ABOUT ME CONFIDENTIAL 1 • Co-founder and CEO of Rippleshot • Husband and father to two boys (one a teenager) outside of Chicago • Lived in five countries before the age of 13 (Vietnam, U.S., France, Italy, and Greece) • Grew up in suburban Maryland and graduated from University of MD • First year at UMBC (U Made a Bad Choice to U Must Be Cinderella) • Member of Bank-Fund Staff CU in Washington, D.C. ABOUT RIPPLESHOT CONFIDENTIAL 2 • Automated fraud detection platform helping FIs reduce card fraud, decrease re-issuance costs, and minimize member impact • Working with over 80 FIs and onboarding 10 new FIs per month • Partners include CUNA, Fiserv, FIS, MasterCard, and KII Consulting Coach Jason Buck Homeless at 6 when his family lost their farm Slept under a hay truck Washed in cattle watering trough Found clothes in county dump All-American Defensive Lineman at BYU 1986 Outland Trophy Winner 1987 1st Round Draft Pick Cincinnati Bengals 1991 Super Bowl XXVI Champion Washington Redskins We exists to protect the financial security of coach Buck and his granddaughter FRAUD TRENDS CONFIDENTIAL 6 Card Fraud Losses Worldwide (in $ billions) $31.26 $32.82 $24.71 $27.69 $18.11 $21.84 $11.27 $13.70 2012 2013 2014 2015 2016 2017 2018 2019 The loss of personal information directly contributes to growing fraud losses for banks and merchants Nilson Report WHY Biggest US data breaches 2012-2017 (# of stolen records in millions) Court Ventures – 200m LinkedIn – 117m Yahoo – 500m DropBox – 68m Heartland – 130m Sony – 77m JP Morgan – 76m Anthem – 80m Uber – 57m Target – 56m Home Depot – 70m Equifax – 167m 7 ATM AND GAS PUMP COMPROMISE CONFIDENTIAL 8 546% 400% 350% Increase ATM compromised cards 300% Increase GAS compromised cards 250% 195% 200% 150% 98% 100% 70% 54% 50% 10% 11% 0% 2015 2016 2017 2018 YTD FICO, Industry BUSINESS EMAIL COMPROMISE CONFIDENTIAL 9 2015-2016 2017-2018 2370% increase 136% increase $5.3B losses $12.3B losses FBI BEC/EAC INDUSTRY BENCHMARK CONFIDENTIAL 10 Asset Size <$1B $1-5B $5-10B >$10B 2017 88 bp 65 bp 79 bp 80 bp 2018 YTD 93 bp 73 bp 89 bp 86 bp Change 5.68% 12.31% 12.65% 7.50% RIPPLESHOT ECONOMICS OF EARLY BREACH DETECTION CONFIDENTIAL 11 $1,800,000 $1,600,000 Fraud loss $1,400,000 6 months $1,200,000 Early detecGon difference Visa/MC $1,000,000 detecGon $800,000 compromised cards $600,000 $400,000 $200,000 $0 1 2 3 4 5 6 7 8 9 10 11 12 13 Breach 4meline (months) Early detection before Visa and MC can stop 60% of fraud losses while reissuing less compromised cards ECONOMICS OF ATM SKIMMER DETECTION CONFIDENTIAL 12 • Average ATM skimming fraud: $600 per card • 14-30 days harvesting period • 24-48 hrs. cash out • Average loss: $150,000 EARLY DETECTION 2 hours Detect ATM skimmer locations 4 hours Identify compromised cards and reset pins 80% Fraud reduction STEPS YOU CAN TAKE NOW CONFIDENTIAL 13 MEMBER EDUCATION Educate members on common scams and fraud schemes (sources: FBI, CrimeDex, CUNA, Rippleshot) Educate members on making safer online purchases Encourage using stronger passwords and two-factor authentication Encourage members to regularly check their statements Encourage them to sign up for alerts Encourage them to freeze their accounts with credit bureaus Send regular bulletins about ATM and gas skimmers STEPS YOU CAN TAKE NOW CONFIDENTIAL 14 INTERNAL PROCESS Conduct regular employee education and fraud training (phishing, spear-fishing, vishing, baiting, …) Improve internal controls around EFT (authenticate vendor and customer changes, validate vendor requests, implement mobile and two-factor authentication, limit EFT $ and wire transfer authority) Reconcile often Consult with data providers for available services and tools STEPS YOU CAN TAKE NOW CONFIDENTIAL 15 ATM SKIMMING Update plan on what to do when skimmer is found to reduce operational process to 1 day Consider resetting pins of compromised cards for faster response Improve odds of detecting skimmers by using more sources for alerts including CrimeDex, FICO alerts, Rippleshot ATM Fraud Detect Discuss with ATM provider new prevention tools including for Deep Insert skimmers Develop manual detection response (Excel) or consider calling outside vendors that have on- demand rapid detection analysis LONGER TERM PLANNING CONFIDENTIAL 16 12-24 Months Demand more from your processor: more reports more often Get access to your data on a daily basis and establish good fraud metrics Ask and review with your processor new tools and cost-benefit Explore new technology that can detect fraud faster and scale with you Hint: digital platform, cloud based, automated, new data sources, machine learning Thank you Canh Tran 773-383-2933 [email protected] .