Show Notes
On this week's Compliance Unfiltered, AI-driven fraud is escalating, with deepfake voices and synthetic identities posing new threats. This episode reveals how traditional security measures fall short against sophisticated scams, like a $25 million fraud in Hong Kong. Discover innovative detection techniques and why real-time monitoring is crucial. Perfect for security professionals and leaders, this episode is a wake-up call to adapt and protect your organization from AI-enabled deception.
Episode Transcript: Adam Goslin: I’m doing good. It is today, Cinco de Mayo. So nicely done. Todd Coshow: Thank you, sir. Today we’re going to have a conversation up and down about fraud, but before we get there, I want to make sure that we say thank you to our listeners. We would love to hear from you. If you’ve got something that you’d like to share, if you have some suggestions or show ideas, please do not hesitate to reach out to us at [email protected]. We’re excited to hear what you have to say. As I teased just a moment ago, today we are talking about AI fraud, deepfakes, and the death of trust. Let me ask you a kind of off-the-wall question, Adam: if your CEO called asking for a wire transfer, would you trust it? Obviously, in this instance, you are a CEO. In your past life, if you were to receive a call from your CEO, would you trust it? Adam Goslin: It’s becoming more and more difficult these days. I was going to say, if I got a call from me, then the cat would be out of the bag. Looking at it philosophically, it used to be that the bigger concern was somebody taking over an email account and passing you weird messages, or they’ve ghosted out the number and they’re sending texts to your phone from the appropriate number, or phone calls that would come in with somebody trying to mimic their voice or whatever. But nowadays, it’s not a safe assumption. AI can clone voices. You can clone identities well enough to trick. Let’s say you got a real strong training program and people are going through training not once a year, but twice a year, three times a year, monthly. It’s tough because when you’ve got the capability to mirror off faces, voices, etc., it becomes astronomically difficult to blindly trust. It’s the same mantra that we’ve had in this arena for quite some period of time. One needs to ask themselves, does what is happening right now feel right? Trust your gut and be a little skeptical because I would much rather have somebody coming in and saying, “Hey, I got this request. I’m coming through a back channel just to validate that this is actually legitimate.” I would rather answer those types of inquiries from my people a hundred times than take one opportunity for somebody to not bother or drop the ball or trust what they were hearing. It’s what these people need to do. There was a recent thing that happened out of Hong Kong, and this was just fascinating. It was a finance worker in Hong Kong where the fraudsters were using AI deepfake technology. They impersonated the company’s CFO and other colleagues on a video conference call. Initially, the employee was doubting the request, but was convinced when all these different participants in the video call appeared to be familiar staff members. They basically set up this multi-person video call with everybody where everybody except the finance guy was fake. They basically told them they needed to execute a confidential transaction. That’s why you hadn’t heard about this previously, etc. They convinced this dude on this call to go in, and they did 15 different transfers to five different local bank accounts totaling $25.6 million. They didn’t even figure out what the heck happened until later on, the employee checked the validation with the company’s UK-based headquarters. That’s when they ended up discovering, “No, you’ve just been had.”
More from Compliance Unfiltered With Adam Goslin
PCI is evolving, and AI is reshaping payment security, vendor accountability, and compliance. Todd Coshow and Adam Goslin preview the PCI Europe Community Meeting in Edinburgh, exploring emerging AI risks, governance challenges, and the importance of industry collaboration. Discover why attending matters, how to maximize networking opportunities, and what to expect from this year's event. Plus, learn why stopping by the TCT booth could help make compliance suck a little less!
AI can automate compliance, but what happens when it automates bad compliance faster? Todd Coshow and Adam Goslin explore the dangers of scaling broken processes, weak evidence, and checkbox-driven compliance through AI. Discover why automation without proper foundations creates more problems than solutions, where AI genuinely adds value, and why human oversight remains essential. Learn how to identify automation opportunities, avoid costly mistakes, and build smarter, more effective compliance programs without sacrificing accuracy, accountability, or security.
Fresh from the 20th PCI North America Community Meeting, Todd Coshow and Adam Goslin break down what had the PCI compliance world talking. From AI and compliance fatigue to manual evidence collection and the annual audit scramble, they explore the challenges teams still face—and what’s changing. Hear why continuous compliance, smarter automation, multi-framework management, and responsible AI governance are becoming essential for organizations looking to reduce friction, improve accountability, and make compliance suck a whole lot less. Episode Transcript: Well, Adam, we’re officially back from the 20th PCI North America community meeting. Give me your overall impression. What was the energy like this year and what stood out to you? Adam Goslin: Well, I can tell you one thing for sure. I forget who it was. I had a conversation with somebody that was complimenting you on starting the pod with a different, “Oh, Adam’s the sparkle of your sterling silver,” or whatever you come up with. They’re like, “I don’t think we’ve ever heard Todd say the same thing twice. It’s pretty impressive.” So yeah, you were getting some shout-outs. Todd Coshow: Appreciate that. Adam Goslin: The show was a little bit smaller than I expected. Now, I know it was in Canada, so people have to actually travel internationally to be able to get… Todd Coshow: Shout out to Vancouver. Incredible city. Adam Goslin: Oh, hell yeah. Hell yeah. We got us some absolute rockstar poutine while we were up there. It was definitely a good time. Beautiful place, beautiful city. We were very, very lucky. The days of the conference were absolutely gorgeous. It was blue sky and sunny. Sometimes when you head to the northwest of the US, Seattle area, southwest Canada region, it tends to be a little wet sometimes. Todd Coshow: It can get a bit gloomy. You’re not wrong. Adam Goslin: Yeah, no, it held off. It was great. It was a little bit smaller. I’d say there were maybe two-thirds of the normal crowd. Todd Coshow: Sure. Adam Goslin: This year they didn’t have some new version of PCI or whatever. It was their 20-year anniversary, so there was a lot of hoopla around that and whatnot. I’m hoping that next year it’ll be in Vegas. One of the side notes that we got out of the conference was it sounds like, from the release timing for the next version of PCI, they were not specific if, right now we’re on 4.0.1, so are we going to 4.1? Are we going to 5? Don’t know yet. But whatever it is, I believe they’re going to have that ready to start previewing next year. So one, being in Vegas, someplace easy for everybody to get to, lots of fun stuff to do in that area, and if they’re gonna be releasing a new version of PCI, I’m really hoping that the numbers are up over where they normally are. The one person that I do wanna give a shout-out to is good old Gina at PCI. She’s always been involved in helping to coordinate and orchestrate the show. She does a fricking rockstar job. Todd Coshow: Absolutely. Adam Goslin: That lady needs a raise, for sure. She’s always very attentive and helpful and all that fun stuff, so I wanna give her a shout-out too. There was a high amount of engagement at the show. Because it was smaller, it has an ancillary impact, which is that the quality of those conversations tends to go up. Todd Coshow: Yeah, it does. Adam Goslin: So that part was cool. Vancouver was kind of like a homecoming for me because the very first show that we did as TCT where we had a booth was… Todd Coshow: Oh, cool. Adam Goslin: My wife, Kit, and I manned the booth in Vancouver in 2019. So it was kinda cool seeing it come to a full-circle moment on the 20-year anniversary, etc. A couple other people I wanted to give a shout-out to. First is Heidi and Jeff. Thank you so much for the annual gift box. Quite frankly, I started tucking into it before it even made it back home. So that was much appreciated. And a special shout-out to Paul.
What happens when your compliance champion suddenly disappears? Todd Coshow and Adam Goslin explore the hidden risks of building a compliance program around one go-to person. From tribal knowledge and scattered evidence to undocumented processes and failed handoffs, discover why single-person dependency can derail your next audit. Learn how clear ownership, documented procedures, distributed responsibility, and a centralized source of truth can create a resilient compliance program that survives resignations, vacations, turnover, and the unexpected. Episode Transcript: Today, Adam, we’re gonna talk about a fateful day, and that is the day that your compliance champion leaves. Every successful compliance program seems to have that one person who knows where everything is, understands every control, remembers every audit finding, and somehow keeps the entire program running and the coffee cups full. But here’s the question, Adam: If your compliance manager quits tomorrow, would most organizations’ compliance programs survive? Also, why do so many compliance programs become dependent on one single person? Adam Goslin: I just had this visual of people running down the hallway screaming. It’s cats and dogs and da, da, da, da. I think it’s a little extreme to go, would they survive? Well, yeah. There’s that expression out there, right? “Everybody’s replaceable.” That’s what they think. It doesn’t mean… Now, could they be replaced? Sure. But at what cost is really the question. Todd Coshow: Exactly. Adam Goslin: Most companies kind of have that central figure. Quite honestly, the main reason why for a lot of organizations that it ends up funneling down to this one person is that, at the end of the day, most organizations are managing their stuff manually. There’s too much going on. There’s too many control owners. There’s too many hands in the pie. There’s too many assessors. There’s too many states this stuff can be in for everybody to go sticking their fingers in the midst of all of the tracking, etc. If you’re using a manual system, then you’re almost forced into this notion. But not even almost forced. For every single company that I’ve ever seen that has either completely manual or hodgepodge manual and internal systems, etc., it ends up eventually gravitating to that single individual. The reason is simple. Organizations keep getting burned as they are trying to manage their programs. Somebody went in there to go and make mass updates to their stuff. Let’s pretend we’re using an Excel sheet. I go, “Oh, I need to mark these 10 things in this state.” Inadvertently, the person that’s going in to make their 10 things update accidentally blasts 57 items in the process and overwrites their statuses, etc. When you’ve got shared sheets, etc., it is not if you’re going to have a problem, but when or how many times you’re gonna experience a problem. It forces organizations to move into this notion where they’ve got the one ring to rule them all, type of deal. So you end up with that go-to person. The other thing is that whoever that central figure was, they’ve learned a lot, right? Year over year over year. It’s knowledge building that basically accumulates between their ears. I’ve been through so many audits, and I’ve learned what the assessors are looking for and their feedback. I’ve got boots-on-the-ground operational experience of running the program, etc. That person that’s at the center of the compliance efforts, they literally amass an unbelievable amount of data, information, experience. It isn’t experience that this person could just poof, walk away, and somebody else is just gonna inherit it. It’s not the reality. Over time, the knowledge, data, and information moves out of documented processes and things along those lines and lands up in somebody’s noggin.
PCI has evolved from checkbox audits toward continuous assurance, but are organizations truly keeping pace? Todd Coshow and Adam Goslin explore how AI, cloud-native payments, software supply chain risk, and operational compliance are reshaping payment security. They explain why continuous evidence beats annual screenshots, what the PCI Community Meeting in Vancouver can offer, and how teams can turn compliance into practical, measurable risk reduction. Ideal for security leaders and compliance professionals worldwide. Episode Transcript: Adam, join us at the PCI North American Community Meeting in Vancouver, British Columbia, Canada. 20 years later, I have to ask you, Adam, has PCI actually made payments more secure? Adam Goslin: Oh, I mean, there’s no doubt it had a dramatic impact. You got to remember back in the day, it was the absolute Wild West. The card brands were just getting their asses handed to them, and something needed to be done. The level of change from when this whole adventure first started to now is pretty startling. I think in many ways it was necessary. I think that the card industry as a whole forced a lot of organizations to start leveling up, start taking this stuff seriously. I believe it was astronomically helpful as we’ve headed into this arena. Certainly, we’re seeing a lot of shifts in the marketplace where we’re moving away from a checkbox approach, etc. It’s hard to remember. I was looking up, when did PCI V1 officially get released? It was middle of December in 2004. Todd Coshow: Oh, wow. Adam Goslin: It was like the first version of it, type of a deal. It was 2006 that the PCI SSC was officially formed. Then they started to make enhancements. But there have been a whole myriad of different changes and modifications to the standards over that time. The payments arena really has made a fairly startling shift from just checking the box, annual validations, into more of a continuous security or, as we here at TCT like to call, operational mode, type of a deal. The acceleration of AI, both for the white hats and black hats, has enabled attackers to move as quickly as defenders. So it remains a very, very vibrant and exciting arena. Todd Coshow: No doubt. Well, what do you think the biggest conversations at this year’s community meeting will be? Adam Goslin: Yeah, I think there’s a lot. New and exciting things happening in the payment space will certainly be one. Bar none, a big participant will be a lot of topics surrounding AI. AI, its use and benefits and all that fun stuff. Honestly, I’m kind of hoping that somebody whips a little bit of realism in there about the dangers of AI as well. I think I’ve mentioned once or 80 times about AI zombie walk. I think there’s a lot of signs in the marketplace right now that the AI zombie walk mentality isn’t necessarily the best idea in the grand scheme of things. I think there’s a lot more reasonability starting to enter into the mix. That’s what I’m hoping at least. Certainly, a lot of discussions around operational compliance, automation of evidence collection, various ways to streamline your engagements, looking at threat intelligence and attack trends as they’re going. Certainly, one of the cool parts about being at the conference is getting updates direct from the council, what’s happening, what’s coming soon to a theater near us, all of that fun stuff. We’ve got all that coming our way as well. Todd Coshow: Indeed. What’s one thing every first-time attendee should do in Vancouver? Adam Goslin: Well, number one, I’m just gonna underscore this big time.