Become a Creator today!Start creating today - Share your story with the world!
Start for free
00:00:00
00:00:01
Scam Prevention in 2026: Moving from Recommendations to Urgent Execution, A Conversation with Ken Palla, Former Cybersecurity Executive at MUFG Union Bank
0 Plays2 seconds ago
In the final Scam Rangers episode of 2025, Ayelet Biger-Levin is joined by industry veteran Ken Palla for a deep year-in-review of the global scam prevention landscape.
This conversation examines what actually happened in 2025 across regulation, enforcement, and industry action, and why 2026 must move decisively from research and recommendations to urgent execution.
From mandatory reimbursement in the UK, to Australia’s Scam Prevention Framework, emerging collaboration in Canada, and fragmented efforts in the United States, the episode cuts through policy language to focus on real-world impact.
The discussion also outlines concrete actions financial institutions, telcos, and digital platforms can take now to better protect consumers, reduce losses, and treat scams as the organized crime and national security threat they are.
This episode closes the year with a clear message. The research is done. The problem is understood. Now the industry must act.
Topics Covered
- What 2025 revealed about the effectiveness of global scam regulation
- Where reimbursement models succeed and where they fall short
- Australia, the UK, Canada, and the US, lessons from different approaches
- Why execution, not new task forces or studies, is the real gap
- Urgent actions banks can take to prevent scams before money moves
- The role of telcos and digital platforms in stopping scams upstream
- Government, law enforcement, and the need for coordinated leadership
- Why 2026 must be treated as a year of action
Guest :Ken Palla
Former cybersecurity executive at MUFG Union Bank, longtime industry advisor, and recipient of the Legends of Fraud Award. Ken has spent decades focused on online security, fraud prevention, and consumer protection, and is a leading voice on scam regulation and industry accountability. You can find Ken on LinkedIn: https://www.linkedin.com/in/ken-palla-09b585/
Australian Scam Prevention Framework – Analysis of the November 2025 Treasury Consultancy https://www.gasa.org/post/assessment-of-the-november-2025-australian-treasury-scam-prevention-framework-consultancy
🎧 About Scam Rangers
Scam Rangers is a podcast exploring the human, technical, and policy sides of scams. Hosted by Ayelet Biger-Levin, Founder and CEO of RangersAI, the podcast brings together experts, practitioners, and advocates working to stop scams before the money moves. For more information go to www.rangersai.com
Ayelet on LinkedIn: https://www.linkedin.com/in/ayelet-biger-levin/
🔔 Closing Note
As we move into 2026, one thing is clear.
Scam prevention cannot wait for perfect policy.
It requires urgent execution across industry and government.
Recommended
Transcript
Introduction to Scam Prevention and Key Stakeholders
00:00:02
Speaker
I think the banks, telcos and digital platforms, the private sector know what needs to be done and they need to stand up and more publicly say, we're in this fight. And individually in each sector, there's more each of those sectors can do.
00:00:15
Speaker
The telcos like I recommended that they you know have the market international call. So if I ever get a call on on my phone, tell me
Sector-Specific Responsibilities in Combating Scams
00:00:23
Speaker
it's international. That's a simple thing, but doing more to try and to stop the scams. So each of those sectors needs to jump up and be more aggressive and, you know, take a stance on this publicly and publicly pull their entities within the sector together to fight this. And you don't need to wait for the national government to do that. now Once you do what I just talked about, the idea of sharing data and signals is another important part of it. But I think it's secondary to each of those sectors stepping up to just acknowledging this is a serious thing. And it's it's a war. It's a fight.
00:00:57
Speaker
Before we get started, I want to take a moment to say thank you. As we close out the year on Scam Rangers, I'm deeply grateful to everyone who's been part of this journey. Our listeners, our guests, and the community working every day to protect people from scams.
Year-in-Review: Scam Prevention Highlights with Ken Pala
00:01:12
Speaker
This podcast exists because scams aren't just a fraud problem.
00:01:16
Speaker
They're a human one. And this year, we've had powerful conversations with people across research, policy, advocacy, and industry who are committed to doing better.
00:01:26
Speaker
To our listeners, thank you for tuning in, sharing episodes and reaching out with your stories. And to every guest who's joined us this year, thank you for your honesty, expertise and leadership.
00:01:37
Speaker
These conversations matter more than ever. Today's episode is a fitting way to close the year. I'm joined by Ken Pala for a year in review discussion on what's changed, what still needs work and where real progress can happen.
00:01:50
Speaker
And on a personal note, as a founder, these conversations fuel me. They remind me why this work matters and why we have to keep pushing forward together. So let's dive in.
00:02:04
Speaker
Welcome to Scam Rangers, a podcast about the human side of fraud and the people who are on a mission to protect us. I'm your host, Ayelet Bigger Levine, and I'm passionate about driving awareness and solving this problem.
00:02:23
Speaker
So today's Scam Ranger is no stranger to the podcast. I'm so glad to have the opportunity to have a chat with Ken Pala again for our year in review. So if you're hiding under a rock, then you might not know Ken Pala. So I'll just give you an overview of who our guest is very quickly, but you probably so have seen his opinions and thoughts as he publishes on LinkedIn or with other collaborations in the industry he's been doing over the past few years. So since 2005, Ken Pala has been in online security. He was a director at MUFG Union Bank, retired in early 2019. And at the bank, he managed the online security for both commercial and retail customers. And Ken has also been very involved in the industry as an advisor for the eFraud Global Forum as part of RSA. And he has also received ah Legends of Fraud Award from FraudCon and published many white papers ah over the last few years. And i think one of the things that you've been doing, Ken, most recently is really following the regulatory landscape evolving around the scam landscape, and what different countries are doing, but also how can we turn that into recommendations for financial institutions? And what are those regulators missing when it comes to different players in the market, financial institutions, telco, social media companies? So I really love how you're focusing on these topics and, you know, you keep publishing new thoughts and new ideas and really how these things evolve.
Regulatory Landscape and Its Impact on Financial Institutions
00:03:59
Speaker
So I'm excited to cover all of that with you today. Welcome to the podcast. Ayala, thank you very much. It's always a lot of fun coming back here and talking with you. So it was great to have seen you at Gaza and good to be talking with you today.
00:04:10
Speaker
So, yeah, we had a few Ken's at the Global Anti-Scans Summit, even two of them in one session. So as part of the session where we covered urgent controls to be implemented by different stakeholders to to create big impact.
00:04:23
Speaker
you covered recommendations for financial institutions and telcos. So we'll definitely touch that at the end of our conversation today. But last time we met, we talked about what is happening in and Australia, the UK, US s and Canada. and really interesting is that I think last time we talked, Australia had either was about to or just approved the regulation that touched um scams. But one of the points of criticism was There's not no meat to it. So they still had to explain what this means and who needs to do what. and nothing happened for months. And then suddenly in November, there was some change. So we'll cover that today. We'll talk about UK. What are the findings and learnings from the mandate from 2000 that actually went into effect in October 2023? There was some reporting. And then what's happening in Canada? There's some regulation unfolding in Quebec and not a lot of regulation here in the US, but there is definitely a lot of activity. So shall we dive into it? let's go yeah i think i'd like to start with the u k because that sets a framework for the rest of it
00:05:27
Speaker
so just as a refresher in the uk for scams what they basically say is there has to be mandatory reimbursement effective october twenty twenty four and that's up to eighty five thousand pounds and it's basically for a list of scams that are covered by the regulation. So a lot of it has to do with faster payments.
00:05:45
Speaker
And so this is key, but also in the UK, there's a strong requirement for controls. So it's a combination of reimbursement and controls. There's no linkage between the two. You have to reimburse if you're a bank. for an authorized push payment scam. Doesn't matter if the controls are working or not. And that's a difference when we talk to Australia. And so this has been effective. um According to the regulator reports this year, 88% the scams have been reimbursed by banks. ah That's really good.
00:06:16
Speaker
But what's important to note is that maybe 30% of the scams are out of scope. So I'm estimating that maybe 60 to 65% of scams are being reimbursed in the UK, unlike this high 88% number that's in scope reimbursement. So fraudsters are figuring out additional ways to create these scams, and therefore more are not being covered.
00:06:39
Speaker
Yeah, and I think that the fraudsters obviously don't care what's in scope or out of scope, but they do probably want to circumvent any bank controls that were implemented to cover those scams in scope. So they're innovating out of scope a little bit, too.
00:06:52
Speaker
And so if you focus on the out of scope, there may be less controls. And that you're right. That's probably part of what they're thinking. So that's kind of one thing. So the good news is reimbursement is in effect in the UK. The reality is it's maybe 60 to 65% reimbursement.
00:07:07
Speaker
The other thing I've noticed this year is ah is a little bit of a slipping in the UK. So one of the things the FCA, the Financial Conduit Authority, did a report and they were looking at romance scams. And they were still finding as they studied banks that still a number of banks weren't really paying attention enough to the romance scams and therefore the romance scams were occurring. There could be like dozens of transactions that would have been obvious but just weren't being picked up. On the other hand, they did say some of the banks were doing a superb job, but they highlighted an inconsistency and I thought that was interesting because in the UK with all the focus for the FCA to still see inconsistencies on something like romance scams with a large number of transactions by one customer being missed. So that was kind of, that's that's another point. And the second one- pause on that point for a second, that's really interesting because we know that many of the banks, especially probably the large ones, have deployed break the spell teams. So specialized teams of- professionals who are not just customer success or customer support, but really social workers and psychologists that employ empathy and trying to really uncover the scam for the victims.
00:08:16
Speaker
Maybe not all financial institutions have the budget or have the means to do that. So maybe, I don't know if it was between the large and smaller financial institutions, but um I'm wondering if there's any effectiveness. Yeah, they didn't mention the financial institutions that weren't doing a good job, but I thought it was just interesting that they highlighted that, that it was still happening. oh The other thing in the UK that's happened is the financial ombudsman service has been told to kind of be more, the term is, I guess, balanced, which means in the past, most times when a consumer went to the financial ombudsman service with a complaint, they would get the reimbursement from the financial institution. This year, we're seeing a change in that where they're making it tougher for people to file complaints. So basically, you go to the bank and say, hey, I lost this money, and the bank's supposed to reimburse you. But the bank may look at it and go, you know, for reasons ABC, I'm not going to do that. And then the consumer goes to the financial ombudsman.
00:09:09
Speaker
Well, this year, the financial ombudsman is coming back with dozens of questions saying, you must answer all these questions before we will consider your claim. And so as a result, it takes people like Anna Rowe from Lovesaid, who help consumers, it takes them an extra maybe 24 hours to put together the documentation that the financial ombudsman requires. And so therefore, what I'm seeing is the financial ombudsman basically being told by the government to balance out reimbursements. And in essence, they're becoming more leaning more to the banks than they were before is the way I would phrase it. Do you have any thoughts about why this is? Well, there's a new government in town. So a new government came in in September, just a month before the the reimbursement was going to take effect. And the new government has a focus on innovation in in financial regulation. So they've made it clear they want the regulators to focus much more on innovation. And in doing that, what I'm seeing is probably less interest in some of the consumer side of this.
00:10:09
Speaker
Now, that's just my observation. People in England and the UK would have a sharper view of that. But as an outsider, it just seems like I'm seeing some weakening. And again, with the fact that maybe only 60 to 65% of the scams are being reimbursed, the excitement in my mind of the UK model, clearly it's the best in the world. And I don't want to under, I want to underline that. It is the best in the world for consumers because it has strong controls and strong reimbursement. But what I'm seeing is the reimbursement isn't as much as people thought. Yeah.
00:10:38
Speaker
That's kind of my assessment. Just one last thing. I i think there was a lot of concern from financial institutions about now that this is in place, then consumers are going to be more negligent and less careful. i don't think they were ever neg negligent. They were scammed by criminals that are very sophisticated, but it does seem like with this balance, quote unquote, it does require. And I don't know how much how much consumers really know ah this whole back and forth. Probably they don't know much. I don't know how many of them even know that they might be reimbursed. But given that the the changes, I think it will be interesting to see how things unfold and where they go from here. Right. And I know initially, earlier this year, the payment systems regulator, the PSR, came out and said, we're not seeing any first party fraud, you know, any material first party fraud because of reimbursement. On the other hand, I talked to someone at Gaza and after the Gaza meeting, they called me and said, you know, we're talking to some banks in the UK and they're starting to see it, but it's not public commentary. So I guess that remains to be seen. It's certainly a potential for first party fraud the way it's set up. So
Legislation and Models of Scam Prevention Globally
00:11:40
Speaker
we have to see. But let's move on to Australia. So you're right. Australia in February of this year passed legislation called the Scam Prevention Framework. And this was the first in the world to involve banks, telcos, and digital platforms.
00:11:54
Speaker
And the legislation that was passed said there are six pillars having to with disruption and prevention and reporting and things like that. But basically, there will be some controls that banks, telcos, and digital platforms have to have in place. And if these controls are not in place and not done properly, therefore not being compliant, then the banks, telcos, and digital platforms would be liable for reimbursement. So that was a legislation, you know, very bold, first in the world involving all three of those entities. And now it's a matter of turning that into execution.
00:12:28
Speaker
and And I do want to say, and sorry to pause you here for a second, after that came out, I think that became, and I know that i I was present at one of the Aspen Institute meetings where we had a representative from the Australia Banking Association that came and talked about this really balanced approach. I think definitely financial institutions looking at this model versus the UK model, definitely prefer the Australian model that doesn't put everything on banks. But then what happened since then? Well, so the legislation was passed in February and then things were quiet until the very end of November when the Australian Treasury came out with a consultancy on the scam prevention framework. And this consultancy is basically the first step after the legislation to say, here's how we're going to implement this. And so within this consultancy, they're asking for response back by i think ah January 5th. It lists a number of controls. I think over 30 controls that involve all three entities or in some cases are sector specific for banks, telcos and digital platforms. And most of that's pretty good. I thought it was light on the telco side.
00:13:30
Speaker
And also, I was surprised to see that a couple areas on digital platform were excluded, such as dating platforms and marketplaces, online marketplaces. That kind of stunned me. But the other thing that I think is most critical, starts to talk about the reimbursement. And again, remember that telcos, digital platforms and banks have to have controls in place. And if they're not properly in place, then there's reimbursement.
00:13:52
Speaker
I thought the reimbursement side of the consultancy was very light. And and one of my concerns, and I actually wrote ah a report on this for Gaza that came out around the 16th of December. Yeah, we'll put a link to it in the show notes. And in that, I said, I think it's going to be difficult for this reimbursement side because one of the big things is how do you know if the banks, telcos, and digital platforms are compliant? Well, the banks, telcos, and digital platforms get to tell you they're compliant.
00:14:17
Speaker
So they produce a document that says, I'm compliant. Now you want to get a reimbursement, but I'm compliant, so I'm sorry. So I think there's a real flaw there where we're saying that the banks, telcos, and digital platforms have to have controls in place.
00:14:29
Speaker
And the determination of if they're in place properly are the banks, telcos, and digital platforms themselves. And what bank, telco, digital platform is going to say, I'm not compliant? So I think they really have a problem there. and i think it's going to be difficult on the reimbursement side. Again, I applaud what they're doing. And I think it's another laboratory. So like the UK was a laboratory. Australia is going to be in a laboratory. It looks like they're leaning more towards action and prevention and disruption than they are leaning into reimbursement. Well, the legislation is called the scam prevention framework.
00:15:01
Speaker
So prevention is the word yes in the legislation. Right, right. And I think it's really interesting timing also with the social media ban for teens. I know it's not connected, but you know we know there are a lot of bad things in social media for teens, but also one of them is scams like extortion and other scams that are targeting teens. So That's high, you know, it's it's a really convenient time for, I would say telcos needed to to put, and sorry, social media companies needed to put in controls for age verification and for, which is, by the way, also an opportunity for scammers to create a lot of phishing sites for collecting and verifying people's ages, collecting their identity, information, etc. But it will be interesting. and in this, again, Australia has been a leader, right? in the global ecosystem with regards to, you know, let's let's take action. let's
00:15:53
Speaker
It seems almost impossible to mandate something like this in the in the size of the social media ban, in the magnitude of, okay, let's just think about how we prevent scams and hold these institutions accountable, being it financial institutions, telcos, social media companies, and platforms And so I think as descriptive as it can be, we'll really tell them, okay, here are the things that you need to do. The self compliance statement is a little tricky, but hopefully they will come up with a framework over time and not just stay with where things are right now. Well, it's it's a work in process. And again, I applaud what they're trying to do. And I think it's it's excellent what they're attempting. But the execution, I think, is a little bit lacking right now. One, it took a long time to come up with this consultancy document. You know legislation passed in February and you don't pass it till the very last day of the month in November. And you send it out at like 8 p.m.
00:16:48
Speaker
You know, so it didn't even get much publicity when the thing went out. That's number one. But there's still a lot of work to be done. I think there has to be an honest focus on the reimbursement. So the Australian government said this is prevention and reimbursement. They need to make sure the reimbursement is done properly. And I don't think it's there yet. In this document that I wrote for Gaza, I listed recommendations. So, I mean, there are things that can be done. It's just not quite ready yet. And the other problem is since it took so long and now you have this consultancy, when will the government come out with their response to the consultancy? And maybe that's not going to be until February or March. They talk about a July 1 launch date. I don't think that will happen.
00:17:26
Speaker
Because by the time they're coming back and say, okay, here's what we're really going to do and what we really want, it's getting too close. So frankly, I think this is going to push out until 2027. So it's just it's just not going to happen quick.
00:17:38
Speaker
I sometimes want to pull my hair off with the time that things are taking from a government reaction to this this national security threat to our economies, right? This is not something we're talking about billions of dollars stolen from citizens of these countries. And still things are taking so long and we'll get to the U.S. and... the Aspen Institute has worked for a year to get recommendations out. And then I saw that some recommendations talk about new government agencies that will have a year to come up with new recommendations. But we just had a year of work. So, you know, I think we can expedite by learning from other countries. And let's not make perfect the enemy of progress. And we really need to step up and do something, even if we make mistakes along the way. So that that would be my point of encouragement for people.
International Collaboration and Strategy Documents
00:18:27
Speaker
stakeholders and decision makers, let's do something now. And if we need to fix it, we can also always fix it later. But we have some models that that do make sense. Well, and where we see that is in Southeast Asia, in in places like Singapore and Hong Kong, they're coming out with prevention controls for banks. And in some cases, it also involves the digital platforms. But they're putting them out and they're saying, this is what we want you to do and want to be effective in the next quarter. So they've to taken more of the focus of prevention, but they're doing things and there's there's things happening and changing in those countries. Unfortunately, in Australia, because this is this like really big program, you know, it's much tougher to get this off the ground. Now, to be fair, the Australian banks have added a lot of controls, so they haven't waited for this to happen. And they do have voluntary programs. programs for both telcos and digital platforms. So there are efforts underway apart from the scam prevention framework. And I want to give Australia credit for that as well. But the scram prevention framework itself is taking a while to launch.
00:19:29
Speaker
And i I just don't know when it will launch. And it has to, like I say, it has to have more balance to the reimbursement. But now let's kind of move on. So that's there. And I'm watching that very closely. Let's move to the let's let's move to Canada. So I think Canada is doing some good things. They have the Canadian Anti-Scam Coalition ah that's headed up by Jennifer McQuaid and her organization. So the the Canadian Banking Association or Bankers Association turned it over to Jennifer and her group to basically help manage this and bring tank telcos and digital platforms in as well.
00:20:02
Speaker
So they have a group together and they're they're putting a focus on it. So it's it's it's a non-governmental focus to try and do something. We have to wait a little bit to see what actually comes out. The first thing was some education in October.
00:20:15
Speaker
Yeah. And they also, um at least I think yeah both you and I were at eFraud in Toronto. We heard about collaboration between telcos and banks, data sharing that's starting to happen. So those are going to be also really, really interesting blueprints for the whole process.
00:20:29
Speaker
you know, for the global industry to see how we can learn from that. Yeah. So I look forward to that. Also in Canada, there's been Bill 72, which is in the Quebec province. And this would be a bill when it implemented further pieces of it would require reimbursement for consumer scams. But again, there's definition in this that banks have to do certain things. And if they don't do certain things, then there can be reimbursement. But it's been very quiet. So it's up to the Quebec province government to come up with the next steps of this proposed, in essence, implementation of legislation. But from my contacts, it's been very quiet for the last several months. And so nothing has happened on that publicly. So that kind of sits there. But as we go into the end of the year, there doesn't appear to be any immediate action for whatever the reasons are.
00:21:14
Speaker
ah But when that does come about, that'll be significant for Canada. For Canadian banks, I think most of them do business in Quebec. So that's going to be something that regardless, they'll need to consider the controls and be accountable for that. um One interesting comment that I received from talking to some Canadian contacts as well is it starts in Quebec and then typically it will take over of Canada. So something to consider even if you're not doing business there. That could happen. So right now it's a wait and see, but there's been nothing, again, very quiet in Quebec after they said we're going to do something.
00:21:48
Speaker
it's It's been quiet. So let's come over to the United States. The United States is interesting. One big party. Well, we have things, of course. We had the um Kate Griffin's Aspen Institute had...
00:21:59
Speaker
pulled a whole bunch of people together. They spent a year and they put a very impressive document out October 1. Just to clarify, when you say a whole bunch of people, JPMC was one of the founders of this initiative and then Amazon and Meta and and Google and other financial institutions, telcos, other players in the market. but So we're talking about over 80 institutions that have participated in and I think over 300 were part of different conversations. So it was definitely a leading group of industry led activity. Yes.
00:22:32
Speaker
So a leading group that came out with ah a very good document. I liked the document. personally I personally, thought it was a little light on the banking side, but they had a lot of recommendations. What's troubled me there is that document came out October one, and I haven't seen all those people that you mentioned step up and say, for my sector, I'm going to implement the recommendations that came out of that document. And that's disappointing to me.
00:22:57
Speaker
Scams don't begin with money moves. They begin when trust is manipulated one message at a time. Rangers AI builds ScamRanger to help step in before the damage, detecting scam messages and guiding people while they still have the power to choose. And on the ScamRangers podcast, we bring you the voices on the front lines, experts, advocates, and leaders fighting back.
00:23:19
Speaker
Because stopping scams means protecting people before they're pulled in. Learn more at rangersai.com.
00:23:29
Speaker
So let's talk about that for a second. So the Aspen Institute, and we'll put a link to that also in the show notes, the National Strategy to Combat Scams, that there was a document that was published and it had actually, let let's call it two main sections. One is a recommendation for government and the other one was recommendations for private sector. And then there were recommendations general recommendations for everyone around around prevention and disruption. And there's a lot in there around collaboration, data sharing across industry, but there's also a lot, and this is where, just to your comment, where organizations internally need to step up and take accountability and do things that are in their control and not bound by safe harbor or additional regulation or enablers. They can today take action and step up. So if you are
00:24:16
Speaker
In one of these ecosystems and or or industries, I encourage you to read the document and see, and there are summaries of one-pagers. What can we do today?
00:24:27
Speaker
and What can we implement from this policy recommendation today to drive change and protect consumers from scams? Yeah, and it is an excellent document, and I'm sure it's been passed on to people in Congress. and There's a lot to read in there. It gives a really good background. So we don't need to keep reinventing the research on this. What what the Aspen Institute did was really good. um It's something I'm doing some work in California to try and see what the state of California might be able to do for consumer scams. And I recommend that to them as well. I say, start reading this. let's not Let's not do more research. The research is all done. It's now about execution.
00:25:00
Speaker
If you're doing research, you're wasting time in late 2025, 2026. We know what the problem is. We have people, we have Operation Shamrock, Aaron West has documented heavily the scam compounds in Myanmar, Cambodia. So we don't need to redocument it. We know what the problem is. It's big. It's transnational organized crime, Chinese triads.
00:25:20
Speaker
We get that. Now we have to take action. So the other thing in the U.S., Congress has basically introduced a number of bills. And so there's things that they want to do. I'm i'm working with a committee member on on one of those where they're trying to get get things to happen. ah But as always in Congress, you never quite know. These are bipartisan programs as I see it. Which is good. Which is great. Which is significant because this is not a political issue. It's about Republicans, Democrats, their friends, neighbors, and relatives being scammed for you know tens of billions of dollars in the United States, well probably well over $100 billion in a year. ah And so it is a bipartisan event. So we have to see what happens there. I do want to mention one thing, Ken, that Congressman Shreve was at the Global Anti-Scam Summit. I think this part happened in a briefing to the, actually said it both in the briefing to staffers on Capitol Hill, but then also at the summit. And he said, my constituents are people who answer the phone. And if someone has a wrong number or, you know, want something from them, they're not going to hang up immediately. They want to be helpful and they want to, you know, they they think well, positive of others. So, and I think he's from Idaho. So we need to help them.
00:26:29
Speaker
So that was really... He's from Indiana. Indiana, sorry. Yeah. Yeah, no, he had, and that's right. I mean, they're very trusting people. And so those are prime candidates to be scammed. So I'm optimistic for what they come up with, but it's it's Congress and there's a lot of things going on a lot of political stuff happening in Congress these days. So it's hard to tell what will come out of that, but they are focused on it. And there's an official Stop Scams Caucus ah in Congress. And we also see a number of senators now interested in this topic, like Senator Kelly, also a bipartisan group in the Senate. But again, yet to be seen how this comes into bills, legislation, bills being passed, et etc. And I did talk to one of Congressman Shreve's aides, and the person was very, very on top of it. So it was a very intelligent conversation. This person got it. So I was happy to see that. It wasn't just like, okay, they just put someone here to kind of talk. Very knowledgeable. And so that's good. So good understanding out of Congress. We have to see what happens. And I think that's been very, very encouraging for the industry, the community. I think we've been talking about this topic for a number of years now, but to hear representatives from the government who talk in depth and just brings me to the strike force, to the government strike force. So maybe you want to talk a little bit about that.
00:27:43
Speaker
Right.
National Efforts and Urgent Actions in Scam Prevention
00:27:44
Speaker
So a couple months ago, the ah U.S. attorney, Janine Pirro, who is the U.S. s attorney for the D.C. district, basically announced a strike force to go after consumer scams, especially focused on pig butchering and especially targeted in what's happening in Southeast Asia. And I know that some ears are shrieking right now. So we'll also also known as financial grooming, also known as cryptocurrency investment scams. A lot of different names. Unfortunately, I know pig butchering isn't the best term, but when you say that, people understand what you're talking about. So you have a very clear message of exactly the kind of scam and the severity of it. I know but people like softer terms, but I think that one gets the message across, especially amongst the fraud fighters. when you're saying This is a fraud fighting type of podcast today.
00:28:26
Speaker
So that's going to be very interesting because it it involves Homeland Security, the FBI, Secret Service. I was talking to some friends of mine in the Secret Service, and they go, yeah, we're engaged in that. And so it's going to be something that has an impact, and it would be nice. They talked about, ah she talked at the Gaza conference about we want the We want this, the private sector to come into this and help us fight this. So I hope she pulls them in because that's another way to get the private sector into the scam prevention framework activity and the scam fight.
00:28:55
Speaker
Because I think when I look at the United States, that's the part that I still don't see as active involvement as I would like. Now, I come from the banking side, and so what I will say is that as I talk to bankers, there are definitely things that they are doing. Chase put out a press release about three weeks ago now that said, we are in this fight, and here are the things that we're doing. So the first bank to do that.
00:29:16
Speaker
I talked to a smaller bank in Southern California, and they said, you know, We're not at the scale of Chase and we can't do all the things they talk about doing, but we're putting a really serious effort on training our staff so that when they have the opportunity to interdict on these consumer scams, they will. And if they can't do it themselves, they can call me and I'm a senior person in the bank and I will help them interdict in that.
00:29:38
Speaker
So that's another example. ah There's another bank that I mentioned at the Gaza conference, but I won't mention today. It's a regional bank that's on the journey. And they basically have hired a person to be the scam prevention manager. And this person's pulling a team together. And he reminds me that this is a journey. It starts, but it really never ends.
00:29:56
Speaker
And it's a journey you go on. And so I am hearing from financial institutions that they are joining this and getting on the journey, but I still think more need to do it. So we'll get there in a bit. i did want to spend one more or a few more minutes on the holistic view in the U.S. before we get into specific recommendations, which you started kind of high level. I do see, so we talked about the Aspen Institute policy recommendation. we see that... ah Several organizations are starting to do more. Probably some organizations are doing things in but not public about it.
00:30:30
Speaker
Hopefully, maybe it's time for them to be more public to create some peer pressure in the market for their competitors to do more too. There is some movement in the legislative branch of the government with regards to the Stop Scams Caucus and and other senators that are starting to put some pressure. And then we see the strike force. One of the challenges that I see is still is not like a holistic, centralized activity in the form of a national strategy for scams that really ties everything together. So I wanted a crystal ball moment here, Ken. And now you can predict the future and who knows what will happen. But if you could move everyone like puppets and create, take the but the momentum that has been really created, but has been created over last year and a half. And what would you envision as next steps to drive this into a national effort where everyone is working together. And one of the biggest problems we have is 10 different places or maybe 20 different places to report the scam to, right? As an example. So how can we drive this energy to us you know, national effort? Well, a couple things. One is I think the U.S. government should appoint someone to be that national leader. At the moment, Janine Pirro comes closest as the U.S. attorney because of the strike force. But in addition to that, I think the banks, telcos, and digital platforms, the private sector, know what needs to be done. And they need to stand up and more publicly say, we're in this fight. And individually, in each sector, there's more each of those sectors can do.
00:32:01
Speaker
The telcos, like I recommended that they you know have the market international call. So if I ever get a call on my phone, tell me it's international. That's a simple thing, but doing more to try and to stop the scams. So each of those sectors needs to jump up and be more aggressive and you know take a stance on this publicly and publicly pull their entities within the sector together to fight this. And you don't need to wait for the national government to do that. Now, Once you do what I just talked about, the idea of sharing data and signals is another important part of it. But I think it's secondary to each of those sectors stepping up to just acknowledging this is a serious thing. And it's it's a war. It's a fight. I don't see that. You know, I see individual banks do things. I see, like as an example, in digital platforms, I see Match Group, Lucia, who is a key person in that. Lucia Harris, yeah. Yeah, I've seen things that they're doing. They are adding controls to make their various websites, which is like Match.com, Bumble, and things like that, to make those websites more secure. And so I applaud Match Group for that, but I don't see others doing that necessarily. I do see Google doing Like as an example with Android at the Gaza conference, they presented a number of controls that they're adding on the Android platform so that if you get text messages, they're helping to tell you they might be scam messages and things like that. So I see i see some examples like that, but I don't see the digital platforms in general embracing this. And I don't see, I see the the banks out there, but I think they have to more aggressively say, this is a war and all banks are participating. And there seems to be an unwillingness to do that. But that's my crystal ball. And 2026 is the time to do it.
00:33:41
Speaker
We have to fight it with a serious war type mindset. I was in the military. I spent time in Vietnam, not on the front lines, but I was there. And you understood people had a serious focus to fight that war. This is a war just like what we've seen before, and we have to have a serious effort. So that's my crystal ball is that people wake up and say, we've really got to fight it.
00:34:01
Speaker
Chase gets other people to participate. Chase put that press release out. They stepped up and said, these are things we're doing. Jamie Dimon should get out there and make a public statement that this is a serious war and we are fighting it, and I'm calling all bankers to join the fight because there is so much more that can be done.
00:34:20
Speaker
Jamie Dimon, if you are listening to this podcast, that's a call to action for you. He could do it. I mean, he's the most respected banker today, and I think he could step up and do it, and other people would do it. I'd like to see the same from Bank of America, Wells Fargo. ah We have to treat it like a war, and we're we're not. I know that Aaron West is pushing really hard in that sense of urgency.
00:34:41
Speaker
And I'm wondering how can we get that momentum across the line to really have everyone, just like you described with the Vietnam War, we're in war, we understand we need to fight. How do we get that momentum?
00:34:53
Speaker
momentum across to everyone in this industry. Well, and that's where if you had a national leader, you you could help get the private sector and say, this is important to the US government. And these people go, then it's important for me. And that's another way to to get everybody fired up is if it comes from the top.
00:35:12
Speaker
Let's transition into your recommendations. One of the things or one of the roles that you had in at the Global Anti-Scam Alliance, and then you published a little more context on papers and in LinkedIn, you had a number of recommendations for financial institutions and telcos. You kind of iterated some of them during this conversation, but maybe we should do kind of a more organized review of what you think are some urgent actions with big impact. that financial institutions and telcos could take in the immediate term that will really drive a difference for consumers. Okay. Well, what I presented at at Gaza was as follows. I said for financial institutions... Yeah, because you only got three. Mm-hmm.
00:35:54
Speaker
Here's kind of a best practice for for financial institutions. And basically it's creating a written anti-scam strategy. So put in writing what you're going to do so you can commit to it, to the C-suite and also to the employees.
00:36:06
Speaker
The next thing I said is track your consumer scam losses. So understand what your customers are suffering. And you'll find out, as other banks probably have, that although it happens to all people as far as the scams occurring, it's the elderly, the 60 plus, who suffer the most amount of money because they have the most amount of money.
00:36:22
Speaker
And they may suffer 80% of the losses in your financial institution. But if you don't track it, you don't know it. So track consumer scams. Then, of course, adding anomaly detection controls. So basically, for your outbound transactions, have anomaly detection controls. have money mule management account control. So look at your account opening and understanding what you can be doing there. And also have ah inbound anomaly detection controls. So understand the money coming into your bank accounts that will help you identify money mules. And by the way, Notcha is now requiring starting in 2026 for receiving banks to have inbound transaction controls. So this is already starting to happen by the payment operators to say, look, you really need to monitor what's coming into your bank.
00:37:06
Speaker
Then you need to be able to let customers choose some of the controls. So as an example, you'd look at things like Zelle and retail wires. Maybe I don't want those turned on. Maybe as a consumer, I don't need that. Or maybe for Zelle, I don't need it real time. It's okay if I send it to my daughter tomorrow.
00:37:23
Speaker
So as a bank, give me a chance to choose. And it's important on the retail wires because retail wires, as my reading of Reg E, are not covered. So if a customer has an online account takeover or there's a scam activity and it involves a retail wire, there's no coverage whether it's unauthorized or authorized. Well, maybe as a customer, I never do a retail wire, so why should it be turned on on my online account?
00:37:47
Speaker
Let me turn it off. So that's important. Another thing is to train the staff on how to handle these consumer scams. And that becomes really important that you include the psychology of the scams so the the trained staff can understand that customer victim, what's really happening to them psychologically so that when I do talk to them, I understand where they are at that moment. And I'll i'll ask questions and I'll interdict with them and talk with them in a way that reflects that understanding. And also, i should understand how these scams work so I can deploy psychology when I'm talking to that customer. So I should be trained on asking questions that have a psychological relevance to someone who themselves is under the whole scam problem, the brainwashing type of a thing, and give me a chance to break that spell.
00:38:35
Speaker
I'll just interject here for a second. So in ah and our previous episode, we talked to Martina Dove, who is a scam psychology expert. And one of the things she was talking about is the fact that the person who entered the scam, your customer is no longer the person who's currently going under the scam because they're manipulated and just telling them, you know, you're under a scam, stop, you know, we're not going to transfer the money, like all those harsh messages where they're not ready to consume the information that way. And it's more around showing empathy, asking questions, making them think about what's happening, but also establishing trust with them because they were just groomed by a criminal for, you know, between half an hour to two years. So how do we establish that connection of trust with them before
00:39:20
Speaker
we get into you're being scammed, right? so So that is really, really important, a really important recommendation. Yeah, so it's a real process when you train these people that you train them correctly, when you train your staff.
Training and Strategies for Effective Scam Intervention
00:39:32
Speaker
I kept asking though, like with the size of the problem, how scalable is that?
00:39:36
Speaker
I think it can be scalable. I think you train people and what you do is you have you have your frontline staff and maybe some of them are like maybe only 20 years old and just come out of high school or or maybe briefly out of college. But what you do is you have that ability to to contact someone more senior in the organization when you're doing this. So when I talk to this ah bank down in Southern California, they have it set up where the the branch staff will initially try to interdict with the customer But if that's not working, then they they call senior staff on on a phone line who then gets in on this conversation with the customer. So not every person in the bank is going to be able to successfully interdict, but you can pull someone more senior either in the fraud department or your risk department. And even then, they may not be able to be successful because these people are so heavily groomed. But if you can get a 50% success rate or whatever that meaningful number is, you're way better off and the customer's way better off. But it is not.
00:40:28
Speaker
because they have been groomed for a long time and you've only got five minutes or 10 minutes to impact that. That's really hard. And so it it it is not easy, but that's what banks have to do is train their staff and have a ah an escalation process as part of that training.
00:40:45
Speaker
It's essential. The final thing the banks have to do is have effective customer education. And we talk about this a lot. It's more difficult to do than you think, but it needs to be effective customer education. Now, those are all the things that I mentioned that a bank should have. And what I've come up with, especially talking to some of the smaller banks, is maybe a couple of the things I've mentioned are not things to focus on initially because some of the smaller banks may not have the money.
00:41:10
Speaker
And this involves the outbound and inbound anomaly detection to help trigger alerts. Right. that That does require integration with the bank systems. Right. Right. So maybe you put that to the side. If you're a smaller bank, you put that to the side.
00:41:23
Speaker
Wait till your payment platform providers come up and say, guess what? We have those types of capabilities, and then you can make use of them. And also, how effective you are on online account opening.
00:41:34
Speaker
ah Maybe you don't focus on that as much initially, although I will tell you, the fraudsters will target the banks that are weak in online account opening, and that's where they will set up the Money Mule accounts automatically. So if you're a small bank or credit union and think it isn't going to happen to you, think again, because the fraudsters don't care about the size of the bank. They care about how weak the bank controls are.
00:41:54
Speaker
And so I will say online account opening controls have to be important at every bank, but maybe for the smaller banks, that isn't your day one scam prevention program. So you can see a number of the things that I talked about, like an anti-scam strategy being written, track consumer scam losses, let customers choose controls, train your staff, educate the customers. Those are things any bank can do. And so that becomes important. So that's kind of what I tell banks. And i really think that if you take either the the mid-level or the full-level approach that I've recommended, it will help you fight these scams. And you will be surprised when you do the tracking how much your customers are losing. And it becomes a not should I do it, but I must do it. If I'm a bank and I'm going to protect my customer and my customer's money, which is deposits in my bank, I need to have a scam prevention program.
00:42:43
Speaker
It's not a nice thing to have. It's part of being a bank in 2025, 2026. I'm sorry, but that's the reality. I couldn't agree more. i think that financial institutions that are only focused on fraud detection and do not have a scam program, it doesn't matter what the size is. i think it's really critical for their future to have the right focus on scams as well.
00:43:07
Speaker
Fraud is not enough. And even if you don't have a dedicated fraud team, you have someone with the role of BSA manager and has that responsibility, include scams in that as well. It's really, really critical. And there are best practices from smaller financial institutions, like the recommendations that you provided with what to focus on first.
00:43:26
Speaker
And that's it. So my my key point is there is a mid-level approach to this. So it doesn't take a lot of money, but it takes being smart. But every bank needs to have a scam prevention program. It doesn't have to be the same size as Chase or anything like that. I'm cognizant that smaller banks don't have the money and they have to be more careful how they spend it. And so what I've come up with in my mid-level is is a good approach for them, I believe.
00:43:50
Speaker
So with maybe a couple of minutes left, what are key highlights you think for telcos as well? Well, the telcos are are a little more tricky. Obviously, the US has a more complicated telco system than, say, Australia or Europe. And so it's more difficult to do things. There's many, many more players. But I think nonetheless, as the mean, the telcos will tell you they've stopped a lot of scam calls. They've stopped a lot of robocalls. They've stopped stopped a lot of text messages. But the problem is we still get them.
00:44:16
Speaker
And so I think the telcos really have to think about themselves and also work with the Google and Apple because Google and Apple have the operating systems for the mobile phones. which is what most people use these days. We don't have landlines anymore for the most part. It's a mobile phone. So between the telcos, Google and Apple, they have to work through how we can better prevent these scam text messages from getting through or how we can better prevent these calls coming in I mean, sometimes they'll come in from international, so that's why I think it's important to mark an international call. We also have issues where we have these SIM farms where people just get a whole bunch of SIM cards and put them into a SIM device, and they can, from that, start to do calls within the United States. So we have more scammers within the United States than we had before. And so the telcos need to figure out more ways to do that. I talked to one of the telco carriers at the Gaza conference, and they mentioned they actually have some programs to detect these SIM farms.
00:45:10
Speaker
and It's not 100% perfect because sometimes they'll take these SIM farms and they'll move them around in a car. And so they make them mobile. ah But they are starting to think about ways to identify and stop these SIM farms. So I thought that was positive. But those are the things that have to be done. It's hard for me to tell them specifically what to do, but I'll tell you today, it's not enough. We are seeing the 50 state attorney generals sometimes take action in the telco space.
00:45:35
Speaker
where they'll see things. They recently did some stuff about robocalls in the month of December 2025 to warn certain providers in the telco space that you're not doing enough and you need to stop all these robocalls.
00:45:47
Speaker
And they have influence because they can fine and they can put severe penalties on a number of these carriers that are smaller. I think there needs to be more KYC in the people who are wanting to send text messages and phone calls through the carrier ecosystem, that there needs to be more checking of those people and and killing people, blocking them off if they're not doing the right thing.
00:46:06
Speaker
Right. And the same for Google and Apple accounts, right? ah I've seen many of, and I think this this these might be messages coming from those SIM forms where it starts with a text message, like an SMS. And then once there is a response, it turns into iMessage.
00:46:21
Speaker
So what happens is essentially they use those SIM forms, but then they transition to an Apple account. So where's the KYC on that Apple account that enables the scammer to have an account to begin with? And then it might switch to a phone call too, because you go, okay, this person responded to my text message. They're hot. Obviously. Yeah. And maybe that phone call comes from a different number, too. Right.
00:46:39
Speaker
So i I think there's more. i they They do things, but I think there's more. The digital platform's the same thing. I mean, we've been covering, thanks to Reuter, the story about Meta that's been going on for about a month now of all the allegations. Yeah, we have to talk about that for a second. And clearly, I mean, one of the latest ones was that ah Meta, they were identifying ads that were coming from a certain sector, and they actually had a ah team that was helping to get rid of these ads.
00:47:06
Speaker
But then allegedly the the head of ah Meta, Zuckerberg, got involved in this and found out what they were doing. and found out that it impacted some of their Chinese customers where Meta is not allowed in China, but Chinese advertisers can advertise on Meta. And apparently the allegation is that Zuckerberg told these people to stop this scam prevention activity because it was messing with revenue.
00:47:29
Speaker
Now, again, if that allegation is true, it's it's shameful. I mean, does the company have a soul is the way I would phrase it. But Meta has to get into the hunt. And at least the allegations from Reuters are that Meta is so much more concerned about the revenue from advertising than preventing
Challenges and Responsibilities of Digital Platforms
00:47:44
Speaker
scams. So they're basically opening up a massive amount of scam activity to the Meta customers.
00:47:50
Speaker
which is shameful in itself, but that then leads to these customers taking money out of their bank and sending them to the scammers. And that's what creates part of this scam activity. So the digital platforms have got to get up on their game and the government has to step in at some point. If they can't do it themselves, that's why you have government regulation, which we're seeing in other countries, by the way. ah We're seeing that in Australia. We're seeing that in ah the UK, although the UK has been slow in implementing the consumer scam part of the Online Safety Act.
00:48:20
Speaker
Although this bill was passed, I think, in 2023, it may not be until 2027 that they start to enforce that part of it. So these things, they take time. I think there's some, as as far as I know, there's there's some investigation by the FTC that's going to start as a result of this Reuters article. And it's not the first, it's, I think, the second or third report.
00:48:41
Speaker
article that's come out about how men are profits from scam ads. And ah you asked about a soul. i don't care if they have a soul or not. They need to stop. They need to do something. And the the government or or legislators need to enforce that. And legislation on social media in general is very, very lacking, delayed. We need to step up.
00:49:02
Speaker
I think in the name of free speech, there has been like hands off social media regulation, but we're in war against online scams. But these are ads. I i think it's a difference between content where people say something and ads that are on the site. Of course, of course.
00:49:19
Speaker
I think the digital platforms have responsibility for the ads and they shouldn't hide themselves behind 230 and say, oh, that's not our responsibility. It absolutely is. Absolutely. And these have to stop because that's a big part of these scams. It comes from the digital platforms. Very big.
00:49:34
Speaker
So we'll wrap up with our usual question, Ken. What are you hopeful about in 2026? Well, in 2026, I hope that the banks, telcos, and digital platforms in their own sectors take a more serious approach to this. Again, with what Match Group a match group has done is one example of a digital platform that before was pretty laissez-faire, and all of a sudden they've gotten religion. So it can change. We can't affect the past, so I look to the future for all of these different entities. Something else I'm going to work on is the concept of network signals. I think we can get more network signals and I'm specifically going to be looking at payment operator systems and how more signals can come out of that. And so I have a couple of ideas there that I'm going to kind of initiate on my own with some people I'm working with to get more strength there because that can be very helpful to everybody.
00:50:23
Speaker
We can have reason for optimism, but as Aaron West says, it's like, let's get the people to stop talking and start doing. So let's hear what people are committing to do in 2026. That's the key. I've identified what banks can do. I have a robust program and I have the more mid-level that I've just described today.
00:50:44
Speaker
I'm working with one state to maybe help ah produce some of that in that particular state. But we have to execute in 2026. We don't need to research anymore. We know it in depth. We need to execute. So Congress needs to come up with some legislation and execute against it. Everybody needs to execute. We need to hear more stories like Chase saying, this is what I'm doing. I'd like other banks to say, this is what I'm doing. I liked what Google did. They said, this is what I'm doing. That's what we need to see in 2026 is more. This is what I am doing.
00:51:14
Speaker
I, again, couldn't agree more. I want to reinforce that. And I want to reinforce stepping up and saying what you're doing. I think positive peer pressure here is going to play a role as well. And I also want to mention that the advancements in technology, ah we see, you know, AI being used for bad between voice cloning, deep fakes,
00:51:35
Speaker
ah We're going to see more gentake AI used for scams. We already see tools that that are circumventing all the phishing controls that we put in place for years that look at copying JavaScript of the website to actually reproducing the whole website just from visuals ah by by AI tools today. So we can't stop in research because the pace of acceleration of the technology in the criminal space is just so quick that we need to just do action after action after action to resolve this. so One example we've seen in AI is Apaté, which is in Australia, where they're basically using bots to talk with scammers. And we've seen some other companies doing that same kind of thing. And so we are seeing some use of AI for the good, not enough, but we are seeing some examples of people using AI to actually work in this consumer scam prevention. And of course, Rangers AI is also using AI to analyze text messages. And there are other solutions in the market that do the same. You have a solution and there are other companies in that same space. So that's exciting because the more people in that space makes it a more viable space.
00:52:39
Speaker
We absolutely see that. So it is starting, but we need to see it in a much more aggressive way because the fraudsters have gotten very aggressive with using Gen AI, at what I call the evil twin, ah for the success of the of the fraudsters in the game they play.
00:53:00
Speaker
Ken, thank you so much. I'm wishing you and your family a lovely holiday season and happy new year. And Ayelet, the same to you and your family. And I look forward, I'm i'm optimistic to 2026. I look forward to it. And hopefully people listen to what I say about scam controls for the banks because I put a map out for them. You know, I've told them this is what you have to do. So step one is done. Let's go get it done.
00:53:23
Speaker
Yes.