Remy Blaire: Financial institutions are facing increases in automated, high-speed fraud while grappling with elevated compliance as well as consulting costs. Yet for commercial banks as well as lenders, updating core fraud defenses and anti-money laundering workflows still takes months of manual coding as well as external advisory oversight.
Well, joining us to examine the costs of combating financial crime, as well as the shift toward automated risk infrastructure, is Patrick Harr, CEO of DataVisor. Patrick, thank you so much for joining us. So when it comes to the bad actors out there, we know they are increasingly using machine-driven attacks to overwhelm traditional defenses. So how much direct bottom-line damage are these automated threats currently causing banks as well as insurers?
Patrick Harr: Yes, it’s great to be here. I think if you look globally, fraud represents about $200 billion in losses, and obviously much more of that impact is in North America. So I think one of the key threats, which we’ll talk about, is now the use of agentic fraud, or basically these fraudsters using agents to attack banks, financial institutions, and payment networks. They use those agents in what we call polymorphic attacks to attack those banks and institutions in real time. And that really is what presents a very strong danger today.
Remy Blaire: And I understand that your platform uses natural language prompts to write as well as deploy compliance workflows in days. But how do risk teams actually verify that these AI-written rules don’t introduce critical system glitches or even security gaps?
Patrick Harr: Yeah, I mean, you point out something really important that we see in banks and heavily regulated industries. Honestly, the banks and their teams know what fraud patterns are emerging. The challenge that they have is that it takes literally months to implement those strategies. Now, we introduced what’s called [unclear: “Varrick code”]. It’s an agent that helps those investigators, those folks that are building those fraud strategies, to implement real-time defenses now in hours, as opposed to weeks and months.
And we do that very transparently, right? So everything is published inside the model. That’s important from a governance perspective. And then second, there’s what’s called the human-in-the-loop capability, meaning everything that the AI agents are recommending to implement for that defense is reviewed first by a human before they actually move it forward.
Remy Blaire: And Patrick, while I have you here, I do want to ask you about automated filters that might block legitimate payments out there. So how do financial institutions prevent new automated risk engines from spiking false positive rates?
Patrick Harr: Yeah. So this is a little bit of a tricky problem, right? Everyone’s using Muse, and everyone’s using all these new agents out there. So how do you determine what’s a legitimate agent and what’s a bad agent? This is obviously where we use what we call behavioral AI. So you want to actually look at the device, and at what’s being done on that device by that agent. So you have to look at the actual behavior. What are they attempting to do? Are they trying to enact a payment, or are they trying to simply buy a ticket online?
So we have what’s called device intelligence, and we actually have the ability to recognize an agent and determine if it’s a good agent or a bad agent based on the behavior that it’s exhibiting. So obviously, that’s what has to happen. You actually have to look at the behavior on an e-commerce basis. What are they attempting to do? What are they not attempting to do? And then look at the subsequent transaction that they’re trying to initiate. It really comes down to behavior, and using AI to determine if that’s legitimate or not.
Remy Blaire: Yeah. And expanding on this, as you mentioned, we are talking about a highly regulated space. And when we’re talking about bank regulators, they do require audit trails as well as detailed justifications when we’re talking about suspicious activity. So how do examiners as well as internal auditors evaluate some of the fraud rules that are generated by artificial intelligence?
Patrick Harr: You know, it’s interesting. I was actually talking to one of the Federal Reserve auditors, and honestly, I really talked to them about the speed and the weaponization of using agents to attack the banks and the payment networks. Honestly, we have to accelerate what we’re doing on the audit side.
Now, all that being said, this is the reason for what I talked about. We have this agent called [unclear: “varicose”]. It enables the banks and the payment networks to put in very sophisticated defenses, and do those in hours as opposed to days and months. Second, as the attack evolves, it will also adapt within minutes, in real time, to those attacks.
Now, with that, as I said, you also have a human in the loop, meaning that the investigator, or the person that’s putting in this strategy, has the ability to review every aspect and implementation of that defense. And then second, there’s full publication. This is the transparency side: full publication of that exact model, or the defense that they’re putting in place, which can be reviewed again by the Federal Reserve, or whoever the auditor is, to ensure that the bank or the payment network is in compliance.
Remy Blaire: And finally, Patrick, before I let you go, it goes without saying that institutions out there are spending billions annually on third-party risk consultants as well as manual system integration. So how much cash overhead are institutions actually saving by automating coding in-house?
Patrick Harr: So, number one, you have to look at the big component of fraud, which is fraud itself, right? So if you can reduce that fraud by using AI and agents, that’s a significant impact, honestly, to the bottom line. Second, if you look at it, one of the biggest costs that you have in implementing these strategies is actually the employee side, right? So I don’t like to say that AI replaces the employee. AI actually enhances the employee and what they can do. It really enhances productivity. And second, honestly, it removes some of the consulting overhead of implementing very sophisticated strategies. That’s the benefit of using our code agent. That’s the benefit of using AI in general. It really helps the productivity side.
But coming back full circle, it enables the banks and the institutions, these large payment networks, to fight fraud with AI, as opposed to sitting on the side waiting for things to happen. I think there has to be a fundamental shift, moving from defensive strategies to offensive strategies. And second, using AI agents to not only defend against those very sophisticated fraud attacks, but also to really enhance productivity internally at the banks and the payment networks.
Remy Blaire: Well, Patrick, we will have to leave it there for today. But thank you so much for joining us. I appreciate your time as well as all of your insights.
Patrick Harr: It’s great to be here.
