Beyond the AI Hype: Government Model Suspensions, BIN Enumeration Attacks & UK APP Fraud Mandates

In this episode of Fraudology, host Karisse Hendrick cuts through the AI noise to analyze the critical fraud news and regulatory developments impacting the industry today. Inspired by conversations with Merchant Fraud Alliance ambassadors, Karisse separates empty hype from actionable intelligence to help fraud and payments professionals better protect their organizations.

The episode kicks off with a personal story: a real-time "fraud phone a friend" scenario involving a reissued credit card that suffered an enumeration attack (card testing) before it was even activated. Karisse breaks down the mechanics of modern BIN enumeration attacks. How fraudsters leverage AI to narrow down math equations like the Luhn algorithm, test numbers across friction-free merchant checkouts, and navigate the lack of activation requirements or AVS letter checks in payments. She also touches on Visa's merchant enumeration thresholds and the lesser-known Visa Issuer Monitoring Program (VIMP).

Karisse then reviews four major industry news stories driving the future of cyber fraud:

• The Fall of Frontier Models & The KYC Paradox: Following the U.S. government forcing AI models Mythos 5 and Fable 5 offline over cybersecurity concerns, frontier AI labs are pushing for strict, bank-grade Know Your Customer (KYC) identity verification. Karisse reads an insightful debrief explaining why traditional KYC will fail to stop threat actors due to pre-verified accounts, session-hijacking infostealer logs, and deepfake biometrics.
• Meta's $16 Billion Scam Economy: New statistics and internal documents reveal that Meta platforms (Facebook, Instagram, WhatsApp) account for up to 68% of fraud reported by major institutions like Lloyds Bank—and that Meta actively profits off fraudulent ad traffic rather than taking it down.
• The Reality of the UK's Mandatory APP Fraud Reimbursement: A 15-month progress check on the UK's 50/50 mandatory scam reimbursement policy for banks. While 89% of in-scope losses were returned to victims, APP fraud losses actually climbed year-over-year due to high-value, long-gestation social engineering scams.
• Google's RICO Lawsuit Against "Outsider": Google files a lawsuit targeting "Outsider," a massive PhaaS (Phishing-as-a-Service) Telegram network responsible for 9,000 fake sites, $1.9 billion stolen, and over 3.87 million compromised credit cards using AI-assisted smishing templates.