Know Your Business, Know Your Agent

Transcript

There may be transcription errors: we apologize for those in advance.

Rob: In 1841, a New York merchant named Lewis Tappan started a company called the Mercantile Agency. The idea was simple. He recruited correspondents all over the country to write reports on whether local businesses could be trusted — not their paperwork, their character. Could you believe what this merchant told you?

The job attracted some talent. Four future presidents worked as correspondents: Lincoln, Grant, Cleveland, and McKinley. And people hated it. Tappan was accused of invading privacy almost immediately. He had 280 clients by 1844 anyway. The company still exists. Today we call it Dun & Bradstreet.

The question — is this business real, and should I believe what it's telling me — isn't new. It's about as old as American commerce. What's changed is that you can now spin up a company, a website, and a merchant account before lunch, and there's no correspondent in town to write you up.

My guest has spent his career on the modern version of that problem. John Canfield built risk and verification systems at eBay, at WePay — which JPMorgan Chase acquired — and at Google, where he led the ads verification and transparency initiative. He's now co-founder and CEO of BlueArc, which uses AI to verify businesses. His argument, which is why I wanted to talk to him, is that our whole industry has spent the last decade getting very good at answering a question that doesn't actually protect anybody.

John, how are you? Long time no see.

John: Hey, good to see you, Rob. I think we just saw each other in San Francisco about a week ago.

Rob: Yep — the Global Anti-Scam Alliance conference. It was a good one.

John: Yeah. It's very serious, because you hear about the human impact of scams. It's great hearing from victims — I mean, it's a horrible story, but for victims to come forward so you really understand what's happening. That can be sobering. On the other hand, it's great to see people collaborating across tech, regulators, and nonprofits.

Rob: Part of the reason for having these conversations is to get people aware of what else is happening. So tell us a bit more about your background. You and I met when you were at Google, working on advertiser verification. Tell us about that, and what you've been doing the last couple of years.

John: My background originally was engineering and tech product management. But in the early 2000s I started working in trust and safety risk management — starting with eBay, protecting them against bad sellers. Then WePay, doing risk management at that payment company that was acquired by Chase. Then Google Ad Safety. So really across marketplaces, payments, and ads, dealing with risky merchants in various forms has been the primary thing I've done. And then three years ago I left Google and started BlueArc, to fill a gap around deep research into businesses.

Rob: I'm a big fan of what you've been doing — investor as well in the company.

John: I appreciate that.

Rob: Very tiny investor. My angel investments are all fairly small. But I like investing in things I think are important, and in people I think understand the space very well. What you're doing qualifies in both respects.

Rob: One of the things I find really interesting is how we've evolved. In some ways we've evolved our sophistication a lot. In other ways we still lean on manual ways of assessing businesses, and heuristics. So tell me more about how you think about what a company is, what a person is — what are we actually trying to figure out about whether we should do business with someone?

John: It's interesting, because a lot of risk management has been invested in people. Certainly with stolen credit card fraud, and a lot of fraud generally, it's really a user — in many cases a fraudulent consumer — who's the actor. So all of KYC verification, driver's licenses, all those things.

The bottom line is that a person is a physical being. They have biometrics. They're doing something at one time, in one place, through one geolocation, and they have devices they own that can be detected. So a lot of that work is based on the assumption that here's one entity with some devices and some characteristics you can test, and you can match it to a government identity.

When you think about businesses, it's very different. Businesses have users, and those can be evaluated as people, but ultimately a business is about relations. They have relations with employees who all have different roles and different levels of authority. They have relations with customers. They may or may not have significant revenue. They might have an office, or they might not.

So to understand a business, it's a matter of understanding all these elements — the different domains they have, the different social media accounts — and asking what you can be confident about, based on all that evidence, about whether the business is legitimate or a scam.

Rob: So what's the gap? What are companies not doing that you thought, and still think, they need to do?

John: Because there's been so much investment in understanding users, there's a hole in business understanding. I saw this in my pre-BlueArc experience, in terms of false positives and false negatives — where if you really investigated, and thought about the business like a skilled investigator, you'd say either "no way would we let this business in," or "no way would we suspend them, they're clearly legitimate and there's plenty of evidence for it."

But most companies, even large platforms, don't have the data structure to model a business. Their data structures started way early on: you have users, who log in, who have a payment method, who are going to place ads. There's some conglomeration of different user accounts into a business entity, but a lot of that is freeform and not that structured from a risk point of view.

So even if you get an LLM now to evaluate it — where do you put that in your data structure? A big part of it is having a new type of graph that's really a business relationship and business entity graph, as opposed to a traditional risk graph.

Rob: I've probably told this story before, but at Facebook, when we were doing political ad verification, we decided to verify the individuals. We did some entity-level work, but it was things like the address where the person was. It's very tricky to verify an entity, or at least to do it consistently — at least historically. I've heard stories of the kinds of things that have been done in various contexts to verify businesses that wouldn't pass the sniff test.

So is this just the reality of these entities? Or is this an intractable problem? Are documents just not good enough? What are the underlying issues with these entity checks?

John: The interesting thing about our current Bank Secrecy Act and anti-money laundering regime — which is the foundation for bank-level KYC and KYB — is that it dates back to the early 1970s, and a lot is represented in that. There wasn't an internet. So much of it is based on legal entities.

What is a legal entity? It is important to understand whether a legal entity is registered. But I think there's an overemphasis on it. "Do we know this legal entity exists?" becomes a checkbox.

If you start to ask, okay, what does that legal entity represent — what's associated with it — that gets much harder. How do you verify that so-and-so is associated with that legal entity? In some states, including Delaware, they won't say who the officers are. Other states are better. So sometimes you have this person, you have this entity, and you're not really sure what the entity does. It's just a name and a registration number.

So I think it's a factor, but it's missing the bigger picture. For individuals it's often hard to get a unique ID — a name isn't unique. But the great thing with businesses is that business domains on the internet are unique, in the sense that there's only one owner and controller of that domain. And that's true across all countries.

I actually think the domain is a vastly underutilized asset for analysis. It has complications — if you think of a large multinational like Google or IBM, they have lots and lots of domains, so how do you figure out which are legitimate and which aren't? It becomes a cloud of domains you have to evaluate. But that's the hard work we at BlueArc have endeavored to do.

Once you can say "we're confident this domain is a subsidiary of this large public company, through all this evidence and these data sources, and this one is not — it's just an island website that claims to be" — all of a sudden a lot of problems become much simpler. Not only can you look at ads and where they point, you can also ask whether someone can prove they're associated with the domain. Email verification isn't perfect, but it's pretty good and very easy, and there are more powerful ways to prove domain ownership.

So with a domain, as opposed to a legal entity, you get: I know what this thing is claiming to do, I have references of people pointing to this domain saying they work with this company, and I have ways to link individuals to it. That starts to be a valuable entity to analyze.

Rob: Years ago, the first time I went through the Google Webmaster Tools flow, it was: claim this domain, prove you own it. There are a bunch of these flows — change DNS records, whatever. But a lot of companies have decided it's too onerous to put people through that for things like running an ad. I could run an ad to a website I own, or to a website you own. I could pretend to represent a company and just send traffic there.

So why is that? Have companies optimized for less friction? Is that changing?

John: It's a good question. I think friction is really important to optimize — have the right amount when you need it, and don't make people go through excessive friction when it's not necessary.

There are cases where having someone modify their website metadata or put a tag on their site is a good option. There are cases where someone says, "I own a website, but I'm not paying $20 a month to Google to get email through that domain. I'm a very small business, I shouldn't be forced to do that." Great — put this tag on the website you control, either yourself or through your webmaster. So it's a good method for certain circumstances, or if we think an email has been compromised.

But I think for 95%-plus, email domain verification is much better bang for the buck. Extremely low friction, extremely normal for people to do — you get a link or a code and you verify you have access to that email at that domain.

The main risks are two. Is that employee just some contractor who doesn't really have authority? And has that email address been taken over? There are ways to mitigate both.

I think the biggest factor is vouching. Ultimately, in KYB, you should have a relationship. If this is a major advertiser to a major ad platform, that company has a relationship with them. And if you're suspicious about the activity — this user logged in with this domain, but they're putting up gambling ads — you should have somebody else who can vouch for you.

That vouching flow is something we've worked on, and it's so powerful: vouching between users within a company, but also between companies. If this marketing business is claiming to be an ad agency for Nike — is it really working for Nike? You could do all sorts of vouching there, and at very low friction.

Rob: When I had my first company and worked on ads, every now and then — often on a Friday — you'd get an email from a company saying, "We're the agency of record for XYZ, we're trying to run this campaign over the weekend, can you help us set it up?" I'd send a couple of messages to other people in the industry, and pretty reliably they'd have been approached by the same fake agency.

So to your point about vouching — sometimes those things turn out to be super useful when someone's claiming a relationship that's very hard to prove, and is also injecting urgency into it, made up or otherwise.

John: And what's crazy is the number of ad accounts that have just a Gmail address associated with the user. Some of those are obviously fraud and scam, but a lot are legitimate — some of it is historical, and in Google's case they encouraged people to have Gmail accounts. But if that's all you have, you really have no idea whether this person is associated with the domain the ads point to. There are all sorts of ways advertisers can be faked.

Rob: One of the themes I've heard from regulators and from members of the press is: if we just verify all the advertisers, we'll stop scams. I don't think you agree with that. Tell me about the trade-offs between verification and scams specifically.

John: I'm not against verification. At Google Ads I played a major role in adding advertiser verification, which is a costly step. But I do think it reaches a point of diminishing returns, especially with regard to friction.

The problem is that these are traditional banking concepts dating back to the original 1970 BSA laws — does this legal entity exist, and is the person somehow associated with it? That's helpful. But what you really want to know is what this business is, and whether it has credibility to do the thing it's doing.

So if you have an individual, or a very small legal entity incorporated somewhere outside the U.S., and you verify them — you've got an ID for the person and you've verified the legal entity exists — and then they start running Delta Airlines customer support search ads, saying "Delta Airlines customer support, call this number"...

The question isn't whether this is a real person out of the six billion, and a real company. Frankly, fraud and scam businesses *are* people, and in many cases they *are* companies. The key question is: do they have anything to do with Delta Airlines? Is there any credibility to what they're going to provide — presumably that they're a subcontractor being overseen by Delta Airlines? If they don't have that, that's the main problem. It's not a checkmark on whether they exist. It's whether the representations they're making to their customers are credible or true.

Rob: So it comes down to credibility — verifiable versus non-verifiable claims.

John: Yeah. I did a blog recently along the lines of: it's not so much about verification, it's about claim credibility.

And the way I think about this is probabilistic. To get that friction optimization, a risk-based approach is very important. The great thing about the development of AML regulations and thinking is that it has gone much more toward risk-based. I think you could do the same thing with advertising.

So it's a matter of looking at the totality of the business — their whole public footprint, everything we know about their activities, all the claims they're making, all the validation we have — and then asking: what's the chance that their claims are lies? Material misrepresentation, in FTC language.

Then it becomes an interesting question of what you do with the various probabilities. And when I say probabilities, it's not that our algorithm can't figure it out. These are things where, even if you bring it to a human reviewer — if you just have a website and some ads and some information, unless you do further confirmation, in many cases you can't know. There are so many trust and safety groups that say, "I think this is a scam, but I can't be sure. They may be telling the truth."

And various regulations, including the EU's DSA, have very strict consequences for platforms that take action against a business where they don't have good enough proof. So the question is really: is the claim credible? Let's get it into a risk bucket. And based on that bucket, let's figure out what we do next.

Rob: One of the product managers who used to work for me used to call bad actors shitbags. So if I'm hearing you correctly, per the DSA you can't just have a shitbag score and decide that based on factors you're not willing to explain, this company is on this side of the score. You can't use that as a pretext to get rid of someone.

John: Right. Interestingly enough — and this is a public case, but it's from when I was at Google — Google was sued by an advertiser it had suspended for violating, I think, its misrepresentation policies, and it was brought before the French competition authority. Google was found in the wrong and was fined over $100 million. Some of that learning went into DSA regulations.

The interesting thing about it is that the French authorities said there should be a transparent way for that advertiser to understand what they did wrong. It shouldn't be a mysterious black box. It should be consistent, and it shouldn't seem like some guy at the platform just didn't like you. So it can't be wild.

Rob: Wow.

John: There's a lot of justification for it. But that's what's making it hard for all these incredibly hardworking trust and safety and ad safety teams at the platforms to do their job. They're being squeezed to be really sure and to have really good criteria — while the fraudsters and scammers are trying to make everything as ambiguous as possible.

Rob: I really worry about this. We're increasingly in a world where LLMs and AI tools are non-deterministic — they're probabilistic, to your point. You can come up with scoring criteria that give you almost certainty that something is bad. But if the standard is different from that, it means people are probably going to be less safe. And every now and then you will make a mistake. Some of these schemes aren't realistic in the way they operate, unfortunately.

John: The key part of this — and this is where AI can make a big difference — is advertiser engagement.

The hard part is that when you have these big platforms with hundreds of reviewers working in your tools, you have to be consistent. In the old days, maybe one of your trust and safety staff could just email someone and say "please justify this," and figure out the response. But that quickly became unscalable, and somewhat unsustainable — that's human variation, and per the DSA it doesn't look consistent.

But I think we have to get back to advertiser engagement, because ultimately that's what the advertisers and the regulators are asking for.

It's interesting what your friend called scammers. I actually think the better mental model of scammers is profit-maximizing entrepreneurs. That's the way they think of themselves. "I'm going to use all the machine learning tools, all the AI tools, to take this $4 item and maximize my profit." That's what being a business person is about. I'd disagree with their moral compass, but profit maximization is what it's about.

What that means is that, given the choice between never being able to advertise again on Google or Meta versus complying, they will comply. But you need a way to enforce that.

Some things are so bad — super dangerous, violations of laws — that you just never want it, and that person gets a life sentence. But there's a lot where it's, "hey, you're materially misrepresenting the health benefits of this supplement." That should have some consequence and should be demanded to be fixed. But you want to engage with the advertiser and say: this is what's wrong, provide the backup evidence that this benefit is real, or fix it and remove the claim.

That's the type of intense engagement we can now do with AI.

Rob: Do you think claim verification hasn't happened historically because of the infeasibility of doing it at scale? Is that the reason — and have those economics now flipped?

John: I think that is historically it. I've known people who debated whether we could do this. Ideally we could do claim credibility and claim validation, but ultimately people decided it wasn't going to be scalable — and scalability at these giant platforms is a giant concern.

I think we're at the point where it can be done. That's what a lot of my work is about. But the challenge is whether people are ready to make that step, because it's a significant paradigm shift. So we're getting a bit of the innovator's dilemma, where it actually is possible, but where is that leap going to be made? Is it going to be soon, or one year, two years, five?

Rob: You and I have both been in these meetings and told these tales — and not that they're untrue — about why platforms are such an engine of growth for small businesses. Google Ads, Meta Ads, other ad platforms, and services that aren't ads, that rely on being easy for smaller entities globally to access. I do believe that to be true.

But if you want to open a store in a city, you probably have to have a business license, and do a bunch of other stuff to prove you're going to clean up and put your trash in the dumpster, or whatever that jurisdiction requires. So as usual, the internet hasn't caught up. And you also have immediate global scale, so the things you have to verify are somewhat the same and somewhat completely different.

So who has to pay for this? Does it become the responsibility of the countries you're running ads in, or the advertiser? Where does the money come from?

John: Say you have a small business selling flowers, anywhere in the world. They don't have much of a footprint. They don't have the ability to do very onerous verification. But their ads are just flowers, targeted at their local country or city.

You'd say: okay, we don't have incredible validation about exactly who's running this. Maybe we have a corporate entity, but it's not super strong. But frankly, if that's the activity they're doing and that's what their website says — and maybe there aren't any scams in flowers right now — that's an example where you give that person low friction. The credibility of their claims is pretty good. There's no reason to suspect a problem.

But if that flower shop is suddenly advertising Oprah-endorsed miracle weight loss solutions to people 5,000 miles away — all of a sudden, ding ding ding, the claim credibility has gone to zero.

So it gets to: what is this business actually claiming to do, and how does that compare with its footprint and its reputation? That's the key innovative capability. When you get to that level of analysis, you can have maybe not zero friction — you may still need email domain verification — but low friction for the entrepreneur, and they feel confident they can run their ads without harsh restrictions. And then for the one doing something really weird and highly risky, you can start to put things in.

Rob: The Oprah case is extreme — it's obviously not real. But there could be cases in between. Now they're selling baked goods in their country. Now in neighboring countries. Now some other type of product. At a certain point it becomes more risky, but it's not black or white. It's maybe in the 50% range. And then how do you deal with that at internet scale?

John: Yeah. And if you want, I can go into the cost aspect — who pays for it — because I do think that's a big part of it.

Rob: Sure, that'd be interesting. Give us a sense of how expensive the different kinds of things are, and how you decide whether it's even worth it.

John: A lot of people don't realize how much these profit-maximizing entrepreneurs can create sizable businesses.

What I've seen in some recent work is that some of these scammers — not the totally obvious crypto fraud, but some of the lower-consequence e-commerce scams and subscription traps — are getting through and then happening on a gigantic scale.

There was a recent FTC case brought against a company named Genesis Tech. In the filings, they said the company had $700 million of PayPal payments across all their different accounts. Which is a stunning amount. So you think: is that a real business? Yes, it is. That's a very big business.

And they were doing subscription traps. They'd say, here's a PDF editor, you can edit the PDF for free — oh, but if you want to print or save it, you have to pay us $2. So just pay us $2. But in the fine print, you're actually signing up for a $50-a-month subscription. And then when you try to cancel, it takes months and months.

The amazing thing is, you don't make $700 million by not advertising. That's a very profitable business, and they are advertising like crazy.

That's what informs me about the economics and who pays. Because for a trust and safety team — or an outsourced trust and safety agent who has a metric and has 10 minutes, or 30, or even 40 to look at this case — this high-spending advertiser that may or may not be a scam... the odds are so stacked against them. How do they make a principled decision? It's a big decision. That's a big customer, but it's also a big amount of harm. And how do you unravel whether this is acceptable, or whether there's something they need to change?

If it's e-commerce, there's secret shopping. How hard is it to undo the subscription? That's a key fact, and you can't know it unless you try it yourself. That gets very expensive and very hard to scale — unless you make the advertiser pay.

That's the thing for me. If an advertiser is paying millions, or tens of millions, of dollars a month in advertising, and there's a 50 or 60 percent chance of scam, it's crazy that the platform would have to pay for that whole investigation. The advertiser should have to pay for some of the work to validate that what they're saying is true.

Rob: It seems like there's something missing — whether it's collaboration between platforms, or something that sits in between. There wouldn't need to be complete replication of all this verification if there were better tools in the middle, which I guess is the thesis behind what you're doing.

But in this Genesis case there were a bunch of things that might have raised red flags. Cyprus subsidiaries operating out of Ukraine. One or two of these things by themselves may not be a red flag, but you add a few yellow flags together and you should end up with a different set of decisions. I guess that's part of it — a lot of decisions are made at an atomic level and aren't looked at from a graph perspective.

John: The suspicion is pretty easy to get. If somebody is doing a million dollars a month of ads for a free PDF editor, and you go through the flow and there's ultimately a subscription, you can pretty quickly say this looks iffy.

This came out in some of the articles about Facebook from internal sources — what threshold they have, above which they'll action an advertiser, and below which, at some percentage, they have to let it go. I think it was 90% or something.

That's the key change. If it's a 50% chance of fraud or scam, we don't know for sure, and we may not be able to action them right now — but we have to engage with them. And if it's an expensive engagement that involves secret shopping and a real in-depth evaluation of whether their product does what they say, they may need to foot that bill.

If you have strict enough enforcement across platforms, so that's the expectation everywhere, then it's in the advertiser's interest to say: I want to work with one company, maybe a third party, that's going to validate me. And if I get validated well enough for Meta, hopefully Google can take that same validation.

That's to some extent what happened in the credit industry. We don't have every single bank doing their own independent credit agency work. We have Experian, Equifax, TransUnion. And in the business case we have Dun & Bradstreet and credit bureaus doing some of that work. Those were huge enablers for those industries. I think we need to do that with claim credibility and business.

Rob: What's next for BlueArc? What are you focused on right now?

John: Technically, it's continuing to improve our analysis. We have 20 or so different scam and fraud scenarios we've built. There's always opportunity to improve those, collect more information, be more rigorous, and analyze the relations. But we're at the point where we can provide very good results, especially in the 50 to 90% probability range, or even higher.

What I'd really like to see is the building out of this engagement. That's a bigger commitment for the platforms and marketplaces, because they all have it — they all have all these advertisers they think are probably scams but can't justify actioning yet.

So: let's start to put something in place. Maybe it's as little as email verification. "I'm actually part of this larger company that's very reputable — I'll just verify my email, and we're fine." "I'm part of a big-six ad agency that set up this brand new domain with no reputation." Great, okay, fine.

In some cases it may be more in-depth, or it may be claim remediation: you can't say this, I want you to fix the problem, and when you resubmit, if it meets the new bar, fine. There's technical work, but what I'm really interested in is people saying they're going to hold a higher standard.

John: It might be worthwhile talking a little about the FTC. They've been pretty active recently on scams, not just the Genesis Tech case.

What a lot of people in tech don't realize — and even people in trust and safety circles don't realize — is how good a framework the U.S. Federal Trade Commission, and its comparable agencies internationally like the UK's ASA, have for evaluating scams.

It comes down to their definition of material misrepresentation: a misrepresentation that materially affects a customer's purchase decision, such that they're ultimately deciding on a false premise. They thought it was accurate, and it wasn't. And it addresses disclaiming — fine print doesn't save you from the fact that you're misleading.

It's a really, really good framework. It's the way television and print ads, before the internet age and its giant scalability, were kept free of the serious material misrepresentations that are now commonplace. So it's a proven capability. It's really up to the platforms and marketplaces to decide whether they want to use it as their framework.

That's the key thing I'm looking for. Now that this technology exists, a lot of people are saying, "I'm going to train an LLM, I'm going to have it make the same decisions I'm making now." But to really get rigorous — to have a policy framework you can build on, with the evidence, and then share with the advertiser: here's what's wrong, this claim was wrong, that claim doesn't have the evidence — that's where I'd like to engage.

Rob: That makes a lot of sense. I've had conversations with advertisers who say, "We are playing by the rules, but the other ones aren't, and we're being disadvantaged by the people who aren't." So there's a community aspect of the rule-followers that can help move things along more quickly, I hope.

John: Indeed, the good advertisers in some cases are getting priced out. If your competitor selling this toy has a 90% margin because they're lying and it's a scam, and you're the legitimate one, you're not able to advertise.

A lot of people are getting suspended, and some of them are false positives. There's a great opportunity to raise the bar. A lot of these profit-maximizing entrepreneurs, if you raise the bar to an appropriate level, won't leave — they'll hover right at the bar. So you have to have a good bar. But a lot of them will comply if you give them a clear enforcement signal.

So there's a lot of opportunity to clean things up, still have very good revenue, and have a lot of advertisers perform better.

Rob: One other area I wanted to touch on before we wrap up. Know your business, know your customer — and now, you're in the Bay Area, and every time I go back, every other billboard is agent this and agent that. So what about know your agent? KYA. Is that a thing? Is it going to be a thing? Is it already?

John: It's a big thing. It hasn't impacted us as much, because typically the agent is working for a user — a consumer. So a lot of the emphasis is: I'm a buyer, I'm evaluating this dishwasher I want to buy, and I'm going to purchase it. And when that agent goes into the buying flow of an e-commerce site, are they really authorized? It's a very in-depth, complicated problem that a lot of people are working on.

The interesting reputational flip side is: those buyer agents — are they getting fooled? So one aspect is, for the e-commerce seller, is this really the buyer, the real person who can authorize that credit card transaction? But the other way around is: if I'm the buyer and I'm trusting my agent not to fall for a scam — LLMs can do pretty well, but as adversaries get more sophisticated with prompt injection and who knows what else, how do you make sure that agent isn't falling for it?

That does relate to what we're doing. You need to not just read stuff. You need very good information about each domain and what its reputation is. And it's not just the e-commerce domains — you look at the reviews of that e-commerce domain. Are the reviews on a reputable site? What's the business model of that review site? Is the review site owned by the same company as the scam, which we see all the time?

Rob: There are more entities involved in the discussion now. It's me, my agent, my credit card company — maybe my card company gave me an agent card. I haven't used one, but I've seen that these exist. And then it's Best Buy. And maybe the scammer sets up bestbuyrightnow.com with a hidden prompt that says, "we've temporarily had to redirect our website from bestbuy.com to bestbuyrightnow.com because of reasons."

So it's going to be an interestingly complex thing. There are probably liability models that can adapt to these new scenarios. But consumers often don't even realize they can dispute a credit card charge — hopefully most do now. But then you have something that looks similar but is slightly different, like a mobile phone bill, and they don't know they can dispute that the same way.

So it'll be interesting to see how these models evolve from a liability perspective, as well as what the common practice becomes and what safety mechanisms the different entities adopt.

John: It comes down to review articles. Most people have had the experience of going to a site like bestconsumerreviews.com and wondering: is this legitimate? It's a site, it has reviews — but are they independent reviews, or are these just ads?

I think we can now get to the point where those sites get this type of evaluation of how independent they are. And if they're really investing and want to differentiate themselves, then maybe as part of their verification they give read-only access to their payroll, and you could see that they have actual journalists on staff with this type of resume, or technical evaluation. There's a lot that can be done to differentiate the truly valuable review site from all the AI-generated slop out there that a typical person can't distinguish.

Rob: I'll share this anecdote — I think I've shared it before on this podcast. There was a Trustpilot review page for a certain scam, where people were saying they'd been scammed out of thousands of dollars. But oh, thank goodness, they found this one company that helped them recover some of the money. And they didn't include the name or the link to that company — they said, "I put the name of the company in my profile image."

John: That's crazy.

Rob: It's one of the worst ones I've seen recently. It's always going to be adversarial, and hard to figure out, even on platforms people would generally say do a good job, like Trustpilot. There's going to have to be more policing in general — who is the person commenting? And if it isn't verified in some way, you may need different standards for scrubbing or reviewing that content, including the image of the person.

Rob: John, it's always really fun to catch up. I want to thank you for taking the time. We'll have links to the website, your LinkedIn profile, and everything in the show notes. Thanks again.

John: Thanks so much, Rob, for having me on. And thanks for all you're doing across your three or four different jobs, all different aspects of fighting these scams. It's really great what you're bringing together.

Rob: Thanks, John. Appreciate it. Have a great weekend.