Fraudology Podcast with Karisse Hendrick

Welcome back to Fraudology.This is part two of my conversation with Mohammad Muzahir, also known as Red Bull, the cybercrime whistleblower in the WIRED reporting on scam compounds. In part one, Mohammad described how a fake job offer took him to a scam center in the Golden Triangle region of Laos, and how forced workers were handed scripts, personas, and stolen accounts. This time we pick up with what keeps people inside, how deepfakes make a persona believable, and how he finally got out. This conversation includes human trafficking, violence, and corruption, and Mohammad describes all of it from his own experience. Mohammad is a human trafficking survivor, and he is clear that most of the people forced to scam were tricked in the same way he was. His scam compound escape includes details he told me he has never shared publicly. We also talk about practical scam prevention. He explains how to test a video call for a deepfake, why banks should consider a cooling off period for large crypto transfers, and why scam victims should speak up without shame. If you work in fraud, risk, or law enforcement, I think his advice is worth your time. What you’ll hear in this episode:How Mohammad finally got out of the compound, including a part of his scam compound escape that is not in the WIRED reportingWhat life inside a scam center looks like, from dormitories and constant surveillance to forced scamming by workers trafficked from several countriesHow a trusted friend can become a recruiter, and how recruiters are paid for the people they bring inWhy some personas in romance scams and pig butchering scams are real people who work on commissionHow deepfake scams use stolen photos, live video, and voice notes to convince victims that a persona is realSimple deepfake detection tests you can use on a video call, including digital arrest scamsWhy banks may need a cooling off period for large crypto transfers, and what law enforcement can learn from a victim’s chatsWhat Mohammad says about scam center corruption in Southeast Asia, and why we both call this a humanitarian crisisWhy scam victims should talk about what happened and why the shame belongs to the criminals You should listen to this episode if you:Work in fraud, risk, or compliance and want to understand how social engineering scams keep victims from believing the truthTrain bank or credit union staff who talk with customers who are moving money to cryptoWork in law enforcement and want to know what information victims hold that can help an investigationSupport scam victims and want language that takes away shameWant a scam survivor’s account of a scam center escape and what it takes to leave a scam compound

This is a survivor’s story. Mohammad Muzahir, also known as Red Bull, is the cybercrime whistleblower in the WIRED reporting that opened a window into how scam compounds work. He escaped one, and he now spends much of his time helping large organizations understand how they operate. He was studying computer science and looking for a way to fund a bachelor’s degree abroad when a friend of a friend offered him an IT manager job in Laos, in the Golden Triangle region. The job did not exist. What followed is a human trafficking story and a fraud story at the same time. This episode of the Fraudology podcast sits right where the two meet. We cover how the fake job offer worked, what daily life looks like inside a scam compound, and how forced workers are handed scripts, fake personas, and stolen accounts to run romance and crypto investment scams. This is not an easy conversation, and I hope it gives you a fuller picture of the people on both sides of the screen.This is part one of a two-part conversation. What you’ll hear in this episode:What a scam compound looks like from the inside, including buildings with dozens of floors, long daily shifts, and fines that keep workers in debtHow a fake job offer and a chain of trusted contacts moved a young IT graduate from India into a scam compound in LaosWhy many of the people running these scams are forced workers, and why Mohammad calls himself a victim as wellHow the story bible gives each fake persona a childhood, a hometown, a daily schedule, and an answer for every questionHow romance scam victim manipulation turns trust into a crypto investment, including fake gains and small early withdrawalsWhy a scammer may coach a victim to dismiss a bank’s warning before the victim ever walks into the branchWhat Mohammad says about stolen, aged social media accounts and how recovery flows were used against account ownersWhat his 4,200 pages of evidence shared with WIRED’s Andy Greenberg add to what investigators knowYou should listen to this episode if you:Work in fraud, risk, or trust and safety and want a clearer picture of how the people behind these scams are organizedSupport scam victims and want to understand why they trust a persona so deeplyTrain bank or credit union staff who talk with customers who are being coached by a scammerWork on account takeover or social media platform integrity and want to hear how stolen accounts are usedWant a survivor’s perspective on how a fake job offer becomes forced labor

Welcome back to Fraudology.I’m sharing the presentation I gave to open the Merchant Fraud Alliance conference in Chicago. It was a “where are we right now” look at the fraud attack landscape, and it grew out of a question I heard from merchants all through the conference. What is actually different about fraud today, and how much of it comes down to AI?If you work in e-commerce fraud, you have probably felt the shift in your own numbers. Generative AI has changed who can attack, how quickly they can do it, and how well the attacks blend in with good customers. I walk through how AI fraud looks from the ten thousand foot view I get from talking with so many merchants, and I pair it with fraud prevention ideas you can take back to your own team and your own leadership.What you’ll hear in this episode:Why fraud has been industrialized, and how AI lowers the cost, skill, and time needed to attack e-commerce at scaleThe headline numbers, including fraud pressure up 33% year over year, account takeover up 78%, card testing up 175%, and BOPIS fraud up 65%How the EMV chip shift in 2015 and the rise of account takeover compare with what AI is doing to the fraud attack landscape todayWhy AI-powered account takeover keeps climbing, and how generative AI makes phishing cheap to personalizeHow AI card testing attacks differ from old scripts, including how agents sort cards and adapt to your controlsHow one campaign can move from identity to checkout to customer support to disputes, and why event-based controls miss itWhy evidence is now cheap to fake, from fake receipts and identity documents to fake damage photos and deepfakesWhat a dark web card marketplace demo shows about how easy it is to buy the pieces of an attackHow to fight AI with AI fraud detection using session-level data, telemetry, device ID, and behavioral biometrics You should listen to this episode if you:Need to explain fraud increases to leadership and want current numbers to bring with youHave seen a sudden rise in account takeover or card testing, or heard from your processor about the Visa enumeration programDeal with refund fraud or chargebacks involving photos, receipts, or item not received claimsAre evaluating fraud prevention tools and wondering why snapshot-based controls keep missing attacksWant to hear how merchants are using generative AI to spot AI-written scamsCouldn’t attend the Merchant Fraud Alliance and want to hear how the conference opened

Welcome back to Fraudology.I’ve now had a few days to recover from the inaugural Merchant Fraud Alliance conference in Chicago. I helped create this event. Watching two days of conversation among merchants go from a plan to a room full of people was a real highlight for me. The Merchant Fraud Alliance 2026 conference was built around a gap I had heard about for years. Merchants wanted a place to compare notes with peers without feeling like the target of a sales pitch. We kept the ratio at roughly three merchants for every solution provider, invited sponsors based on what their customers say about them, and added merchant only deep dives. I explain why we made those choices, then walk through the AI bootcamp, the deep dives, and the main stage sessions. Topics include fraud as a service, app cloning, account takeover trends, executive scorecards, build versus buy decisions, and the PSP gaps merchants keep running into. This episode is for everyone who couldn’t be there. Two days of sessions won’t fit into one episode. I’m sharing the moments that stuck with me the most.What you’ll hear in this episode:Why we built the Merchant Fraud Alliance as a merchant first fraud practitioner event, and how invite only sponsorship shaped the roomHow the merchant only deep dives worked, including a fraud center of excellence discussion, a refund fraud ecommerce session for food delivery and retailers, and war room roundtables for retailers and marketplacesWhat came out of the AI fraud bootcamp for merchants, from Slack alerts and chargeback research to governance questions and the rising cost of AI tokensWhy a fraud as a service session encouraged attendees to treat fraud threat intelligence from Telegram, Discord, and the dark web as an input to decisions at the time of purchaseWhat one vendor’s data showed about app clone fraud detection, with chargebacks running roughly four times higher when cloned apps were involvedEcommerce fraud trends 2026, including a threefold rise in account takeover over two quarters and agent traffic that one vendor found to be nine times riskier than human trafficWhy fraud now moves upstream and downstream of the payment, and the merchant PSP fraud gaps that appear when you rely only on processor toolsLessons in cross functional fraud collaboration, and how to build a fraud executive scorecard with metrics your executives actually wantA look at the build vs buy fraud stack panel, a non payment fraud discussion covering loyalty fraud and promo abuse, and research on how cyber signals can improve payment fraud decisionsYou should listen to this episode if you:Couldn’t attend and want a practical summary of the sessions and the ideas that came out of themAre curious what a merchant only fraud conference looks like and whether it’s worth attending next yearAre exploring generative AI in fraud operations and want to hear what other merchants are doing, and what they’re struggling withStruggle to explain fraud to executives and need a better way to present your dataAre weighing a build or buy decision, or feel limited by the fraud tools your PSP providesDeal with refund abuse, promo abuse, or loyalty fraud and want to compare notes with peers

Welcome back to Fraudology.Welcome back to Fraudology. I'm Karisse Hendrick, and this week I'm talking with someone who has become a regular guest on the show. Matt Vega has joined me across six years and several different employers. He's now the Chief Fraud Strategist at Point Predictive, where he works with Frank McKenna on lending fraud, and his move into that world gave me a good reason to ask what looks different from where he sits.Lending fraud rarely looks like the fraud most merchants picture. Plenty of losses start with an applicant who stretched the truth about income or cleaned up a credit report through repeated disputes, and those cases sit right next to organized attacks. Matt explains how credit washing fraud and income misrepresentation blur the line between abuse and fraud. He also shows how lending consortium fraud data lets a lender see patterns that a single credit report never will.Then we get to the part I think deserves the most attention. A super prime synthetic identity can now be assembled quickly, and on paper it can outperform a real customer. Whether you work in lending, fintech, or ecommerce, you'll leave with a clearer sense of where your defenses actually hold up. What you'll hear in this episode:How lending consortium fraud data works, and why one lender's loss can protect an entire network from the same attackHow credit washing fraud and credit bureau dispute abuse can turn a 580 score into a 790 for a short window, and why lenders sometimes miss itWhy income misrepresentation and bust out fraud lending sit on a spectrum between friendly first party abuse and deliberate attacksHow a super prime synthetic identity can be built in roughly 90 days using an authorized user fraud scheme and buy now pay later fraudWhy a perfect credit profile can be the red flag, and what fraud network intelligence lending teams can see that a credit report cannotHow jailbroken LLM fraud tools, dark web fraud tools, and a dark web identity marketplace make it easier to produce identities, identity document fraud lending, and matching cardsWhy AVS CVV fraud limitations and PSP fraud tool limitations show up as high declines, false positives, and chargebacksHow good user behavior mapping makes anomalies easier to spot, and how polymorphic fraud attacks and device farms try to imitate real human behaviorHow behavioral biometrics lending fraud controls, friction strategy fraud prevention, and fraud stack vendor evaluation fit together, including why a design partnership fraud tech opportunity can be worth saying yes toYou should listen to this episode if you:Work in lending, auto finance, or fintech and want a current look at lending fraud beyond the standard synthetic identity playbookAre responsible for fraud tech stack strategy and want a practical way to think about proven vendors versus newer technologyAre a merchant relying on a PSP fraud tool and wondering why your declines and your chargebacks are both highNeed language to explain friction decisions to executives and growth teams using data they already care aboutWant to understand why a fraud consortium lending network matters when attackers are using AI to adapt quickly