Skip to content
InTechnology Podcast

Buy Now, Hacked Later: Security of Online Shopping (134)

In this episode of InTechnology, Camille and Tom get into “buy now, pay later” credit and security with guests Jim Ducharme, COO at Outseer, and Armen Najarian, an industry advisor in digital fraud and identity. The conversation covers the potential security risks and threats of “buy now, pay later” credit for online shopping, how AI and machine learning are being used to detect and prevent those security threats, and brand impersonation.

To find the transcription of this podcast, scroll to the bottom of the page.

To find more episodes of InTechnology, visit our homepage. To read more about cybersecurity, sustainability, and technology topics, visit our blog.

The views and opinions expressed are those of the guests and author and do not necessarily reflect the official policy or position of Intel Corporation.

Follow our hosts Tom Garrison @tommgarrison and Camille @morhardt.

Learn more about Intel Cybersecurity and the Intel Compute Life Cycle (CLA).

Buy Now, Pay Later: What’s the Risk?

As online shopping becomes more ubiquitous in everyday life, more convenient payment options are now available. Consumers who might not have been able to access traditional credit can now take advantage of “buy now, pay later” installment payment plans through popular platforms like Afterpay or Klarna. Consumers can benefit from “buy now, pay later” options by bypassing traditional credit, while companies can benefit by increasing sales and bypassing the reduced profits that come with using third-party credit companies.

Unfortunately, these benefits come with many security risks and growing threats for both companies and consumers. Cybercrime is going to be present where there is money to be made, Jim and Armen explain. Risks to companies include the potential for overall loss when customers can’t pay all of their installments, while consumers are at risk for cyber crimes like account takeover fraud, synthetic identity fraud, and identity theft.

Stopping Fraud with AI and Machine Learning

Cybercriminals now have multiple ways to gain unauthorized access to consumer accounts and personal data. They can impersonate someone to make fraudulent charges using their credentials, or they can create entirely synthetic identities (i.e., fake accounts) using someone’s personal information like their name, location, device, etc. Because “buy now, pay later” platforms are not tied to financial institutions like your bank and because they are frequently being used for the first time by many consumers, the accounts and personal data are easier for fraudsters to hack into.

Thankfully, companies like Outseer are using artificial intelligence and machine learning to stop fraud from these nefarious actors in their tracks. Jim and Armen share how their engine uses hundreds of data points to verify the identity of consumers and the legitimacy of their transactions, as well as to identify criminal patterns. It takes sophisticated AI and machine learning to work behind the scenes of every transaction to ensure security.

Brand Impersonation and Phishing

Fraudsters are finding new ways to get around advanced security for online payments. One of the most prolific methods right now is brand impersonation, which puts both consumers and brands at high risk. These are often phishing attacks where cybercriminals attempt to look like legitimate brands by contacting consumers, posing as brands using their logos/graphics and similar-looking URLs, and getting consumers to enter their credentials or personal information. Nowadays, phishing attacks can even happen by gaining remote access to consumer devices while consumers unknowingly provide hackers with their information.

Consumers are at risk of their personal data or identity being stolen, while brands risk gaining a negative reputation. Thankfully, these brand impersonations and phishing attacks are becoming more detectable with the multipronged security approach from companies like Outseer.

Jim Ducharme, COO at Outseer

Jim Ducharme buy now pay later online shopping phishing

Jim Ducharme is the Chief Operating Officer at Outseer. His career in technology began 30 years ago at Natural Intelligence after studying computer science at the University of New Hampshire. Before becoming COO of Outseer in 2021, Jim was the VP of Identity and Fraud & Risk Intelligence Products and later General Manager of the Anti-Fraud Business Unit at RSA Security, the parent company to Outseer.

Armen Najarian, Industry Advisor, Digital Fraud & Identity

Armen Najarian buy now pay later online shopping phishing

Armen Najarian has over 15 years in the B2B and technology marketing space and has worked with globally-renowned companies including IBM. He studied accounting at the University of Massachusetts at Lowell and received an MBA from the University of Southern California’s Marshall School of Business.

Share on social:

Facebook
Twitter
LinkedIn
Reddit
Email

[00:00:38] Camille Morhardt: Welcome to What That Means, I’m Camille Morhardt.  And thanks for joining me for part 2 of our discussion on Non-Fungible Tokens – better known as NFTs.  If you missed Part 1, I suggest you go back and listen or watch that episode first so you can get a good grounding in what NFTs are.  As in Part 1, my guest is Mic Bowman, a Senior Principal Engineer at Intel Labs who runs the Trustworthiness Distributed Systems lab. For part two of our conversation, the talk turns to potential uses of NFTs beyond artwork, video clips or collectibles.

[00:01:18] Mic Bowman: Let’s speculate outside of media. Let’s say that what I want to do is create a trained machine learning model. I’ve got a classifier, right? And it does some really cool things, and I’m going to create an NFT for that. You buy the classifier and now you can use that classifier in your application. And if I do it right, maybe I can allow you to use the classifier, but you don’t have the right to see the model that’s inside the inferencing engine.

But you have some additional data and you take the original model that I gave you and you add your data and you retrain that model. So it’s a better classifier, right? And then you turn around and sell it, your new model. We could create a marketplace for those kinds of things, where even though you’ve created this new model, I get a portion of the sales when you sell yours, because I contributed to yours.

Those new ideas for what constitutes ownership and monetization and what is an economy is in this space. That’s the power of the NFT, that transactions can get a whole lot more interesting than me giving you $3 for a cup of coffee. There’s a lot more that can be about inside those transactions.

So, back to the technology. NFTs are really boring, it’s an identifier and an owner that goes along with it. But the interesting part is that we can expand that transfer operation to do a lot more interesting stuff, that it really is a smart contract. And that means that we can code entirely new behaviors in ownership transfer. It also means that we can define new ways for determining what ownership pose. 

[00:03:11] Camille Morhardt: Okay. Say more about that. How was ownership changing? 

[00:03:16] Mic Bowman: So let’s go back to an image, right? When you purchase an image, I’ve got a painting on my wall that I have, what am I allowed to do with that? Well, I can actually turn around and resell the physical art that way, but I have not purchased the copyright to that image for it, but with an NFT it might be possible to encode in that the right for me to purchase, not just the art, but to purchase the copyright that goes along with the art. There was one company that was talking about taking all of their patents, creating NFTs for the patents. And ownership of the NFT would convey certain rights to use the intellectual property that was part of the patent that way. So there becomes a very concrete license for what you can do with this idea that’s been patented. We can code up in these smart contracts simple licenses, complex licenses, or in some cases, no licenses at all for it. We can encode sort of downstream transactional value and derive the value of derived products from it, all of this can be encoded in the smart contract that goes along with the NFT. 

[00:04:39] Camille Morhardt: And part of the benefit of the smart contract is it self polices in a sense. How are you ever going to get something back if it’s stolen or you misused. It’s like good luck, but you’re saying you’re going to code it in so it may… 

[00:04:55] Mic Bowman: It doesn’t right. I mean, ownership, the NFT does, but recall what we said is that the asset is the separate thing out here, the picture. I may try to resell the picture, even though the NFT doesn’t necessarily give me the rights to do that. And honestly that distinction between the two and sort of these open markets, maybe the biggest barrier in extending NFTs out into new assets.

We do it right now. I mean, these things work really well with media right now because there’s some standard. External recourse through copyright law, that sort of sets what you can and can’t do with things. There’s some fairly standard creative commons licenses that define some basic sets of rights for access to simple media.

But as we extend these things out and start representing complex things like patents, for example, or there were a couple of bizarre things that have shown up recently, there was a woman who was selling eggs for an in-vitro fertilization through an NFT, which has got to be the most bizarre thing I’ve seen in the space so far. We don’t know what rights ownership of the NFTs actually conveys. That one to me feels like there’s a set up for some really complicated legal discussions about what constitutes ownership and the rights to define that. 

[00:06:25] Camille Morhardt: Wouldn’t it just kind of follow like stock market and rights to portions of securities. 

[00:06:33] Mic Bowman: those are well-defined by the government has really well-defined those and what the ownership parts of it are, but people are throwing stuff out and random ways about what they’re trying to get access to, and they’re doing it without any sort of standard legal vernacular to apply to those transactions in those relationships. 

[00:06:56] Camille Morhardt: To venture out on the like extreme speculative side of things here. We have all kinds of data that’s been collected through internet of things. And obviously some of that data or much of the data has privacy concerns, but let’s talk about data that’s just valuable information for people like sensor data of anything, whether nutrients in the soil, anything like that. Nobody has really a mechanism to release because they’re not going to gain anything from it. I know we’re way out in the future and we’re speculating, but can you let us know about how NFT might change something like that? 

[00:07:38] Mic Bowman: So again, we were talking about some of the kind of excitement what NFT facilitates that way. And to me, in some sense, this is the most exciting and most speculative kind of aspect and usage for NFT is can we really start to monetize the data?

As you pointed out, we have sensors collecting information in so many different ways. But the cost of getting that data to an open market of individuals who might find it valuable is just prohibitive right now. And so if we can find a way of connecting data providers or data creators to those who want to consume the data again, through some kind of an open market; that begins to justify the collection and publication of things we would not have done before. On the social good side of things, it opens us up to the potential for doing much more interesting queries over sort of large collections of information. Things like if a vineyard decides that they’re going to export the information about the soil type and climate information and how they manage the grapes and what the yield was that was collected as a result of their management type. That information suddenly becomes useful to somebody else who is trying to potentially start a new field. Can I find others that have done similar things, so I can configure mine in a way that will optimize the yield and the quality of the grapes that I’m getting. In individual vineyard the value of that data is disproportionately small to the cost of making it available. But if we can now start to create these NFTs around it, if there’s a way for us to tokenize that data, now we can create this marketplace and potentially make consumers of the data connected to the providers of the data in a way that justifies collection of and publication of that data. And that would be really exciting. 

[00:09:53] Camille Morhardt:  It’s interesting because it’s making me think about people who put up a YouTube of something that they’re doing. And if somebody else finds it valuable or many, many people find it valuable eventually whoever posted the video that who received nothing from it at the time becomes monetized and now, or they have a following and then somehow they get to monetize and make money contingent on the number of people who like it and they’re not in charge of the content. You’re not pairing people together, you are now getting advertisers involved or platforms involved.

I think what you’re talking about is a bit of a paradigm shift might be a little strong, but you’re talking about this decentralized way of connecting the content producer with the current consumer. 

[00:10:43] Mic Bowman:Yeah, exactly. And I love the YouTube analogy, right? Because what YouTube did by making it easy to publish videos is that it makes everyone who’s got some expertise an opportunity to monetize that expertise either through advertisements or subscriptions or whatever. When we collect data right now, there’s no easy way for us to get the value back for the data that we’re collecting. If there was some opportunity to make it as easy to collect the value on the data, as it is to get value for our expertise through YouTube, then maybe we would see a lot more people collecting more information and sharing it, which means that we will get a better understanding of what’s happening.

[00:11:25] Camille Morhardt: You have to also agree that this could be frightening. 

[00:11:29] Mic Bowman: It’s terrifying, actually. The biggest barrier for me on the technical side is how do we make it possible to do this monetization of data and preserve the appropriate use of that data? And there are some technologies that we could bring to bear on it, but it’s very much an open question. This is why we do research and forward-thinking and development in this space. 

[00:11:58] Camille Morhardt: Pay attention to the ethics side and the privacy side.  

[00:12:01] Mic Bowman: Absolutely you have to. 

[00:12:04] Camille Morhardt: I want to ask two questions on the security side. One is how do you protect your NFT? And the other one is more interesting to me; are NFTs going to allow us to protect things differently than we’ve been able to in the digital word.

[00:12:21] Mic Bowman: Protection is an interesting word. The NFTs themselves, to a certain degree, don’t need to be protected. They are a very standard representation, they’re well-defined with the smart contract platforms that we have and to a certain degree, every one of these new marketplaces that builds their own blockchain around it is defining a certain set of rules for it, they’re all trying to be relatively public about what transactions and exchanges mean? So the NFT part of it is not that interesting to me. It’s how do you protect the asset that goes along with it? So let’s go back to that classifier. I give you a model that has been trained by some machine learning algorithm. That model may have confidential information and what I give you is the right to use this model to do interesting inferencing and potentially to derive new models. It doesn’t mean that I’ve given you the right to see all the data that went into training, the model that I gave you. So how do I protect that? How do I prevent you from taking this interesting asset, copying it out and then selling it independently without giving me my cut of the derived goods? 

[00:13:37] Camille Morhardt: I’m also saying you may have personal information or private privacy concerns. 

[00:13:43] Mic Bowman: Exactly, or things that have been derived from that.  And right now the answer is we just don’t do it if there’s going to be private information in there, which is a very safe thing to do that’s appropriate.

But if we have technologies that allow us to protect the confidentiality of it and whether that’s zero-knowledge proofs or homomorphic encryption or trust that execution environments or whatever. Are there ways that we can protect the intellectual property and those assets to create digital scarcity and to protect the assets more rigidly than we currently have, more formally than what we have with existing kind of media parts of it. If we can do it, that opens up some doors for some really interesting new applications for NFTs that we can create new markets for data, not just for media.

[00:14:37] Camille Morhardt:  I have heard of scenarios where it’s at least being explored that NFTs are helping verify the authenticity of a physical object. I heard Nike does it for sneakers to verify that there are certain kinds of sneakers.

[00:14:58] Mic Bowman: Let’s be a little careful to differentiate between the NFTs which are the kind of tradable representation and having a serial number registered in a blockchain or in a database someplace. I think we’ve talked about this last time that there were a couple of times to do diamond registries where you could actually add some identifier and the diamond and then you could track its progress. There are already systems to be able to do that, you don’t need an NFT in order to track the uniqueness of shoes. What you need is a way of creating a unique identifier in the shoe, and then registering that identifier someplace else. 

[00:15:42] Camille Morhardt: But that could create the need for digital items or digital assets to self-generate IDs that are non vulnerable, non hackable, 

[00:15:55] Mic Bowman: Do we have the ability to generate unique identifiers? Yes. Do we have an ability to generate unique identifiers that are unforgeable for physical goods? It’s not all that easy, but it can be done. Do we need NFTs in order to make those unique identifiers? Yes, it might be a nice way to do it, especially for thinking about moving into these secondary markets. But if you buy a pair of Nike shoes and I buy those Nike shoes from you and somebody else wants to buy them from me and verify that they are a unique real Nike product unless when I bought them from you, we did an NFT transaction that transferred ownership then what’s the point? 

There’s a lot of this stuff about, we know how to trade NFTs. But we don’t necessarily know how to update the NFT as we trade the physical goods. There’s a new space of digital twinning where you’re binding a physical object to a digital representation of that. And the synchronization of those two in a continuous synchronization of those two, if you build it that way can be done. But for a lot of these physical goods, if you’re not building it that way, it’s going to be really hard to maintain those relationships. 

[00:17:25] Camille Morhardt: Well, okay, that’s one of the hottest topics in NFTs right now. Are there any other kind of barriers or major things that people are arguing about? 

[00:17:38] Mic Bowman: We just talked about interoperability as being one of them, partial ownership is another thing. And you can kind of understand that again from an investor’s viewpoint, rather than an owner.

What does partial ownership of an image mean from a practical terms? Does it mean I own a slice of pixels out of that image? What can I do with that slice of pixels? I don’t know. Right? I mean, there’s that part of it. But if I’m treating the NFT as a security in which I am purchasing it for an investment for resale, then partial ownership is a very interesting concept. Especially when these NFTs are going for a hundred thousand dollars, and being able to get into the NFT marketplace becomes so expensive. So in those situations, how a collective goes together to purchase the NFT, that becomes important as the values are going up.

[00:18:32] Camille Morhardt: A most basic question is which is why create scarcity when it’s not needed? Why create digital scarcity? Anything digital can be reproduced essentially for free. Forever. So why create the scarcity? 

[00:18:55] Mic Bowman: Can we make digital assets that can’t be copied arbitrarily? That is an interesting question here that that supports the scarcity, but why scarcity is valuable because it makes them collectible it’s back to that Onus Wagner card. What makes that card valuable is that there were only a very, very small number of them originally produced. And Onus Wagner happens to be a really good, popular baseball player.

And my understanding is that the card came out before he became a popular baseball player. And there were certain mistakes made in the card run. Whatever it is, there are very, very few of this particular card, as opposed to some mass-produced card. Even though it’s 110 years old, a mass produced card because they’re available the marketplace doesn’t support high value.

[00:19:53] Camille Morhardt: It’s just the human nature of valuing what’s scarce, we’re going to create that in the digital world so that we can essentially replicate the system of trading money value as we know it, but in the digital space as well. 

[00:20:10] Mic Bowman: And there’s all the sociology and psychology that goes behind possessing something unique. The whole point is that we can own something that nobody else does or that very, very few other people do. What is the cost or what is the value to you of owning that thing? In some cases it’s like owning a Monet, what’s the value of owning the original Monet?

It’s a painting, right? And I can get digital prints that are very, very good copies of that Monet. But owning the digital print is not owning the Monet. The digital print may look just as good on my wall, but it’s not a Monet. It’s not the original Monet. The print on my wall is worth $25 bucks. The Monet, the painting Waterfront just sold at Christie’s for what, $60 million or some ridiculously high number. It’s worth that much to somebody. Is it worth it because they are a collector. Is it worth it because they value seeing the paintbrush strokes on the Monet? I don’t know. Those are good questions and probably all of them are a little bit true. 

[00:21:20] Camille Morhardt: All right. Thank you, Mic. Good conversation. I appreciate it. I feel smarter and also have 25 more questions than I came in with. 

[00:21:31] Mic Bowman: It is a very exciting space.  I’m really excited to see what happens over the next few years as we start to realize more value. 

[00:21:39] Camille Morhardt: Thanks again for your time. 

[00:21:40] Mic Bowman: Thanks Camille.

[00:21:42] Camille Morhardt: Thanks again for joining me for our two-part look at NFTs.  Again, if you missed part 1, I suggest you check it out because Mic gives a good explanation of what NFTs are and we explore the nuances of what people are actually buying when they purchase an NFT and what they can and can’t do with it.  Thanks for listening.

 

Stay tuned for the next episode of Cyber Security Inside. Follow @TomMGarrison and Camille @Morhardt on Twitter to continue the conversation. Thanks for listening. 

The views and opinions expressed are those of the guests and author, and do not necessarily reflect the official policy or position of Intel corporation.

More From
Moty Kanias cybersecurity zero trust insider threat

Will Modern Tech Last? Cybersecurity of the Future (145)

What That Means with Camille: Digital Health and Personalized Medicine (144)

Haseeb Awan SIM swaps

SIM Swaps: How Your Phone Number Is Key to Your Personal Data (143)