Fraudology Podcast with Karisse Hendrick

Welcome back to Fraudology.It’s just me for this episode, but I’ve got two stories to dig into. They are genuinely important for anyone dealing with chargeback disputes. Whether you’re on the merchant side or the banking side.The first is Uber and the nearly billion dollars in fines for automated account deactivation. The second story is the story that I really want to unpack. Hims and Hers blowing past their chargeback threshold on their weight loss subscription business.It’s rare that this stuff becomes public, and I think there’s a lot merchants can learn from it. I know a lot of companies leaning on AI right now to cancel buyer or seller accounts. We will walk through the math on chargeback fee per dispute, what’s actually driving these disputes, and what I’d tell these businesses if they were my client.What you’ll hear:Why Uber's near-billion-dollar GDPR fine over automated account deactivation AI should matter to any company using AI to cancel buyer or seller accounts, not just ride-share platforms.How Visa's acquirer monitoring program actually works, including the chargeback threshold merchants need to stay under and the real dollar cost once they don't.A full breakdown of the Hims and Hers chargeback situation, including the FTC lawsuit, Restore Online Shoppers Confidence Act violations, and real customer complaints pulled from public FOIA records.How I'd approach chargeback root cause analysis if this were a client, from subscription billing practices to refund policy gaps.Real examples of merchants using generative AI chargeback response tools, including one who took their chargeback win rate strategies from a 40% to 65% win rate.Why dispute monitoring program penalties go far beyond the per-chargeback fee, and how they can affect your relationship with your payment processor.How to calculate the true cost of a chargeback, including fees, fines, operational costs, and the merchant reputation and chargebacks damage that doesn't show up on a balance sheet.A reminder that subscription chargebacks are almost always a symptom, not the actual disease, and what usually causes them.You should listen to this episode if you:Are a merchant, especially recurring or subscription-based businesses, currently on or worried about landing on Visa's acquirer monitoring program.Are a fraud, risk, or payments professionals who want a practitioner's breakdown of what actually drives chargeback disputes.Are using or considering AI to automate account decisions, cancellations, or chargeback responses.Are a banking professional curious about the ecommerce and merchant side of dispute management.Are a business leader weighing whether an aggressive subscription or cancellation policy is actually saving money, or just deferring a bigger cost.

Welcome back to Fraudology.I have to tell you I’m genuinely excited about this one. Today’s guest was highly recommended by Matt Vega, someone whose opinion I trust completely in this industry. By the time we finally hit record, we’d already been talking for 45 minutes off air. That’s a pretty good sign this episode is going to deliver.Cy Khormaee spent years at Google, building out what eventually became the company’s user protection platform and the technology that now runs quietly in the background protecting billions of devices worldwide from phishing and malware. He took that experience and eventually founded Aegis.AI, and he just got back from Black Hat, which means he is walking into this conversation with a front-row view of exactly where adversarial AI is heading next.What I wasn’t fully prepared for was how far he was willing to take the demonstration. Cy didn’t just tell me adversarial AI is a growing thread, he showed me, live. Using nothing more than ChatGPT and information freely available online. It’s the kind of moment that changes how you think about a threat you thought you already understood.We cover a lot of ground in this one. And if you work in fraud, trust and safety, or security in any capacity, this is one you’ll want to sit with.What you’ll hear in this episode:Cy's path from Google's user protection platform, home of reCAPTCHA and Safe Browsing, to founding Aegis.AI, and how credential stuffing defense evolved into a hundred-million-dollar business.A live ChatGPT phishing demo where Cy used open source intelligence to research himself and generate a convincing, contextualized phishing email and matching fake conference website in minutes.Why AI phishing attacks have moved from theoretical to fully operational, with real-world state actor phishing tactics now automatable at near-zero cost.The staggering AI phishing email bypass rate statistics: over 50% of emails now slip past existing security email filter bypass controls.Why AI red team fraud thinking, treating AI as a gardener to nurture rather than a carpenter to micromanage, changes how fraud and security teams should actually deploy these tools.How the real Robinhood phishing attack shows why login fraud detection signals and upstream fraud detection AI matter more than ever.Why fraud and cybersecurity convergence isn't optional anymore, and how fraud data sharing across teams closes gaps that adversaries are actively exploiting.How automated sandboxing fraud detection can catch attacks before a user ever clicks, and why carding attack prevention and account takeover detection increasingly rely on the same signals as cybersecurity teams. You should listen to this episode if you:Work in fraud, trust and safety, or security and want to understand how adversarial AI is changing social engineering and phishing attacks.Are responsible for account takeover detection, credential stuffing detection, or synthetic identity risk at a bank, fintech, or merchant.Assumed business email compromise had been mostly solved and need a reality check.Are evaluating AI fraud investigation automation tools and want a clearer sense of what can realistically be automated today.Are trying to build the case internally for fraud and cybersecurity convergence and fraud data sharing across teams.

Welcome back to Fraudology.This week I’m joined by Dave G., who spent years investigating money laundering, wire fraud, and scams before moving into e-commerce and, eventually, directly into crypto. Dave was on the ground floor of Bitcoin back when the white paper first came out, and he brings a rare vantage point on stablecoin fraud risk as someone who has watched a payment technology evolve from a niche curiosity into the backbone of a real conversation about agentic commerce.We start with a story that sets the tone for the whole conversation. It demonstrates how unpredictable this space has always been, and how easily it is to miss where the real value and the real risk end up landing. From there, we get into the heart of what a stablecoin actually is, and why stablecoin unit economics change the payment fraud conversation entirely. They function less like a new currency and more like an infrastructure upgrade.That capability sounds abstract until you follow it to its logical endpoint; agentic e-commerce. Everyone wants to talk about AI agents buying jackets, concert tickets, or collectibles, the high-consideration, emotionally driven purchases people actually enjoy shopping for. But Dave argues the real volume, and the real fraud exposure, is going to show up in the boring stuff. Bread, milk, and eggs. The things nobody wants to spend time discovering, just delivered. And when those transactions are worth pennies instead of dollars, low-dollar transaction fraud stops looking like a nuisance and starts looking like a scalable business model for criminals willing to take a cent at a time instead of hundreds of dollars at once. That shift exposes a chargeback liability gap that already has real victims. A reminder that new payment technology fraud adoption always follows the same pattern: whatever gets built, someone tries to exploit before the guardrails exist. What you'll hear in this episode:How Dave went from investigating money laundering and wire fraud to working directly in crypto, and the story of accidentally giving away roughly $1.5 million in Bitcoin at industry conferences.Why stablecoin fraud risk needs to be understood separately from Bitcoin fraud history, and how stablecoins function more like an infrastructure upgrade than a new currency.How stablecoin unit economics make micropayment fraud economics viable at a scale traditional card and ACH rails were never built to support.Why the agentic e-commerce conversation has it backwards, focusing on high-consideration purchases like jackets and concert tickets instead of the low-dollar transaction fraud risk hiding in everyday purchases like bread, milk, and eggs.A real chargeback liability example where a cardholder admitted an AI agent made the purchase, and the merchant still had no compelling evidence chargeback rules to fight it.Why device-based identity verification is a weaker foundation than the industry treats it as, and an early look at an emerging protocol for verifying AI agent identities.How consortium fraud data sharing can create real, sometimes irreversible fraud blacklist consortium risk when a label gets attached to the wrong entity.A subscription chargebacks story involving an antivirus company that charged customers for software that did nothing at all.Why every new payment technology, from ACH to stablecoins, follows the same pattern: fraud arrives before the guardrails do.You should listen to this episode if you:Work in payments, fraud risk, or chargeback management and want to understand where stablecoin fraud risk and agentic commerce actually intersect.Are responsible for card network relationships or dispute strategy and want to understand the chargeback liability gap in agent-initiated purchases.Are evaluating identity verification strategies and want a real critique of device-based identity as a long-term solution.Participate in a fraud consortium and want to better understand the risk and responsibility that comes with labeling data.Are trying to get ahead of new payment technology fraud adoption instead of reacting to it after losses show up.Want a grounded, practitioner-level conversation about crypto fraud and payment fraud that goes beyond the hype cycle.

Welcome back to Fraudology.Every once in a while I come across a report that makes me stop what I was planning to talk about because it's just that important. This is one of those weeks.Matt Vega recently released his quarterly fraud report 2026, and after reading it, I knew we needed to break it down together. Not because it's predicting what might happen next year. Because every attack covered in this report is already happening.One of the biggest themes running through the report is that fraud is simply moving faster than fraud teams are. AI is making sophisticated attacks cheaper, easier to launch, and much harder to detect. Criminals no longer need deep technical skills when they can rent the tools they need through fraud as a service marketplaces.So what does that actually look like?In this episode, I walk through several of the newest fraud tactics already showing up in the wild, including malware hidden behind fake unsubscribe links, banking malware that can piggyback on a customer's trusted device, and session hijacking techniques that make account takeover fraud incredibly difficult to detect using traditional fraud detection models.At first glance, many of these attacks look legitimate. That's exactly the problem.We also talk about why fraud teams can't rely on individual trust signals like device intelligence, IP reputation, or even behavioral analytics by themselves anymore. Criminals have learned how to blend into legitimate customer behavior, which means our approach to fraud detection and fraud prevention has to evolve too.This is where things get interesting.One of my biggest takeaways from Matt's report is that the answer isn't one new tool or one new model. It's layering better fraud intelligence, sharing information across consortium networks, and understanding the broader cybercrime trends happening outside your own organization. Because by the time a new attack reaches your queue, there's a good chance another company has already seen it.I also spend a few minutes sharing an update on the Merchant Fraud Alliance conference, including our new AI bootcamp that's focused on practical ways fraud teams can start using AI in fraud prevention today. Not because AI replaces fraud analysts, but because it helps good teams move faster.If you work in merchant fraud, banking fraud, online fraud, or e-commerce fraud, this is one of those episodes that will help you recognize the patterns before they become your next incident.What you'll hear in this episode:Why Matt Vega's quarterly fraud report 2026 is one of the most valuable fraud intelligence resources released this year.How AI is accelerating modern cybercrime and making sophisticated attacks accessible through fraud-as-a-service platforms.A breakdown of several emerging fraud tactics already targeting merchants and financial institutions.How unsubscribe phishing campaigns are being used to install malware and keyloggers.Why banking malware is becoming increasingly effective at bypassing traditional fraud controls.How session hijacking enables criminals to perform account takeover fraud from trusted customer devices.Why device intelligence, IP reputation, and behavioral analytics all need to be evaluated together instead of independently.How fraud intelligence sharing and consortium data help organizations identify emerging threats faster.An update on the Merchant Fraud Alliance conference and its new AI in fraud prevention bootcamp.You should listen to this episode if you:Lead fraud, risk, or trust & safety teams.Manage fraud prevention for an ecommerce merchant, fintech, bank, or payments company.Want to stay ahead of the latest cybercrime trends instead of reacting after attacks become widespread.Are evaluating how AI is changing both fraud prevention and AI fraud.Build or manage fraud detection models.Investigate account takeover, synthetic identity, or online fraud.Want practical fraud prevention best practices instead of theoretical discussions.Rely on device intelligence, IP reputation, or behavioral analytics as part of your fraud strategy.