How to detect bank fraud with maths
Вставка
- Опубліковано 14 жов 2024
- I chat to Daniel from the financial crime and security team at Monzo to talk about how they used maths to detect a data breach at Ticketmaster which exposed people to bank fraud.
Here is their post about what happened:
monzo.com/blog...
Thanks to both Daniel and the team of Monzo for letting me in the building and chatting about what they do. As stated in the video: I am a customer of Monzo but this video is not sponsored or supported by them.
And extended edit of my chat with Daniel is available on my Patreon page. If you are a teacher and would like to show it to your students let me know and I'll give you the direct link.
/ 20309889
If you also have an interesting job which uses maths and will let me in your building for chat, do get in touch!
If you're still at school, then study hard and one day you could have an interesting job which uses maths!
Thanks to my Patreon supports who do support these videos and make them possible. Here is a random subset:
Paul Bates
Neil McGovern
William Marple
Jordan Scales
Adam Scatchard
Support my channel and I can make more videos:
/ standupmaths
CORRECTIONS
None yet. Let me know if you spot anything!
Music by Howard Carter
Filming and editing by Trunkman Productions
Design by Simon Wright
Sound production by Peter Doggart
MATT PARKER: Stand-up Mathematician
Website: standupmaths.com/
Maths book: makeanddo4D.com/
Nerdy maths toys: mathsgear.co.uk/
This was a public service video. It was very good of Monzo to participate in this. It's too bad that Ticketmaster didn't acknowledge them. Fascinating stuff.
It's very, very, very common from companies to ignore security warnings from other companies or individuals. Unless you get lucky and talk to someone who cares they won't do a thing
I use a unique email address for every website I sign up with, so it's quite obvious a specific site has had some sort of a data breach when suddenly I start to get spam to those addresses. Of the ones I've notified, one said they'd asked their team and nothing had occurred, the other didn't respond. Now GDPR rules exist in the EU, it'll be interesting to see if more of them are honest.
That is nice ideia, but some things came to mind:
- You don't sigh up to many sites
- You use this only to the important ones and have a generic mail for the crap sites
- You have a lot of accounts, and presumably some kind of pattern on them, that would defeat the propuse since getting one would allow the attacker to guess the pattern (like the sine name on the account)
If not any of these, how do you do it?
MaxSantos Easy, I do the same, if you have a mail server ~£20 per annum then you can just have multiple mail aliases at your server feed into a single mail box, or indeed all unrecognised addresses feed into a single mail box; you effectively have an infinite number of email addresses at your disposal even though you may have a limited number of mail boxes.
I know how a email server works and that you get the mail all in one mailbox. That is not the question.
The question is how you keep track of what address goes with what site?
Do you need to look at a table "site/address" prior to login because you forget what address to use for that site?
Well done Monzo for being open to having a discussion about this
I mean, its good advertisement for them...
If Monzo haven't paid you for this, then they should. What a fascinatingly transparent discussion, instant new customer!
Wow, this was surprisingly open about the methodology considering they work with security. Thanks a lot to Monzo and Daniel for sharing!
Security by obscurity is no security at all. That's widely understood in security circles. So I'll bet that Monzo wanted to review the video to ensure they had no customer data referred to in the video - and I'll bet that they had a few grey hairs in the legal department about "that one customer" - but, once it was cleared, it's much better to have it out there in the open than hidden away somewhere.
Much respect to Monzo for this - if I was still in the UK, I'd be looking to move my accounts to them.
Pretty sure that some amount of keeping your methods of detection secret is pretty paramount for effective fraud detection.
Secrets like that rarely stay secret. You have a bunch of people in an arms race with you, constantly probing and learning what you're bad at detecting.
Not really. The aim is to make it so you can detect what they're doing by the doing itself. Knowing that if they take money, you'll figure it out real fast changes the game from "stay low so ticketmaster don't realise we got their details" to "take as much as you can as fast as you can", and that's even easier to detect, so the bank wins. There's some of the details that they keep secret, but as much of it as possible is in the realm of just how the thing works, and that part is public knowledge. The best option is to be so good and open at it that people decline to attack you because it's pointless, you'll beat them before they get started. That's holy grail territory, and not what anyone expects to happen, but that's what you aim for, if you're smart.
Showing off how they detect fraud is either going to make the fraudsters learn how to hide their fraud better (which they're always doing anyways) or show their competitors how to do something similar, which is good for security.
Also, showing off your fraud detection skills is free advertisement :)
Matt, you've gotten loads better at interviewing people. Great job. I also really like where the content has been going lately.
Thanks! I’m always trying to get better: both content and interview style.
Quinton Baker Agreed; that was pretty slick. Almost didn't notice Matt, there. (In the most positive way.)
A brilliant young man. The bank is lucky to have him.
Really interesting stuff!
Thanks for sharing, Matt! And thanks for agreeing to the interview, Monzo!
Daniel is clearly so good and knowledgeable at his job, I’m jealous he’s not working in my industry. We need more people like him. Sadly if you’re that good you don’t tend to end up in my industry.
Sam What's your industry?
Charalampos Koundourakis Clinical trial reporting
Sam you should meet more people in your industry
From the title, I thought this was going to be the standard video on Benford's Law.
I'm happy to see it wasn't, because it was really interesting!!
Awesome of Monzo to let you do this interview. Really interesting.
So interesting! Great work Daniel, I’ve never been happier that I use Monzo! You’d never see a traditional bank talk about this sort of thing!
This is a fantastic inspiration. I remember my dad loved talking about the old system that used to be shared with some banks which used it to analyze usage and fraud statistics. It's great to see that your bank decided to be a detective and active good citizen on such an issue. Very interesting to see they could identify a potential breach, just about conclusively
He comes across as a sincere and interested interviewer.
Great video! It reminds me of those computerphile videos were they report on new exploits and cyber attacks. It’s weird because I would love to see more videos like that, but that implies having more exploits and people/systems being affected.
It was super cool for the bank to let you do this interview and I appreciate that you went through all the trouble of convincing them. Cheers, Matt.
Inb4 "damn the monzo employee is young"
he looks like 20-22-ish,.
He's actually 30, but he's dying of Ligma
@ Donnie Morrow - How petty. Grow up.
I was actually thinking "damn the monzo employee is switched on".
Aaron Hollander
Some people just have to point out others flaws to make them feel like they got something going in their life. It really is petty indeed.
"It's just highschool stats" nice ticketmaster shade!
This is high quality content - thank you to Matt from standupmaths for taking the time to seek out the interview and thank you to Daniel from Monzo for taking the time to answer
A reaction from a bank as this would seriously make me think about switching to them, thanks for providing such honest answers!
Thank You...And all Your patreon supporters for yet another great and interesting video.
That kid looks and sounds like a young James Grimes
@@Peter_1986 I don't hear it. Young Daniel here has a pretty standard Southern English accent, whereas Dr. Grime has a Midlands or Northern sort of accent. Obvious standouts are that Daniel has the trap/bath and foot/strut splits, whereas Dr. Grime hasn't either.
One really cool thing is Benford's law: about a third of a random selection of account balances (or the heights buildings, or the value of physical constants) will have begin with 1.
MWSin1 another cool one is Bofa’s law
I honestly can't find anything on "Bofa's Law" that makes any sense. There's a blogger who goes by The Bofa on the Sofa that is credited as establishing something like "If the best defense of a group is 'they aren't all bad' there is something wrong with that group." While interesting, it seems out of place in this context.
The law's about BOFA DEEZ NUTS
side-note/nitpick : in unary and binary every value begins with 1.
I was thinking about that too. You are talking about hiding fraud by randomly choosing numbers to go into the books. However, these numbers are chosen from a certain range, where 1/10 of them begin with 1 instead of the naturally occurring 1/3.
Great, great video. Who knew banks could be cool. Thanks to both of you for taking the time to make the video. Now I just need Monzo to start doing business in the US.
Daniel's explanation is fascinating.
It is!
But, how old is he?
What does it matter? It's the way the brain is used that counts, not the number of birthdays celebrated.
That red piece of coral looks like a really creepy glove.
How do I use math to commit bank fraud? Asking for a friend.
sirkowski idk ask Yoshi
Think of your PIN number, now add 3 to encrypt it. Now tell me your encrypted PIN... >:)
Mathematicians have already created lists of all the PIN numbers in the world. Yours is on it too, guaranteed. Scary stuff.
Theres only 10,000 4 digit pins.
Pluto : That's the joke.
Good on you for properly blocking out the card numbers. I was at a sporting event where during half time, a guy from a bank came up to do a contest and said "anyone who has a card from our bank, take them out. Look at the numbers on it." He held his up so the camera could focus on it. He had used his thumb to block out some of the numbers, but it was the first four. Which tells you... Which bank it's at. Which we knew. The rest was shown, as was his name and the expiration date. I honestly wonder if someone committed fraud with his card.
(The "contest" was that they listed off a four-digit number, and if you had those that set of four digits in a row *anywhere* in your card number, you won $100 or something.)
Anonymous Freak - Ouch!
Banks must have quite a few sets of four-digit numbers available for identification. I have yet to see any two card numbers with the same beginning
@@mysteryman7877 both my Monzo physical cards start with 5355 (and virtual cards with 5168), so I assume it's not too uncommon to see.
This was super interesting. It's always cool to hear someone talk about something when they know exactly what they're talking about. Would love to see more of this kind of thing in the future (hopefully not bank fraud related though)
As someone that works in an adjacent tech sector, this kind of work is extremely common at tech companies when dealing with sensitive information. Most are using machine learning algos to flag suspicious behaviour but there is still a lot of manual work to figure out the underlying problem.
Years ago I was working in postal carrier and it was noticed that the mail volumes on carriers had increased. So a countdown was issued where every carrier would count the amount of mail they delivered for two weeks. Some carriers tought that it would be easier to just fudge the numbers insrtead of counting them. In the end these guys had statistics people watching them counting the mails. It is very easy to find out from a statistcal sample what is the false data.
That was one of the best interviews I've ever seen.
lol the scene of him sitting with the young employee reminded me of the similar situation with Malcolm Tucker of In The Loop.
Awesome.
showcasing the important people behind the scenes is pretty awesome
Well, I'm changing my bank over tomorrow, so Monzo have at least 1 new customer from this.
Although I have almost 20 years working experience, part of me always wanted to be a data/fraud analyst. You are basically a crime fighter like on TV with the difference that you are really smart.
So while I am watching this young guy shows up and I think, so this is who I want to be? This is my idol?
I had a difficult time explaining that to myself.
Cool, but what's with the red plastic sea sponge thing? Seems like an odd decoration
looks like a 3d printed piece of coral
The Monzo cards are a colour called Hot Coral so in that particular room, we have a couple of coral-like pieces scattered around!
Ahh, makes sense. Thanks!
MicroBlogganism I thought it was a postmodern hand hahaha
It's a specially lab-grown coral that emits a waft of anti-fraud leptons that give their systems the edge. All banks have their own anti-fraud coral bio-division.
Fabulous video and hats off to Monzo. Too bad they don't seem to operate in Australia, as I'm with a major bank and am looking for alternatives at the moment. Also, as a uni student (not in a maths-related subject, though), it's very promising to see an internship that turned into a real job!
Did any pets predict this data breach?
My dog barked and ran in circles the other day
Doug Dimmadome, owner of the Dimmsdale Dimmadome Sounds like a successful prediction to me!
@@daniel117100 Ah, but which direction did he run in? And did he bark 'Ticketmaster'?
Amazing for you and Monzo for doing this!
Very impressive detective work. Must have been a nightmare to go through all those transactions.
Very interesting! It’s good to see that there are actually smart people out there; spending anytime on the internet you are bombarded with so many mindless people.
Wow, what a surprise that a business who is reluctant to admit possibility of breach while it is clearly happening, and reluctant to accept evidence as being important also didn't communicate with the people who found it and tried to play it down when they admitted it. Surely a rare case.
This just made me check whether Ticketmaster faced any severe, lasting backlash for its horrendous handling of the situation.
Of course not...
Very nice video, I wasn't expecting that at all. Thanks for sharing!
Kudos to Monzo! Seems like they're doing great things!
7:20 that zoom on specifically his hands. XD
The Monzo guy looks like the male version of Vicky Pipe. Vicky and Daniel, you are great, both! And Matt did a good job as an interviewer.
As a fellow Monzo user, I recommend it to everyone
Regarding the clustering in dates.
There would likely be clusters come coinciding with major festival/event ticket releases. That could explain som of the clustering.
(Depending on how distinct/disjoint the clustering were of course)
I just got accepted to do a Computer Engineering BA, so thanks for your encouragement! I'm going to study hard! :)
@Monzo if you ready this, this is great promotion for you guys. Definitely would consider banking with you.
Good work by the people at Monzo!
CSI: Monzo
Loads of close-ups, sciency bits and a The Who soundtrack.
I know this wasn't a paid promotion or anything like that but the openness shown here and the mention of the api (as a developer I am embarrassed that I didn't know about it sooner) has sold me on using my Monzo account full time and move from my current high-street bank.
I always found this kind of mathematical application absolutely fascinating, but absolutely loathed statistics when I studied it at school. I should go back and see it with new eyes, might change my life who knows!
3 people that work for ticketmaster are unhappy with this video
This is fascinating, but I hope fraudsters don't learn from this. Also, I'm experiencing semantic satiation with “Ticketmaster”.
Im in infosec, so this was pretty fascinating to me. Thanks for sharing!
Regular Ponder Stibbons he is young Daniel.
Well done!
That's awesome! Thanks for sharing your curiosity
Just goes to show the power of having that much data and understanding operations you can do on them.
I used to work at a credit union, and we had a similar incident with a local movie theater. All the financial institutions in the area were trying to figure out who it was and then somebody at our credit union noticed that they had all gone to this one movie theater, and I think there ended up being a skimmer installed there or something.
There was also another time I noticed everyone who had their card number stolen was a gamer, and then GameStop announced a breach.
Monzo - also has - the : _cleanest_ chimneys *_R > G_*
Looking forward for another video with Daniel. Very informative.
yogobogo get him on as a regular for CS fun
A banking company known as Monzo is the most British thing ever.
Oh i'm changing my bank. Right now!
My only bank these days. App is incredibly useful, knocks the “big banks” out of the park.
Incridible to see how little large companies like ticket master actually cares about our private data. Luckily the bank does care.
I like the hand zoom in bit
Love Monzo. Would highly recommend them and use them as my main bank now!
Great interview, really impressed with Monzo! Hooray for internships becoming full time hires 😁
"I don't think they agreed with our interpretation of how important this evidence was"
Me, a Pentester: "lol, first time?"
It’s a shame ticket master didn’t go full security mode when a bank told them they have a very high chance of a security breach.
If I was them I would change how I respond to that kind of info.
This is pretty amazing. Well done.
Damn the Monzo employee is young!
Old enough to have finished uni, but very young-looking. Based on the other comments here, he could probably pass for 16 as long as there wasn't an actual 16-year-old next to him to compare him to.
No offence to him, but he could act as a stereotypical geek/nerd in any movie if he lost a little skin colour :)
I half expected that you would chat with Jack Wright :D
My bank sent me a new card for the same reason a few years ago. I called them to find out which company got hacked so I wouldn’t by from them anymore but bank refused to tell me. I guess the reason is because while they had statistical proof of who it was they can’t confirm it and would probably get sued by that company. But it is nice to know they are watching for it and apparently good at it.
Good tech banking handywork!
_Very_ interesting video. Not sponsored by Monzo, but watch their number of customers surge as viewers flock to Monzo.
wow. remind me to never use ticketmaster's services again. remind me to sign up for monzo if i ever move out to the uk.
There is at least one online service that will give you temporary virtual cards so that you can use them for such risky purchases. There are a bunch of different ones actually.
I run e-commerce websites and now I feel like I should share this story with clients that embed chat support scripts into their pages.
Matt, did Monzo retain editorial approval? (For security?)
Yes, they checked the edit before I released the video.
I don't mind this, I mean they took a risk by agreeing to this. You were doing the edit and they only checked then it's fine. If they were doing the edit, then it wouldn't be ok.
It is a risk, but it was also a smart move on Monzo's part. This sort of video provides excellent PR. Keep in mind that the high level information provided in this video is information that they'd already chosen to share via their blog. Further, I'll note that the risk-reward trade-off of this sort of video is far more favorable for newer, less well-established companies than it would be for an older, better established bank.
That was fascinating. Thank you!
That sounds like a very interesting/fun problem to work on. I'd like to play with their data and see if I could automate that but I'm guessing they don't just hand that data out.
I watched the extended video just published..... dam you now i have a monzo account.
I wished my bank was so thoughtful.
Love my Monzo. Do not love Ticketmaster one little bit. Had to proactively replace another card.
Now that I've watched this, I'm going to be less annoyed when my bank denies a legitimate transaction, because I understand, now, that more goes into it than freaking out about me travelling. (Although I'm about to get rid of the credit card that still expects me to make overseas calls to verify transactions, instead of just confirming a push notification on their app-it's 2018!)
Nice video...
You should have asked how the handle anonymisation of the data. It turns out that is nearly impossible
People usually fail to realize how math is important to save their butts or improve their quality of life.
Just had an idea for a way the banks can detect fraud, not sure if it works or not.
So the idea would be to have fake cards that do transactions to only one vender (Ticketmaster etc) and when that card gets used outside that vender it would Then raise a flag of breach. The transactions would be fake, but would appear real to scammers.
It's great to see hear the story. I am curious as to why machine learning isn't core to their detection systems though.
Choosing a bank because they have a nice API... that must be one of the nerdier reasons for choosing your bank ;D
great video dude
Bravo Monzo!
Good job, well done!
*reads video tittle
Me: *Easy!* When your balance number has a minus sign in front of it
I'm surprised they don't use more automation to find fraud irregularities like this.
Smartest kid on the planet.
Smartest kid on the planet? He recognized like a 70% increase in sales between 2 print outs... Like Matt said, that is SUPER basic math. If you think that is super intelligence, I'm not sure how you function in your day to day life.
@@elrobbo6
damn, son
Chill, he is by no means smartest kid on the planet like what the commenter said but no need to wreck him :V
Straight savage
"If you see a Parker square in your account, you may have been hacked"
Thanks for finding the math!