Fraudology Podcast with Karisse Hendrick

Welcome back to Fraudology.
AI is here, and it’s making every kind of fraud we already know cheaper, faster, and harder to catch. We are going to walk through a handful of stories that show exactly how AI enabled fraud is showing up right now. From card testing at scale to one very messy fraud story.
That story is Polymarket, and I spend some real time on it. It’s rare that we get this much visibility into a company’s actual fraud details. A Wall Street Journal investigation lays out the stolen debit cards linked to thousands of new accounts and a fraudulent deposit rate that hit 80%. I also get into AI-generated deepfake delivery orders, a bank coalition’s new warning about agentic commerce fraud, and a warning about AI voice cloning scams.
We aren’t eliminating fraud, we never can, but we can get the information to be as fast or slightly faster than the fraudsters.
What you’ll hear in this episode:
Why AI-enabled BIN attack fraud and card testing are up over 75% according to at least one fraud vendor, and how fraudsters are now optimizing payment authorization the same way legitimate payment teams do
A full breakdown of the Polymarket fraud scandal, including the prediction market fraud risk baked into its business model and the leadership decisions that made things worse
Why Polymarket scrapped its same-source withdrawal rule to speed up payouts, and how that decision opened the door to real money laundering prevention failures
A serious account takeover fraud exploit where a new account created with someone's stolen SSN could inherit their existing balance and linked cards, no password needed
Why compliance staffing fraud programs need people with actual prevention experience, not just investigators brought in after the fact
How growth at all costs fraud risk plays out when a CEO's response to an 80% fraud rate is reportedly "just keep growing and pay a fine"
A new bank coalition report on agentic commerce fraud, and why AI shopping agent chargeback liability still has no real framework under current Visa and Mastercard rules
An AI-generated fake delivery order used to attempt a retail theft at Walmart, and a Georgia police chief's warning
What a real chargeback monitoring program actually looks like from the inside, and why Polymarket landing a fraud vendor like Riskified says a lot about how serious this problem became

You should listen to this episode if you:
Work in payments, card fraud, or retail fraud prevention and want a grounded look at how AI is scaling attacks you already know
Are building or evaluating a chargeback monitoring program and want a real, public example of what happens when fraud rates spiral
Care about prediction market fraud risk or are watching the regulatory and legal fallout at companies like Polymarket
Are responsible for compliance staffing fraud programs and want language for why prevention expertise matters as much as investigative expertise
Are tracking agentic commerce fraud and want to understand the AI shopping agent chargeback liability gap that still hasn't been solved
Want practical, real-world examples of AI-generated fake delivery orders and AI phishing scams to bring back to your own fraud team

I'm joined today by Sudhir Lanka, Associate Director of Fraud Strategy at GrubHub. Sudhir's team doesn't just cover GrubHub anymore. His scope recently expanded to include Wonder, GrubHub's new parent company, and Blue Apron, which means he's thinking about food delivery fraud across three genuinely different business models at once, and I wanted to dig into how that actually changes his approach.
We get into what makes a three-sided marketplace uniquely exposed to fraud, since GrubHub has to protect diners, restaurants, and drivers all at the same time, and a gap in protection on any one side eventually breaks trust for everyone else. Sudhir walks through the primary fraud vectors his team deals with, account takeover, payment fraud, refund abuse, and promo abuse, and gives some of the most specific, real-world detail I've heard on this podcast about how each one actually plays out, down to the exact excuses customers give to get a refund they're not owed.
What you'll hear in this episode:
How Sudhir's career path through JP Morgan Chase, Discover, and GrubHub shaped his approach to fraud strategy at each stage of scale
Why GrubHub, Wonder, and Blue Apron each carry different food delivery fraud risks despite serving the same underlying mission
The three primary fraud vectors GrubHub tracks, account takeover, payment fraud, and refund and promo abuse, and how they show up differently across business lines
A detailed walkthrough of restaurant account takeover, including how a compromised owner's email can lead to a redirected ACH payout and an expensive double payment for GrubHub
Real examples of driver and diner collusion, including self-delivery loops and a surprising exploit tied to minimum wage laws in cities like Seattle and California
Why refund abuse and first party fraud can't be predicted at the time of transaction, and Sudhir's framework for placing controls at the actual point of irreversibility instead
How layered fraud controls work across account creation, checkout, and post-order stages, including multifactor authentication, 3DS authentication, CVV validation, and delivery PIN verification
The difference between soft friction and hard friction, and why Sudhir intentionally reserves harder friction for a very small percentage of customers
Why Sudhir sees fraud strategy as fundamentally pro-growth, not anti-growth, and how protecting trust across the marketplace translates directly into revenue

You should listen to this episode if you:
Work in fraud strategy at a marketplace, food delivery, or platform business balancing multiple user types
Are dealing with refund abuse, promo abuse, or first party fraud and want a real framework for controlling it without over-relying on prediction
Want to understand restaurant account takeover and payment redirection fraud from the platform's side, not just the consumer side
Are building or refining layered fraud controls and want concrete examples of where soft friction versus hard friction actually belongs
Need language to make the case internally that fraud strategy is pro-growth, not a blocker to it

Welcome back to Fraudology.
This is a solo episode, and I’ve got two stories for you this week. I wanted to follow-up on the ID scan breach that Frank McKenna and I discussed last week. Where things stand now, whether we should still be worried, and what the driver’s license data breach means for KYC fraud prevention going forward.
And then I wanted to get into one of the biggest fraud stories this week. This one is brand new and I wanted to get it to you as soon as possible. A government email phishing scam hit Revolute using what appeared to be a legitimate .gov email domain. The request was fulfilled. Customer data was released. And it did not require a breach of Revolute at all. It required a spoofed email that looked real enough to pass.
I have been talking to my fraud threat intelligence sources about this, including someone with a background at one of the three-letter government agencies. What he told me changed how I’m thinking about this incident entirely. We are going to get into all of it.
This is a fraud news episode, and I’m going to keep it tight today. Let’s dive in.
What you’ll hear in this episode:
The ID scan data breach update. Where the 153 million driver’s license database stands now, why the FBI takedown matters, and whether we should still be treating this as an active threat.
Why the ID scan breach was so dangerous for KYC fraud and identity document fraud detection. And why most verification companies would not have caught it.
What supply chain data breach risk looks like in practice and the vendor contract language every financial institution should have in place.
The Revolute government request fraud incident explained. What data was released, what a fraudster can do with it, and why it could be used for identity theft and espionage.
Why a .gov email domain is harder to spoof than it sounds, what a CAC card is and why it matters for government email security, and what my fraud threat intelligence source actually thinks happened.
The three most likely explanations for this government email phishing scam. Including the foreign adversary fraud angle that changes the whole picture.
How to prevent government email phishing at your financial institution, email authentication tools, two factor authentication for sensitive inbox access, and training the team that handles government information requests.
Why this kind of email domain spooking fraud is going to be attempted again, and what neobank fraud prevention teams specifically need to have in place.

You should listen to this episode if you:
Work in fraud, compliance, or risk at a bank, neobank, or financial institution and want to understand what the Revolute incident actually means for your team.
Are responsible for financial institution phishing prevention and want practical recommendations you can bring back this week.
Want to understand how government impersonation fraud works and why a .gov email does not guarantee legitimacy.
Are evaluating your vendor contracts for supply chain data breach liability language and want a framework for what to include.
Work in KYC fraud prevention and want to understand why the ID scan data breach was uniquely dangerous for identity document verification.
Follow fraud news and want a practitioner's read on what actually happened with Revolute, not just the viral LinkedIn version.

Welcome back to Fraudology.
I’m joined this week by Frank McKenna of Frank on Fraud and Point Predictive, because this was one that I needed a second brain to process it all with me.
I was heads-down working on the Merchant Fraud Alliance agenda when my phone would not stop buzzing. It was a group chat with the people I trust to tell me when the big deals are happening versus just internet noise. And this time, it was a big deal. Brian Krebs had uncovered a dark web portal selling real driver’s licenses. Front, back, barcode, and all. For the price of about a hundred dollars each. That’s roughly 60% of the entire US population sitting in a database that almost anyone could buy.
The rest of this episode is really two stories that are more connected than you realize once you start looking deeper. The data breach itself is only half of the story. The other half is understanding the vendor working behind the scenes of a huge number of household-name businesses, handling their identity verification. That’s what makes this breach so much bigger than it looks on the surface. Then we shift to the scam that has been on my mind since Frank first flagged it last year. Digital arrest is a form of psychological captivity scam that’s now officially made the leap from India to the United States, with real victims and real seven-figure losses to prove it.
Buckle up, because the way to start fighting this is to know what we are up against.
What you’ll hear in this episode:
How a supply chain breach at an identity verification vendor exposed 153 million physical driver’s licenses, and why that’s different from a typical retail data breach.
Why forged identification cards used to be the thing fraud detection software looked for, and why that entire approach breaks down when the ID being used is real.
How AI deepfake drivers license techniques let someone swap their face onto a real, stolen license and pass a liveness check.
What digital arrest actually is, and why I was wrong to assume it would stay contained.
Real case studies of US victims, including a woman held under surveillance for two months and who lost $4.2 million.
How digital arrest has evolved into homegrown versions, including police impersonation and FBI impersonation calls, plus jury duty bail scams.
The scam compounds and pig butchering scam infrastructure in Cambodia that’s now being repurposed for new scam types.
Why some of the jury duty and bail scam calls are reportedly coming from contraband cell phones inside US prisons.

You should listen to this episode if you:
Are working in identity verification, KYC, or fraud prevention and need to think what “the ID is real” actually proves.
Are a fraud and risk professional at a bank who may be the first to see a victim of digital arrest scams withdrawing large sums under duress.
Someone who wants to understand how a breach at one vendor can quietly expose customers of dozens of major, recognizable brands.
Are part of a consumer-facing team and may need to train frontline staff to recognize a customer who’s on the phone with a scammer while standing at the counter.

Welcome back to Fraudology.
It’s just me for this episode, but I’ve got two stories to dig into. They are genuinely important for anyone dealing with chargeback disputes. Whether you’re on the merchant side or the banking side.
The first is Uber and the nearly billion dollars in fines for automated account deactivation. The second story is the story that I really want to unpack. Hims and Hers blowing past their chargeback threshold on their weight loss subscription business.
It’s rare that this stuff becomes public, and I think there’s a lot merchants can learn from it. I know a lot of companies leaning on AI right now to cancel buyer or seller accounts. We will walk through the math on chargeback fee per dispute, what’s actually driving these disputes, and what I’d tell these businesses if they were my client.
What you’ll hear:
Why Uber's near-billion-dollar GDPR fine over automated account deactivation AI should matter to any company using AI to cancel buyer or seller accounts, not just ride-share platforms.
How Visa's acquirer monitoring program actually works, including the chargeback threshold merchants need to stay under and the real dollar cost once they don't.
A full breakdown of the Hims and Hers chargeback situation, including the FTC lawsuit, Restore Online Shoppers Confidence Act violations, and real customer complaints pulled from public FOIA records.
How I'd approach chargeback root cause analysis if this were a client, from subscription billing practices to refund policy gaps.
Real examples of merchants using generative AI chargeback response tools, including one who took their chargeback win rate strategies from a 40% to 65% win rate.
Why dispute monitoring program penalties go far beyond the per-chargeback fee, and how they can affect your relationship with your payment processor.
How to calculate the true cost of a chargeback, including fees, fines, operational costs, and the merchant reputation and chargebacks damage that doesn't show up on a balance sheet.
A reminder that subscription chargebacks are almost always a symptom, not the actual disease, and what usually causes them.

You should listen to this episode if you:
Are a merchant, especially recurring or subscription-based businesses, currently on or worried about landing on Visa's acquirer monitoring program.
Are a fraud, risk, or payments professionals who want a practitioner's breakdown of what actually drives chargeback disputes.
Are using or considering AI to automate account decisions, cancellations, or chargeback responses.
Are a banking professional curious about the ecommerce and merchant side of dispute management.
Are a business leader weighing whether an aggressive subscription or cancellation policy is actually saving money, or just deferring a bigger cost.