No video :(

How to detect bank fraud with maths

Подписаться 1,2 млн

Просмотров 186 тыс.

50% 1

I chat to Daniel from the financial crime and security team at Monzo to talk about how they used maths to detect a data breach at Ticketmaster which exposed people to bank fraud.
Here is their post about what happened:
monzo.com/blog...
Thanks to both Daniel and the team of Monzo for letting me in the building and chatting about what they do. As stated in the video: I am a customer of Monzo but this video is not sponsored or supported by them.
And extended edit of my chat with Daniel is available on my Patreon page. If you are a teacher and would like to show it to your students let me know and I'll give you the direct link.
/ 20309889
If you also have an interesting job which uses maths and will let me in your building for chat, do get in touch!
If you're still at school, then study hard and one day you could have an interesting job which uses maths!
Thanks to my Patreon supports who do support these videos and make them possible. Here is a random subset:
Paul Bates
Neil McGovern
William Marple
Jordan Scales
Adam Scatchard
Support my channel and I can make more videos:
/ standupmaths
CORRECTIONS
- None yet. Let me know if you spot anything!
Music by Howard Carter
Filming and editing by Trunkman Productions
Design by Simon Wright
Sound production by Peter Doggart
MATT PARKER: Stand-up Mathematician
Website: standupmaths.com/
Maths book: makeanddo4D.com/
Nerdy maths toys: mathsgear.co.uk/

Опубликовано:

28 авг 2024

Ссылка:

Скачать:

Готовим ссылку...

Добавить в:

Мой плейлист

Посмотреть позже

Комментарии : 368

@nymalous3428 6 лет назад

This was a public service video. It was very good of Monzo to participate in this. It's too bad that Ticketmaster didn't acknowledge them. Fascinating stuff.

@RochesterOliveira 6 лет назад

It's very, very, very common from companies to ignore security warnings from other companies or individuals. Unless you get lucky and talk to someone who cares they won't do a thing

@RobeenaShepherd 6 лет назад

I use a unique email address for every website I sign up with, so it's quite obvious a specific site has had some sort of a data breach when suddenly I start to get spam to those addresses. Of the ones I've notified, one said they'd asked their team and nothing had occurred, the other didn't respond. Now GDPR rules exist in the EU, it'll be interesting to see if more of them are honest.

@maxsnts 6 лет назад

That is nice ideia, but some things came to mind: - You don't sigh up to many sites - You use this only to the important ones and have a generic mail for the crap sites - You have a lot of accounts, and presumably some kind of pattern on them, that would defeat the propuse since getting one would allow the attacker to guess the pattern (like the sine name on the account) If not any of these, how do you do it?

@BenANFA 6 лет назад

MaxSantos Easy, I do the same, if you have a mail server ~£20 per annum then you can just have multiple mail aliases at your server feed into a single mail box, or indeed all unrecognised addresses feed into a single mail box; you effectively have an infinite number of email addresses at your disposal even though you may have a limited number of mail boxes.

@maxsnts 6 лет назад

I know how a email server works and that you get the mail all in one mailbox. That is not the question. The question is how you keep track of what address goes with what site? Do you need to look at a table "site/address" prior to login because you forget what address to use for that site?

@BobOgden1 6 лет назад

Well done Monzo for being open to having a discussion about this

@roton1011 5 лет назад

I mean, its good advertisement for them...

@matts1900 6 лет назад

If Monzo haven't paid you for this, then they should. What a fascinatingly transparent discussion, instant new customer!

@DaniErik 6 лет назад

Wow, this was surprisingly open about the methodology considering they work with security. Thanks a lot to Monzo and Daniel for sharing!

@llearch 6 лет назад

Security by obscurity is no security at all. That's widely understood in security circles. So I'll bet that Monzo wanted to review the video to ensure they had no customer data referred to in the video - and I'll bet that they had a few grey hairs in the legal department about "that one customer" - but, once it was cleared, it's much better to have it out there in the open than hidden away somewhere. Much respect to Monzo for this - if I was still in the UK, I'd be looking to move my accounts to them.

@konstantinschubert2094 6 лет назад

Pretty sure that some amount of keeping your methods of detection secret is pretty paramount for effective fraud detection.

@rhamph 6 лет назад

Secrets like that rarely stay secret. You have a bunch of people in an arms race with you, constantly probing and learning what you're bad at detecting.

@llearch 6 лет назад

Not really. The aim is to make it so you can detect what they're doing by the doing itself. Knowing that if they take money, you'll figure it out real fast changes the game from "stay low so ticketmaster don't realise we got their details" to "take as much as you can as fast as you can", and that's even easier to detect, so the bank wins. There's some of the details that they keep secret, but as much of it as possible is in the realm of just how the thing works, and that part is public knowledge. The best option is to be so good and open at it that people decline to attack you because it's pointless, you'll beat them before they get started. That's holy grail territory, and not what anyone expects to happen, but that's what you aim for, if you're smart.

@moth.monster 5 лет назад

Showing off how they detect fraud is either going to make the fraudsters learn how to hide their fraud better (which they're always doing anyways) or show their competitors how to do something similar, which is good for security. Also, showing off your fraud detection skills is free advertisement :)

@qbaker20 6 лет назад

Matt, you've gotten loads better at interviewing people. Great job. I also really like where the content has been going lately.

@standupmaths 6 лет назад

Thanks! I’m always trying to get better: both content and interview style.

@Varksterable 6 лет назад

Quinton Baker Agreed; that was pretty slick. Almost didn't notice Matt, there. (In the most positive way.)

@AaronHollander314 6 лет назад

A brilliant young man. The bank is lucky to have him.

@Sam-pm9vy 6 лет назад

Daniel is clearly so good and knowledgeable at his job, I’m jealous he’s not working in my industry. We need more people like him. Sadly if you’re that good you don’t tend to end up in my industry.

@CharalamposKoundourakis 6 лет назад

Sam What's your industry?

@Sam-pm9vy 6 лет назад

Charalampos Koundourakis Clinical trial reporting

@mysteryman7877 6 лет назад

Sam you should meet more people in your industry

@dragoncurveenthusiast 6 лет назад

Really interesting stuff! Thanks for sharing, Matt! And thanks for agreeing to the interview, Monzo!

@johnchessant3012 6 лет назад

From the title, I thought this was going to be the standard video on Benford's Law. I'm happy to see it wasn't, because it was really interesting!!

@g0mikese 6 лет назад

Awesome of Monzo to let you do this interview. Really interesting.

@aimeerivers 6 лет назад

So interesting! Great work Daniel, I’ve never been happier that I use Monzo! You’d never see a traditional bank talk about this sort of thing!

@marleahstout2395 6 лет назад

He comes across as a sincere and interested interviewer.

@markfrellips5633 6 лет назад

This is a fantastic inspiration. I remember my dad loved talking about the old system that used to be shared with some banks which used it to analyze usage and fraud statistics. It's great to see that your bank decided to be a detective and active good citizen on such an issue. Very interesting to see they could identify a potential breach, just about conclusively

@AlcuBerry 6 лет назад

Great video! It reminds me of those computerphile videos were they report on new exploits and cyber attacks. It’s weird because I would love to see more videos like that, but that implies having more exploits and people/systems being affected. It was super cool for the bank to let you do this interview and I appreciate that you went through all the trouble of convincing them. Cheers, Matt.

@izziexxx 6 лет назад

I always found this kind of mathematical application absolutely fascinating, but absolutely loathed statistics when I studied it at school. I should go back and see it with new eyes, might change my life who knows!

@Arikayx13 6 лет назад

"It's just highschool stats" nice ticketmaster shade!

@spcalv 6 лет назад

This is high quality content - thank you to Matt from standupmaths for taking the time to seek out the interview and thank you to Daniel from Monzo for taking the time to answer

@GglSux 6 лет назад

Thank You...And all Your patreon supporters for yet another great and interesting video.

@MarcelMaatkamp 6 лет назад

A reaction from a bank as this would seriously make me think about switching to them, thanks for providing such honest answers!

@smoov22_sonic 6 лет назад

Inb4 "damn the monzo employee is young"

@peppybocan 6 лет назад

he looks like 20-22-ish,.

@deluxeassortment 6 лет назад

He's actually 30, but he's dying of Ligma

@AaronHollander314 6 лет назад

@ Donnie Morrow - How petty. Grow up.

@fatsquirrel75 6 лет назад

I was actually thinking "damn the monzo employee is switched on".

@Ziirf 6 лет назад

Aaron Hollander Some people just have to point out others flaws to make them feel like they got something going in their life. It really is petty indeed.

@MicroBlogganism 6 лет назад

Cool, but what's with the red plastic sea sponge thing? Seems like an odd decoration

@dalitas 6 лет назад

looks like a 3d printed piece of coral

@NekomimiScience 6 лет назад

The Monzo cards are a colour called Hot Coral so in that particular room, we have a couple of coral-like pieces scattered around!

@MicroBlogganism 6 лет назад

Ahh, makes sense. Thanks!

@AlcuBerry 6 лет назад

MicroBlogganism I thought it was a postmodern hand hahaha

@jamster251 6 лет назад

It's a specially lab-grown coral that emits a waft of anti-fraud leptons that give their systems the edge. All banks have their own anti-fraud coral bio-division.

@AnonymousFreakYT 6 лет назад

Good on you for properly blocking out the card numbers. I was at a sporting event where during half time, a guy from a bank came up to do a contest and said "anyone who has a card from our bank, take them out. Look at the numbers on it." He held his up so the camera could focus on it. He had used his thumb to block out some of the numbers, but it was the first four. Which tells you... Which bank it's at. Which we knew. The rest was shown, as was his name and the expiration date. I honestly wonder if someone committed fraud with his card. (The "contest" was that they listed off a four-digit number, and if you had those that set of four digits in a row *anywhere* in your card number, you won $100 or something.)

@jedigecko06 6 лет назад

Anonymous Freak - Ouch!

@mysteryman7877 6 лет назад

Banks must have quite a few sets of four-digit numbers available for identification. I have yet to see any two card numbers with the same beginning

@unicodefox Год назад

@@mysteryman7877 both my Monzo physical cards start with 5355 (and virtual cards with 5168), so I assume it's not too uncommon to see.

@Harxey128 6 лет назад

That kid looks and sounds like a young James Grimes

@kourii 4 года назад

@@Peter_1986 I don't hear it. Young Daniel here has a pretty standard Southern English accent, whereas Dr. Grime has a Midlands or Northern sort of accent. Obvious standouts are that Daniel has the trap/bath and foot/strut splits, whereas Dr. Grime hasn't either.

@maghouinbeg5011 6 лет назад

Daniel's explanation is fascinating.

@keetrandling4530 6 лет назад

It is! But, how old is he?

@maghouinbeg5011 6 лет назад

What does it matter? It's the way the brain is used that counts, not the number of birthdays celebrated.

@MWSin1 6 лет назад

One really cool thing is Benford's law: about a third of a random selection of account balances (or the heights buildings, or the value of physical constants) will have begin with 1.

@hezzr3 6 лет назад

MWSin1 another cool one is Bofa’s law

@MWSin1 6 лет назад

I honestly can't find anything on "Bofa's Law" that makes any sense. There's a blogger who goes by The Bofa on the Sofa that is credited as establishing something like "If the best defense of a group is 'they aren't all bad' there is something wrong with that group." While interesting, it seems out of place in this context.

@AnCoSt1 6 лет назад

The law's about BOFA DEEZ NUTS

@SkyCharger001 6 лет назад

side-note/nitpick : in unary and binary every value begins with 1.

@nivolord 6 лет назад

I was thinking about that too. You are talking about hiding fraud by randomly choosing numbers to go into the books. However, these numbers are chosen from a certain range, where 1/10 of them begin with 1 instead of the naturally occurring 1/3.

@sirkowski 6 лет назад

How do I use math to commit bank fraud? Asking for a friend.

@smoov22_sonic 6 лет назад

sirkowski idk ask Yoshi

@stumbling 6 лет назад

Think of your PIN number, now add 3 to encrypt it. Now tell me your encrypted PIN... >:)

@renxula 6 лет назад

Mathematicians have already created lists of all the PIN numbers in the world. Yours is on it too, guaranteed. Scary stuff.

@pluto8404 6 лет назад

Theres only 10,000 4 digit pins.

@yellowcrash10 6 лет назад

Pluto : That's the joke.

@DanHughesNC 6 лет назад

Great, great video. Who knew banks could be cool. Thanks to both of you for taking the time to make the video. Now I just need Monzo to start doing business in the US.

@nscantling 6 лет назад

That red piece of coral looks like a really creepy glove.

@ALifeOfWine 6 лет назад

Well, I'm changing my bank over tomorrow, so Monzo have at least 1 new customer from this.

@samc5898 6 лет назад

This was super interesting. It's always cool to hear someone talk about something when they know exactly what they're talking about. Would love to see more of this kind of thing in the future (hopefully not bank fraud related though)

@Friend_of_the_One-Eyed_Ladies 3 года назад

That was one of the best interviews I've ever seen.

@ooloncolluphid9975 5 лет назад

lol the scene of him sitting with the young employee reminded me of the similar situation with Malcolm Tucker of In The Loop.

@JoostMehrtens 5 лет назад

Although I have almost 20 years working experience, part of me always wanted to be a data/fraud analyst. You are basically a crime fighter like on TV with the difference that you are really smart. So while I am watching this young guy shows up and I think, so this is who I want to be? This is my idol? I had a difficult time explaining that to myself.

@TheSenorTuco 6 лет назад

Amazing for you and Monzo for doing this!

@MooImABunny 6 лет назад

Awesome. showcasing the important people behind the scenes is pretty awesome

@topilinkala7651 3 года назад

Years ago I was working in postal carrier and it was noticed that the mail volumes on carriers had increased. So a countdown was issued where every carrier would count the amount of mail they delivered for two weeks. Some carriers tought that it would be easier to just fudge the numbers insrtead of counting them. In the end these guys had statistics people watching them counting the mails. It is very easy to find out from a statistcal sample what is the false data.

@Yupppi Год назад

Wow, what a surprise that a business who is reluctant to admit possibility of breach while it is clearly happening, and reluctant to accept evidence as being important also didn't communicate with the people who found it and tried to play it down when they admitted it. Surely a rare case.

@roceb5009 6 лет назад

Did any pets predict this data breach?

@daniel117100 6 лет назад

My dog barked and ran in circles the other day

@OtherTheDave 6 лет назад

Doug Dimmadome, owner of the Dimmsdale Dimmadome Sounds like a successful prediction to me!

@ukeleleEric 5 лет назад

@@daniel117100 Ah, but which direction did he run in? And did he bark 'Ticketmaster'?

@graham1034 2 года назад

As someone that works in an adjacent tech sector, this kind of work is extremely common at tech companies when dealing with sensitive information. Most are using machine learning algos to flag suspicious behaviour but there is still a lot of manual work to figure out the underlying problem.

@catriona5268 6 лет назад

Fabulous video and hats off to Monzo. Too bad they don't seem to operate in Australia, as I'm with a major bank and am looking for alternatives at the moment. Also, as a uni student (not in a maths-related subject, though), it's very promising to see an internship that turned into a real job!

@n8style 5 лет назад

Kudos to Monzo! Seems like they're doing great things!

@Cimlite 6 лет назад

Very impressive detective work. Must have been a nightmare to go through all those transactions.

@LikkanC 6 лет назад

As a fellow Monzo user, I recommend it to everyone

@15october91 6 лет назад

Very interesting! It’s good to see that there are actually smart people out there; spending anytime on the internet you are bombarded with so many mindless people.

@recklessroges 6 лет назад

Matt, did Monzo retain editorial approval? (For security?)

@standupmaths 6 лет назад

Yes, they checked the edit before I released the video.

@TheSenorTuco 6 лет назад

I don't mind this, I mean they took a risk by agreeing to this. You were doing the edit and they only checked then it's fine. If they were doing the edit, then it wouldn't be ok.

@TheAguydude 6 лет назад

It is a risk, but it was also a smart move on Monzo's part. This sort of video provides excellent PR. Keep in mind that the high level information provided in this video is information that they'd already chosen to share via their blog. Further, I'll note that the risk-reward trade-off of this sort of video is far more favorable for newer, less well-established companies than it would be for an older, better established bank.

@reedjasonf 4 года назад

Good work by the people at Monzo!

@ThomasGodart 6 лет назад

Very nice video, I wasn't expecting that at all. Thanks for sharing!

@antoineroquentin2297 6 лет назад

CSI: Monzo

@dogdrovenorth 5 лет назад

Loads of close-ups, sciency bits and a The Who soundtrack.

@roraraptor 6 лет назад

I just got accepted to do a Computer Engineering BA, so thanks for your encouragement! I'm going to study hard! :)

@littlered6340 2 года назад

"I don't think they agreed with our interpretation of how important this evidence was" Me, a Pentester: "lol, first time?"

@ORIONGaming 6 лет назад

7:20 that zoom on specifically his hands. XD

@61Ldf 4 года назад

The Monzo guy looks like the male version of Vicky Pipe. Vicky and Daniel, you are great, both! And Matt did a good job as an interviewer.

@banniball 3 года назад

Regarding the clustering in dates. There would likely be clusters come coinciding with major festival/event ticket releases. That could explain som of the clustering. (Depending on how distinct/disjoint the clustering were of course)

@AlexBalhatchet 6 лет назад

Great interview, really impressed with Monzo! Hooray for internships becoming full time hires 😁

@Yogobogo 6 лет назад

Looking forward for another video with Daniel. Very informative.

@MattCookesurl 6 лет назад

yogobogo get him on as a regular for CS fun

@abcmsaj 6 лет назад

Love Monzo. Would highly recommend them and use them as my main bank now!

@thermitebanana 6 лет назад

That's awesome! Thanks for sharing your curiosity

@notthere83 Год назад

This just made me check whether Ticketmaster faced any severe, lasting backlash for its horrendous handling of the situation. Of course not...

@jhyland87 5 лет назад

Im in infosec, so this was pretty fascinating to me. Thanks for sharing!

@kuromurasaki5273 6 лет назад

3 people that work for ticketmaster are unhappy with this video

@JustinWPruett 6 лет назад

A banking company known as Monzo is the most British thing ever.

@wheedler 6 лет назад

I was going to ask what a bank API would be used for, but then you almost started talking about it, but then you didn't. So what is a bank API used for? What kind of stuff is it capable of?

@rlamacraft 6 лет назад

wheedler Here’s some stuff people have built github.com/rdingwall/awesome-monzo

@MisterAppleEsq 6 лет назад

This is fascinating, but I hope fraudsters don't learn from this. Also, I'm experiencing semantic satiation with “Ticketmaster”.

@Petch85 6 лет назад

Nice video... You should have asked how the handle anonymisation of the data. It turns out that is nearly impossible

@londospark7813 6 лет назад

I know this wasn't a paid promotion or anything like that but the openness shown here and the mention of the api (as a developer I am embarrassed that I didn't know about it sooner) has sold me on using my Monzo account full time and move from my current high-street bank.

@TheGrooseIsLoose 6 лет назад

I used to work at a credit union, and we had a similar incident with a local movie theater. All the financial institutions in the area were trying to figure out who it was and then somebody at our credit union noticed that they had all gone to this one movie theater, and I think there ended up being a skimmer installed there or something.

@TheGrooseIsLoose 6 лет назад

There was also another time I noticed everyone who had their card number stolen was a gamer, and then GameStop announced a breach.

@martinsalko1 6 лет назад

Oh i'm changing my bank. Right now!

@dankojotanovic3948 6 лет назад

Regular Ponder Stibbons he is young Daniel. Well done!

@OghamTheBold 6 лет назад

Monzo - also has - the : _cleanest_ chimneys *_R > G_*

@jeffreymorris1752 5 лет назад

This is pretty amazing. Well done.

@TheFrenchMansControl 6 лет назад

@Monzo if you ready this, this is great promotion for you guys. Definitely would consider banking with you.

@zachburke8906 6 лет назад

It’s a shame ticket master didn’t go full security mode when a bank told them they have a very high chance of a security breach. If I was them I would change how I respond to that kind of info.

@defau1tMC 6 лет назад

Just goes to show the power of having that much data and understanding operations you can do on them.

@ianw8479 6 лет назад

I like the hand zoom in bit

@prasunadhikari6054 6 лет назад

Did any pets predict the entire world cup of a team?

@YuzuruA 6 лет назад

I think a pulp from japan - but when japan got eliminated (the pulp also won that one), the owner simply killed and sold the poor thing

@MichaelBerthelsen 6 лет назад

Yuzuru A Ehh, you mean pup? Pulp is what you get when you crush trees... And why would a Japanese person sell a dead dog? Why would he kill it in the first place, that makes no sense?

@YuzuruA 6 лет назад

sorry, don´t know where I came up with pulp - it was an octopus or a squid

@raykent3211 6 лет назад

Yuzuru A pulpo is, I think, either Spanish or Italian for octopus, so maybe that's why.

@ChrisLeduc 6 лет назад

wow. remind me to never use ticketmaster's services again. remind me to sign up for monzo if i ever move out to the uk.

@TheAkashicTraveller 6 лет назад

There is at least one online service that will give you temporary virtual cards so that you can use them for such risky purchases. There are a bunch of different ones actually.

@jetti7944 3 года назад

My only bank these days. App is incredibly useful, knocks the “big banks” out of the park.

@amenicHD 6 лет назад

I half expected that you would chat with Jack Wright :D

@connorwilliams3451 6 лет назад

Damn the Monzo employee is young!

@ragnkja 6 лет назад

Old enough to have finished uni, but very young-looking. Based on the other comments here, he could probably pass for 16 as long as there wasn't an actual 16-year-old next to him to compare him to.

@snafu2350 5 лет назад

No offence to him, but he could act as a stereotypical geek/nerd in any movie if he lost a little skin colour :)

@bingfannumberone 2 года назад

great video dude

@joen0411 6 лет назад

My bank sent me a new card for the same reason a few years ago. I called them to find out which company got hacked so I wouldn’t by from them anymore but bank refused to tell me. I guess the reason is because while they had statistical proof of who it was they can’t confirm it and would probably get sued by that company. But it is nice to know they are watching for it and apparently good at it.

@landonkryger 6 лет назад

That sounds like a very interesting/fun problem to work on. I'd like to play with their data and see if I could automate that but I'm guessing they don't just hand that data out.

@Caitlinm007 6 лет назад

That was fascinating. Thank you!

@komnishura 6 лет назад

Good tech banking handywork!

@wrainexc1 6 лет назад

Incridible to see how little large companies like ticket master actually cares about our private data. Luckily the bank does care.

@MrR9999 6 лет назад

It's great to see hear the story. I am curious as to why machine learning isn't core to their detection systems though.

@thomasoddberge4225 6 лет назад

Just had an idea for a way the banks can detect fraud, not sure if it works or not. So the idea would be to have fake cards that do transactions to only one vender (Ticketmaster etc) and when that card gets used outside that vender it would Then raise a flag of breach. The transactions would be fake, but would appear real to scammers.

@_Onlime 6 лет назад

*reads video tittle Me: *Easy!* When your balance number has a minus sign in front of it

@PuchMaxi 6 лет назад

Good job, well done!

@eamonnsiocain6454 6 лет назад

Bravo Monzo!

@AalbertTorsius 6 лет назад

_Very_ interesting video. Not sponsored by Monzo, but watch their number of customers surge as viewers flock to Monzo.

@andljoy 5 лет назад

I watched the extended video just published..... dam you now i have a monzo account.

@redactedwatkins6195 6 лет назад

wh-when did matt shave his head

@schadenfreudebuddha 6 лет назад

after he'd lost a critical amount of territory along the frontlines. I'm sure he has a formula...area covered by hair, versus cranial volume...

@pomtubes1205 6 лет назад

damn ur late

@mattgsm 6 лет назад

When a reply gets more likes than a comment

@unvergebeneid 6 лет назад

Choosing a bank because they have a nice API... that must be one of the nerdier reasons for choosing your bank ;D

@aguy6773 6 лет назад

Thanks for finding the math!

@nomadMik 6 лет назад

Now that I've watched this, I'm going to be less annoyed when my bank denies a legitimate transaction, because I understand, now, that more goes into it than freaking out about me travelling. (Although I'm about to get rid of the credit card that still expects me to make overseas calls to verify transactions, instead of just confirming a push notification on their app-it's 2018!)