Beyond Recognition: A Cautionary Tale of AI and Identity Fraud

you um I'll just move on to the next slide this is what we're going to cover in this session today we're going to talk a bit about identity fraud which is a space we're in we're going to if you're not familiar with digital identity fraud technology we're going to show you and talk a bit about that we're actually going to share with you some real mortgage fraud cases in Canada including showing you one of the criminals that our system has caught uh we're going to talk about how geni is uh making our lives a little more challenging in the identity verification space and we're going to show you some face swapping briefly talk about digital

injection attacks and then we're going to actually roll out you will be the first group to get to see our secure video meeting room system uh that was our next product that we're launching that's in beta so that's what we're going to cover off today um just quickly a bit on myself and AIT um I'm a co-founder and EVP of information security and HR for tree for Technologies I'm proud to say we are an Edmonton we were an Edmonton startup I would say we're probably not a startup anymore because we're actually have clients across the country this technology is being used in the legal space and uh with us is Amit anant who's our our chief technology officer and has

lots of experience in it so one of the things that we're concerned about is of course data breach and identity fraud so this is the easiest for a lot of the Cyber criminals and fraudsters that we're dealing with they can simply go to the dark web search and pick anybody's information and then of course they will use it to perpetrate fraud in particular what our interest is is real estate fraud so I don't think any of you here don't know about what happened this year with Trello moab's actually bigger now and now searchable and and Ticket Master so all of this data is our data and now Apparently one of the latest stats I saw

and is that pretty much cyber criminals and all of us now have access to all of Canadians social insurance numbers as well as Social Security numbers for the United States so that is what we're up against and it's great for criminals not as great for the good guys the other type of identity fraud that we're concerned about is synthetic identity fraud this is really where the bad guys it takes them a little bit more time so they tend to like data breach it's identity fraud it's easier but this is where they create new identities by combining real and fictitious information so one of the big takedowns that actually happened this year kudos to the Toronto police department uh they

were able to take down an organized criminal ring that created 600 over 680 synthetic identity frauds they use those to open up bank accounts and to also open up credit cards and proceed to unfortunately steal a lot of money by the time the Toronto police were able to arrest them in April of this year they were only able to recover $300,000 so this is is where it's challenging also for law enforcement um synthetic identity fraud is something that now one of the stats I'm showing is pretty old we need some new information on this but back in 2020 it was a 300% increase I can tell you that it's increasing rapidly from what we're seeing so what stops these types of

frauds uh digital identity verification technology and so in the early 2000s is when it started uh Banks went online and digital identity verification started to uh develop in 2010 and Beyond we started to see different Technologies so digital identity verification has become basically One tech stack it's got a whole bunch of other technology to verify a person's identity in that one Tex stack and so in 2020 I am proud to say that we were the first digital identity verification technology company in Canada to create uh idv specifically for the legal sector and specifically for dealing with real estate fraud so now I'm going to share a video that's just going to show you what this

technology looks like and I'm going to mute actually can talk over this that's not too bad um what we're seeing right here is first of all for a typical client what they've got to do is they have to have a cell phone they will be asked by their lawyer because let's say that they're going to refinance their house they lawyer will ask them to I tell them they're going to have to go through tree fors idv they will get access to a link that will be sent to their email or by text they will then go through the link and be able to access trefor system through two Factor authentification you can see here they will have to consent to the

process and we are uh we're even privacy compliant in kuac which has changed their privacy uh rules second thing is the person will need to load up their ID and so our systems designed and most idv is today to confirm one or two primary IDs most people about 80% select their driver's license so this is what you're seeing here so now what they're going to do is they're going to capture the front of their driver's

license and then they're going to capture the back of their driver's license behind the scenes what the technology ol is doing is our technology is looking at this license to see is it a fake license first of all and it's looking at a number of different data points to determine that and including the barcode on the back and it's a combination of AI technology as well as human super recognizers because AI is only so good at being able to determine whether an ID is fake or not the next thing that's going to happen is facial verific Biometrics this is actually specifically to detect whether we're dealing with a deep fake whether that person is a real

person or not so the person goes through this next process you'll notice that there's flashing lights those flashing lights will not cause seizures for anybody this has been tested the technology that we're talking about that's being used right now it's called I proove it is the one that you'll see starting to be rolled out by US border security it's five eyes compliant and we actually uh changed our Tex St to put this technology in because it's the best in liveness detection so that is what happens with identity verification technology uh and what happens is the lawyer or the notary we have clients across the country but mostly lawyers notaries title insurance they will look at the fraud report that's returned on

that identity verification and what they're looking at is a number of different things one is compliance with rules across Canada and fin Trak anti-money laundering rules so that there's a compliance piece but the other thing that they're looking at is all this fraud detection so is the SIM card swapped for example on the cell phone so we have the ability to tell that in the background that's what you're not seeing we are checking to see if the person has a credit file uh because that's another sign that tells us whether we're dealing with a fraudster or not we also have the capability which we didn't show here to look at banking verification so if a lawyer really needs it they will

put on banking verification and require that person to go through sign into their financial institution and sign out this is some of the technology that you're seeing for example with the CRA these days if you have an online CRA account so this is the type of Technology you're going to see more and more and why is that well it's because of this so why digital identity verification is taking off in Canada in the real estate space is because of Fraud and it really has to do with Title Insurance there are only four title insurance companies in Canada and they are the title insurance companies that insure against a fraudulent mortgage and so if you don't have them the people

that have to pay are the Land Titles if Land Titles is paying that means you and I the taxpayer is paying so the mortgage fraud as you can imagine when covid hit mortgage fraud increased dramatically the type of mortgage fraud were concerned about is the first which is involving um an individual financing on land that they do not own so being able to get financing through a property they don't own and the other is title fraud which is transferring the title of a property from the real homeowner to the bad guys and then they'll sell it this gives you an idea of what's happening in Canada in terms of mortgage fraud unfortunately it is targeting more

older Canadians 55 and up uh and you can see how it's increased 52% over the F past five years in ter in terms of uh what we're looking at in terms of Damages the last one specifically a mortgage fraud from the Canadian anti fraud Center was 98 million and that was in 2020 I can tell you that in talking and we work with the title insurance that title insurance itself hit uh had hundreds of millions of dollars worth of title fraud so this has been a big issue that they've been dealing with the other issue that really shocked us is we ended up working with title insurance and we found that there were 33 properties that were actually

successfully sold out and transferred actually title fraud that were transferred out from real homeowners of those 33 properties most of the fraudsters were meeting in person not online we'll show you what we're talking about in a bit so one of the things we learned is that fraudsters are quite bold they're willing to meet online and iners with their fake identities so here's an example of one of the many cases that uh we got to deal with one we call the tenant trap in this case a retired couple had paid off a mortgage on a property in Markham montario uh they decided to buy a new property and they went and purchased their new property moved into that and

they decided to rent out their property that they had in Markham many of us would do that so what happened was the tenants used a fraudulent ID to secure the lease from the homeowners and then they proceeded to um they they were then successfully able to impersonate the owners and then they were successfully able to transfer the title over and then they were they basically transferred the title and then they got a mortgage for 700,000 the good news is is that they were caught the bad news is is that this wasn't the first time that they had done this so they had built more than one homeowner another one to share with you quickly we

call the deceptive deal this is where um homeowner had a property management company uh managing their property fraudster was able to Pro pose as the property owner again using fake identity verification fake identity and then the funds were luckily in this case the funds were frozen but unfortunately there are many cases like this where they were successful so here's an example of what we see at treefort in and what other idv companies should be seeing in their systems this is an example of a real life uh individual who tried to scam and commit mortgage fraud this individual first went to Chicago Title but this individual was one that met in person so as you can see these are the IDE DS they

created we had to blur them out because they're real people and so the identity that this individual Stole was from data breach they used that and then they put their own face on the ID so you can see how bold we're talking and they didn't just do one attempt they did three so here we didn't hear anything from this individual and then three months later this individual did an attempt for this time this individual was going to steuart title insurance company they also met with mortgage broker and lawyer in person and the ID that they created this time was more sophisticated you can kind of see it even though I have to blur out the

information but the underwriting teams who are fraud investigators looked at this and was the they were really Amazed by The increased capability that this fraudster was using in terms of creating their ID so one good news is that digital idv is working to combat these guys um this is a quote from John Ryder who uh heads up mortgage fraud and for he's a senior vice president of retail and Commercial title insurance for Chicago Title um but he was talking about on a podcast how between 80 to 90% of all the frauds they were dealing with have ID V's basically stopped it we can confirm the same working with Chicago as well as with steuart title title plus and

fct at least the good news is is that I idv is working the bad news is is that we're getting emerging threats uh so geni is of course taking off and two areas where it's of concern to us is in deep fake technology where they're face swapping and deep fake technology where they're using digital injection attacks and so going to talk a bit about that in fact you can see that the Canadian anti fraud Center is also talking about deep fakes in this case the bulletin that they put out there is about political interference so we're hearing about it here's uh information on what's happening right now and this is from 2023 to 2024 uh geni deep fake attacks are have

increased by 74% I this is for face swapping and then for digital injection attacks we're looking at 2 55% increase so it it's taking off rapidly and this is the new world that we're living in these are just some of the fraud Trends I'm not going to go into a lot of detail due to time but I want to showcase the the big block of green there it's showing you that liveness bypassing is one of the big issues that we're dealing with as well as identity forgery and others why does that matter liveness detection is how we the technology that we use to detect deep fakes so what's happening now is the bad guys are finding out that idv is successful

so now what they're doing is trying to spoof the liveness detection technology that we use to be able to get through by digitally injecting and spoofing our systems so we're now in a battle on the idv side to actually combat how smart these criminals are getting this is a survey that I thought was interesting it shows what a thousand UK and US consumers think about uh deep fakes and I think the key thing I wanted to show you here is 81% believe Biometrics will be used more in the future to assure identity online and I think that that's true so I think you're going to see more and more of the type of technology that we have uh the

other thing is is that 88% believe online security threats are growing and that is true we know because we can see the data and it's happening and interestingly 75% think they're more likely to use online services that protect against deep fakes so that might be good news for us and our company I think it's bad news for the general population and especially what I'm often concerned about which are small and medium smmes these small businesses that make up our economy because they're not as sophisticated to handle what is coming at them so now I'm just going to show you briefly uh a bit of face swapping and why this is a concern so we just did this it didn't

take us very long so we went on to LinkedIn grabbed my photo and pulled it and then we just went online didn't do a sophisticated job here but quickly grabbed it grabbed one of the ID templates for the uh province of Alberta and then we simply swapped the face from the ID with my face so now I'm going to show you a quick video of us doing this and while this video is going it we have identified there's over at least 110 face swapping tools that are available right now on the internet we're not talking the dark web which means anyone in this room can go download one of these apps which we did and you can do

this uh these don't have to be all that sophisticated in order to unfortunately trick somebody into a fraudulent situation um and these can be produced in 28 seconds so the idea that you can meet in person so the idea that lawyers can meet in person when they're trying to do a real estate deal and they can stare at that ID in person and make sure it's real are gone the ID the idea that a lawyer can go online and do be sure that that's person is gone and that's why technology like ours is taking off because it's the one way to combat these guys digital injection attack I'm not going to go into tons of detail but basically

as I said they are able to spoof the uh liveness detection technology uh and there's only so many liveness detection technology companies globally uh and combating that is going to be really tough we're lucky we actually we actually changed our Tech stack and put in took out a technology that we were concerned about its ability to detect liveness and deep fakes and we put in uh that eye proof technology that I mentioned that's how committed we are to cyber security um this is the new big issue with again digital in injection attacks how many have you heard about the video meeting system where a woman wired 25 million it was actually 25.6 million anyone noticed that raise your hand how

many heard you about the story about okay so some did those of you who didn't uh this worker was out of Hong Kong Multinational Global company she got asked to transfer all this money she was suspicious because she got an email she then met they said no problem let's just go on a video meeting system and we'll all discuss it so she gets on the video meeting system and lo and behold there's her CFO and all of the people that are involved in the company that would be responsible for making these decisions so she feels satisfied she then goes and does these wire transfers straight into the money went straight to North Korea and hackers so every individual that was in

that video meeting system was a deep and so the technology is here now now I'm going to turn it over to emit because he'll show you what our next technology is for combating exactly that thanks Kim well first of all uh good afternoon everyone and uh thanks to Nate and bides uh for hosting us uh you know it was a lovely lunch I really enjoyed it I hope you all enjoyed the lunch as well and uh coming tonight for me it's homecoming um I'm a proud graduate of Nate back in 2001 not that I want to date of just mentioning about my experience I've been in it for over two decades and I see few familiar p uh

faces in the crowd as well so I don't know if are you guys scared with what Kim has presented so far it's it's reality right so no matter you know we want to shy away from it but if yourself your kids your parents they're going online you may get hit by these types of frauds and scam um every every now and then in fact this morning my own team member sending me a WhatsApp message hey uh we got a message that uh you're at a conference today but you can't make it to the meeting you want to give leave uh a vacation you want to approve a vacation request for a few of our employees I said that's a scam I'm not

approving any vacation requests so so I just wanted to let you guys know it's it's happening even to to the best of us but we do approve vacation request though if they if they deserve it uh anyhow but uh yes the the digital identity fraud is increasing as Kim mentioned within a span of less than uh one year it say increased over 255 per. and especially the frauds that of uh $25 million that's happening so it could be could be one of us that someone is impersonating us uh selling our own house uh without the knowledge of our and we come home and uh someone someone else has occupied our house so we don't want to do that so to counter that we

have really truly launched state-of-the-art most safe and secure uh video meeting uh platform it's not like Zoom or Microsoft teams or Google meet it's you log in you get the request you get in but it actually goes through a lot of various steps before you can get into that particular meeting this is really for uh secure transactions where you're actually signing legal documents Bank documents or you know could be transferring money so on so forth so that's how we built it and on top of that you can't really get into the meeting platform unless your idv has been done so whatever Kim showed you have to go through that process first and this is actually crosschecking and

referencing the ID that you actually um completed the digital ID verification does it still hold true is it you in uh in fact coming in and that blls again lot of liess detection making sure it is who you are countering combatting uh generative Ai and it's it's again I think the Gen Z's probably creating this gen AI so those gen Z's guys like will'll get to them uh one or the other way uh but yeah so just want to walk you through what does that platform looks like again this is beta we just launched beta so you guys are probably one of the first one to have a look at it how it works so we're going to show you two

different scenarios where it matches your ID uh it authenticates you and automatically gets you into the platform and where in the other scenario actually it does not match your ID what you have already provided or no ID and then it gives the ability uh to the meeting organizer to verify your ID and then let you into the meeting platform you you can't just simply walk into the meeting and start signing documents or or even participate I'll try to speak over the music our marketing uh Team loves to put music behind so this is before you joined the meeting the organizer sends you the invite again it has two Factor uh authentication built in as well you

have to authenticate yourself it also looks at your device compatibility again we don't want you to come in and your browsers and device are not compatible it will let you know but this is Happy pot scenario so in this case it will let you in all the steps you can switch your devices from uh a desktop laptop to your mobile device but typically it's it's okay if you do it over your uh over a laptop the meeting itself but authentication can be done on the mobile device as well so you can constantly switch back and forth uh between the devices so this is what again the Life Scan is happening so this is both checking your deep fakes it's

also making sure you are a life person we can't tell you the secret sauce but that's what's happening behind the scenes if I tell you we all have to shoot you guys and by the way make sure please let us scan your QR code so we can create defects for you guys just kidding so this is where you actually get in and you'll see there will be two participants up at the top and signing any documentation mortgage documents legal transactions and now in this case the client has not completed the idv and they will not be able to get into the platform right off the bat so system will detect it

and it's going through that scanning phase

again running all the background checks and I'll say yeah you got to wait because we can't verify you so now the organizer is actually doing a manual verification that in fact it is the client who I need to meet with and they have to permit that person to come into the meeting platform so they get all the notifications as the events are getting triggered so they're continuously informed see what's going on what's Happening and there's a lot of logging happening at the back end you know all your IPS your server addresses your location your coordinates all of those data is getting also processed in the

background yeah that's the client I want to meet and it was it was pretty difficult and challenging to maintain a balancing act as well because we don't want it to add too much friction while you're doing the transaction as well because if we had too too much friction then you know the usability uh has to be uh you know taken care of and again as Kim alluded to we're catering diverse group you know diverse demographics from you know uh people that are buying houses or anything like in 20 years old to all the way seniors that are refinancing their mortgages you know that are in their 70s and so on so forth so that Balancing Act

had to be taken care of when we're designing all this system so so yeah so that's our beta video meeting platform let me rephrase it a secure and safe video meeting platform much better than zoom and teams from a security perspective Ive thank

you so that's our uh tale for today so we're done I'd like to thank everybody but does anyone have questions we had been asked that we save some time for questions

yes no they're part of the process they're actually looking for digital signatures so we can say that yeah they are and that's what you're going to start to see in the US when you start going for bter security

yes yeah we had you might have noticed with the idv itself there's a checklist um and so the the client knows they need that from from the person going through the process they know that they have to have you know their ID ready and then they have to have a cell phone so we're checking for that and then their cell phone is set up so it kind of automatically will say will you allow the camera so we've got all of that built in on the video meeting system same scenario but as mitt demonstrated and talked about we you always have to balance cyber security with business use case so one of the issues that we had is

when we were looking and talking to lawyers they were like okay well we need to be able to if there's a technical glitch because we all know technology can have issues how do we still let our client in if we're positive it's the client uh and so that's why we had to create that system so that the host can decide whether they want to let them in now if it's a deep fake it's going to show fraud risks so they're all going to know this is a problem and so then they can ask more questions and really think about it so it gives the host the control to look at what they're dealing with from a fraud

perspective and as far as we know we know that the US government has some stuff like this I think we're the first though that have bolted ITV on to a secure Mee and I kind of wanted to show it because this is our home turf and we think it's pretty cool um but we're just launching that right now and letting Law Firm clients pay for it one of the things that we're interested in is mad in the- Middle attack so we had our first law firm client in Ontario had their trust account actually hacked and as most of you may know or don't know lawyers move all the money across the country so this particular

Law Firm had a trust account hack um the bad guys took over their emails they also took over their VoIP phone systems so then they had no eyes on site so they're going to be using a video meeting system to do wire transfers because of course the hackers are going have to get through here so that's kind of the new scenario that we're seeing where there'll be different uses for this kind of thing I'm assuming you're going to start to see zoom and others you're starting to see that you're already seeing LinkedIn with idv it's not as robust but but you're going to start to see that I think everywhere just ours is very specifically designed

for the niche area of compliance and so we're not in the zoom world this is definitely uh for specific use any other questions yeah it mentioned logging M mentioned logging um are you running any correlation in the background machine learning on the failures to kind of build a picture of yes eventually we will be right now we're collecting data we just launched it so about that is one of the next step to run machine learning algorithms behind and of course through the logging to uh geo coordinates and stuff like that there's other warnings that we run in the background in terms of where the the person should be or where there the person is and so on so

forth so there's a lot of those analytics that goes behind the

scenes you bet you absolutely absolutely we are you you're on to something we are developing a big fraud database the problem we've got is that there's no we have a lot of data and we've been going through it and sifting through it and one of the challenges is for example one of the big fraud risk factors is that the person has it's it's not a cell phone plan but it's simply operating on a on a plan without a like simple they're not using a plan well it'll come up and show that the problem is is that I looked at like the month of March there were 47 people that didn't have plans so they're just

using any phone that they buy that day with a SIM card bought that day so not all 47 are going to be frauders so you have to look at a series of different things that's why we look at that is certainly going to be one indicator but that's why in our treefort reports which we didn't show here because we're not I want to be clear we're not here to sell treefort we're really trying to show you what idb is and that's why we showed our technology but what we do is we provide the with very detailed fraud analysis because they need it but everything you saw is privacy Centric I want to be clear it's consent and the reason why

our company's probably taken off is because when people want to borrow money to refin you know re they want to refinance their home or borrow money to buy a house they're most likely especially in Ontario and BC you're going to have to have title insurance so as part of title insurance Title Insurance insures against fraud therefore it's your choice but that's why it's driving that because people want the money so they're going through the consent and a lot of people are find it's not so bad but one of the things we've had to do and I think any idv technology has to do is provide customer support for across the country our biggest worry and what our customer

support team feels every day is getting seniors through the system so they're refinancing their house they need that money so we had to build a very robust customer support and I think that's the other thing that this type of technology is complicated uh and while we've made it as seamless as possible you still need customer support to get people through so we are very very focused on that but with the data of fraudsters we certainly had uh the Canadian anti fraud Center was very interested could we start posting that so there's debates as to how we and could we do that at this point we're

not I'll get you next

um yeah we could we actually have we I I didn't get the question the first part sorry did you want to repeat that just so everyone can hear here the the the question is is that do you plan to integrate this into identity and access management systems to be able to apply this to a wider market right so I was with what you're talking about the the the law firms and things like that this is a great Target audence but there's other applications like um in the oil field an operator being confirmed that it is the actual operator as an example so at this point we're not necessarily going in that direction we still have quite a bit of work in the

real estate side so that's where our Target is at the moment in the future yes we are looking at branching out into other areas we do have right now integrated clients these are clients because we have API capabilities so we have clients across the country Land Titles of BC would be one of them who have integrated our technology behind theirs so we do have clients that are doing that we have not been actively pursuing necessarily identity access management or HR systems for example are gone in that direction at this point so the way the system is designed you could pick and choose and that's something where we're going so as Kim mentioned we got a lot of integrated

clients already and it's really up to the those integrated clients at the end of the day once we provide the results whether they want to authenticate their users coming into their own application or not so that's that's definitely there and that's something we would be pursuing pretty actively down the

road so we've had you hit the we've had to develop very robust processes and we work closely with Title Insurance um but what we do is our our teams will help them so for example we will see fraud risk which lawyer will see uh if we allow a senior for example who doesn't have access to technology to use let say their grandchild's cell phone so they can use it to get through the process but on this fraud side the lawyer is going to see that so if they know and that's what they've been doing again it's the lawyer decision we actually worked I want to do a shout out to the law soci of Alberta when we first

started we approached the Law Society of Alberta and said we want to design a system that will meet compliance for Law Society rules and allow lawyers to meet and sign remotely that was our original plan covid hit and our company took off but the Law Society of Alberta was very involved with the Federation of law societies and helping us to understand what you had to do and one of the things they've been very clear on is that we can't we can give you a green check mark but we're not allowed to make the decision for the lawyers so there's a lot involved in the what we've had to design and so it's still lawyer's decision to proceed because that's how

the rules work but we give them tons of information and we help them you saw that checklist in the idv it really helps the seniors most of the lawyers have information we have information on our website and actually in our website we did multiple languages for example so you can go on and you can watch the video and then you can also read the consent form for example in multiple languages we again had to think of those things because it's not just about technology it's about getting humans to be able to use it so those are some of the challenges that we had to work through with customer support I can say we've done it and our numbers are really

good but it's been a quite a journey yeah we're we're continuously impr improving our user experience getting all those sorts of feedback to make sure our end client gets through the process again maintaining that F fine balance and it's about preventing fraud at the end of the day so once you communicate that you know because we do get why do I have to do this why do I have to to now do the Second Step it's because we don't want to end up uh you guys uh going through a fraud experience right so I'm sharing this ts are really really helpful what Kim didn't show us you know you can also go verify your banking information like if you log in

through a c those are again optionals for the organizations to enable or disable it knowing your end client audience so we're giving those flexibilities to our clients at the end of the day we're also connected to the anti-money anti-money laundering pep lists which are Global which are quite interesting because when you actually put those into your Tech stack you have to think about do you want Russia's list and China's list because they're targeting people in the G7 so it's been a really interesting experience figuring out what we want to offer the lawyers and how they can toggle on and off depending on what their need is and and I think you're going to see this type of

Technology as I said it's going to explode in more areas it's not just going to be us we want competitors we need an army of this technology in order to deal with what's coming any other questions I know we're at 2:15 I think that's when we were supposed to end it but we probably have time for one more question if there is one more okay see none I think we're good all right thank you everybody for your time I hope we've uh shown you some information that you found interesting