GoldFactory: Rethinking Digital Identity in the Age of Biometric Theft

For years, stronger authentication was seen as the answer to online fraud. As passwords became easier to steal, organisations turned to stronger forms of verification, from facial recognition and voice authentication to digital identity checks. 

But cybercriminals are now weaponising those too. 

This episode revisits GoldFactory, the threat actor behind some of the first large-scale campaigns designed to harvest biometric data for financial fraud. As cyber criminals increasingly target the systems used to verify identity, the group raises a much bigger question: how do we establish trust in a world where identity itself can be manipulated and exploited?

Hosts Gary Ruddell and former INTERPOL Cybercrime Director Craig Jones are joined by an author, advisor and one of the world’s leading experts on digital financial services and digital identity - David Birch. Together they examine the implications of biometric theft, the future of digital identity in an AI driven world, and how we can rebuild trust where proving who we are online is becoming increasingly complex.

By understanding who these actors are and how they operate, you can better anticipate threats and protect yourself in an increasingly hostile digital world.

Subscribe to learn more about Group-IB's top 10 Masked Actors  - and stay one step ahead in the fight against cybercrime.

FOLLOW GROUP-IB

• Group-IB Threat Intelligence on X:   https://www.x.com/GroupIB_TI
• Group-IB on X:  https://www.x.com/GroupIB
• Group-IB on LinkedIn:  https://www.linkedin.com/company/group-ib
• Group-IB on Facebook: https://www.facebook.com/groupibHQ/ 
• Group-IB on Instagram: ...

Transcript

Copy Transcript Copied

Gary Ruddell 0:00

Whatever barriers we put in front of criminals become their target. We introduced padlocks and vaults, and soon lock picks multiplied. When we moved online with passwords to protect our information, criminals found ways to steal those two. And so they stole phones and hacked 2FA. So we moved a step ahead. We made our passwords the only things that can't be stolen. Our face, our voice, our unique biometrics. But what happens when criminals figure out how to take those two? What happens when your face is no longer proof of identity, but an asset that can be copied, sold, and weaponized? We are already seeing this play out, and no more clearly than in the exploits of one threat actor codenamed Gold Factory. We've talked about Gold Factory once before last year when we did a deep dive into their theft of facial data. So check out episode one of season one if you want to catch that discussion. And if you're new to Gold Factory, it's a Chinese-speaking cyber criminal group that uses sophisticated tactics to conduct large-scale financial fraud across APAC, notably through Gold Pickaxe and Gold Digger Malware families. Now, they've earned their place again in the top 10 due to sheer evolution. Craig, for anybody who didn't catch last season, what is the most significant thing that people need to understand about this group?

SPEAKER_00 1:29

Yeah, thanks, Gary. I think you sort of explained it in your opening there. We've got a group here that are evolving all the time. So as the technology evolves, they're looking to see how they can take back technology and use that for, shall we say, nefarious activities. So in terms of deep fake, in terms of the malware they're distributing, they're bringing that all together very effectively now. And they do this on an incremental basis as well. You know, they will test it out, almost maybe on a beta test to start with. But that ecosystem that they have and that sort of knowledge they have is growing and expanding over time.

Gary Ruddell 2:06

And are we seeing geographical expansion?

SPEAKER_00 2:09

Yeah, for sure. I think you know, we looked at the APAC region uh initially, so sort of Vietnam prime Vietnam primarily, Thailand, Indonesia, those sort of countries. We then sort of saw some activity going over to the Philippines and then some expansion into the Meta region. But also we've seen some sort of isolated attempts now targeting banks out in sort of Latin Central South America, so actually Peru, Mexico, Brazil. Um, but again, the regional basis further into Bangladesh and Africa. So I think the majority is still in the APAC region, but they are reaching out, and they may not always be delivering the attacks. They will work with others as well, and they will sell those techniques to other groups in different regions. So it's it's it's almost growing out that that regional business model into a global expansion, effectively.

Gary Ruddell 3:03

Yeah, I remember in our high-tech crime trends report, there was that case in Indonesia, which hit like 16 government and financial brands through that malware infrastructure, which was really targeted and very, very precise to the Indonesian national tax season. Clearly, the group is highly opportunistic. How do they compare it to other groups of their kind?

SPEAKER_00 3:27

Yeah, so I think some of this is opportunistic, but also some of this is almost like a very carefully delivered and crafted campaign. They will look to see when the tax returns are being done. They might look to see when something comes out of the news which catches the public's interest. So people are then looking at that that latest news article, or it might be something around uh refunds or lotteries or something like that. So it'll pique people's interest, and then the criminal groups will piggyback on the back of that effectively to then do those attacks and start those scams going.

Gary Ruddell 4:04

When you would describe Goldfactory, would you class them as a malware developer, a fraud operation, or a like a cybercrime ecosystem?

SPEAKER_00 4:12

Uh I think all of the above, realistically. Um, you know, they they they build the infrastructure out, they operate in that space, they don't just stay in one area. And the bottom line is they want to make money. So anywhere where they can see a business opportunity to make money, even using their tools, using other groups selling it on, that's what they will do.

Gary Ruddell 4:38

Craig, can you walk us through the attack chain of Gold Factory?

SPEAKER_00 4:41

Yeah, there's a number of different phases to this. So the sort of first phase is about initial access and social engineering. So the attackers will target the victims via SMS mission, messaging, using applications such as WhatsApp. Um, they'll impersonate and mimic fake sites, trusted entities. We spoke about the government one previously in the tax. And then they'll look to hook them in. So they might be frightened into action. So we'll get that sort of notice saying, you know, got an overdue bill, there's a tax refund, a mandatory account verification, and then they're downloaded to uh that they're then directed to download a specialized application, and that moves us into a next phase now where it's about that malware delivery and side loading. So the mobile operating systems block unauthorised apps by default. So Gold Factory relies on that social engineering trick into bypassing these security warnings. There's different ways they can do that for Android, iOS. Um, but what they want to do is get onto the mobile device uh management and those profiles that grant them attackers access to deep configuration controls within that person's device. And then the next stage is that sort of masquerade masquerading and defensive evasion. So you have these installed on the applications, they replicate the exact user interface, the banking utility, government apps, and then that doesn't arouse the victim suspicion. So they think they're interacting normally. Um, but that malware establishes a persistent connection with the C2 server that's controlled by sort of the group effectively. Then they'll move into that credential harvesting and data collection. So, you know, they they want the information there. They they may do it through um reading screen context, uh logging keystrokes, overlaying fake login, so people are logging in and putting their information in. They may do it by SMS interception, so as incoming text messages or one-time passwords that are sent by financial institutions. Um but interesting one here and using the gold pickaxe was that biometric harvesting. So this is about getting the person to complete a fake identity verification. So you've got their face, they might have their security check as well, so like an ID card or something like that. So then the criminal groups will capture all of that information. And then the final phase there is moving into sort of that fraud part. So executing um, you know, the banking apps, using the facial recognition, um, emptying people's accounts, or even just completing know your customer checks by impersonating someone else. So there's a number of different phases to this, and the criminal groups will work all the way through those different phases, um, you know, using their IDs, using people ID as well, to then commit the offenses.

Gary Ruddell 7:38

I want to take a minute to introduce us to David Birch, an author, advisor, and professor on digital financial services. David is also a columnist for Financial World and has written for a number of other publications, including Forbes. He spent years talking about trust, identity, and digital money, exactly the areas that Gold Factory throws into question. David, thank you for joining us. Quite the resume you have, a lot of areas to cover. Tell us, what's the one thing you're most passionate about? You're very kind, Gary, thank you.

SPEAKER_02 8:10

Um I I think the the scale of fraud is I think is not understood by people. Fraud is is completely out of control. It's it's the number one crime in the United Kingdom, and and we all know it's massively underreported. The the sheer, I mean, the amount of money that's going to these criminal groups is is and I I don't understand why people aren't more upset about it. I mean, to me, it seems a very fundamental aspect of modern life which has gone hopelessly wrong. And in the UK, of course, because we don't have any kind of digital identity infrastructure, we you know, we're we're we're uniquely vulnerable to all of this. So I don't understand why people aren't more upset about it, but it's a my my sort of fundamental point. But I also don't understand why there isn't more of a call for action because we we don't need to wait for people to invent some amazing new technology to deal with this. We we have the technologies that we need. Yeah, we've had digital signatures and encryption and stuff like this for years, we just we just don't use it, and so I feel very kind of frustrated about the whole thing. You know, you you turn on the TV and you watch scam interceptors for that's one of my favourite programs, but you watch scam interceptors like it. Every week you just want to reach out, like, how are these people still doing this? You know, it's anyway. So I know I sound a bit deranged, but but my I think my point holds fraud is out of control, and we really should be doing more about it than we are, frankly.

SPEAKER_00 9:44

So I was just gonna say I I echo David's point, you know, the the the volume and scale of this is so vast, but we still look at it through a single lens of single victims a lot of the time. And we hear these stories about you know people losing huge amounts. But, you know, I refer to cybercrime as high harm, high impact, high volume, high interest. This is very much high volume, but it's not something that always grabs the headlines. And I think this is the struggle we have at this moment in time about grabbing the headlines and getting something done effectively in this space.

SPEAKER_02 10:22

That's right, Craig. I mean, I think the the you know this stuff is going on all day, every day. We all understand that, and we understand, you know, we can measure to some extent the financial losses, but what we can't measure to some extent is the kind of more pernicious impact of this kind of crime, which gradually eats away people's sense of of society, frankly. And and you know, it's it's almost as if someone's pulling at the threads of society, and and we can see the starting to come apart, and we're not panicking more. And so it isn't just about the money that's being stolen. This undermining of trust in in our infrastructure, I think, has very, very negative outcomes downstream. So we we need to find ways to regain people's trust, not just get their money back.

Gary Ruddell 11:09

What are some of the biggest challenges that you've seen within the industry in recent years, David? We we laugh about it, but it kind of isn't funny.

SPEAKER_02 11:16

So, but it basically if you walk down the street and say to people, oh, you know, do you take security seriously? They'll go, yeah, yeah, yeah, yeah. And then you say, um, oh, by the way, um, can I have your password? Here's a Mars bar, they'll give it to you. Like people, people are utterly like they say that they take security really seriously, but actually they don't. And so the amount of phishing that goes on, getting people to give you their passwords and click on links they shouldn't, is to and again, we don't we don't make the infrastructure work there. We we we expect people to take care of all of this. So I think there are some very basic things we could start doing. One example which I think is quite interesting, and I know this goes to sort of marketing and stuff as well as technology, but is pass keys. So if I see on a website I can use a pass key instead of using passwords, I click on it immediately. I never want to type in another password again if I can. And there's quite a few websites, like eBay, for example, if you see the thing that says use a pass key instead of a password, you know, I click on that every single time, you know, because then you've got real security sitting there. But would one in a hundred people know what a pass key is? I mean, we think everyone knows what pass keys are because we we're in the industry and we use them all the time. But if you went and tried to get the general public to I'm I'm not sure they'd know we've done a terrible job at communicating some of these things. So uh I know that's kind of a ragbag, but you can see sort of what I'm driving at. So what we want is we want the infrastructure to protect people. We don't want people to have to do it themselves. We need to do the simple things like stopping sending SMSs and stuff like that, when we've already got apps that could do this sort of thing. But we need to move people away from pretend security like passwords into real security like pass keys.

Gary Ruddell 13:05

Thanks, David. Yeah, you you make some really good points there. Even you know, I'm sort of the tech guy in my family, so when it's Christmas and somebody gets a new printer or device, it's you know, Uncle Gary, etc., can you do this? But like people won't even set up their devices fully. One of my uh relatives, you know, I saw a little red dot on the iOS settings app on her phone, and I was like, what's this? And I tapped it, and then it was could finish setting up this iPhone. And she had the iPhone for years. You know, I don't know how you teach people the the basics of base of the basics, you know, it's really, really hard to impart some of that stuff.

SPEAKER_02 13:50

I think uh you can't, and but actually that's an odd source of optimism for me at the moment because if you look at what's going on in other parts of the industry, people who are doing strategic planning around next generation services, you hear people talking about the the end of the app generation. Like we've just been through this generation where the where the sort of fundamental way that we communicate, not just with banks, but with everybody, is the app, and that's about to go away because we're replacing everything with AI. So uh, you know, I'll give you a simple example. I've just walked in from the garden, we just talked to my wife in the garden. There used to be an app, you could run an app to look at a leaf and say what plant this was that was growing. Now you don't bother with the app anymore, you just ask Chat GPT. So we're we're moving into a sort of different world where we have a different way of interfacing with things. Now, actually, I think this could be a very good thing. Because I think, and I'm prepared to be I'm prepared to be argued out of this, but I think AIs are going to be much harder to fool than the average person. So if you think about uh I mean it's not funny, but I think it's an interesting case. We we all remember that story last year of the the woman who sent $800,000 to Brad Pitt because you remember Brad Pitt. Brad Pitt was on his uppers and needed a bit of a sub uh for a while. And so Because it looked like Brad Pitt, you know, and it sounded like Brad Pitt, and you know, people are easy to fool. There were scientific studies which show you absolutely people cannot tell the difference between an AI-generated face and a real face. They can't, you know, and I'm I'm normal, I can't, you know. So But the AI doesn't work like that. Your AI wouldn't be thinking, does this look a bit like Dave? Does this sound a bit like Dave? You know, under the hood, the AI is saying, you know, we all live in the world of agentic commerce and mandates and certificates and digital signatures. The AI isn't like, oh, does this look a bit like Dave? The AI is saying, is this Dave's digital signature? And that's that's a very different world. Um there's a lot of interesting work done around sort of financial inclusion. Um, this idea of uh you know, we should increase people's financial literacy, we should help them to be on their guard against scams, this kind of thing. I'm starting to think maybe that's barking up the wrong tree. I'm starting to think, you know what, we should just give up on this, or we should just get AI to do it for people instead. In fact, you know, maybe maybe you should make it illegal for people to access their own bank accounts. Maybe you should only be able to access the bank account using an AI. I don't know. But yeah, I'm starting to think we need to have some radically different thinking about how to help people through this.

SPEAKER_00 16:43

The the whole premise then of uh protecting the public or protecting people, individuals, businesses, that comes back to that law enforcement model, prevention, detection, investigation, disruption, and that's the model. But prevention is that first part. And I think you're quite right. Anything we can do to design out the human interaction by default within this should help because the technology now is there to support so minimising the human element to this, you've got to keep human in the loop for this this stuff because a human will initiate the the action potentially, although thinking about how AI works now, you know, it can take that side of it as well. But for a long time, we've had this technology in different places, and it's been uh, oh, well, it's all a little bit too difficult, it's all a little bit hard. But there are some great applications going on now, and the way that I interact with the banks now about if I'm sending money from one bank account to another one, um, you know, I have to open up the apps and things like that, get the reminders coming to me via my device so it's locked into my device as well. So there's that secondary checking within that. But then as humans, we're lazy and we wanted things quickly. So this is why there are vulnerabilities in systems and networks, and as humans, we're we're quite quick to exploit those, but even more so are the criminal groups. They're the ones that exploit this very, very quickly, as we're talking about here.

SPEAKER_02 18:14

Yeah, and and the thing is they understand the psychology of this very well. Well, uh a very good friend of mine got caught by one of these scams. Uh, she thought she was talking to Virgin Broadband and um uh got got scammed out of some money, which um which she got she got most of it back, but um which said, Oh, I felt so stupid falling for this. And I'm like, you really shouldn't. These people are professionals, they do this day in, day out, all day long. We're normal people. You know, you were trying to get out of the house to go to work, and you know, Virgin Broadband bringing you up some annoying stupid thing about bills is like that happens, you know. So it's it's like don't feel bad for yourself. Like it's not that you're these people are professionals, they know exactly what they're doing, and they know what questions to ask. Me, you know, yesterday, in fact, you know, I'm trying to send money. My my assistant changed her bank account, so I had to change the bank account details. So I send it, and the bank is pestering me to death. Are you is this someone you know? Have you sent the money before? You know, you know this could be a scat, blah, blah, blah. That that's a speed bump to criminals. That's nothing. Uh you know, all the annoying, you know, we drive people up the wall with this stuff to actually no benefit. It it does nothing to stop the criminals. It I think we need a rethink, and that's why I think you know, we should be a bit more imaginative in the way we think we're going to use technology to help here.

Gary Ruddell 19:41

Um, how much of growth is down to technology and how much is down to the business model behind modern fraud?

SPEAKER_02 19:49

I I think the business models that Craig alluded to when he was talking about the chain earlier on, I think those those hold. They're the same. In the sense that, you know, trying to imagine like are these things new crimes or are they just the same old crimes but you know, automated. I mean, I think we know what the we understand the business models that are there, you know. Um, but no, technology has led to to significant automation for the criminals in this uh in this kind of space, and they're taking full advantage of it. And in a way, and I'm not saying this is a kind of a throwaway thing, but in a way, they have a slight edge here because let's use that example of AI we were talking about earlier on. If you're a bank and you want to bring in some AI to help you detect some kind of fraud or stuff like that, you're a regulated institution, you're a responsible organization. You have to test it and certify it and check it, and you have to make sure that it doesn't discriminate, you have to make sure that it's fair to people. You know, there's a lot of hoops you have to jump through to use that technology, as it should be, right? If you're the criminals, you could give them monkeys. Just fire it up. If it hallucinates sometimes, who cares? I mean, it doesn't matter to you. So you get the you know, the latest, you know, you fire it up and away you go, and you're you're a step ahead. And because you're attacking something that's not being defended properly, that's always going to give you an advantage. If you look at what would I mean, I'll I'll give you a simple example of what what kind of thing we could do. We're talking about pass keys earlier on. Suppose you couldn't fish passwords anymore, right? I mean, just just say we could get to a situation in a year or two years' time where no one's using passwords for anything anymore. You can't fish passwords anymore. Okay. Those criminal business models would still be in place. The criminals wouldn't go away. It it would it would hopefully raise their cost of being in business, but it it it wouldn't stop them. They just attack another part of the chain instead. So now I don't think the business models are changing very much, but I do think the use of technology has allowed them to automate in certain areas, and we haven't yet responded to that to to fight back. We s We still rely too much on you know, you s you said about the you know, having to identify yourself early on with the passport and whatever. We're we're training people to do this all the time. In a sane country, what we would have is a digital identity infrastructure so that when you go to login, like or my my accountant, we changed accountants recently. So my accountant had to have copies of my passport, actually, and my wife's passport as well. Absolutely ludicrous. That's one more place where all of our personal information can be stolen from now. You know, that shouldn't be what's happening. What they should be doing is sending a digital message, you know, a digital challenge, getting a digital response from you know, my identity wallet to identity application or something like that. Nobody should be sending around copies of passports, or actually, I was asked to send a copy of a bank statement to a fintech the other day, which I absolutely refuse to do. It's like we're we're we've allowed the we've allowed the criminals to kind of automate and use the tube jet terminology. We haven't responded to this yet, you know.

Gary Ruddell 23:01

So and when we talk about gold factory and like the scale of what they're doing, so Group IB's research found that they were doing 15 infections a day across their active campaigns, and each successful case averages around $1,700. So it's a decent little earner for that group for sure. Um for years, you know, we've assumed that stronger authentication would reduce fraud, but look at a gold factory and just biometric theft in general. Do you think that's really true or not, David?

SPEAKER_02 23:34

No, I think stronger authentication does help, but but you but you've got to understand the system context of it. So if I'm if I've got to you know wave my face around and show up to somebody I have no idea who they are on the other end, it could be absolutely anybody, that doesn't improve security, you know, one little bit. You know? When I when I look at my face on my iPhone, that doesn't improve security. Because actually I'm not sending my face to you, I'm authenticating myself locally to my device, not to your device, and then I'm sending you a cryptographic confirmation. So strong biometric authentication against um, I mean, to get technical, uh, strong biometric authentication against keys that are held in tamper resistant hardware that's under your control is a substantially different, you know, that that's very different from pretend authentication, which is me showing you my passport when I've no idea who you are, you know.

Gary Ruddell 24:34

If your face, you know, your biometric data is compromised, what are the long-term consequences of that?

SPEAKER_02 24:40

Well, your face is your face is compromised. There's nothing secret about your face. Your face is this is what makes me laugh when the again, I won't say the banks because it's not fair, but it's for business banking. And I had to go through security the other day, and the guy, what's your mother's maiden name? What's the point of asking me that? My mother's maiden name is a matter of public record, just the same as my date of birth. Is like, why are you even asking me these things? It's ludicrous. Yeah, so my face is already compromised. My face isn't secret. So I don't understand where you know we're not going anywhere with that stuff.

Gary Ruddell 25:14

Uh Craig, when investigators look at a campaign like Gold Factory, are they mostly stealing biometric data to bypass controls or are they collecting it as part of a you know future campaigns?

SPEAKER_00 25:28

It can be either or or both, basically. Um, you know, it data and information is key to criminal groups and how they can then use that information. As David just talked about, you know, you have to use this information to access certain things, whether it's for you, your business you're running, or or something like that. And the criminals know this. But coming back to that point David made earlier about you know what a country's doing, we we see some countries having very, very strong digital systems and networks. Estonia would be one I would highlight. Um, but the reason Estonia has a very, very strong digital infrastructure is because back in the 90s, you know, they were hacked by another country, and that caused absolute mayhem for them internally. So they went back to the drawing board and redesigned their whole system and structure. So everything that's done digitally is done under one number, which is that person's, but you have that digital ID, which is unique to you and your devices. And we've seen other countries adopting this technology. I think that the challenge we have where the criminals have the advantage are those countries that are using legacy or bolt-on systems where these things have grown organically and we've added security as an afterthought sometimes for the best intentions, and then the criminals are then able to use the data and information that they've harvested in previous years, which may not have been useful at the time, they can repurpose that. And it's again when you have large data sets as well. This is where we get into AI space now, being able to use AI in combination with that, and that's even before we get into sort of quantum computing and tracking encryption, because you know, a lot of data people are talking about it's been stolen and then harvested and stored, even though it's encrypted, with the hope that later on it can be decrypted. So, what does that look like in in the future as well? But coming back to your point, yeah, you know, information is absolutely key. You know, some of it is they want to bypass, know your customer, they want to be able to bypass the banking systems by pretending to be that person effectively to get access to that account, or open new accounts um elsewhere uh as well.

Gary Ruddell 27:51

Are we approaching the point where institutions can't really rely on face equals identity?

SPEAKER_02 27:58

Not face alone. I mean, what what institutions need to do. Well, in fact, what institutions are doing is is moving to a kind of more integrated I I know we try to use these words interchangeably, but because I'm a horrible nerd about these kind of things, in my head, identification, authentication, and authorization are completely different things, you know, and what we want, ideally, what we want is an economy which is based on authorization, not, you know, does this look a bit like Dave? But is this entity presenting a credential, you know, a digitally signed, unforgeable credential, which says the entity is allowed to do whatever it is they're trying to do. Not is does this look a bit like Dave? Is this thing, whether it's a person or a bot or anything else, allowed to access Dave's account within these parameters and do these activities? We need to move into a space where we're checking authorization. And actually, in that kind of environment where security is structured and implemented correctly, the need for identification almost disappears. Not quite, but almost. Should I be on this team's am I an employee of the company? Not am I Dave Birch? I was just looking at a website earlier on before I came in here. So it's the yeah, you know, do I have a British Airways, you know, uh club membership thing? You know, it it's like moving to this authorization space is the thing. Every time you have to identify yourself, you're creating another place where your identity can be stolen from. It it doesn't it doesn't help at all. You know, this is why, again, I don't want to sound completely mad about this sort of stuff, but we we already have the technology, we have cryptography, we have verifiable credentials, we have you know, if you look at what's going on across the channel, the European digital identity wallet is coming into place fairly soon. Like they have all the building blocks, people already know how to write the software. You know, we could be using that ourselves.

SPEAKER_00 30:22

I mean, David, I I had a diff I had an interesting one the other week. I wanted to update my eSIM onto my new phone, and I I have uh an eSIM, I've got my own SIM for UK, but I've got a dual SIM on my my phone, and I was trying to update my UAE number, uh eSIM. I could only do it by being physically present in the UAE. I couldn't do it outside, even though I've got to go on V. So and I and my identity, coming back to your point, my identity had been verified, but I had to be physically, my phone physically had to be in the UAE. So again, they're putting measures in place to protect their networks and systems.

SPEAKER_02 31:01

I I had a similar thing. I I I wanted to move, I this was with three in the UK. I wanted to move a number from from an old SIM to a new SIM. So and I so I and I had to physically go into the three shop with my passport. I mean, why? Since you're not showing the passport to some you know, Mossad trained international expert on detecting fake passports, it's just someone who's gonna take a photocopy of it and stick it in a drawer. But but anyway, the point is I had to physically go into the shop to do it like to criminals, they do sim swap attacks all the time. They know exactly what to say online, uh, exactly what to say to the court. Whereas mugging is me, it took me an hour to change it. And I'm thinking, you know, uh if I was a member of an international criminal gang, this would say can be 10 seconds, and I've got to go into town and spend an hour doing this, you know.

Gary Ruddell 31:48

From a security perspective, we seem to be willing to do everything except require passports or some sort of verification for buying domains. That's one of my big bugbears. Like, I can go and sign up today and get Dave and Craig's domain.com. No problem, no ID required. Like it's just it's a it's a joke.

SPEAKER_02 32:09

If we had to register all those, and you used to be able to do that with companies, it's only like a few months ago they changed it at company's house. So you have to do a rudimentary KYC before you can register a company. And I'm sure 99.9% of the companies on the register still don't have anybody verified as an officer. So no, we we we need to change the infrastructure of this stuff. We just really do.

Gary Ruddell 32:33

In your view, David, should developments like this force us to really reconsider whether we base online interactions on ID versus credentials?

SPEAKER_02 32:41

Oh, I I'm I'm uh I'm a maximalist on this. I think we should move to a credentials-based infrastructure as the earliest opportunity. Your your personally identifiable information shouldn't be present in any transactions that don't need it. I mean, there's one or two cases where you can think of where I don't know, you know, you know, like if I if I'm if I'm trying to check in at the airport, they need to see my real passport. Or in the future you'll use a digital one, of course. But um but the number of interactions in daily life where your your real identity is absolutely necessary for a transaction to proceed is negligible. I remember years ago I did an experiment, actually, much to Tesco's credit, actually. I was curious to see what Tesco were doing with people's data, this was years ago, when club cards were still new. So I got a club card in the name of David Beckham, and then I waited to see what you know what mail would come through the post addressed to David Beckham. And the answer was none. It never happened, as I say, much to Tesco's credit. However, for years I went to Tesco's with a club card that said David Beckham on it, and everything worked perfectly because they didn't care whether I was David Beckham or not. What they cared was, is this the person that bought toothpaste last week? Or, you know, what kind of beans does this person buy? Or like who I really am is just not important to the transaction. And I know it's a very silly and simple example, but like that's how everything should work. You know, you've you know I've got my digital ID app government wallet thing on my phone. Have you got a are you a s are you a solicitor licensed to practice in the English and Wales as of now? Tap the phones together, yes or no. That should be I like what's your real name? I don't care. Like what I need to know is are you a solicitor that's licensed to practice in the UK? You can put any name you like on the wall, I don't care, right? It's like it's we need to move into this mode where where we're we're doing real, real authorization based on real credentials, and it has to be completely simple for people. Like, we can't go around trying to teach people about you know PGP and digital signature, it can't work like that. It's gotta be, you know, Jerry Fishend didn't uh at Wild Bikes uh who's a big expert on government IT. I listened to Jerry a lot on this. He said, you know, we're everyone's used to tap to pay. When are we gonna get tap to prove? And I thought that was a really nice way of putting it. How are we gonna get to tap to prove? That's the you know, when you go to the pub, should you be showing your driving license to people? No, you shouldn't. Should you be tapping your you know, identity, whatever it is, app, wallet or something, you know, and then it shouldn't be telling them I'm Dave Birch, I live at this address, whatever. It should be there's a green light that goes on if I'm over 18, there's a red light if I'm not. End of story. You know, we need to get to that. Tap to prove is a very nice way of thinking about where we need to get to.

Gary Ruddell 35:40

Like cases like Old Factory really bring light to a number of big questions, clearly. Identity is increasingly becoming a key that unlocks you know financial services, which means it's super valuable for cyber criminals. But there's also, I guess, another question here is the role of rapidly emerging synthetic identities. What role does agentic AI play in all of this, David?

SPEAKER_02 36:06

So obviously, we need to have a kind of KYA, know your agent, just the same way we have KYB, know your business, and KYC, know your consumer. So, I mean, let's say, let's just imagine a future where I've got I'm paying £9.95 a month for my Martin Lewis money-saving expert superbot, which does all of this stuff for me, right? So it goes off to get some car insurance. I think car insurance is a good example because personally, if I never had to speak to another car insurance company ever again, it would be too soon. The sooner I can pay an agent to do that for me, I am in absolutely 100%. So my Martin Lewis money supermarket expert bot agent goes off to the car insurance companies to get the quotes, compare them. The car insurance company needs to know not only that it's talking to a real Martin Lewis money supermarket bot and not a fake North Korean Martin Lewis money supermarket bot. So it needs KYA. It also needs to know what the Martin Lewis money saving expert is. That's a real company or whatever, so that's KYB. It also needs to know who has authorized that bot, which should be me, of course. You know, has Dave authorized this bot to do whatever it is you're trying to do? So you need the KYC. Probably also was that actually Dave's phone that that did this, so you need KYD or your device. And actually, you probably want to know at the Martin Lewis level who's the executive officer that allowed this bot to be released. So you also need something kind of KYE at the other end, all of which proves I don't know very much about identity, but I know a bit about marketing because that's like A B C D E. C A B C D E is of digital identity. That's where we need to get to. So uh given that we've made virtually no progress on KYC as it is, we've got our work cut out, I would suggest. Perversely, and I was writing something about this recently. Perversely, I think it might kind of work because the pressures for KYA mean that companies have to get KYB and KYC sorted out where they might not have done before. So although we haven't made much progress on digital identity, it oddly it could be the the arrival of agents which makes us fix identity for people, because we need to do that in order to fix it for agent. You see what it what it is I know it's a convoluted argument, but I think I can I think I can back it up a little bit that um companies have been tolerating poor KYC just as a cost of being in business. They've seen the cost of fraud as just a cost of being in business before it began to escalate. But with AI showing up, though that that changes. So oddly, it could be the arrival of AI that is almost a catalyst for getting KYB and KYC fixed, which should have been fixed years ago and worked. I hope I don't sound too rose-tinted on that, Craig, but I I do think there is some real some optimism there, don't you? Possibly.

SPEAKER_00 39:19

Again, the the whole piece now about agents and who you're dealing with and who you're talking to, and it sort of comes right in at the trust issue as well and identity. So who are we actually dealing with now? I'm creating a company, I don't need to bore anybody. I can create a whole bunch of agents to carry out all the tasks effectively, um, and I can use those agents. I was recently um in Shanghai at the World AI conference, and one of the researchers there was speaking about some of the work he'd been doing, a Chinese guy, and he said he didn't actually know in some cases whether he was working with an agent or a human. And in fact, one of them, which was running the project, he found out after six months was an agent. So he'd be working all this time on his project and interacting with an agent. So when you step back and think about that, think about all the different things that he would have been doing, thinking he's communicating, yeah. We're now very used to working in that online space, working remotely, not coming into the office, sitting down next to them and say, How are you? Yeah, how was your night last night? Did you want with that's we've moved away from that so much now. We're having these sort of conversations where you could in the future also not be talking to a real person, but you think you are. And this is my concern now on the criminal side, where we see criminals are starting. I don't think we're quite there at the moment, but criminals are looking to see how can they use agents as well as part of their work because they're using them in business, you know, companies using it in business, sure as eggs are eggs, nights holidays, the criminals will start adopting that as well.

SPEAKER_02 41:00

Well, this is why I have the sort of deep-seated, but hopefully not ill-founded hope that AIs will be better at spotting the fake identities than people are. So actually, I don't think it's necessarily a negative that we have AIs working for us on our teams because they they potentially could be very valuable in this fight.

Gary Ruddell 41:22

As deep fake becomes more available, like the technology behind it, you know, whack it on GitHub and download it to your heart's content, do you reckon facial recognition theft is going to become more common?

SPEAKER_02 41:36

If I if I get if I if I get a Zoom call from from someone who looks like Gary, who says, you know, do you want to do this podcast when you do main edits or whatever? But if I get a if I get a Teams call from Gary who says, um, I want you to invest in cryptocurrency, whatever, then I really ought to be a bit suspicious. The fact that it looks like Gary doesn't mean anything, you know, and we we're gonna move into that fairly quickly because people are pretty, I hope, people are pretty quickly gonna learn that you you can't trust what you see. Like you why would you trust anything? You can't trust anything you see or hear unless you've got absolute proof. But of course, we want that proof to be built into the infrastructure, not for people to deal with individually. So is it gonna be worse? I don't know.

SPEAKER_00 42:25

But I think David, we've we've moved into this realm already, so I think Martin Lewis is a good example. Martin Lewis has gone on public record to say he does not sell anything, you know. So if you see him selling something, it's not him. Yet people will still watch a video. Martin Lewis will give a recommendation, they will do the investment. It comes into that whole methodology of those criminal groups and how they operate. You know, they look on the vulnerable, so you know, you look on people that are lonely, um, you know, gaining the trust of that person over time is one way of doing it. Or, you know, I've seen it in families where the parent has gone online, befriended someone, and then their children have found out months later this person has given over loads of money because the person's been, you know, kidnapped in hospital. And these are normally safe people, and it and you're seeing a lot of these.

Gary Ruddell 43:18

Craig, are we seeing criminals use deep fakes mostly for targeted fraud against high-value victims, or do you expect this to become uh mass market capability?

SPEAKER_00 43:29

I think it's both. Um, we're with we're seeing a sort of volume side of this, the mass market side of this, where they will be having posts on Instagram, they will be putting general things out there with you know a very famous person saying you have to invest in this, you know, it's great. So there's an association with a famous person, and that that's clearly a deep fake effectively, right? Yeah, that that's what that is. But also you'll see that business model evolving. Um Um, where they and the criminals start understanding how they can best use this. So it's like any technology, what what's the nub of that technology? How can you really use that technology to focus in on a specific business model? So in this case, it might be they will work for a while on you know someone that they can see has a large amount of money, is particularly vulnerable, and they'll use a combination of factors within that. And you know, deep fake will be part of that because they might be impersonating someone and gaining that trust over a period of time. So it might be one element to it, and you know, they won't go for that quick sort of cash grab and run, they will build it out over a period of time and basically milk milk that person effectively for as much money as they can. Um, sometimes this can be picked up by family groups, sometimes it's not picked up at all. And you know, on the BBC recently, they they were going through some different cases. Uh, they they were really, really shocked. Yeah, from an outside looking, how the hell does this happen? But actually, you had an extremely vulnerable elderly person, you know, that's one group, or someone's particularly lonely, so the criminals will target that. And you're looking at losing losses of 500,000, 750,000 pounds, a million pounds in some cases. These are huge amounts. Um, remortgaging their homes, taking a loan out to help that person out because they believe they were in love or that person needed their help. Um, and this can continue for a long period of time, and they can become further socially socially isolated from their families. And we see quite a lot of this reporting going into UK policing now. And it's not just in the UK, this is happening elsewhere. We've seen in China as well a lot of the vulnerable elderly people in China where they become more technical. Savvy they're online using using tools effectively, but they are being contacted, and you you see in different countries as well this happening, and that's what the groups will do. They will target wherever they can effectively.

Gary Ruddell 46:10

Uh surely it's possible for financial institutions to distinguish between legitimate users and deep faked ones, right?

SPEAKER_02 46:19

Well, yes, if they have their ice security in place. I mean, that's that's the argument from earlier on. So if you're going to live in a world of passwords and sending out SMS messages, then frankly, you deserve everything you get. You know, because we already have the technology that we need to improve that. I mean, I realize it's complicated for banks to change these things. If you've got if you've got 30 million customers and you've got to get them all to start doing things in a new way, that's time consuming and so on. But actually, we should be looking towards more sort of standardized approaches to this. It should be that people just expect to see a pass key, not a password. If they're asked for a password, they should see that as being kind of unusual. If they're asked to identify themselves instead of presenting credentials, that kind of thing. So I'm not stupid. I realize it's going to take time to make these changes, but we but we need to start. And I think banks are a good place to start it actually. If but you know, in in in Scandinavian countries, for example, it's the bank identity, which is what people use for getting everything else done. You want to rent a car or or you know buy something online, or you use your bank identity because that's the sort of secure identity. So I mean banks are actually a good place to start fixing that. But yeah, I'm not unrealistic about it, it'll take time, but we could at least make a start.

Gary Ruddell 47:44

Yeah, I mean, gold factory's operations were first publicized by Group IB in February 2024, and they have continued to grow and you know, scale at pace on the financial institutions front. How quickly are we seeing them make changes to protect customers? Do you have any insights into that?

SPEAKER_02 48:02

Well, I I you know I can point to examples where you see, and actually, one thing that you might add there is that uh one thing I might add there is actually the the challenger banks, you know, the the Revolutes and the Monzos and the Starlings, they've they've been quite good at pushing this sort of stuff forward, actually. So the banks have to respond to it. So you do see changes. You do see things like the banks doing in-app notification and uh you know, or if you go to your is it Revolute, I can't remember, you go to the app, it'll tell you if you're if you're on a call with somebody at the time, that's the thing. So no, I think they are sort of making those changes. I just yeah, we could do with making them a little bit quicker. And that's just banks. I mean, then you've got everybody else to deal with, you know, state agents and accountants and solicitors and everything else as well. That will take time too.

Gary Ruddell 48:47

What immediate steps would you, you know, tell financial institutions to take today to reduce exposure to biometric theft and impersonated attacks?

SPEAKER_02 48:57

Well, God, I think the immediate steps. So, first of all, I mean, it we'll go back to the point that was made earlier on by Craig, which is stop sending people textes. I mean, really. That has to stop, you know. Uh look, I think um moving towards in-app solutions, I think, is an obvious thing to do. Moving towards past keys is an obvious thing to do. Moving towards uh I mean, and this is something that I wonder if the banks should sort of sit around waiting for the government to come along with some sort of digital ID solution. Well, maybe it would be better if the banks got together and did it themselves. But you know, we do need some kind of bank ID equivalent here. You know, I I shouldn't be like when I when I'm getting my new accountant, I should be using my bank login to show the new accountant I'm a real person and I've really got this bank account, all that sort of stuff. So I I think there's a lot of practical steps we can make to I mean, maybe maybe it just needs more of a sense of urgency. I don't know.

Gary Ruddell 50:00

It's it's hard to say. What's the biggest assumption uh about trust that banks and financial institutions really need to rethink?

SPEAKER_02 50:11

Well, I think actually that's the other way around because that that's the thing you get all the time, which is they expect you to trust them. So it's not about trusting us. So, you know, you're walking down the street. Oh, if this happened to me, it's mapped to me more than once. You're walking down the street, you get a call from somebody claiming to be your bank because they want to ask you about a debit card thing, and they're like, and I'm like, okay. And they say, Well, I just need to take you through some security, you know. Can you confirm your name? And I'm like, who the hell are you? Like this, you've got this the wrong way around. You know, I don't for one moment believe I'm talking to Barclays. As it turned out, I was talking to Barclays, but that's a different issue. But I mean, I was very suspicious about this. So so no, I think the trust thing has to be symmetric, it has to be mutual. Um, and again, this is another area where digital identities because when I say digital identity, I think a lot of people imagine sort of an electronic version of your passport or your driving license. But that's that's what I think of as digitized identity. You know, a digital identity is not the same thing as just having an electronic copy of your passport. And this would be an obvious case. So if the bank phones like my digital identity, yes, it will tell the bank this is Dave Birch or this is his address or whatever. But my digital identity can also check the bank's digital identity. My digital identity will tell me you're talking to the bank or you're not talking to the bank. You know, this is where digital identity is, you know, it's not an it's not a it's not a version of what we already have now. It's it's a new way of handling trust in that environment. So if I had to pick out one thing, I'd probably look at that symmetry. You know, people don't know whether they're talking like how many times do you see these frauds where, hello, this is your bank security department, you know. And if I get a call like that, they go, Oh, it's your bank security department, you know, your m you know, your money is at risk. And I'm like, no, your money's at risk. I couldn't give them monkeys, you know. It's like, why are you even telling me about this? If the money gets stolen, it's your problem, not mine. Stop ringing me, you know. Again, that turned out maybe that was the bank, I don't know. I mean, they sounded like scammers, I couldn't be sure.

Gary Ruddell 52:23

Do you think financial institutions are like overly reliant on technology that can be exploited?

SPEAKER_02 52:29

No, I don't, I don't, I wouldn't say that at all. I I would say that there's lots of technology out there which can be employed very successfully to help with this sort of thing, and they don't use enough of it. But then and that sounds like I'm being hypercritical, but I understand the reality. A bank is a really big organization, and it takes a lot of time to make these changes, and actually, banks it's easy to criticize, but they don't have that much money to spend on this stuff. If you look at the budget of like if a big European bank could easily have an IT budget of let's say for round figures a billion euros a year, but 900 million of that is going on ATMs and you know keeping the lights on, basically, and and making sure statements get printed. And you know, the amount of discretionary spend is relatively small. Let's say it's 10%. And as um you guys well know, most bank discretionary spend at the moment goes on regulatory stuff. It doesn't go on like new new products and services. So of the hundred million they've got to spend, you know, 90 million of that is gonna go on Baal 2 and you know, all this kind of stuff. They they don't actually have that much money to spend on the new technology, and it's it's gonna take time. This is why moving towards standardized solutions like the European Digital Identity Wallet and having banks use that is a potential way forward on this kind of thing, you know. A solution where you just tap the verifier or whatever is extremely convenient. I I I'm I'm with Craig on this. Like it it it offering a solution to people that that that doesn't have maximal convenience is gonna go, no, people just are very lazy about these. I am too, you know. Uh so it it that that I think that's table stakes. But having said that, I think that's where technology can actually help at the moment, you know. Uh and so despite everything I was saying at the beginning about being outraged by nothing going on, I I do actually have some optimism around this. I do think that um the transition to AI, the transition to using real security with pass keys and strong biometric authentication, not identification against keys in tab resistant hardware, etc. etc. I think all of those things are actually quite positive.

Gary Ruddell 54:45

Well, dear, thank you so much for taking the time to join us today. It's been fantastic uh speaking with us here. That's great. Well, thanks very much, guys. That was fun. Your data is valuable and it's under attack. But for every threat actor working in the shadows, there's someone who's made it their life's work to understand them and stop them. Who are these people protecting our most valuable data from falling into the wrong hands? Who are the defenders?