Inside the Arms Race to Stop AI Deepfakes From Beating Identity Checks

Okay. Let's get this thing started. This is gonna be a mega show today. This is gonna be our first one. We have we have about a dozen conversations stacked up today. It's gonna be a fun day. We're here again in Mexico City. We're kicking off the day with Nano from Bitso and Inigo from Inco. StableDash live is sponsored by Agora, built for global institutions, moving money at the speed of the Internet. You can learn more at agora.finance.

There's some partnership announcements. There's some fun things that you guys are gonna do together. Maybe maybe we start with, we'll kick off with Nana. If you wanna intro yourself in your role at the company, we'll do the same for you next. And then I'd love to just kick off with the partnership that you guys are talking about today. Sure. Thank you. Thank you, Drew. So quick intro on my side. I am am Manuel Rodriguez. I lead payments and operations here at Bitso. I'm super excited to be here.

Thanks for for the invitation to the to the to the podcast, but also happy to have you here Yeah. In this event conference. Very, very fun days. It is the second day, so a lot of activity happening. Nana, you've been at Bitso for how long now? It's been I have been for five years and a half. Five years. It has been a while now. Yeah. But, yes, it's been a lot. You've seen a lot at the company through that time. Indeed. Yeah. It has it has been a long drive, similar to a roller coaster maybe, but, yeah, far behind.

And what is your current focus? I'm sure that has evolved a lot in five years. What are you currently focused on? As a company, do you mean? Or For for you personally at at the business. So right now, am leading the, the payments team that which it's a component it has different components. I I under my rep reports, I I lead the operations, team, the alliances team that manage the, the key relationships as Encode that has, become one of, the relevant partner for us.

We manage our legacy with our key payments providers, intermediaries that we're using across the region. So that's the, like, the payment function,

right now, and that's my current focus. Awesome. Cool. Pass to you. I'll try I'll try my best to mediate throughout the throughout the chat. It's always it's a little easier being one on one, but I'll do my best. That's great. How about you? Super happy to be here.

Inigo Castillo, I live, Encode, at LATAM. So here from Mexico City, we run operations all the way down to to Buenos Aires. Encode is an identity company. So what we do is we help customers in a variety of of of sectors and industries to adequately, identify their their customers and prospects in a in a, I mean, in a ever more fraudulent environment. Right? I mean, fraud is getting more complex and and and more sophisticated to catch.

So, I mean, we help, our customers to in a very simple way to identify the good guys and the bad guys when they're acquiring customers.

I was talking last night with, I was I was at I was at a ramp event. Mhmm. And, I'm forgetting the name of this company, but it was it was someone building in compliance who was based in Mexico City. And, I asked the question what the difference is between compliance and fraud. Mhmm. It seems like a there's there's sort of sharing a Venn diagram, but how would you describe he I think he described it as, well, I'll let you describe. How do you see the differences? Yeah.

I mean, it it's an interesting question, and we see it because when we I mean I mean, we're an enterprise

service company. Right? And we do our own stakeholder mapping. And, you know, it's such a different conversation when you talk to a head of fraud or a company and you when you talk to a compliance officer. So compliance officers usually just go through their it's like a checkbox. Right? And they're doing their checkbox, and they're they want to be sure when a regulator comes in or whatever that they're ready.

And then fraud has, I think, at least in my opinion, a a deeper, or or a more business oriented and that sounds interesting, but a business oriented outlook where, you know, they, it's not just checking the boxes. Right? I I mean, if you ask a a fraud money or whatever, they they they get they get paid for how much fraud they let pass or not. Right? It's so it's not just it has a direct impact or or they they keep a a more direct impact on a company's balance sheet at the end.

So I I would say that's kind of the difference. I think, again, compliance officer are more regulate regulated focused stuff like that. Yeah. Okay. So

I wanna dive into more of, like, you know, each each of the focus of each of you separately, but what are what are you announcing today? What is this partnership and,

yeah, give us the details of how you guys come together. Yeah. For sure. Maybe maybe sharing a little bit of of background here for a better understanding of the decision and how these partnerships comes in place. But Visio has been historically characterized itself by being in a company that we bought trust and security on top of any other priority. That's nonnegotiable for us.

We we have been operating in this region for twelve years, and our main value for no matter what team do you work is to honor the the commitment with trust and security that we have with our users and customers' funds. So I I think that, in honoring that commitment, we are obviously continuously evolving that way, that we build, solutions and the companies that we partner up with to help us in this mission of becoming the most secure and trusted platform across the region.

So as a result, this was a maybe this is a long story, B2B has a set of different providers to validate the identity of the users that are being onboarded into our company. We have, like, more than 9,000,000 users on the retail side and 2,000 businesses on the B2B business side or the B2B, arm of our company.

You said $99,000,000 or 90,000,009 million. 9,000,008. Consumer users Yeah. And then, 2,002

businesses. Okay. Yeah. So we found out that there were there were, like, an opportunity to to improve the way that we were validating identities to individuals in the region. And in the team that I lead, it was historically a payments team, a payments related. So this was a hard mission because, we decided to run an RFP and to took all the relationships, with our current providers that runs KYC or ID verification in Bitso to to really make a bold, move, and improve the the the way that we were validating this.

So in alignment with those end of teams in BITSO with compliance, legal, product, operation, engineering, etcetera. We built one of the strongest,

maybe longest RFPs that was ever built to evaluate all vendors across the industry. I mean, I cannot test the list. Let me put you through a lot is what you're saying. You work for this one.

She can confirm that. So we built this very long process, very tough process with dozens of tests, real tests, dozens of questionnaires, etcetera. And we evaluated more than 30 different vendors across the region. Wow.

That's a lot. I'm surprised there's, like, 30 people in this this stack Yeah. That can deliver. And this is just to be clear for people who are kind of, like, you know, getting to know this this a little bit.

So this is like, this is the process that you go to if I'm wanting to get an account with BitsO to, know, whether I'm trading trading or sending funds or bringing funds into the platform, this is a part of the process, which is typically, like, the worst part of the process because it's typically, like, full of a ton of steps and time, and it can be a really, it can be a it can be a process that loses customers if you do it wrong. And there's a ton of, like Yeah. User experience things.

So this is, like, for all the companies that we talked with, this part of the the stack has typically been riddled with with friction historically. Mhmm. So there's, like, this interesting balance of, like, you want it to work, but you also want it to feel seamless.

We can dive we can dive into this a little bit, but keep but keep going. I just wanted to frame, like, where this takes shape. Oh, that's that's totally accurate. So, yes, as a result of this very long thought process that we put together, encode result with a winner, in sort of, like, dimensions, characteristics. I won't pitch you encode.

I I I will let Inigo to to pitch, encode in that sense, but I can confirm that the the main drivers of the decision was obviously that we saw the the technology kind of stack that Inco have, that it was very smooth, for our for the user experience, but also they were very connected to all databases, across the region, specifically in Mexico, which is our main market.

So we can validate the the identity of our users against all those different databases and be sure that the user that we are onboarding is a real user, and we are, we are not failing in in that screening. Right? So it has, like, both both sides of the of the coin. First, ensuring a great user experience, but also a very, deep connection to databases and controls that we need to have in place.

Because if we, in fraudulent user users, it's not only a a detriment or or a risk for the company, but it's also for other users as well because it's kind of a shared risk, you know, at some point, maybe. So that was, like, the ultimate reason that that we selected Encode as a to becoming one of our partners to to identity validation and and other checks that we do for onboarding.

What was the before we get into what what it is, just what what was the thing that stuck out most to you? And you you reviewed many different companies here. Like, what was the what was one of the key deciding factors

of why they stood out in your mind? I would say that, like, a strong LatAm footprint that Inco have was the one of the main differentials against the other Regional depth. Yeah. Exactly.

So speak a little bit about that. How have you built that, and what what are these databases that he's very thankful that you guys have integrated so well? Yeah. So the database thing is is interesting because we kind of pioneered that in Mexico, actually. So there's I mean, this varies by country. There's some countries

like The US, for example, where it's, like, highly federated. The identity is managed in a very federated way. Right? So if you go the like, you go to Washington, there's not, a federal, you know, database of, you know, biometric data or whatever. You have to go to the DMV, for example, and each DMV is run by the state. So that's an example. You go to Brazil, and then that's, again, that's even more fragmented, right, because you have so many different ID documents, and each state has their own its own rules.

And then you have countries like Mexico or Colombia, for example, where you have a centralized governmental institution, in the case of Mexico, the electoral institution that serves as that source of truth. We call them source of truth.

So what that gives you in the process of identifying someone, it it turns from a probabilistic identification where you use, you know, our algorithms and all that to a deterministic one because you can, for sure know if whoever is onboarding or whoever is doing an authentication process is who they say they is against a governmental database that has a bunch of data, well, you know, of of data points. Right? It could be biometrics. It could be course name, address, whatever. Right? So we pioneered that.

That that's that's an important thing. We're pioneering that in US as well, for example. We're first company to be able to connect to several of the safety of these. Right? And a bunch of our clients in The US are quite happy, at that. And then we've done it in Colombia. We've it in Argentina. Now there are countries where that's not possible. There are processes where that is not needed from a regulatory standpoint.

So still, you need to be very strong on the performance of your algorithms when you're doing ID and and ID verification. And I think that's also what sounds out about InCode. I mean, we own our all our stack, and that's very important because a bunch of our competitors kind of bunch third party, technology on top of their of their solution. What owning our own stack gives us is that, I mean, fraud is changing so fast.

You need to adapt really fast, and and and not owning your own stack just makes you slower to react. Right? Yeah. Let's let's dive into this a little bit. Like, what are you both I mean, one, from maybe taking the infrastructure side of this, you're probably integrated with many different companies. You're seeing, like, across fintech or across different applications, the attempts at, you know, attempts at being fraudulent. You see all of that.

I'm wondering for for each of you, like, what are what are you seeing thematically that you maybe have seen in the past or, like, examples of that you were able to stop from happening? Like, give us give us a re as as tangible as possible, like, what is actually being prevented here, and what have you seen happen,

you know, if if these types of things aren't in place? Yeah. I mean, I I think the the LATAM point that Nano was making comes into place here because, I mean, Inco, despite now being quite a global company, really started out in LATAM. And LATAM is as much as an adversarial place in the world to work in fraud. Right? I mean, the type of fraud that we were seeing four or five years ago in Brazil, you you will not believe, I mean, what we're seeing now. What does that mean for those what does that mean?

So so it means, like, you know, the level of sophistication of deepfakes, for example, right, Or the ability for fraudsters to, you know, get a jailbroken phone, put a virtual camera in, and then, you know, slide,

deepfake videos in order to bypass an onboarding process. So this is the part where they will essentially it's identity fraud where where they'll appear that using using a deep fake, they will that part of the KYC process where you're showing your face, like Exactly. That would be Exactly. Like like Exactly.

Like, bypassing a liveness. Aliveness test. Aliveness test. The thing is, I mean, the the MO is known. It's just the quality of how they're doing things with I mean, we always talk about AI, and AI is lowering, of course, barriers, and and creating access and all that. But there's this other side that we see is that AI is just giving all these tools to the to the fraudsters who are able to just increase the quality of of their attacks. Yeah.

And and it's and the only way to counter that is with just better technology, better machine learning algorithms, and that's I I think that's where we've we stand out because when we when we build the company ten years ago, we always thought that there will be there will come a time where man the the human eye will not be able to verify identity. So all our, you know, most a lot of the, you know, the the legacy identity companies had a a human in the loop process, right, to to to verify identity.

And since we started without that, just and in LatAm, we you would have these two modes. Right? It's just time and data. And we've been able to to, I mean, kind of climb on that to to have the best trained models in the world, we think, to do a completely automated,

identity verification. Yeah. Nana, what about you? What are you what are you seeing when it comes to what you're what you're ultimately trying to prevent here? What have you seen? What are some of the maybe learnings you've seen internally with this conversation around fraud and compliance? Or what have what have you maybe seen in the industry externally that you're trying to avoid? Why is this so important for you to get right?

Yeah. I I think that I fully agree with what Inyo say here that the the level of sophistication that we are seeing in the industry, to to create fraud, it's it's incredible. We haven't we have seen very, like, strong cases where deep fake AI, I've seen you say that people that do the liveness check, but they have plugged in or do the data there the the the device so they can just generate a deep deep fake AI version of of their sales for a different person.

And several companies are failing to to validate and and detect that. So we are preparing a little bit for the future because AI and the this fraud will keep evolving with the time, and we want to be paired up with them with a provider that has a very strong technological stack to adapt their self at a time as fast as the fraud is adapting to new tools and ways to to commit fraud. No? So that's the ultimate reason that that we partner up, but it's also what we are seeing, that is gonna happen in the future.

So having folks like, Encode on on on top of our validations makes us being more prepared for for for that future where with the time, it's gonna become very, very hard to to detect fraudulent in in in platforms digital platforms overall.

Right? What are what are some for those who aren't working in compliance or fraud full time or and they're not they're not seeing this, I think crypto digital assets for for in some ways, good reason has been associated with fraud and and crimes, and bad actors typically are you know, this industry has like any payments industry, we have had our fair share of that.

What are you guys seeing as, like, really the main the main use cases that you're trying to avoid or, like, landmines that, this type of relationship or this technology avoids? For those who aren't working in in the conversation, what are the most common ways that fraudsters are leveraging these types of tools?

Like, I'd love specific use cases that you've seen or, like, common ways that you know, deepfakes is a good example, but, like, let's just say that let's say that that happens and they are able to these fraudsters are able to access these systems. Why do they like, how are they once they're in, what are they doing? Like, what what what are the core ways that they're taking advantage of this? There is a long variety of use cases, to to be honest. Bad actors are

basically trying to or to, like, to launder money or to enter money that that that is from illegal sources to platforms. Likely, in in in Bitso, as as I mentioned, we invested a ton since our very beginnings into into having great fraud prevention barriers, and controls on top of our onboarding processes. So we haven't seen many of that in in our platform. But as I mentioned, we are seeing that the the the in in the industry, the fraud cases are are constantly evolving.

So we want to be prepared for for for for that for that future, wherever the sophistication is super high. But ultimately, answering your question, use cases are the, like, bad actors that use an identity of of a person that they are not their self, but they, maybe through pre phishing, they got some personal information from a third party and they onboarded that person, using an identity that is not their self to move money, or to move illegal funds across the financials, financial services.

And that's I will say that it's, the most common use case of bad actors.

And for sure, maybe Inyo has more context and Yeah. I mean, I can give a couple of examples. I mean, on on lending use cases, for example, I mean, you can onboard and then So if I have, like, a great credit history

and so and someone who doesn't could intentionally try to steal my credit my identity to you. We were we saw fairly recently in one of the countries we operate

where credit bureau information was filtered, for example. Right? So a fraudster could get still your identity and go ask a credit on your behalf if you had a good credit, and then they'll they'll they'll open a new account, they'll receive the funds and run away. Another is, you know, financial institutions have several authentication use cases. Right?

So you might have a biometric authentication use case for when you want to, you know, change the device that you have had uploaded with a with a with a with a bank or whatever. And those are great windows for account takeover, use cases. Right? So someone can impersonate you, take over your account, and and literally just go inside and and and empty empty your account. So going back to one of your original points is how how do you, you know, build this trust layer

without adding friction to an already friction full process? Yeah. Because you could you could take, you know I mean asking questions and diligence. You need to

go to a Yeah. Let's the stake in the I mean And and and then it kind of defeats the purpose of of, you know, what companies, what are doing, which is just decentralizing and giving access and lowering barriers and all that. So, that's what we feel, like, really at at Inco, we feel really compromised in our partnerships because we are an agent of a lot of the missions that, you know, companies like Vizso are are pursuing. Right? I mean, we are a very special part

of that, and we take that very seriously. Yeah. Yeah. It's an interesting tension because you want to these tools reduce barriers. They give access by nature, but compliance and onboarding by nature is putting barriers in the way. Correct. So it it is an interesting thing. You know, as as we as we close here, I know this was quick. What would you guys say just from maybe your perspective as the adopter or the platform side and then you as the infrastructure?

Like, what would be the main if if you were speaking to others in your positions and other companies or you're speaking to other other nanos Mhmm. What is your what is your main piece of advice or, like, things that you've learned throughout this very extensive process of vetting Encode? Like, what would be your advice to maybe others at other payments companies who are considering this this, really crucial stack decision?

Yeah. I think that I am gonna, repeat myself a little bit, but it's it's a matter of preparing for the future because, no matter if the current company is not receiving these fraudulent actors, it's it can just happen in a second. The bad actors, exploit the vulnerability in a in a in a platform.

And if you are not prepared, if you that you haven't built the right technological stack, if you haven't partnered up with the right persons to make those controls or help you during the onboarding process, that company is gonna be under a sever sever severe risk. So my suggestion maybe for for those in the in my role as another company is is to be prepared because we are seeing that AI is evolving at an exponential rate, and everything is changing.

And you really want to to have, a very robust partner helping you, abstracting all that complexity out from the users, but also ensuring that, you are gonna be prepared for that for that moment. Awesome.

Yeah. I mean, we see our partnerships as technology partnerships. Right? So what we offer our customers is that we jump on our bandwidth innovation. Right? We're at the forefront of a lot of these things, and I think that depend on us on our ability to speed up innovation. And and and we're seeing that. I mean, at some of the topics we're talking about, they will just get more complex. The trust part will always be at risk. For example, as as as we enter the agentic world and economy. Right?

I mean, just imagine each of us is gonna have, you know, hundreds of agents working on our behalf, maybe moving funds from one place to another. There's gonna be the need to put processes in place to identify the who's behind those agents. Right? Like, the personhood part. Not it's not only just, you know, if you are who you say you are, it's if if you're human, right, doing the process. And we are entering into all these things that are quite frontier, but it they're closer than, yeah, what we might imagine.

And I imagine Bitvo is depending on us and saying, well, you know, they're probably working on their their, you know, their their agentic plan and all that is, well, how are we gonna be able to, you know, partner up in that as well. Right? And and so that's an example on how it is, at the end, an innovation partnership. And I think that's what we offer, and we're super happy to to to to be able to have the trust of of of of Pizzo and and looking forward to this. It's incredible.

Well, we, in the coming weeks, are announcing a new series a new media series called Incline, which is gonna be focused entirely on Agenza Commerce.

So if you guys are build building some some cool stuff in that world together, maybe we can have you guys back for for that. We do the show virtually. I know we're in person right now. But, guys, this was fun. Thanks for unpacking this relationship a little bit, diving into the yeah. Just the the key part of the stack around compliance. I know it can be, like, boring for some, but it's incredibly important to get right as we've as we've talked about. So really appreciate appreciate y'all, Sam. Happy to be here.

Appreciate you. That was our live conversation with Bitso and Encode here in Mexico City. We're in the Stabilash booth powered by Agora. We're gonna take a quick break, and we'll keep having we have a lot of conversations up next. So folks, stick with us. We'll be right back. Thank you.