As you've seen, I'm now working with a celebrity spokes puppet, and it seems to be wise to delegate all my social skills to him. And he's more lifelike than I am. And he allows me to focus on my core branding, which is about social awkwardness. That may not be a joke.
My deal is that I've been working in this area for a long time. I've now been speaking with a lot of the tech companies involved in this for some time, and they're all doing a much better job of scam detection, particularly on our phones, than we normally know about. What I'm doing is I'm encouraging everyone to work together and to build best practices which they can share, best practices which can actually do something useful.
I'm also asking companies to share the threat intelligence they gather regarding scam fighting, and in particular this includes the use of small language models on our phones, because our phones are now smart enough with a suitable engine to advise people when they may be approached by a scammer.
Overall, my deal is that I'm approaching these groups through back channels. I'm being very quiet about it. That works better for me. And the world doesn't need another tech guy being loud, unless he's funny, and I know I'm not as funny as I think I am. So you're going to see the effects of my gently pushing in the background, but otherwise not so much. Or as the account would say, h.
Hi, everybody. Whoa. Good morning. I thought you needed to wake up, right? My name is Betsy Cooper and I represent the Aspen Institute and Aspen Digital, and we've been working with Craig for a number of years to get loud about cyber security, to get loud about scams, and to get loud about fraud. So everybody needs to stand up and make a difference in this space.
Here at Aspen Digital, among one of the things that we do is help people who have been scammed actually advocate for change in their communities. So we run scam fighters workshops that help especially older and younger adults who have faced a difficult time, like several members of my family have, and give them the opportunity to actually go out and advocate for change. But we have to do this work together. It's going to take all of us, and as Craig mentioned, it's going to take the mobile platforms with these devices that we're using every day to stand up and say something about cyber security. And I'm so delighted that we have a great group of folks here who are going to come talk to you about that. So I'll invite our panelists up onto the stage and we'll sit down and have a conversation.
Awesome. So we're going to kick off just by talking about how scams reach people through their phones. And I'm going to ask each of our amazing panelists, I'll introduce them as we go, to talk a little bit about what is the thing that they've done in the past 12 to 18 months that they're the most excited about. So first we have Zean Ali. So Zean, he's representing AT&T. You want to tell us a little bit about what you all are doing and what you're most excited about?
Yeah, I'm Zean Ali. I work in AT&T's global network fraud organization. So at AT&T, we view this as a layered defense challenge. We combine our network intelligence information, advanced analytics, and threat detection information that we have through our machine learning and AI-driven models to detect and mitigate the evolving scams. In the last two to three years, we have migrated more carriers from our legacy either PSTN or IP networks to more next generation networks. So we can have more information like STIR/SHAKEN instead of just looking at the phone numbers. We have more digital information on the calls that we can preserve and use in our analytical engines to detect more calls in real time and block or label it. So this year alone we have blocked and labeled more calls than ever in previous years.
So I think as AT&T, our goal or objective is very simple that we got from our leadership team is that we have to increase the friction for our scammers that are impacting our mutual customers, then without creating any unnecessary friction for our customers on the trusted communication system that our customers rely on every day. So the last thing that I'm going to say is when I say trusted communication, we have to create the balance on one side where we are catching more bad calls, detecting, blocking, or labeling it. On the other side, we have to make sure that we pass the legitimate communication or calls to our customer. That is very critical.
Awesome. So next I'll turn to Eugene Lerman. Eugene represents Google. What are you most excited about right now?
Yeah. So, whoa. For the last 12 to 18 months, somebody turned this down. We've done quite a bit actually. So for us, well, we think of scams and theft as like under an umbrella of fraud. We think of this as real world threats, things that every user, every person thinks about and cares about, your family, your kids, your elderly, everybody wants this protection. And so from our side, if you think about this from the contact methods, right, there's call based, text based, email based, and for every one of those, we've put in specific protections.
So for calls, for example, we've done things like scam detection, and as Craig mentioned, it's on-device AI, privacy preserving, detecting that if it's a scam call from an unknown caller, giving you an alert, letting you know to hang up the call. We've done the same thing for texts. For email, of course, yesterday Kent mentioned Gmail does like 99.9% detection of scams. Some of the most recent things we launched though, for example, because at the end of the day this is a shared responsibility, so we've also enabled functionality for third party app developers. So one is we call it verified financial calls, and in this case banking apps, fintechs can leverage this to know that somebody's actually calling and pretending to be them in a privacy preserving way and integrate it with their call center so that they can actually alert the user saying this is not coming from us, or we would automatically hang up that call on their behalf.
The other feature that I'm really excited about because our team worked on it was, Kent Walker mentioned it yesterday. It's called fake call detection, where you see, you know, historically scammers have been trying to use like business scams, IT job scams, whatever. But now they're starting to leverage the information about you and your loved ones. So they're calling impersonating you, your friends, your family. This has actually been something that's been trending on social media for quite a bit now. And with fake call detection, we're actually able to use an open standard called RCS to automatically detect if somebody's actually impersonating the phone number of your loved one and will again alert you and notify you to hang up.
Awesome. Thank you. So next we're going to turn to Jeff Halum from Verizon. What are you most excited about?
Well, I'll start with what I'm most proud about, and that is making scammers cry and drink. It's great to watch some of our threat intel and you watch them as you crush their dreams and hopes so that they get just a little bit of a taste for the chaos they cause and the havoc they wreck. And so that's one of the things that we monitor, the jobs that many of us have in this room. It's an unrelenting snowstorm and you get up and shovel every single day. And when we talk about what we're proud about, I think that's really it, is getting up and changing it. It's bringing a different technology in this audience, and we'll talk about it a little bit more as we go.
The thing I'm most proud about is bringing people who are great technologists but maybe haven't lived through the battles and bringing those scars and wounds and stories and sitting down for an hour and translating. So we had a carrier who was number one on our complaint list in all of the major carriers who we sat down for an hour, shared a story around how to eradicate and what they needed to do, and they went from number one to number 280, which is a really big swing, and that means for that day they didn't get to do their nonsense. So we'll talk a lot about technology, about how we do things for real time and people aiding and LLM deliveries on handsets, but I think for me, every day I can make them cry is a good day.
Awesome. All right, happy tears. Jonathan Carpenter from WhatsApp, what are you most excited about?
Well, thank you very much, and I'm very proud to be here on behalf of a large team at WhatsApp that works hard on these issues to make sure that users trust our platform for their most private and safe conversations. As a private encrypted messaging app, obviously we don't see content unless and until it's reported. So the idea of in-app product protections and interventions has been sort of fundamental to us from the start. And I think one of the things that we've seen, and it's been talked about here a lot, is how scammers are moving across the different platforms. So one example we've seen recently, and something I think the team is really proud about, we saw scammers using fake QR codes, malicious websites, scammy ads to convince users to link their WhatsApp account to an attacking device.
And we have friction in the app for when you go to link to make sure it's what you want to do. But what we can now do using new technologies and some of the ability to pull all this data together is we can make a decision on the back end that this particular linking device or this particular linking attempt, sorry, is perhaps more suspicious than another, and we can increase the friction at that moment for that linking device and put more context in front of the users. And I think that concept of increasing the friction, and we've already heard it, when it's more suspicious, because obviously we all know that if you give the same warning every time, people click through them. So increasing the friction, slowing people down in the product, picking up on Craig's campaign, and giving them a chance to think is very helpful in this regard.
We also are very direct. Are you sure you want to link your device, sorry, link your account to a device in Cambodia? I think the importance here is that, as I said, the friction matches the suspicion, and two, this works on every device for all users at all literacy levels, and that's very important that it does. So the design here of the intervention is important to us as the actual detection.
Awesome. So let's move to a little round robin, and Eugene, I'll start with you first on this. How do you actually measure success? How do you know what metrics are you seeing that are actually helping you demonstrate that you're making progress in this regard?
Yeah, that's a great question. I'll start with my favorite feature because it was actually the scam fighter of the year award runner up last year, which I'm still very bitter about. I'm hoping this year maybe it will be better. But we did a partnership with the Singapore Cyber Security Agency because they had reached out and said in Southeast Asia they were really heavily impacted by financial fraud through malware. And so we did some analysis and we came up with an approach to be very surgical and block very specific types of installations through what we call internet sideloaded, so messaging apps, file managers, web browsers and so forth. And it became very effective and it actually led to a case study and it ended up letting us launch this feature across 200 markets now globally, like over three billion devices have it now enabled on by default.
But the success metric was when the Singapore government, they published their annual malware report, them, Singapore, Thailand, many markets started saying financial fraud continues to be a problem, but for malware based it went down to zero, and that was like a very impressive success metric. The other one that I wanted to quickly highlight was if you look at what the FTC says, the average loss for a scam text is about $1,000, and the average loss for a call is $1,400. And so if you look at the scale of some of these features, for example, the scam detection that I mentioned earlier in Google Messages and in the Phone by Google app, we're detecting about 10 billion every two months. So I can't give you like a full number, but you can just quantify and see that used population and how many of those get blocked and multiply that by, you know, a thousand or 1,400. It's tremendous impact.
Awesome. For the other panelists, any really interesting metrics or ways that you're creatively measuring this?
For me and for our teams, the best indicator of how things are going is feedback from our customers. And that feedback directly from humans, through interactions, through feedback on our apps, through feedback and delivery, and our bigger customers, our enterprises and financial partners and others who are feeling the real space of this. Some of the other metrics that are really interesting for us, we talk about how many things we've blocked. That's a little bit like counting the alligators that don't get into your house. Nobody really cares about the alligators that didn't get into your house. So it's an interesting metric for us to celebrate those blocks, don't get me wrong, but we love to see when those blocks begin to go down and go down in a successful way, meaning they are now doing something different across there. So success for us looks like that increasing blocks and then that turning point where you're sure everything's holding but they're doing something different. You forced them to modify.
Awesome. And thanks for bringing the human element into it. And I think that's an important part that we should all be paying attention to. So this wouldn't be a conversation about scams if we didn't talk about AI. And I've had a recent experience with this actually myself where I received an incredibly personalized email inviting me to participate in an organization and I would have loved to participate in that organization. So it was very compelling. The only catch was I was already a member of that organization, and so I did some quick research and figured out it was a complete scam. It was a very well-done email and could have definitely got me if it hadn't turned out that I already was a member. So that's an example of somebody using AI to try to target me personally. They went a little too far that time. But so what trends are you all seeing? And I want to start with Jonathan on this. How are you using AI to detect and prevent threats? What new threats are you seeing as a result of AI? And what trends are you thinking about coming down the pipeline?
Yeah, thanks. And I think that story you tell is a pretty familiar one these days, because I think content for scammers is now increasingly easy to generate, whether that's deep fakes, the hyperpersonalized attacks, the sort of the content of a conversation. I want to answer this in sort of three buckets. So at WhatsApp, the first thing we know is that the content may be easy for the scammers to create, but they still have to deliver it. So the things that we can do upstream at the top of the funnel to prevent scammers from getting accounts, coordinating with industry partners in that instance, stopping accounts when they begin to behave abnormally before they send a message.
I was going to jump in on the question before about metrics. One of the metrics that I really pay attention to across all the metrics that we track is how many actions are we taking before a message is sent and before you get the report. And you combine that with precision and you get a sense about how effective you're being, I think is important. But back to the sort of what we're doing. So using new AI tools to get after scripted automation, group clustering, all these things again totally content agnostic. We're not looking at content. We're looking at the behavior of these accounts, where they're registering from, who they're adding to groups, and how they're behaving. And we've seen them use their tooling to get more aggressive at this and we've matched them. So that's at the top of the funnel.
Once contact happens, similar to the example I gave before, every time you're reached out to the first time on WhatsApp you get a contact card. We are using these backend signals now to provide a more robust contact card when we think that's a potentially suspicious outreach. It has more information in it, a more readily available upsell of the block and report functions, which we think are important. And then we are starting to test, and it's already been touched on by my colleagues up here, we're starting to test in a very limited way an optional on-device AI model that's completely consistent with our encryption and privacy promises that will on-device review conversations, text-based conversations you're having with contacts and surface information to a user, additional resources, etc., for that conversation if the model thinks it's a scam.
We're in early days on this. As I said earlier, it's got to be able to work on, we're in more than three billion pockets globally. So it's got to be able to work on every device. It's got to work for low literacy users. It's got to be something that users trust. But I look forward to the development of this and talking about more in the future. And then the last thing I'd say on the tail end is we encourage reporting. We upsell reporting. That's the one time we see message content. We are now developing, as everybody is, very aggressive LLMs and other to go after and use that. We've always looked at that content, but now we're able to do it in a much more effective way.
And if I could just tell one quick story on this, the other thing we can do is we can deploy these tools much quicker. So a scam that everyone's probably familiar with, fake law enforcement, fake security officers, you know, calling people and trapping them in conversations. And we saw this trend, we heard about it in, you know, talking to our users and seeing it in reporting. We quickly built a tool that used the signals available to us, profile, photo, some registration information, as well as any reported messaging, and launched that classifier at scale again on a platform with three billion people at scale to effectively ban those accounts as soon as we could identify them. And I think, you know, I forget who said it, but you know, I do agree that one of the metrics what you see is you see attacks, you see our response, and you see those particular attacks sort of ramp down. I think that's a measure of effectiveness and obviously part of the adversarial space that we're in.
Awesome. Yeah, please, Eugene.
Okay. So I was just going to add we've evolved so far, like scammers evolved so much since 20 years ago with the Nigerian prince scams, right? There was a great talk by somebody from the cyber security agency of Estonia and he said they're a small country under a million people. Nobody had ever fallen for a scam. They're like the Navajo code talkers. Nobody knows this language. And all of a sudden, with the advent of large language models, these scams are flawless. And so it's no longer a point where you can rely on user awareness. There were like six to eight scam categories, you know, romance, IT, job support, crypto. But if you look at those evolving to subcategories, there's like 240.
How are you going to educate the average user on all these scam categories? You need AI to detect AI. And so like from our perspective, you know, malware authors are modifying their malware with techniques called polymorphic malware where they're making slight changes to get around traditional detection. So for that we have Google Play Protect and it detects that for all the different variations of these 240 scam categories. This is where the on-device models really help. You know, Gmail, Google has of course been like the pioneer of AI right with large language models and the evolution to large machine learning to large evolution of large language models. So this is an area that you kind of need everything as much as you can to be powered by, but you want to give users that guarantee that their data is not being used for training information and providing that, and that's why providing this really nice concept how much you can do on device with these more powerful devices can make a really big difference.
Awesome. So Jeff, I want to bring you into the conversation. So no single company is going to be able to go it alone in this space and we need to share information. What are you seeing in terms of trends in terms of sharing information among different companies and what are the obstacles that we can work on to actually make that easier to do?
Yeah, I love this question because the answer is what can you do rather than what you can't do. And a really smart person told me one time we should be in the business of not saying no but in the business of saying yes and helping people get through that. And I think that's the biggest thing. Our lawyers are here to protect us. We have no interest in violating people's privacy and rights. We want to retain that. But really smart conversations around what's going on between really smart people moves the bar. And so the answer for us, we've got kind of five things. We have the first one which is stuff we keep internally. We look at entropic mapping and keyword matching and volumetrics. All that kind of science stuff that goes on in the background. A lot of that's kind of internal.
But then we start moving to the right and this middle ground of as the bad guys move away from traditional single messaging and MMS into over-the-top things which to many of us look like data sessions and it's encrypted end to end. So you have to talk with people and saying the bad guys are outside the room not between our two companies and where do we go? If you keep them moving to the right, and I'm going to answer a little bit and cheat on that AI question. One of the things that we've found AI is helpful is enabling users to use stuff that they don't even know they have the capability for. How many of you have really good nice things? Trust me, it's our app and it's still not human enough where you say, 'How would I turn on this feature?' Well, go to hamburger menu 3. Six lips down. This one here. This one here.
One of the enablers that AI is giving us is the ability for someone to say, 'What scam protection is available on my service? What are the pros and cons? And please turn it on for me.' That is game-changing. We presented that to my mom, who happens to be with us still. And she was able to do that on one of our beta products and turn it on. And it would have taken me a technical call of maybe 30 minutes to get that through previously, let alone. I'll go quickly through number four. So our fourth thing is what we do with our enterprises and partnering with them candidly. If you're an enterprise and you're struggling and it's oh it's the problem over there, please get in the ship with everybody. Sharing data makes the big difference. And then finally number five, the fact that you're in this room means you are part of the solution there. So sharing those little conversations that happen here, maybe not on stage. Have you heard this? What can we do here? I think every one of us would participate in that.
