Frank Abagnale on fighting internet fraud: We need to start thinking like old-fashioned criminals

Frank Abagnale knows fraud. The man whose life story inspired 2002’s Catch Me If You Can has been an airline pilot, a paediatrician, a teaching assistant and a lawyer, all under false identities and all before he turned 21.

Abagnale defrauded banks of millions of pounds with forged cheques. He was arrested. He escaped the plane that was deporting him to the US. He was caught, locked up, then released to help the FBI uncover scam artists. Since then he’s worked closely with the bureau for close to 40 years and set up his own financial fraud consultancy: Abagnale & Associates.

At the age of 69, he also represents a different paradigm of crime. When Abagnale was a criminal, social media meant the phone directory. The internet was non-existent. The idea of pinpointing a person’s location through pocket computers was a glimmer in GCHQ’s eye. As digital technology has given rise to the global networks of digital security, you’d expect that it would now be much harder to get away with stealing a person’s identity. Abagnale says no. In fact, it’s become a lot easier.

“What I did 50 years ago is 4,000 times easier to do today,” he beams. “I didn’t have the internet. Everything that I did is so much simpler now. If you’d said that to me 50 years ago, I’d have said you were crazy, because I would’ve assumed it would be more difficult.”

The smile-and-handshake schtick of the classic con artist may be all but gone, but Abagnale says a new world of instant communication has drastically lowered the barriers to fraud: “Even if you go back to the simple thing of printing, I needed a Heidelberg printing press,” he explains. “I had to take eight months to learn how to operate that press. There were colour separations, negatives, plates, typesetting. It was a million-dollar press. I was able to produce incredible cheques on it. Today, I’d just need my laptop and I’d be able to produce the most beautiful cheques in the world.”

Abagnale also says we are living in a “too-much-information world”, where the increasing mass of private details held by companies makes it easy to fish for sensitive material. “About 50 years ago, you may have walked up to me on the press and said: ‘Hey Frank, are these British Airways cheques? They’re amazing. They look great. But let me ask: do you know where British Airways banks?’ I’d have to say that I didn’t know, and that I’d just made up a bank. Today, that’s a phone call away.

“If I called BA now, and asked to talk to someone in accounts receivables. ‘Look, I’m getting ready to wire you some funds. I need your wiring instructions.’ They’d give me the bank name, account number, routing number… If I hang up and call back to ask for their communications department, I’d ask them to send me a copy of BA’s annual report. Page three has the signature of the CEO, CFO, et cetera. Scan it, digitise it, put it on a cheque.”

(Above: Frank Abagnale as portrayed by Leonardo DiCaprio in Catch Me if You Can. Credit: Dreamworks)

Technology has made it easier than ever to steal someone’s identity, and this, Abagnale argues, is why new technologies are needed to keep one step ahead. He’s currently working with ID tech company Trusona to support its identity-authentication system. One of the technologies Trusona aims to pioneer, for example, is what it calls “anti-replay”; a way to safeguard against suspicious repeated transactions.

“If the data from a transaction repeats perfectly, we know it categorically isn’t you,” says Ori Eisen, the company’s CEO and founder. “It’s your evil twin that listened to you tap-tapping and is now replaying it to us. Because as a human, you can’t replay exactly where you touched or scanned.”

By analysing the physical properties of the magnetic strip on a scanned credit card, Trusona’s system professes to create a data image of the details around a transaction, including speed, angle, direction, pressure and wear and tear on each card. If this information is repeated, the company knows it is a fraudulent transaction. “There are no two magnetic strips that are the same in the world,” emphasises Abagnale. “It’s like sprinkles on a doughnut.”  

The market for hyper-secure physical authentication may currently be a niche for banks and nuclear reactors, but Eisen is keen to impress that new ways to fight identity theft are needed for everybody. Last year, the Equifax breach alone led to the personal details of 143 million people being stolen by hackers, and the amount of data breaches is increasing year on year.

“In 2016, we had 1,106 breaches, amounting to 1.7 billion identities being stolen,” says Abagnale. “We passed that in 2017. People don’t even think much about it, they just assume their identity has already been stolen.”

The sheer scale of identity theft in today’s world is unprecedented, and while people are aware of events like the Equifax data breach, there is a fundamental disconnect between this awareness and action. Is it any wonder that we hone in on figures like Abagnale, with their sly handshakes and smiles, rather than the faceless, nebulous world of contemporary cybercrime? There’s almost a sense of nostalgia for a time when identity theft involved stolen uniforms and forged ID cards, rather than an incomprehensibly large number of credit card numbers, snatched invisibly across continents.

Modern fraud is an intimidating force, but perhaps a starting point, notes Abagnale, is not to be dazed by the amorphous state of cybercrime, and to start treating the internet like an old-fashioned criminal: “The truth is, most people are honest – and that’s a great thing. But because they’re honest, they don’t have a deceptive mind, so they’re not sitting there thinking: what’s someone going to do with this information?”