Name: Account takeovers: How do you approach this challenge?
Uploaded: 2023-06-12T12:28:53.779Z
Duration: 443.48
Description: *This content is sponsored by Fingerprint.* Alex Melton, Head of Developer Experience, Fingerprint, shares his personal experience as a victim of an account takeover and explores the tech that can help prevent other cases. Stay up to date with the community on https://finovate.com/ Find out more about FinovateSpring on http://www.finovatespring.com/

FSPR.INT.011.mp4

Fingerprint

Alex Melton.vtt

English

{{00:00:05}}
Greg Palmer: Hey, Greg Palmer here
at FinovateSpring 2023, where I'm

{{00:00:08}}
talking to Alex Melton, technical
product manager of Fingerprint.

{{00:00:12}}
Alex, thanks for taking the
time to chat with me here.

{{00:00:14}}
Yeah, thanks so much, Greg.

{{00:00:15}}
So as I understand it, you yourself
were the victim of an account takeover.

{{00:00:19}}
Can you just tell us a little
bit about that experience?

{{00:00:21}}
Alex Melton: Sure.

{{00:00:22}}
Just about a year ago to the
day before I joined, fingerprint

{{00:00:26}}
my hotel account was hacked.

{{00:00:27}}
Someone made a reservation in
my name for a place that I'd

{{00:00:31}}
never been to, no plans to go to.

{{00:00:33}}
I found out the next day via the
confirmation email, and I had

{{00:00:37}}
to go into action because they
had my credit card information.

{{00:00:39}}
They made this booking.

{{00:00:40}}
Unfortunately when you call
the hotel provider, they don't

{{00:00:44}}
know how to help you with that.

{{00:00:46}}
So they directed me actually to
the local hotel itself who directed

{{00:00:49}}
me back to the hotel provider.

{{00:00:50}}
They told me to call
my credit card company.

{{00:00:52}}
And it actually took four weeks to
resolve hours and hours on the phone.

{{00:00:57}}
And I'm someone who knows the space.

{{00:00:58}}
I work in tech.

{{00:00:59}}
I, know what an account takeover
is and it took someone like me that

{{00:01:02}}
much to actually get it resolved.

{{00:01:04}}
So I can only imagine someone who
doesn't know how to resolve it

{{00:01:07}}
the, struggles they would face.

{{00:01:08}}
Greg Palmer: Oh, absolutely.

{{00:01:09}}
Was it at least someplace cool that
you were supposed to have been going?

{{00:01:12}}
Alex Melton: It's a place I
would've never traveled to really.

{{00:01:14}}
Okay.

{{00:01:15}}
So no offense to that.

{{00:01:15}}
I won't name the place.

{{00:01:16}}
Sure.

{{00:01:16}}
Okay.

{{00:01:16}}
Fair enough.

{{00:01:17}}
But I would not be going there.

{{00:01:18}}
Greg Palmer: So talk to me about
Fingerprint and how Fingerprint would've

{{00:01:21}}
approached that problem and helped make
it a little bit easier for yourself.

{{00:01:24}}
Alex Melton: So a huge part of
anything with account takeover and

{{00:01:28}}
authentication around the user of
the device Fingerprint provides

{{00:01:31}}
this supercharged device id, right?

{{00:01:33}}
Something that is far beyond what you get
out of the box from a lot of other people.

{{00:01:37}}
It uses a ton of signals and a.

{{00:01:39}}
Proprietary formula to come up with
a user ID that's 99.5% accurate.

{{00:01:44}}
But more importantly, that accuracy
gives you stability over time.

{{00:01:47}}
So not only do we know the device today,
but we'll know it months from now and

{{00:01:52}}
even years from now, and that can create
a really powerful user experience.

{{00:01:56}}
Where however you
implement your device ad.

{{00:01:59}}
And the real power behind our
technology stack is that it

{{00:02:02}}
works how you want it to do it.

{{00:02:03}}
We're not forcing a solution on
you exactly what to do with it,

{{00:02:07}}
but we provide really good guidance
in, of course, history of how

{{00:02:10}}
we've helped other companies for
you to implement that device Id.

{{00:02:14}}
Greg Palmer: Interesting.

{{00:02:14}}
So obviously one of the challenges
with this kind of technology is having

{{00:02:17}}
it work in this sort of situation
and then also porting it over into

{{00:02:21}}
kind of a real world situation.

{{00:02:22}}
Can you talk a little bit about
what this looks like in practice?

{{00:02:25}}
Alex Melton: Sure.

{{00:02:26}}
For the user it's seamless.

{{00:02:28}}
Which for me as a product manager,
giving us something to the users that

{{00:02:31}}
is truly seamless, is super valuable.

{{00:02:33}}
So depending on the, approach for the
company we integrate via 20 SDKs or any of

{{00:02:40}}
their cloud service providers, CloudFlare,
aws, all those types of things, you

{{00:02:44}}
get the device ID into your system.

{{00:02:46}}
From there, you can implement
it into your authentication

{{00:02:49}}
engine and you can act on it.

{{00:02:51}}
So a very simple example would be
if it's a trusted device that you've

{{00:02:53}}
recognized that user can go right in
seamless experience for them, and they're

{{00:02:57}}
getting that month and month again,
because it's so stable of an id you

{{00:03:02}}
can then action on it in other ways.

{{00:03:04}}
Maybe you want to send that new device to
your two-factor authentication, or if it's

{{00:03:07}}
a DI device that's already been flagged
by your system, you can just block them

{{00:03:11}}
right there and that stability remains.

{{00:03:13}}
So if you block someone once
today, you can be confident that

{{00:03:16}}
you'll block 'em again and again.

{{00:03:17}}
From trying to brute force their
way through an account takeover.

{{00:03:21}}
Greg Palmer: Gotcha.

{{00:03:22}}
Really interesting.

{{00:03:22}}
So talk to me about some of
the other places you could

{{00:03:24}}
potentially point this technology.

{{00:03:26}}
What are some of the other use cases?

{{00:03:27}}
Alex Melton: Yeah, I think
relevant to the, FinTech crowd

{{00:03:30}}
is gonna be on payment fraud.

{{00:03:31}}
So think about instead of the login
page, think about cart and checkout

{{00:03:36}}
and what you're trying to do there.

{{00:03:39}}
Same thing with the device id.

{{00:03:40}}
You can have a trusted device.

{{00:03:42}}
I think a really popular use case is
if a device has been connected with

{{00:03:46}}
a lot of chargebacks, you can  stop
that device from going through the

{{00:03:49}}
transaction in real time and save your
bottom line from those chargebacks at

{{00:03:55}}
the same time with the trusted device.

{{00:03:57}}
If you have a user who comes again and
again, they're not gonna face any friction

{{00:04:01}}
in the checkout experience, which you
know anything about e-commerce, the

{{00:04:04}}
smallest microsecond of friction can
actually cause a decrease to conversion.

{{00:04:09}}
So you're really benefiting the good
users by giving them that experience.

{{00:04:12}}
But stopping the bad users
by introducing this into your

{{00:04:16}}
fraud engine during checkout.

{{00:04:17}}
There are other use cases too,
not relevant to FinTech user

{{00:04:20}}
personalization, marketing attribution
too, which are also very exciting.

{{00:04:24}}
But I think account takeover and payment
fraud are, two things that are top

{{00:04:27}}
of mind in this industry right now.

{{00:04:29}}
Greg Palmer: Yeah, absolutely.

{{00:04:29}}
So one question that I have is
just obviously authenticating the

{{00:04:32}}
device, people are on the road
more than they ever have been.

{{00:04:35}}
People are traveling more.

{{00:04:36}}
How are you able to follow along
with the device as opposed to here

{{00:04:41}}
in San Francisco versus New York or
wherever else in Europe you might

{{00:04:44}}
happen to go, this must be a challenge.

{{00:04:46}}
Alex Melton: Sure.

{{00:04:47}}
We have a ton of signals
and those all go into our.

{{00:04:50}}
Our very advanced model to
account for those, right?

{{00:04:53}}
So you could go on fingerprint.com
and you could see a demo and nope.

{{00:04:58}}
A lot of people travel for conferences.

{{00:04:59}}
Do it at home and then come here when
you do it, and you'll see your visitor

{{00:05:02}}
Id persist because it's not just
relying on geolocation, it's revi.

{{00:05:06}}
Reviving on things about your device
that is a desktop, laptop your phone.

{{00:05:11}}
It's relying on things about your browser.

{{00:05:13}}
And this all goes into create
a really powerful device id.

{{00:05:16}}
So even if one data point falls
off or changes, it doesn't matter.

{{00:05:19}}
It  remains resilient.

{{00:05:21}}
Greg Palmer: Excellent.

{{00:05:22}}
So obviously this is a
potential area where people

{{00:05:24}}
are paying a lot of attention.

{{00:05:26}}
There's no shortage of people
who are focusing on this.

{{00:05:28}}
What really makes Fingerprint special?

{{00:05:29}}
Compared to some of the other solutions
in a similar space that are out there.

{{00:05:33}}
Alex Melton: Yeah, so we
talked about the device id.

{{00:05:35}}
It's the most powerful one out there.

{{00:05:36}}
99.5% accurate stable
for months and years.

{{00:05:40}}
Really no one compares on that front to
me as a product manager, what's super

{{00:05:44}}
valuable is how easy it is to integrate.

{{00:05:47}}
So this space is actually not
where I started my product career.

{{00:05:51}}
I was in e-commerce and many times
companies would come, were trying to

{{00:05:54}}
decide, buy or build, and they'd say,
don't worry, everything's so easy

{{00:05:57}}
to integrate, and then it wasn't.

{{00:05:59}}
Yeah.

{{00:05:59}}
Fingerprint is designed with
developers and business in

{{00:06:02}}
mind to match where you are.

{{00:06:04}}
Like I said, 20.

{{00:06:06}}
Plus SDKs, all the major cloud
providers that we integrate directly in.

{{00:06:10}}
Actually, right after I joined
Fingerprint, I went through

{{00:06:12}}
the process and added it to a
side project web, app of mine.

{{00:06:16}}
It was ready to go in five minutes Wow.

{{00:06:18}}
To get that first API call and
that device ID hitting my system.

{{00:06:22}}
That's a huge feature I think compared to
others, is how easy it is to integrate.

{{00:06:26}}
And then on top of that as everyone knows
in this industry, The global regulatory

{{00:06:31}}
environment is harder than ever before.

{{00:06:32}}
Out of the box gdpr, C P A,
we have SOC two and 2,701.

{{00:06:38}}
You don't have to worry
about those things.

{{00:06:39}}
So even as the landscape changes around
privacy, regulations, cookies, all these

{{00:06:43}}
things that are in the news constantly.

{{00:06:46}}
We're above all that.

{{00:06:46}}
You don't have to worry about it.

{{00:06:47}}
So you can in, you can install Fingerprint
today and we are ahead of the curve on all

{{00:06:52}}
the regulatory challenges, so you don't
have to do anything in the near future.

{{00:06:56}}
We're, ready for, those challenges today.

{{00:06:58}}
Greg Palmer: Excellent.

{{00:06:59}}
I love the combination of kind of the
e-commerce background, understanding

{{00:07:01}}
how quickly customers need and want
things to happen, blended with.

{{00:07:05}}
The kind of compliant
regulatory side of things.

{{00:07:08}}
Not difficult to imagine this being
a pretty attractive solution to

{{00:07:11}}
a lot of the folks in this space.

{{00:07:13}}
Again, I'm Greg Palmer.

{{00:07:14}}
I've been talking with Alex Melton.

{{00:07:15}}
Alex, thanks so much for taking the time.

{{00:07:17}}
Really appreciate it.

Greg Palmer: Hey, Greg Palmer here
at FinovateSpring 2023, where I'm

talking to Alex Melton, technical
product manager of Fingerprint.

Alex, thanks for taking the
time to chat with me here.

So as I understand it, you yourself
were the victim of an account takeover.

Can you just tell us a little
bit about that experience?

Just about a year ago to the
day before I joined, fingerprint

Someone made a reservation in
my name for a place that I'd

I found out the next day via the
confirmation email, and I had

to go into action because they
had my credit card information.

Unfortunately when you call
the hotel provider, they don't

So they directed me actually to
the local hotel itself who directed

They told me to call
my credit card company.

And it actually took four weeks to
resolve hours and hours on the phone.

I, know what an account takeover
is and it took someone like me that

So I can only imagine someone who
doesn't know how to resolve it

Was it at least someplace cool that
you were supposed to have been going?

Alex Melton: It's a place I
would've never traveled to really.

Greg Palmer: So talk to me about
Fingerprint and how Fingerprint would've

approached that problem and helped make
it a little bit easier for yourself.

Alex Melton: So a huge part of
anything with account takeover and

authentication around the user of
the device Fingerprint provides

Something that is far beyond what you get
out of the box from a lot of other people.

Proprietary formula to come up with
a user ID that's 99.5% accurate.

But more importantly, that accuracy
gives you stability over time.

So not only do we know the device today,
but we'll know it months from now and

even years from now, and that can create
a really powerful user experience.

Where however you
implement your device ad.

And the real power behind our
technology stack is that it

We're not forcing a solution on
you exactly what to do with it,

but we provide really good guidance
in, of course, history of how

we've helped other companies for
you to implement that device Id.

So obviously one of the challenges
with this kind of technology is having

it work in this sort of situation
and then also porting it over into

Can you talk a little bit about
what this looks like in practice?

Which for me as a product manager,
giving us something to the users that

So depending on the, approach for the
company we integrate via 20 SDKs or any of

their cloud service providers, CloudFlare,
aws, all those types of things, you

From there, you can implement
it into your authentication

So a very simple example would be
if it's a trusted device that you've

recognized that user can go right in
seamless experience for them, and they're

getting that month and month again,
because it's so stable of an id you

Maybe you want to send that new device to
your two-factor authentication, or if it's

a DI device that's already been flagged
by your system, you can just block them

So if you block someone once
today, you can be confident that

From trying to brute force their
way through an account takeover.

So talk to me about some of
the other places you could

Alex Melton: Yeah, I think
relevant to the, FinTech crowd

So think about instead of the login
page, think about cart and checkout

I think a really popular use case is
if a device has been connected with

a lot of chargebacks, you can  stop
that device from going through the

transaction in real time and save your
bottom line from those chargebacks at

If you have a user who comes again and
again, they're not gonna face any friction

in the checkout experience, which you
know anything about e-commerce, the

smallest microsecond of friction can
actually cause a decrease to conversion.

So you're really benefiting the good
users by giving them that experience.

But stopping the bad users
by introducing this into your

There are other use cases too,
not relevant to FinTech user

personalization, marketing attribution
too, which are also very exciting.

FinovateSpring

Case Study

*This content is sponsored by Fingerprint.*

Alex Melton, Head of Developer Experience, Fingerprint, shares his personal experience as a victim of an account takeover and explores the tech that can help prevent other cases. 

Stay up to date with the community on https://finovate.com/ 

Find out more about FinovateSpring on http://www.finovatespring.com/ 