouble, but it makes them feel nervous, and a lot of times they don't want to get their kids involved and stuff like that. What do you think? That's so true. And I highly recommend people, if you're at a family gathering, be the nerve for five minutes and then say something to your family members about fraud and protecting them. Or I say, hey, this thing happened, just to give them an idea what's out there, so that at least they could pick out the phone and call someone if they have any question, and not like this woman go to the bank and start taking money out and giving it to people.

Michael Roche  22:28

Yeah, and continually reinforce that. So my mom buys stuff on Amazon, but if she's ever got to send money out of her bank account, she has to call me, then she should never do that, because it's too complex the way it is, and she is not tech savvy. So that is a good rule of thumb. I like that idea. It's actually very good. Do your tech support for your family and just announce it. Make it simple. Don't give anyone money that you meet on the Internet.

Debbie Reynolds  22:59

That's true. Your MBA program is focused on AI. What is it that people need to know about AI that you feel doesn't really come through in all the articles? I don't know about you. I'm seeing stuff like the world's going to end in two years because of AI, and then the other end of the spectrum is it's going to cure cancer. So it's neither of those things. But what message would you give to someone who doesn't fully understand or comprehend AI right now?

Michael Roche  23:30

It's not going to go as fast as we think. That's it. I just get the feeling that the brakes are going to be pushed on a lot of it because of the adoption at the very highest level of universities and businesses who are scared of this. I have a feeling the next president that term will be will put in legislation, or maybe even a bill right away to stop AI or have a progression of it because if they don't, there's some crazy classification, some crazy claim to 2045 and the brakes are going to be slowed down 100% they're just not going to be allowed to go out willy nilly. I think there will be criminal charges with it that follow, not just financial charges. They'll be put in jail, like maximum security.

Debbie Reynolds  24:24

Yeah, I think the thing that concerns me, and I think you're right, because, first of all, digital transformation is difficult in companies, period, and so they bring on AI, and it creates a whole nother level of complexity. To me, they're only going to be certain types of companies that are going to really be able to run with AI, and then also they have to think about it in terms of a human risk level. So you're doing something that's minimal human risk. No one cares. Go ahead and do it, but when you're dealing with data of humans or something that could possibly harm someone, I see. That they're going to be looking really closely at what people are doing, and I agree, I don't think it's going to move as fast, even though it's moving super fast now, because there isn't really any super pot regulation, except for the EU obviously, there's activity happening in the US, the government level, and there's a lot of talk about it, but I think it will slow down, not necessarily because of regulation, but because it is complex. What do you think?

Michael Roche  25:27

Yeah, I totally agree. I have a rule if you watch a movie like back from the 80s or 90s, 70s or whatever, and there's a problem that comes up that's catastrophic, and it's a result of something we did, like dropping bombs or creating terminators using Artificial Intelligence, like handheld devices. If the movie created it, we have to really think hard about it because it's going to be something that's going to be used for good, very good, or very bad damage. So that's what I think. If a movie says it's going to happen, it's going to happen,

Debbie Reynolds  26:05

Right, you have a thought in people's heads already.

Michael Roche  26:07

One of the weird things, when I watch the older movies, I'll be like, I keep a tally in my head. If I watch a sci fi movie from the 80s, I'll be like, Look, it's out. In general, you could see things like that were invented a couple of years ago, or automatic driving cars in "The Fifth Element”. I was watching Demolition Man. So in Demolition Man, they say TikTok, oh, yeah, during the crime scene, yeah, they use Artificial Intelligence to look for people and look for bad people, but it's only used by the police, so it's interesting. So it's hard for me to watch movies now because I'm like, look, they were right, and a lot of times they are. It's a fun way to watch movies, especially when you're in the industry.

Debbie Reynolds  26:53

Yes, it's true. I like movies about the future. There are a lot of evil robot future movies, some of which I guess you take with a grain of salt, but you do see a lot of those things come up. I saw recently in the original Westworld, with Yul Brynner, and I just couldn't believe it, the stuff that was happening. Then I'm like, oh my God, that's happening right now. I think my concern with AI is that we're going to abdicate our human judgment. There was a scene in the movie where there was a control room where the people were controlling the robots that were out in the little Westworld thing, and the computer, or the robots, locked them into the room, and they couldn't get out because they didn't have enough air, and they died because of that. It's like, oh, I shouldn't let the robot control stuff like that.

Michael Roche  27:40

Ready Player One is a perfect example of the metaverse. Everyone's living in a universe that's just a game. Even though the device looks the same, the way that they're moving looks the same. People never leave it. There's so many, so many. I just think that's the one thing Hollywood does. Well, they they're very clever.

Debbie Reynolds  28:02

Yes, actually I have a story about Minority Report. So when Steven Spielberg was doing Minority Report, he actually interviewed futurists who work on technology, because he wanted to make sure that the movie was relevant in 20 years, and I think they hit it out of the park, because so much of what was in that movie, it was so shocking back then, a lot of that is coming to pass now.

Michael Roche  28:28

Yeah, it would be interesting if humans weren't done evolving instead of AI.

Debbie Reynolds  28:36

I think we're going to have to because we have so much talk about Artificial Intelligence. I think we're going to have to redefine what human intelligence is, because Artificial Intelligence isn't really intelligent, but it can do things that humans would do, but I think we need to be able to separate how humans are different than artificial technology.

Michael Roche  28:58

Yeah, for sure,

Debbie Reynolds  28:59

If it were the world, according to you, Michael, and we did everything that you said, what would be your wish for privacy or technology anywhere in the world, whether that be regulation, human behavior, or technology?

Michael Roche  29:16

This is pretty tactical, but I think it would be extremely helpful and very much in the near term, the ability to link all your devices that you access the bank with together, no matter where they're at in the world, and be able to identify them for just to increase the authentication score, just to lower the risk, I would wish for that, and I'd go also, I'm wishing for the new device updates coming up to be providing much more metadata than they're providing today. My big wishes are too crazy, yeah. Oh, they're palatable.

Debbie Reynolds  29:59

Yeah, right? Because one person can have multiple devices, and you don't want the company to think that those are different people, so they understand that these devices belong to this person. Maybe it gives that person a more unique signature. It helps you better manage that person's account information and stop fraud as well. Good wish, a good wish. Well, thank you so much for being on the show. I really appreciate it. It was fun for us to be able to chat, so we'll keep in touch for sure.

Michael Roche  30:27

Yep, thanks, Debbie.

Debbie Reynolds  30:29

You're welcome. All right. Bye-bye.