Fraudology Podcast with Karisse Hendrick

Rolled Up Network
Rolled Up Network
  • 4.8 (39)
  • Management
  • Semiweekly

If you work in online fraud prevention, chances are you've caught the "bug". The bug that makes you passionate about identifying & preventing cybercriminals from getting away with stealing from your company, or your client's companies. Most people who have made cyber-fraud their career have the perfect balance of analytical and social skills, a strong sense of justice and the curiosity that will drive you to go down every path of information until you "crack the case". Just like sociology is the study of social behavior, and psychology is the study of human behavior, Fraudology is the science and study of fraud. On the Fraudology podcast, long-time online fraud expert, Karisse Hendrick will dive into all areas of Fraudology from the perspective of a fraud-fighter. With guests ranging from former cybercriminals to fraud-fighters at Fortune 500 companies to law enforcement and others, you will no doubt be entertained, while learning a lot about fraud & other forms of abuse prevention! Subscribe to be alerted when a new episode is out and please rate & review where you can, to help others find this new & unique podcast!

  1. 2d ago

    Inside a Scam Compound: Mohammad Muzahir’s Story, pt 1

    This is a survivor’s story. Mohammad Muzahir, also known as Red Bull, is the cybercrime whistleblower in the WIRED reporting that opened a window into how scam compounds work. He escaped one, and he now spends much of his time helping large organizations understand how they operate. He was studying computer science and looking for a way to fund a bachelor’s degree abroad when a friend of a friend offered him an IT manager job in Laos, in the Golden Triangle region. The job did not exist. What followed is a human trafficking story and a fraud story at the same time. This episode of the Fraudology podcast sits right where the two meet. We cover how the fake job offer worked, what daily life looks like inside a scam compound, and how forced workers are handed scripts, fake personas, and stolen accounts to run romance and crypto investment scams. This is not an easy conversation, and I hope it gives you a fuller picture of the people on both sides of the screen. This is part one of a two-part conversation. What you’ll hear in this episode:What a scam compound looks like from the inside, including buildings with dozens of floors, long daily shifts, and fines that keep workers in debtHow a fake job offer and a chain of trusted contacts moved a young IT graduate from India into a scam compound in LaosWhy many of the people running these scams are forced workers, and why Mohammad calls himself a victim as wellHow the story bible gives each fake persona a childhood, a hometown, a daily schedule, and an answer for every questionHow romance scam victim manipulation turns trust into a crypto investment, including fake gains and small early withdrawalsWhy a scammer may coach a victim to dismiss a bank’s warning before the victim ever walks into the branchWhat Mohammad says about stolen, aged social media accounts and how recovery flows were used against account ownersWhat his 4,200 pages of evidence shared with WIRED’s Andy Greenberg add to what investigators know You should listen to this episode if you:Work in fraud, risk, or trust and safety and want a clearer picture of how the people behind these scams are organizedSupport scam victims and want to understand why they trust a persona so deeplyTrain bank or credit union staff who talk with customers who are being coached by a scammerWork on account takeover or social media platform integrity and want to hear how stolen accounts are usedWant a survivor’s perspective on how a fake job offer becomes forced labor

    Inside a Scam Compound: Mohammad Muzahir’s Story, pt 1

  2. Oct 22

    Industrialized Fraud: How AI Is Reshaping the Fraud Attack Landscape

    Welcome back to Fraudology. I’m sharing the presentation I gave to open the Merchant Fraud Alliance conference in Chicago. It was a “where are we right now” look at the fraud attack landscape, and it grew out of a question I heard from merchants all through the conference. What is actually different about fraud today, and how much of it comes down to AI? If you work in e-commerce fraud, you have probably felt the shift in your own numbers. Generative AI has changed who can attack, how quickly they can do it, and how well the attacks blend in with good customers. I walk through how AI fraud looks from the ten thousand foot view I get from talking with so many merchants, and I pair it with fraud prevention ideas you can take back to your own team and your own leadership. What you’ll hear in this episode:Why fraud has been industrialized, and how AI lowers the cost, skill, and time needed to attack e-commerce at scaleThe headline numbers, including fraud pressure up 33% year over year, account takeover up 78%, card testing up 175%, and BOPIS fraud up 65%How the EMV chip shift in 2015 and the rise of account takeover compare with what AI is doing to the fraud attack landscape todayWhy AI-powered account takeover keeps climbing, and how generative AI makes phishing cheap to personalizeHow AI card testing attacks differ from old scripts, including how agents sort cards and adapt to your controlsHow one campaign can move from identity to checkout to customer support to disputes, and why event-based controls miss itWhy evidence is now cheap to fake, from fake receipts and identity documents to fake damage photos and deepfakesWhat a dark web card marketplace demo shows about how easy it is to buy the pieces of an attackHow to fight AI with AI fraud detection using session-level data, telemetry, device ID, and behavioral biometrics You should listen to this episode if you:Need to explain fraud increases to leadership and want current numbers to bring with youHave seen a sudden rise in account takeover or card testing, or heard from your processor about the Visa enumeration programDeal with refund fraud or chargebacks involving photos, receipts, or item not received claimsAre evaluating fraud prevention tools and wondering why snapshot-based controls keep missing attacksWant to hear how merchants are using generative AI to spot AI-written scamsCouldn’t attend the Merchant Fraud Alliance and want to hear how the conference opened

    Industrialized Fraud: How AI Is Reshaping the Fraud Attack Landscape

  3. Oct 15

    Merchant Fraud Alliance 2026: The Good, The Bad & The Fraudulent

    Welcome back to Fraudology. I’ve now had a few days to recover from the inaugural Merchant Fraud Alliance conference in Chicago. I helped create this event. Watching two days of conversation among merchants go from a plan to a room full of people was a real highlight for me. The Merchant Fraud Alliance 2026 conference was built around a gap I had heard about for years. Merchants wanted a place to compare notes with peers without feeling like the target of a sales pitch. We kept the ratio at roughly three merchants for every solution provider, invited sponsors based on what their customers say about them, and added merchant only deep dives. I explain why we made those choices, then walk through the AI bootcamp, the deep dives, and the main stage sessions. Topics include fraud as a service, app cloning, account takeover trends, executive scorecards, build versus buy decisions, and the PSP gaps merchants keep running into. This episode is for everyone who couldn’t be there. Two days of sessions won’t fit into one episode. I’m sharing the moments that stuck with me the most. What you’ll hear in this episode:Why we built the Merchant Fraud Alliance as a merchant first fraud practitioner event, and how invite only sponsorship shaped the roomHow the merchant only deep dives worked, including a fraud center of excellence discussion, a refund fraud ecommerce session for food delivery and retailers, and war room roundtables for retailers and marketplacesWhat came out of the AI fraud bootcamp for merchants, from Slack alerts and chargeback research to governance questions and the rising cost of AI tokensWhy a fraud as a service session encouraged attendees to treat fraud threat intelligence from Telegram, Discord, and the dark web as an input to decisions at the time of purchaseWhat one vendor’s data showed about app clone fraud detection, with chargebacks running roughly four times higher when cloned apps were involvedEcommerce fraud trends 2026, including a threefold rise in account takeover over two quarters and agent traffic that one vendor found to be nine times riskier than human trafficWhy fraud now moves upstream and downstream of the payment, and the merchant PSP fraud gaps that appear when you rely only on processor toolsLessons in cross functional fraud collaboration, and how to build a fraud executive scorecard with metrics your executives actually wantA look at the build vs buy fraud stack panel, a non payment fraud discussion covering loyalty fraud and promo abuse, and research on how cyber signals can improve payment fraud decisions You should listen to this episode if you:Couldn’t attend and want a practical summary of the sessions and the ideas that came out of themAre curious what a merchant only fraud conference looks like and whether it’s worth attending next yearAre exploring generative AI in fraud operations and want to hear what other merchants are doing, and what they’re struggling withStruggle to explain fraud to executives and need a better way to present your dataAre weighing a build or buy decision, or feel limited by the fraud tools your PSP providesDeal with refund abuse, promo abuse, or loyalty fraud and want to compare notes with peers

    Merchant Fraud Alliance 2026: The Good, The Bad & The Fraudulent

  4. Oct 8

    Lending Fraud: When the Perfect Applicant Is the Red Flag

    Welcome back to Fraudology. Welcome back to Fraudology. I'm Karisse Hendrick, and this week I'm talking with someone who has become a regular guest on the show. Matt Vega has joined me across six years and several different employers. He's now the Chief Fraud Strategist at Point Predictive, where he works with Frank McKenna on lending fraud, and his move into that world gave me a good reason to ask what looks different from where he sits. Lending fraud rarely looks like the fraud most merchants picture. Plenty of losses start with an applicant who stretched the truth about income or cleaned up a credit report through repeated disputes, and those cases sit right next to organized attacks. Matt explains how credit washing fraud and income misrepresentation blur the line between abuse and fraud. He also shows how lending consortium fraud data lets a lender see patterns that a single credit report never will. Then we get to the part I think deserves the most attention. A super prime synthetic identity can now be assembled quickly, and on paper it can outperform a real customer. Whether you work in lending, fintech, or ecommerce, you'll leave with a clearer sense of where your defenses actually hold up. What you'll hear in this episode:How lending consortium fraud data works, and why one lender's loss can protect an entire network from the same attackHow credit washing fraud and credit bureau dispute abuse can turn a 580 score into a 790 for a short window, and why lenders sometimes miss itWhy income misrepresentation and bust out fraud lending sit on a spectrum between friendly first party abuse and deliberate attacksHow a super prime synthetic identity can be built in roughly 90 days using an authorized user fraud scheme and buy now pay later fraudWhy a perfect credit profile can be the red flag, and what fraud network intelligence lending teams can see that a credit report cannotHow jailbroken LLM fraud tools, dark web fraud tools, and a dark web identity marketplace make it easier to produce identities, identity document fraud lending, and matching cardsWhy AVS CVV fraud limitations and PSP fraud tool limitations show up as high declines, false positives, and chargebacksHow good user behavior mapping makes anomalies easier to spot, and how polymorphic fraud attacks and device farms try to imitate real human behaviorHow behavioral biometrics lending fraud controls, friction strategy fraud prevention, and fraud stack vendor evaluation fit together, including why a design partnership fraud tech opportunity can be worth saying yes to You should listen to this episode if you:Work in lending, auto finance, or fintech and want a current look at lending fraud beyond the standard synthetic identity playbookAre responsible for fraud tech stack strategy and want a practical way to think about proven vendors versus newer technologyAre a merchant relying on a PSP fraud tool and wondering why your declines and your chargebacks are both highNeed language to explain friction decisions to executives and growth teams using data they already care aboutWant to understand why a fraud consortium lending network matters when attackers are using AI to adapt quickly

    Lending Fraud: When the Perfect Applicant Is the Red Flag

  5. Oct 1

    AI Enabled Fraud: When Growth Comes Before Guardrails

    Welcome back to Fraudology. AI is here, and it’s making every kind of fraud we already know cheaper, faster, and harder to catch. We are going to walk through a handful of stories that show exactly how AI enabled fraud is showing up right now. From card testing at scale to one very messy fraud story. That story is Polymarket, and I spend some real time on it. It’s rare that we get this much visibility into a company’s actual fraud details. A Wall Street Journal investigation lays out the stolen debit cards linked to thousands of new accounts and a fraudulent deposit rate that hit 80%. I also get into AI-generated deepfake delivery orders, a bank coalition’s new warning about agentic commerce fraud, and a warning about AI voice cloning scams. We aren’t eliminating fraud, we never can, but we can get the information to be as fast or slightly faster than the fraudsters. What you’ll hear in this episode:Why AI-enabled BIN attack fraud and card testing are up over 75% according to at least one fraud vendor, and how fraudsters are now optimizing payment authorization the same way legitimate payment teams doA full breakdown of the Polymarket fraud scandal, including the prediction market fraud risk baked into its business model and the leadership decisions that made things worseWhy Polymarket scrapped its same-source withdrawal rule to speed up payouts, and how that decision opened the door to real money laundering prevention failuresA serious account takeover fraud exploit where a new account created with someone's stolen SSN could inherit their existing balance and linked cards, no password neededWhy compliance staffing fraud programs need people with actual prevention experience, not just investigators brought in after the factHow growth at all costs fraud risk plays out when a CEO's response to an 80% fraud rate is reportedly "just keep growing and pay a fine"A new bank coalition report on agentic commerce fraud, and why AI shopping agent chargeback liability still has no real framework under current Visa and Mastercard rulesAn AI-generated fake delivery order used to attempt a retail theft at Walmart, and a Georgia police chief's warningWhat a real chargeback monitoring program actually looks like from the inside, and why Polymarket landing a fraud vendor like Riskified says a lot about how serious this problem became You should listen to this episode if you:Work in payments, card fraud, or retail fraud prevention and want a grounded look at how AI is scaling attacks you already knowAre building or evaluating a chargeback monitoring program and want a real, public example of what happens when fraud rates spiralCare about prediction market fraud risk or are watching the regulatory and legal fallout at companies like PolymarketAre responsible for compliance staffing fraud programs and want language for why prevention expertise matters as much as investigative expertiseAre tracking agentic commerce fraud and want to understand the AI shopping agent chargeback liability gap that still hasn't been solvedWant practical, real-world examples of AI-generated fake delivery orders and AI phishing scams to bring back to your own fraud team

    AI Enabled Fraud: When Growth Comes Before Guardrails

  6. Sep 24

    Food Delivery Fraud: From Diner to Doorstep

    I'm joined today by Sudhir Lanka, Associate Director of Fraud Strategy at GrubHub. Sudhir's team doesn't just cover GrubHub anymore. His scope recently expanded to include Wonder, GrubHub's new parent company, and Blue Apron, which means he's thinking about food delivery fraud across three genuinely different business models at once, and I wanted to dig into how that actually changes his approach. We get into what makes a three-sided marketplace uniquely exposed to fraud, since GrubHub has to protect diners, restaurants, and drivers all at the same time, and a gap in protection on any one side eventually breaks trust for everyone else. Sudhir walks through the primary fraud vectors his team deals with, account takeover, payment fraud, refund abuse, and promo abuse, and gives some of the most specific, real-world detail I've heard on this podcast about how each one actually plays out, down to the exact excuses customers give to get a refund they're not owed. What you'll hear in this episode:How Sudhir's career path through JP Morgan Chase, Discover, and GrubHub shaped his approach to fraud strategy at each stage of scaleWhy GrubHub, Wonder, and Blue Apron each carry different food delivery fraud risks despite serving the same underlying missionThe three primary fraud vectors GrubHub tracks, account takeover, payment fraud, and refund and promo abuse, and how they show up differently across business linesA detailed walkthrough of restaurant account takeover, including how a compromised owner's email can lead to a redirected ACH payout and an expensive double payment for GrubHubReal examples of driver and diner collusion, including self-delivery loops and a surprising exploit tied to minimum wage laws in cities like Seattle and CaliforniaWhy refund abuse and first party fraud can't be predicted at the time of transaction, and Sudhir's framework for placing controls at the actual point of irreversibility insteadHow layered fraud controls work across account creation, checkout, and post-order stages, including multifactor authentication, 3DS authentication, CVV validation, and delivery PIN verificationThe difference between soft friction and hard friction, and why Sudhir intentionally reserves harder friction for a very small percentage of customersWhy Sudhir sees fraud strategy as fundamentally pro-growth, not anti-growth, and how protecting trust across the marketplace translates directly into revenue You should listen to this episode if you:Work in fraud strategy at a marketplace, food delivery, or platform business balancing multiple user typesAre dealing with refund abuse, promo abuse, or first party fraud and want a real framework for controlling it without over-relying on predictionWant to understand restaurant account takeover and payment redirection fraud from the platform's side, not just the consumer sideAre building or refining layered fraud controls and want concrete examples of where soft friction versus hard friction actually belongsNeed language to make the case internally that fraud strategy is pro-growth, not a blocker to it

    Food Delivery Fraud: From Diner to Doorstep

  7. Sep 17

    A Government Email Phishing Scam and the ID Scan Breach Update

    Welcome back to Fraudology. This is a solo episode, and I’ve got two stories for you this week. I wanted to follow-up on the ID scan breach that Frank McKenna and I discussed last week. Where things stand now, whether we should still be worried, and what the driver’s license data breach means for KYC fraud prevention going forward. And then I wanted to get into one of the biggest fraud stories this week. This one is brand new and I wanted to get it to you as soon as possible. A government email phishing scam hit Revolute using what appeared to be a legitimate .gov email domain. The request was fulfilled. Customer data was released. And it did not require a breach of Revolute at all. It required a spoofed email that looked real enough to pass. I have been talking to my fraud threat intelligence sources about this, including someone with a background at one of the three-letter government agencies. What he told me changed how I’m thinking about this incident entirely. We are going to get into all of it. This is a fraud news episode, and I’m going to keep it tight today. Let’s dive in. What you’ll hear in this episode:The ID scan data breach update. Where the 153 million driver’s license database stands now, why the FBI takedown matters, and whether we should still be treating this as an active threat.Why the ID scan breach was so dangerous for KYC fraud and identity document fraud detection. And why most verification companies would not have caught it.What supply chain data breach risk looks like in practice and the vendor contract language every financial institution should have in place.The Revolute government request fraud incident explained. What data was released, what a fraudster can do with it, and why it could be used for identity theft and espionage.Why a .gov email domain is harder to spoof than it sounds, what a CAC card is and why it matters for government email security, and what my fraud threat intelligence source actually thinks happened.The three most likely explanations for this government email phishing scam. Including the foreign adversary fraud angle that changes the whole picture.How to prevent government email phishing at your financial institution, email authentication tools, two factor authentication for sensitive inbox access, and training the team that handles government information requests.Why this kind of email domain spooking fraud is going to be attempted again, and what neobank fraud prevention teams specifically need to have in place. You should listen to this episode if you:Work in fraud, compliance, or risk at a bank, neobank, or financial institution and want to understand what the Revolute incident actually means for your team.Are responsible for financial institution phishing prevention and want practical recommendations you can bring back this week.Want to understand how government impersonation fraud works and why a .gov email does not guarantee legitimacy.Are evaluating your vendor contracts for supply chain data breach liability language and want a framework for what to include.Work in KYC fraud prevention and want to understand why the ID scan data breach was uniquely dangerous for identity document verification.Follow fraud news and want a practitioner's read on what actually happened with Revolute, not just the viral LinkedIn version.

    A Government Email Phishing Scam and the ID Scan Breach Update

  8. Sep 10

    Impersonation Scams: When an ID Isn’t Proof

    Welcome back to Fraudology. I’m joined this week by Frank McKenna of Frank on Fraud and Point Predictive, because this was one that I needed a second brain to process it all with me. I was heads-down working on the Merchant Fraud Alliance agenda when my phone would not stop buzzing. It was a group chat with the people I trust to tell me when the big deals are happening versus just internet noise. And this time, it was a big deal. Brian Krebs had uncovered a dark web portal selling real driver’s licenses. Front, back, barcode, and all. For the price of about a hundred dollars each. That’s roughly 60% of the entire US population sitting in a database that almost anyone could buy. The rest of this episode is really two stories that are more connected than you realize once you start looking deeper. The data breach itself is only half of the story. The other half is understanding the vendor working behind the scenes of a huge number of household-name businesses, handling their identity verification. That’s what makes this breach so much bigger than it looks on the surface. Then we shift to the scam that has been on my mind since Frank first flagged it last year. Digital arrest is a form of psychological captivity scam that’s now officially made the leap from India to the United States, with real victims and real seven-figure losses to prove it. Buckle up, because the way to start fighting this is to know what we are up against. What you’ll hear in this episode:How a supply chain breach at an identity verification vendor exposed 153 million physical driver’s licenses, and why that’s different from a typical retail data breach.Why forged identification cards used to be the thing fraud detection software looked for, and why that entire approach breaks down when the ID being used is real.How AI deepfake drivers license techniques let someone swap their face onto a real, stolen license and pass a liveness check.What digital arrest actually is, and why I was wrong to assume it would stay contained.Real case studies of US victims, including a woman held under surveillance for two months and who lost $4.2 million.How digital arrest has evolved into homegrown versions, including police impersonation and FBI impersonation calls, plus jury duty bail scams.The scam compounds and pig butchering scam infrastructure in Cambodia that’s now being repurposed for new scam types.Why some of the jury duty and bail scam calls are reportedly coming from contraband cell phones inside US prisons. You should listen to this episode if you:Are working in identity verification, KYC, or fraud prevention and need to think what “the ID is real” actually proves.Are a fraud and risk professional at a bank who may be the first to see a victim of digital arrest scams withdrawing large sums under duress.Someone who wants to understand how a breach at one vendor can quietly expose customers of dozens of major, recognizable brands.Are part of a consumer-facing team and may need to train frontline staff to recognize a customer who’s on the phone with a scammer while standing at the counter.

    Impersonation Scams: When an ID Isn’t Proof
See All (423)

4.8
out of 5
39 Ratings

About

If you work in online fraud prevention, chances are you've caught the "bug". The bug that makes you passionate about identifying & preventing cybercriminals from getting away with stealing from your company, or your client's companies. Most people who have made cyber-fraud their career have the perfect balance of analytical and social skills, a strong sense of justice and the curiosity that will drive you to go down every path of information until you "crack the case". Just like sociology is the study of social behavior, and psychology is the study of human behavior, Fraudology is the science and study of fraud. On the Fraudology podcast, long-time online fraud expert, Karisse Hendrick will dive into all areas of Fraudology from the perspective of a fraud-fighter. With guests ranging from former cybercriminals to fraud-fighters at Fortune 500 companies to law enforcement and others, you will no doubt be entertained, while learning a lot about fraud & other forms of abuse prevention! Subscribe to be alerted when a new episode is out and please rate & review where you can, to help others find this new & unique podcast!

Information

More From Rolled Up Network

You Might Also Like