We caught up with Uri Rivner, co-founder and Chief Cyber Officer of BioCatch, a leading cybersecurity firm that provides behavior-based authentication and threat detection solutions to banks, e-commerce platforms, as well as mobile and web applications.
We wanted to learn how the company, founded in 2011 and headquartered in Israel and New York, has fared in the wake of its major $145 million spring fundraising. We also wanted to hear about the new cybersecurity environment brought on by the global public health crisis and what BioCatch is doing to help institutions manage this challenge.
Finovate: You are one of the founders of BioCatch, and your current role with the company is Chief Cyber Officer? What does this role entail within the company?
Uri Rivner: I was actually head of new technologies at security giant RSA when, in 2011, a foreign state hacked into RSA. It was one of the most famous hacking incidents in history, and following that I was on the look for new technologies that can help the industry against cyber attacks and online fraud. BioCatch, then a very young company, came to us at RSA to present the tech, which sounded really sci-fi. I was impressed and introduced them to industry players who all said that if this was working as advertised, this is a game-changing technology.
At some point the founders of BioCatch asked me to join as a co-founder and help them build the business. I joined mid-2012 as VP of Cyber Strategy. My current role as Chief Cyber Officer is to identify new cybercrime business problems the technology can address, and provide internal and external thought leadership on the role of behavioral biometrics in digital transformation and fighting online fraud.
Finovate: When we last shared BioCatch news with our readers, it was in April on the heels of the company’s $145 million fundraising. How big of a moment was that for BioCatch?
Rivner: It was a major milestone. A vote of confidence that showed us how well the market appreciates what we have accomplished. We’ve taken a scientific field in cognitive studies, something that was working in the lab, and made it extremely practical for use in solving the biggest issues in online fraud across dozens of banks, credit card issuers and companies outside the financial sector, protecting over 100 million online and mobile users. We’ve tackled issues that were initially deemed impossible to solve. And we’ve done all of that with very happy customers and a highly scalable product. It was a proud moment, but at the same time also a commitment to work very hard to justify the trust of our new investors!
Finovate: What has BioCatch been up to in the weeks since then – specifically, how has the COVID-19 crisis impacted the work your company does?
Rivner: Our team has shifted to a work from home model; it was done quite efficiently, and we experienced no issues in continuing to serve customers. We run in the cloud, and there was no interruption to the service. The customers also moved to the same mode of operation.
Finovate: Let’s talk about some of the new security challenges that have developed during the pandemic. It seems like there are fraud “hotspots” everywhere: COVID aid/relief fraud, the security issues of Work From Home, and the potential for identity crime in any track and trace program. Can you talk a little about the cybersecurity landscape in the era of COVID-19?
Rivner: If I had to pick one community that is definitely going to thrive during a global virus outbreak, it’s online fraudsters. They have a golden opportunity to scale their operations while entire companies move their fraud operations and analytics teams to a work from home model, which is not an easy process for, say, a major bank. Here are some of the trends to watch for:
Stimulus Fraud
American taxpayers get a direct deposit to their bank account using the information included in the last tax return they filed. If they haven’t filed a tax return for 2019 yet, it’s then a race with the fraudsters, who will try to beat them to it and provide a falsified tax return including a bank account that they control. This means the stimulus deposit will go to the bad guys. There are many people who do not file tax returns and go to a website where their information is validated and a check is sent to their address. That’s an easy venue for identity thieves who can obtain full identity records for all U.S. citizens in the dark web. Fraudsters are also impersonating small businesses to apply for stimulus loans using similar methods. In short, it’s a fraudster’s heaven.
Account Opening Fraud
The most scalable fraud operation is opening credit card or personal loan accounts. All you need is to buy a bigger list of stolen identity records, and have a team of people opening accounts in other people’s names. Identity theft is reported to sky-rocket, and it can be quite dangerous, especially if it’s a new digital service that is launching these days. If a new digital service is targeted by a massive campaign, there will be more fraud applications than real applications – that’s disastrous. Traditional defenses such as checking KYC (know your customer) data and device recognition no longer hold, and new technologies such as behavioral biometrics are used to stop such fraud campaigns and reduce false rejections due to high security bars.
Corona Tracker Rogue Apps
Cyber space is teeming with coronavirus scams. The most dangerous scams are the ones that manage to trick users into downloading rogue apps onto their mobile device. They’ll look like useful tools that alert you when a coronavirus carrier is in your immediate vicinity or providing CDC-approved virus contagion maps. But, in reality, they’re after your mobile banking app and mobile e-commerce purchases.
Social Engineering… From ‘Your Bank’
“Hey, we’re your bank, and wanted to reach out! The branch is closed, so we’re the friendly help desk. We’ve noticed some issues in your account, and would like to help you sort it out. Can you please install this utility to help us run some tests remotely?” You know the rest of this story.
Uri Rivner demonstrating BioCatch’s Passive Biometrics/Invisible Challenges technology at the company’s Finovate debut in 2014.
Finovate: Earlier this year you were part of a conference presentation that highlighted the importance of machine learning and AI in fighting fraud. What about these enabling technologies is so beneficial when it comes to cybersecurity?
Rivner: My lecture talked about how Sherlock Holmes managed in A Case of Identity to identify an imposter based on a dozen or so “features” related to the typewriter they used to type love letters. Machine Learning can instantly look at thousands of features, resulting in an extremely accurate model that predicts fraud and can adapt itself when cyber criminals change their strategy. At BioCatch we have over 2,000 such features – and not even good old Sherlock could have managed that many in his identity model!
An important consideration though is that some machine learning models are a black box and don’t really provide insights into why a certain action is risky. BioCatch, for example, uses Explainable AI models to make sure customers can get the reasons why a score was high, as well as many negative and positive behavioral factors observed during a session.
Finovate: What can we expect from BioCatch over the balance of 2020? Has the global health crisis made it more difficult to have visibility into the second half of the year?
Rivner: Fraud isn’t going away and, in fact, we anticipate a surge in account takeover activity as criminals scale up their cash-out operations. They already have the data they need to steal more money, but they need to scale their infrastructure. Think of mule accounts for moving money out of victim’s account. The crisis makes it easy to recruit mules in work-from-home scams, and to open bogus bank accounts to which stolen money can be moved. Right now criminals are busy doing just that, preparing for a big wave of attacks that is likely to focus on real-time payments such as the relatively new Zelle infrastructure in the U.S., or similar services elsewhere. So demand for a frictionless control that stops fraud and highlights genuine behavior is going to increase.
