WEBVTT 00:00:00.000 --> 00:00:17.000 Welcome to the KuppingerCole Analyst Chat. 00:00:17.000 --> 00:00:18.000 I'm your host. 00:00:18.000 --> 00:00:19.200 My name is Matthias Reinwarth. 00:00:19.200 --> 00:00:23.300 I'm analyst and advisor with KuppingerCole Analysts. 00:00:23.300 --> 00:00:25.400 My guest today is John Tolbert. 00:00:25.400 --> 00:00:29.500 He is the director of cybersecurity research here at KuppingerCole. 00:00:29.500 --> 00:00:30.500 Hi, John. 00:00:30.500 --> 00:00:31.500 Good to have you again. 00:00:31.500 --> 00:00:32.500 Hi, Matthias. 00:00:32.500 --> 00:00:33.500 Nice to talk to you also. 00:00:33.500 --> 00:00:34.600 Great to have you. 00:00:34.600 --> 00:00:39.800 We are post-EIC, so we are allowed to cover other topics as well. 00:00:39.800 --> 00:00:41.100 So back to cybersecurity. 00:00:41.100 --> 00:00:47.300 So we want to cover two topics that are interesting from different perspectives. 00:00:47.300 --> 00:00:52.000 And for those who are watching this episode, by the end of this episode, you will have 00:00:52.000 --> 00:00:55.424 learned what rogue merchants are and you know 00:00:55.424 --> 00:00:59.000 why we desperately need organizational identity 00:00:59.000 --> 00:01:00.400 and what that is. 00:01:00.400 --> 00:01:03.300 So these are the two topics we want to cover today. 00:01:03.300 --> 00:01:08.500 So my fun topic, so for some definitions of fun, are rogue merchants. 00:01:08.500 --> 00:01:13.100 And you did some research around that topic and it's really something that is gaining 00:01:13.100 --> 00:01:18.100 traction and it's just something that has bad influence on society, on organizations. 00:01:18.100 --> 00:01:20.500 But to start out, first the definition. 00:01:20.500 --> 00:01:21.500 What are rogue merchants? 00:01:21.500 --> 00:01:23.300 A little bit of background. 00:01:23.300 --> 00:01:28.900 So I've been covering fraud reduction intelligence platforms for many years now. 00:01:28.900 --> 00:01:33.800 And that's really been focused on individual consumer fraud. 00:01:33.800 --> 00:01:40.400 But you know, there is so much fraud that's perpetrated under the guise of a business 00:01:40.400 --> 00:01:43.200 when it's not in fact a legitimate business. 00:01:43.200 --> 00:01:48.900 In fact, you'll see that their numbers are huge with some of the examples that we have 00:01:48.900 --> 00:01:50.800 to talk about today. 00:01:50.800 --> 00:01:56.800 But a rogue merchant, excuse me, is a slightly different kind of threat actor. 00:01:56.800 --> 00:02:03.000 Those who are misrepresenting themselves to the general public, it is kind of what 00:02:03.000 --> 00:02:08.500 it sounds like, you know, it could be a case of someone sets up a fake business online 00:02:08.500 --> 00:02:15.400 and they try to sell items, you know, maybe luxury items, high-end goods, you know, for 00:02:15.400 --> 00:02:20.200 a much lower price, they might advertise on social media and try to get people to come 00:02:20.200 --> 00:02:25.400 and buy, you know, a very expensive item for a lot less. 00:02:25.400 --> 00:02:28.900 And what they're doing is they're with their website, they're harvesting a credit card 00:02:28.900 --> 00:02:32.185 and identity information, you know, and they're 00:02:32.185 --> 00:02:35.400 not going to send out the goods in most cases. 00:02:35.400 --> 00:02:38.200 So they're trying to pocket the money. 00:02:38.200 --> 00:02:43.500 And of course, there's a lot of instances where a consumer might push back on that, 00:02:43.500 --> 00:02:48.500 try to dispute the charge, and maybe the banks or credit cards can claw back some of that 00:02:48.500 --> 00:02:49.500 money. 00:02:49.500 --> 00:02:51.500 But they're kind of depending on people not to do that. 00:02:51.500 --> 00:02:56.200 And they can make an enormous amount of money just by doing that. 00:02:56.200 --> 00:03:01.800 Plus, they have the credit card info and some identity information that they can use and, 00:03:01.800 --> 00:03:04.400 you know, other kinds of follow-on fraud. 00:03:04.400 --> 00:03:08.800 And so that's just like one big example of what a rogue merchant might be. 00:03:08.800 --> 00:03:10.700 And so that sounds scary. 00:03:10.700 --> 00:03:13.100 And I think it also has two dimensions. 00:03:13.100 --> 00:03:20.800 First is, how can we, how can somebody enable potential customers from falling victim to 00:03:20.800 --> 00:03:21.800 those? 00:03:21.800 --> 00:03:24.100 And how to identify them in the first place? 00:03:24.100 --> 00:03:26.400 So that would be the end-user perspective. 00:03:26.400 --> 00:03:29.800 So can we really identify them? 00:03:29.800 --> 00:03:32.345 And the other part is, of course, the research 00:03:32.345 --> 00:03:35.000 that you are doing regarding the Fripp platform, 00:03:35.000 --> 00:03:38.228 that's help in identifying them before things 00:03:38.228 --> 00:03:41.600 happen, especially on a B2B use case, I assume. 00:03:41.600 --> 00:03:43.200 So how would that look like? 00:03:43.200 --> 00:03:45.300 How do these businesses actually look like? 00:03:45.300 --> 00:03:48.200 What are typical, call them use cases? 00:03:48.200 --> 00:03:53.000 What are use cases that we should look for when protecting ourselves and other businesses 00:03:53.000 --> 00:03:54.600 from these rogue merchants? 00:03:54.600 --> 00:04:00.900 I guess the first thing would be, you know, if it looks too good to be true, it probably 00:04:00.900 --> 00:04:01.900 is. 00:04:01.900 --> 00:04:06.200 There are various scam detection sites out there and you can look up reputations, get 00:04:06.200 --> 00:04:07.600 reviews from others. 00:04:07.600 --> 00:04:09.900 Of course, there's the problem of fake reviews too. 00:04:09.900 --> 00:04:15.200 And I think a lot of these rogue merchants use mechanisms to pump up their reviews to 00:04:15.200 --> 00:04:17.000 make them look more legitimate. 00:04:17.000 --> 00:04:23.000 So, I mean, there's always a little bit of a gray area, but yeah, I guess I'd start with 00:04:23.000 --> 00:04:27.300 if it looks too good to be true, then it probably is. 00:04:27.300 --> 00:04:32.900 As you mentioned, the types of fraud, I think they vary very broadly. 00:04:32.900 --> 00:04:36.943 There is a wide range, you said, selling luxury 00:04:36.943 --> 00:04:40.900 goods or not selling them for a cheaper price, 00:04:40.900 --> 00:04:42.100 but getting to the money. 00:04:42.300 --> 00:04:46.419 Are there other business models, which there 00:04:46.419 --> 00:04:51.100 are, that are worthwhile knowing for the audience? 00:04:51.100 --> 00:04:53.600 Yeah, that's kind of the entry level part. 00:04:53.600 --> 00:04:57.658 You know, then there are fake payment processors 00:04:57.658 --> 00:05:01.800 that act on behalf of many other rogue merchants. 00:05:01.800 --> 00:05:04.671 They will set up a legitimate merchant 00:05:04.671 --> 00:05:08.600 account and try to fool the large payment processing 00:05:08.600 --> 00:05:15.600 entities and then try to run lots of fake transactions for, you know, maybe a bunch 00:05:15.600 --> 00:05:18.760 of shell companies or things like that, that, 00:05:18.760 --> 00:05:22.200 you know, that are too not legitimate businesses. 00:05:22.200 --> 00:05:27.700 So you have your fake merchants, your rogue merchants, and then you've got fake payment 00:05:27.700 --> 00:05:34.900 processors that are trying to scam banks and other entities within the broader financial 00:05:34.900 --> 00:05:37.800 landscape out of money as well. 00:05:37.800 --> 00:05:40.866 You know, and they can do, they can use these 00:05:40.866 --> 00:05:44.000 identities that they harvest from the consumer 00:05:44.000 --> 00:05:47.600 victims for lots of other kinds of attacks. 00:05:47.600 --> 00:05:52.200 They can use the basic information to create a fake account about a real individual. 00:05:52.200 --> 00:05:58.600 They can sort of take all the information and use it to build synthetic identities. 00:05:58.600 --> 00:06:02.022 There are also businesses out there that are 00:06:02.022 --> 00:06:05.600 like running platform abuse, trying to defraud 00:06:05.600 --> 00:06:11.600 other members of the e-commerce ecosystem, you know, by say buying up a lot of goods 00:06:11.600 --> 00:06:16.000 and then trying to return them or saying that they didn't actually receive them. 00:06:16.000 --> 00:06:23.600 So there's just so many different permutations of how businesses can be defrauded by fake 00:06:23.600 --> 00:06:27.900 merchants, fake payment processors and scammers at large. 00:06:27.900 --> 00:06:28.200 Right. 00:06:28.200 --> 00:06:34.600 So when we look into the research that you do, when we look at how to counter these 00:06:34.600 --> 00:06:42.000 activities, what are the typical technologies, the signals that are used for identifying 00:06:42.000 --> 00:06:45.600 these rogue merchants before anything can happen? 00:06:45.600 --> 00:06:47.900 So what are the technologies in place? 00:06:47.900 --> 00:06:52.400 Well, I think at the individual consumer level, a lot of the things that happen within 00:06:52.400 --> 00:06:55.500 fraud reduction Intel platforms today are very useful. 00:06:55.500 --> 00:06:59.700 And we define that as six major categories of functionality. 00:06:59.700 --> 00:07:04.800 There's, you know, device intelligence, identity verification, compromised credential 00:07:04.800 --> 00:07:11.100 intelligence, user behavioral analysis, behavioral bot, behavioral biometrics and bot 00:07:11.100 --> 00:07:17.500 detection. The combination of all six of those can be very useful at the individual level. 00:07:17.500 --> 00:07:19.600 You can look at behavior. 00:07:19.600 --> 00:07:24.800 Has this credit card been used in conjunction with a device or in a location that's not 00:07:24.800 --> 00:07:27.400 typical of that particular user? 00:07:27.400 --> 00:07:31.700 Is it being used to buy something that's, again, not typical of that user? 00:07:31.700 --> 00:07:36.900 Those kinds of things can help legitimate payment processors and banks figure out whether 00:07:36.900 --> 00:07:40.100 or not this particular transaction is legitimate. 00:07:40.100 --> 00:07:45.200 Of course, that depends on having a lot of information about a user, and that can be 00:07:45.200 --> 00:07:50.700 problematic due to privacy regulations in certain areas to device intelligence, behavioral 00:07:50.700 --> 00:07:54.600 biometrics, you know, understanding how users interact with their devices. 00:07:54.600 --> 00:08:00.900 Both of these things can set off signals that might at least raise the risk level of a 00:08:00.900 --> 00:08:07.100 given transaction so that, you know, a merchant or a payment processor might see that 00:08:07.100 --> 00:08:08.600 they should take some caution here. 00:08:08.800 --> 00:08:13.200 If you look at in Europe, for example, upcoming regulations or already existing 00:08:13.200 --> 00:08:18.100 regulations, they actually want to make sure that organizations take measures to 00:08:18.100 --> 00:08:23.700 identify these rogue merchants because they then would be part of the supply chain 00:08:23.700 --> 00:08:26.400 because you're using them for commercial purposes. 00:08:26.800 --> 00:08:32.100 And this is really something where DORA, NIS2, and Atisax, for example, in the 00:08:32.100 --> 00:08:37.400 automotive industry, really lay a heavy focus on to make sure that there's proper 00:08:37.400 --> 00:08:42.200 scrutiny applied when it comes to dealing with business-to-business partners. 00:08:42.200 --> 00:08:47.900 So I think that's also really an important part for staying compliant, for proving 00:08:47.900 --> 00:08:52.500 compliance, that you say, OK, I have a mechanism in place that detects these or that 00:08:52.500 --> 00:08:56.100 signals these rogue merchants before anything can happen. 00:08:56.200 --> 00:08:57.800 Are there any examples? 00:08:57.800 --> 00:09:03.400 Because I cannot, as a German, as a European, I cannot think of very good examples of 00:09:04.200 --> 00:09:05.600 rogue merchants at scale. 00:09:05.600 --> 00:09:11.300 You've told me that there are quite some larger examples that you can talk about when 00:09:11.300 --> 00:09:15.000 it comes to really saying, OK, yeah, that is really an issue and it's nothing 00:09:15.000 --> 00:09:17.100 theoretical. This is costing money. 00:09:17.300 --> 00:09:21.300 Yeah. You know, over the last five or six years, there have been some high-profile 00:09:21.400 --> 00:09:24.000 cases. One example might be Allied Wallet. 00:09:24.100 --> 00:09:30.200 It was a company that was doing a lot of this miscategorization of transactions. 00:09:30.300 --> 00:09:35.200 They used a bunch of different shell companies and designed fake websites to try 00:09:35.200 --> 00:09:36.600 to attract consumers. 00:09:37.500 --> 00:09:41.600 And then they passed these off against real payment processors. 00:09:42.100 --> 00:09:49.600 It was alleged in the lawsuit that they defrauded people more than 150 million 00:09:49.600 --> 00:09:55.500 dollars. So a pretty substantial amount of money, you know, probably the biggest one. 00:09:57.000 --> 00:10:03.800 Actually, it was sort of a collection of somewhat related fraudulent patterns. 00:10:03.800 --> 00:10:07.200 It was back during the pandemic when the U.S. 00:10:07.200 --> 00:10:11.800 launched what they called the Paycheck Protection Program, which was designed to 00:10:11.800 --> 00:10:17.700 help small businesses especially get through COVID during the initial lockdowns. 00:10:18.200 --> 00:10:22.800 And I think we still don't know the full scope of the amount of fraud that happened 00:10:22.800 --> 00:10:29.500 there. People set up fake businesses and you've got money through different various 00:10:29.500 --> 00:10:31.100 government programs. 00:10:31.100 --> 00:10:33.900 About 800 billion was paid out through that program. 00:10:33.900 --> 00:10:41.000 And some estimates are that more than 10 percent, maybe 80 to 100 billion or more, was 00:10:41.000 --> 00:10:45.600 fraudulently obtained by people creating fake businesses. 00:10:45.600 --> 00:10:52.200 And then at the same time, there was fraud against many states' unemployment funds. 00:10:52.200 --> 00:10:58.000 So really what happened there is that there was not nearly enough identity verification, 00:10:58.000 --> 00:11:00.900 both on the individual side or the business side. 00:11:01.500 --> 00:11:07.200 So I think that really highlights the need for organizational identity. 00:11:07.200 --> 00:11:13.400 Exactly. I think that that would be also a solution for that to say, OK, there is a 00:11:13.500 --> 00:11:19.200 reliable, official, digitally secured mechanism for understanding this is the company 00:11:19.200 --> 00:11:22.000 that I'm dealing with, that I want to deal with. 00:11:22.000 --> 00:11:26.500 And it's actually the organization I wanted to be in touch with. 00:11:26.500 --> 00:11:32.500 So from a research perspective, you're covering fraud reduction intelligence platforms 00:11:32.500 --> 00:11:36.700 and, of course, detection of rogue merchants as part of your research. 00:11:37.400 --> 00:11:38.600 What is the status here? 00:11:38.600 --> 00:11:40.900 Is there an update to be expected? 00:11:40.900 --> 00:11:44.800 And is that also reflected in other areas of your research? 00:11:44.800 --> 00:11:49.000 Yes. So right now, I've got two different reports related to fraud reduction until 00:11:49.000 --> 00:11:50.800 platforms that are in work. 00:11:50.800 --> 00:11:53.000 One is focusing on the finance industry. 00:11:53.000 --> 00:11:56.900 The other will more broadly look at merchants, e-commerce merchants. 00:11:56.900 --> 00:12:03.100 So that will probably be out in the early to mid-summer time frame, both of those. 00:12:03.700 --> 00:12:09.500 But, you know, we're going to dive a little bit deeper this time on the CIM report, 00:12:09.700 --> 00:12:11.400 which we've done for years, too. 00:12:12.000 --> 00:12:17.600 The last time around, we got into a bit about B2B identity management and 00:12:17.600 --> 00:12:20.000 organizational identity will be a big part of that. 00:12:20.000 --> 00:12:23.100 But this time around, I think we're going to try to go a lot deeper because we're 00:12:23.100 --> 00:12:27.000 hearing more and more about concerns around organizational identity. 00:12:27.500 --> 00:12:33.700 And as supply chains grow and become more complex, organizations just need a higher 00:12:33.700 --> 00:12:37.500 level of assurance about the other organizations that they're going to be doing 00:12:37.500 --> 00:12:38.400 business with. 00:12:38.400 --> 00:12:44.200 So, yeah, we we're covering it to a certain extent in the fraud reduction paper, and 00:12:44.200 --> 00:12:50.000 then we will go a little bit deeper the next time around on the CIM and B2B IAM 00:12:50.500 --> 00:12:51.400 organizationally. 00:12:53.600 --> 00:12:57.000 So, and you've mentioned that organizational identity just a few days ago, I've 00:12:57.000 --> 00:13:02.200 published a blog post to say organizational identity, why IAM must evolve beyond 00:13:02.400 --> 00:13:06.800 people, because if you're talking, this is a different type of identity and the 00:13:06.800 --> 00:13:11.800 number and the types of identities within an identity fabric is increasingly 00:13:12.100 --> 00:13:16.400 growing. And this time, it's really the identity of an organization. 00:13:16.400 --> 00:13:21.400 So it says the name, but it's not it's not Matthias as a person, but it's 00:13:21.500 --> 00:13:27.500 Kupinger Coal as an organization that has an entry within the within state ledgers 00:13:27.500 --> 00:13:31.900 to say, OK, yeah, this is Kupinger Coal and they are identified as where they are 00:13:31.900 --> 00:13:35.800 and they have a CEO and they have representatives and Matthias is actually 00:13:35.800 --> 00:13:37.700 working for them and it's trustworthy. 00:13:37.800 --> 00:13:43.400 So that is the new type in air quotes of identity that we're talking about. 00:13:43.900 --> 00:13:47.600 But this is something that many organizations have done for quite a while. 00:13:48.100 --> 00:13:50.700 So what's new? I think it's the digital format. 00:13:50.700 --> 00:13:54.100 It's the signature that's behind that digital signature. 00:13:54.500 --> 00:13:56.200 It's the verification aspect. 00:13:56.200 --> 00:13:59.800 So actually, what are the concepts behind that that you are looking for when you're 00:13:59.800 --> 00:14:05.700 looking for organizational identity verification in context of B2B solutions? 00:14:05.800 --> 00:14:09.300 Yeah, there's so many different things that you can verify about businesses, too. 00:14:09.300 --> 00:14:13.200 And depending on where they're operating, you know, you might want to look at do 00:14:13.200 --> 00:14:15.400 they have a legitimate business license? 00:14:15.400 --> 00:14:21.900 Who are the authorized persons within that organization who can make certain types of 00:14:21.900 --> 00:14:25.500 transactions? Are those licenses still valid? 00:14:25.700 --> 00:14:28.100 Are there any complaints against them? 00:14:28.200 --> 00:14:33.000 And then are any of these people inside the organization or is the organization 00:14:33.000 --> 00:14:35.900 itself on some sort of sanctions list? 00:14:35.900 --> 00:14:38.700 And there are many different sanctions lists out there, too. 00:14:38.900 --> 00:14:43.200 So I think we see now that that is becoming more and more important. 00:14:43.200 --> 00:14:48.400 And I did put quite a bit of emphasis on that in the first Fripp report on finance, 00:14:48.400 --> 00:14:52.900 being able to do sanction screening, politically exposed person screening and 00:14:52.900 --> 00:14:56.400 things like that. Like I said, a number of different sources that have to be checked 00:14:56.400 --> 00:15:00.700 and there are several different third party services that can be used to do that 00:15:00.700 --> 00:15:02.000 validation as well. 00:15:02.200 --> 00:15:07.000 So it's somewhat surprising that a lot of organizations still do that manually and 00:15:07.000 --> 00:15:08.900 that, of course, that is a lengthy process. 00:15:09.200 --> 00:15:14.000 So there are legal departments, there are people that actually scan these documents 00:15:14.000 --> 00:15:20.900 and look them up and try to find maybe even by mail, by fax, by email to find these 00:15:20.900 --> 00:15:23.100 documents that are the proper proof. 00:15:23.200 --> 00:15:24.700 But it's 2025. 00:15:25.000 --> 00:15:26.600 It should be done differently. 00:15:26.600 --> 00:15:28.000 It should be done electronically. 00:15:28.100 --> 00:15:30.200 And there are services that provide that. 00:15:30.200 --> 00:15:35.100 So it's really something that you consume from the B2B platform as a service that is 00:15:35.100 --> 00:15:38.200 provided via an API, via a digital service. 00:15:38.200 --> 00:15:38.800 Am I right? 00:15:39.500 --> 00:15:40.600 Yeah, exactly. 00:15:40.700 --> 00:15:46.400 It's API driven, given the fact that there are a lot of different sanctions lists and 00:15:46.400 --> 00:15:48.200 they do change from time to time. 00:15:48.200 --> 00:15:52.500 Trying to do it manually, I think, raises your own risks that you might miss 00:15:52.500 --> 00:15:56.100 something. So that's why I think these services can be very valuable. 00:15:56.100 --> 00:16:01.100 Right. I think you even save money when you say, OK, I don't have to spend weeks in 00:16:01.100 --> 00:16:06.800 verifying a larger customer, but I can do that within the fractions of a second in a 00:16:06.800 --> 00:16:12.300 digital format. But what are these components that are verifiable? 00:16:12.300 --> 00:16:16.600 What makes this interaction with the service provider reliable? 00:16:16.600 --> 00:16:20.700 Where can I apply scrutiny myself to say, yeah, this is the result. 00:16:20.700 --> 00:16:25.300 And I know it's true because it's what happens, what happens when you want to verify 00:16:25.300 --> 00:16:30.500 that. Well, you know, there's the I think it's the Global Legal Entity Identifier 00:16:30.500 --> 00:16:37.300 Foundation. That's something we've been tracking for a number of years now and really 00:16:37.300 --> 00:16:42.600 hoping that it kind of takes off more broadly to see businesses doing checks against 00:16:42.600 --> 00:16:50.500 that. A legal entity can obtain an identifier, which then makes it easier to do lookups 00:16:50.500 --> 00:16:57.800 against that particular LEI in different domains, find out more information about 00:16:57.800 --> 00:17:03.400 them. So this is kind of a verifiable identity, but for an organization in a digital 00:17:03.400 --> 00:17:09.200 format. So even I know there's a first of all, the number that's assigned, but that's a 00:17:09.200 --> 00:17:12.100 number, a huge one, but not really user friendly. 00:17:12.100 --> 00:17:16.600 But there is a digital representation with a signature, which makes it possible to use 00:17:16.600 --> 00:17:21.800 it within electronic workflows to to provide proof in an automated way. 00:17:21.800 --> 00:17:23.800 I think that's that's the way to move forward. 00:17:24.400 --> 00:17:28.400 But as you said, it's up and coming, but it's not yet widely available. 00:17:28.400 --> 00:17:30.900 Or what is the current status of these LEIs? 00:17:30.900 --> 00:17:36.800 Well, on the recent round of research, there are some of the vendors that understand and 00:17:36.800 --> 00:17:40.600 utilize LEIs as part of their ongoing services. 00:17:40.600 --> 00:17:48.700 But yeah, I would like to see it expand because we are in need of a global LEI registry 00:17:48.700 --> 00:17:49.800 and there is one available. 00:17:49.800 --> 00:17:55.600 And that's a great starting place from which to be able to do, you know, rogue merchant 00:17:55.600 --> 00:18:00.900 detection and other kinds of higher business level fraud. 00:18:01.000 --> 00:18:07.800 Right. And if we look at these LEIs, EIDAS, as the European standard asks for 00:18:07.800 --> 00:18:13.300 verification, it doesn't ask for a glyph, but it asks for some some reliable verification 00:18:13.300 --> 00:18:16.100 of business practice as well or partners in general. 00:18:16.100 --> 00:18:19.000 I think that could or should also be a driver. 00:18:19.000 --> 00:18:22.700 We talked about that at EIC, that this is really something that is driving the 00:18:22.700 --> 00:18:23.900 development there as well. 00:18:24.200 --> 00:18:30.200 And many of the participants also, just like you did, asked for contributing and for 00:18:30.200 --> 00:18:39.200 supporting this mechanism, these LEIs and VLEIs, verifiable LEIs, to get to even more 00:18:39.200 --> 00:18:44.800 critical mass to actually have this as a foundation layer for organizational identity. 00:18:44.800 --> 00:18:47.000 Yeah, I think it's a great starting point. 00:18:47.500 --> 00:18:52.600 And there's certainly much more that everyone needs to do in order to protect themselves 00:18:52.600 --> 00:18:54.200 against fraudulent businesses. 00:18:54.300 --> 00:18:59.600 Right. And if you look back at this, this organizational identity is not really new. 00:18:59.600 --> 00:19:03.700 There have always been organizations like Dun & Bradstreet earlier. 00:19:03.900 --> 00:19:05.200 They did that. 00:19:05.200 --> 00:19:12.600 But having that A, at a global scale and B, digitally available via APIs, that takes more 00:19:12.600 --> 00:19:16.400 than yet one other step to achieve that. 00:19:16.400 --> 00:19:17.700 So we are not yet there. 00:19:17.700 --> 00:19:19.000 What are the challenges? 00:19:19.000 --> 00:19:20.500 What needs to be achieved? 00:19:20.800 --> 00:19:22.200 Of course, broader usage. 00:19:22.200 --> 00:19:28.000 But are there other obstacles in the way to having this organizational identity as a 00:19:28.000 --> 00:19:29.800 commodity that just can be consumed? 00:19:29.900 --> 00:19:32.900 Well, I think promoting awareness of it's a good place to start. 00:19:32.900 --> 00:19:40.000 The mechanisms that there are out there, like LEIs and other trends within fraud 00:19:40.000 --> 00:19:46.400 protection generally, maybe extending the kinds of coverage that we have for individual 00:19:46.400 --> 00:19:49.700 use cases and preventing fraud to the business level. 00:19:49.800 --> 00:19:51.300 But what are the problems? 00:19:51.300 --> 00:19:59.200 I think, like you were mentioning, some of the older models that are still around are 00:19:59.200 --> 00:20:04.300 fragmented. So right now, if you're a global organization and you're doing business in 00:20:04.300 --> 00:20:07.600 multiple regions around the world, you've got to check with all these different 00:20:07.600 --> 00:20:13.000 countries and maybe municipalities within those countries, as well as those different 00:20:13.000 --> 00:20:13.900 sanctions lists. 00:20:13.900 --> 00:20:17.300 So there's just lots of different things that you need to check. 00:20:17.300 --> 00:20:23.000 And that leads to maybe omitting something that you should have checked or not having 00:20:23.000 --> 00:20:24.700 the most up-to-date information. 00:20:25.100 --> 00:20:29.600 So as you were saying, I think the more that we can automate this, the more that we can 00:20:29.600 --> 00:20:35.300 make it comprehensive, call it through an API and get all the information that you need, 00:20:35.400 --> 00:20:37.400 the greater the risk reduction will be. 00:20:37.500 --> 00:20:43.800 We're used to verifying human identities, but also non-human identities at runtime again 00:20:43.800 --> 00:20:46.300 and again. So this is zero trust, always verify. 00:20:46.400 --> 00:20:52.900 Usually, these checks for organizations are done at onboarding time and not very often 00:20:52.900 --> 00:20:56.900 afterwards. And I think especially if you think back to what you said, these rogue 00:20:56.900 --> 00:21:01.000 merchants, maybe they get detected and are no longer trustworthy. 00:21:01.000 --> 00:21:05.000 That would be a signal that you can receive and consume in your daily business 00:21:05.000 --> 00:21:08.200 processes. And that would be something that such an API can provide. 00:21:09.200 --> 00:21:15.700 And this is really something that also should be baked into such a cybersecurity supply 00:21:15.800 --> 00:21:20.300 chain risk management processes to understand what is going on with such an 00:21:20.300 --> 00:21:23.600 organization. So always verify for every transaction. 00:21:23.900 --> 00:21:28.000 You might not want to do that for, I don't know, for Boeing or for Deutsche Bank, but 00:21:28.300 --> 00:21:33.400 for those who are not that well known or just came to your notion and you just make 00:21:33.400 --> 00:21:37.200 first business with them, maybe that's helpful to check them more often. 00:21:37.400 --> 00:21:39.900 I think that's important. 00:21:40.000 --> 00:21:45.600 Are there any other emerging trends in that area that we should consider when it comes 00:21:45.600 --> 00:21:49.800 to using organizational identity and organizational identity verification? 00:21:49.900 --> 00:21:54.100 Well, to address the point that you just made and to kind of answer the question about an 00:21:54.100 --> 00:22:01.000 emerging trend is, yes, doing some sort of check at onboarding time is good, but we 00:22:01.000 --> 00:22:05.900 know from both the individual side of consumer fraud as well as the business side, 00:22:06.800 --> 00:22:13.000 fraudsters will set up accounts and then let them age, sometimes for very long periods. 00:22:13.400 --> 00:22:18.200 So if you do some sort of identity verification or organizational identity 00:22:18.200 --> 00:22:22.400 verification, they may sit on that literally for years. 00:22:22.400 --> 00:22:28.700 So just because something was created and passed its organizational identity check 10 00:22:28.700 --> 00:22:33.000 years ago, even may not mean that it's a legitimate organization today. 00:22:33.600 --> 00:22:39.500 So, yeah, I think knowing that definitely adds to the difficulty of doing 00:22:39.500 --> 00:22:45.400 organizational identity verification, but it's something we have to be aware of and 00:22:45.400 --> 00:22:46.200 try to mitigate. 00:22:46.500 --> 00:22:49.800 We need to understand that it's also just one building block. 00:22:49.800 --> 00:22:56.600 So if you think of it as B2B or a CIM platform, this is the building block that 00:22:56.600 --> 00:23:02.600 tells, yeah, this is A, a valid organization, B, it's well-represented, it's 00:23:02.600 --> 00:23:04.900 there, it has an account, it does business. 00:23:05.400 --> 00:23:12.800 But then the association of a person with this organization is partially still a not 00:23:12.800 --> 00:23:18.500 yet solved problem to say, OK, yeah, Matthias is really working for KupingerCohle and 00:23:18.500 --> 00:23:21.000 John as well, although they are in different countries. 00:23:21.000 --> 00:23:27.300 Having that cross-border, reliable, digitally verifiable, there's a way to go, right? 00:23:27.300 --> 00:23:29.400 Yeah, I think there's still a lot of work to be done there. 00:23:29.600 --> 00:23:36.500 You're right, combining individual verified identities and business identifiers is 00:23:36.500 --> 00:23:39.500 definitely an area for improvement going forward. 00:23:39.600 --> 00:23:44.800 Right. So this is the intersection of cybersecurity and IAM because it's identity 00:23:44.800 --> 00:23:49.700 at the end. And as we always say, all cybersecurity is somewhere around identities. 00:23:49.700 --> 00:23:54.600 And this time it's between organizational verification and the rogue merchant and 00:23:54.800 --> 00:23:55.600 preventing that. 00:23:56.200 --> 00:24:02.000 You've mentioned the research also will be done right now and will be out soon. 00:24:02.000 --> 00:24:07.700 So B2B CIM as part of CIM, that is also, as you've mentioned, in the making and 00:24:07.700 --> 00:24:09.600 should be around somewhere here? 00:24:09.600 --> 00:24:15.300 Yeah, the first fraud reduction report will be out in the next month and a half or so 00:24:15.300 --> 00:24:21.900 on finance. The one on e-commerce will come early to mid-summer and then the CIM and 00:24:21.900 --> 00:24:25.600 B2B CIM will be out near the end of the year. 00:24:26.100 --> 00:24:27.300 Really interesting stuff. 00:24:27.300 --> 00:24:33.100 So this is really, as I said in the beginning, it's a bit scary that there is a full, 00:24:33.600 --> 00:24:38.000 not only businesses, but a full business supply chain from fake payment transaction 00:24:38.000 --> 00:24:40.700 processes to the businesses that use that. 00:24:41.400 --> 00:24:43.300 This is really, really scary. 00:24:44.000 --> 00:24:50.400 But it's good to hear that there are means to counter that and to address these issues 00:24:50.400 --> 00:24:57.200 and for organizations to consume solutions that can help you in preventing that. 00:24:57.300 --> 00:24:58.900 Yeah, really interesting. 00:24:59.200 --> 00:25:02.400 Any final things that you want to mention around this area? 00:25:02.700 --> 00:25:07.400 Are there other developments that you're seeing that speed up things, that speed up 00:25:07.400 --> 00:25:12.900 adoption and make us looking more happily into the future that this can be prevented 00:25:12.900 --> 00:25:14.000 in the near future? 00:25:14.100 --> 00:25:20.600 I guess I would say we have been aware of KYC, Know Your Customer, initiatives, and 00:25:20.600 --> 00:25:26.900 that's become much more embedded into products, specifically CIM kinds of products. 00:25:26.900 --> 00:25:33.400 Now we see a growing emphasis on KYB, Know Your Business, and trying to build that into 00:25:33.400 --> 00:25:38.800 products. So, yeah, I expect some interesting results from the next round of CIM and 00:25:38.800 --> 00:25:42.200 B2B CIM kinds of use cases that we're going to be doing. 00:25:42.200 --> 00:25:46.700 Right. And B2B CIM and B2B partner management is a hot topic anyways. 00:25:46.700 --> 00:25:50.000 And so we need to get better there anyway. 00:25:50.000 --> 00:25:55.300 And then everything that we talked about today is a capability within that. 00:25:55.400 --> 00:26:00.400 We need to build upon that to, as you said, know your business or know the business of 00:26:00.400 --> 00:26:01.400 your peers. 00:26:01.500 --> 00:26:05.600 So thank you very much, John, for being my guest today, for talking about that 00:26:05.600 --> 00:26:08.000 interesting topic. I said EIC is over. 00:26:08.000 --> 00:26:10.600 It's no longer identity management. 00:26:10.900 --> 00:26:11.600 What was wrong? 00:26:11.600 --> 00:26:15.700 It's identity management in the end, but a different type of identity management and 00:26:15.700 --> 00:26:17.400 cybersecurity combined. 00:26:17.900 --> 00:26:23.000 So really interesting topic and a real interesting market segment to watch also in the 00:26:23.000 --> 00:26:27.500 future. As usual, if there are any questions around that topic, and it's not a new one, 00:26:27.500 --> 00:26:32.500 but we have not yet put that much focus on that, please reach out to John, reach out to 00:26:32.500 --> 00:26:35.400 me, leave a comment on YouTube in the comment section. 00:26:35.500 --> 00:26:39.700 We will pick that up. And if you are interested in learning more about that, I'll invite 00:26:39.700 --> 00:26:43.800 John back to this podcast and we have another episode digging deeper into the 00:26:43.800 --> 00:26:48.100 technicalities, into the processes behind that, maybe the business models for those who 00:26:48.100 --> 00:26:51.300 provide this information for these B2B platforms. 00:26:51.800 --> 00:26:54.600 Until then, thank you very much, John, for being my guest today. 00:26:54.900 --> 00:26:57.200 And I'm looking forward to these reports. 00:26:57.200 --> 00:26:58.900 That sounds really interesting. 00:26:59.200 --> 00:27:01.200 And it's part also of my daily business. 00:27:01.200 --> 00:27:02.400 Thanks. Thank you. 00:27:02.400 --> 00:27:03.500 And see you soon. Bye bye.