How AI Beat the Bad Guys

Cheryl Brown

In this episode of The Purposeful Banker, Corey Gross from Q2 and Louann Habenicht from Susser Bank discuss how AI is being used to battle the ongoing check fraud problem. They walk through how positive pay has evolved, how machine learning fits into the process, and what it takes to build not just a tool, but a broader fraud prevention strategy that actually works in the real world.

Listen

Transcript

Cheryl Brown

Welcome to The Purposeful Banker, Q2's leading commercial banking podcast, where we discuss the big topics on the minds of today's best bankers. I'm Cheryl Brown.

Today, we are replaying a powerful session from Q2's CONNECT 25 customer conference that dives into one of the most persistent challenges in banking—check fraud—and how AI is finally making a dent. You'll hear from Corey Gross, VP of product for AI and data solutions at Q2, and Louann Habenicht, director of treasury management solutions at Susser Bank. Together, they walk through a real-world in-production success story of using AI and machine learning to power smarter positive pay.

This isn't just a tech talk. You'll hear how Susser Bank dramatically reduced false positives, protected clients from mailbox fraud rings, and empowered operators to become AI trainers instead of manual investigators. Bottom line, this is AI that's not only compliant, it's practical, profitable, and protecting customers every day. Let's jump in.

Corey Gross

Thank you so much for attending today's session. Excited to talk to you about powerful and compliant AI and with a focus on positive pay. This is not going to be, as a bit of a proviso upfront, an overly technical session. I've been tasked with bringing this down to earth with a focus on the business problem so that we can make AI resonate in a way that appeals to everyone and applies to actually solving something meaningful for the business versus just getting into the nuts and bolts of how the thing works.

So, this conversation is going to be focused on two things. The first is how to deploy AI to solve meaningful business problems and drive value, and the second is how to do that, not just on its own merits, but taking into account a broader holistic solution, including how to make compliance more of a feature rather than a nuisance of an AI solution.

So, safe harbor, throughout today's presentation, we'll be talking about some future plans and expectations. They're based on what we know right now, but things can change and results turn out differently. If you want the full scope on potential risks, please check out our latest SEC filings. I'm Corey Gross. I'm VP of product for our AI and data solutions.

Louann Habenicht

Good morning. I'm Louann Habenicht, director of treasury management solutions with Susser Bank.

Corey Gross

And we are very excited to share learnings from something awfully rare in the AI landscape these days, which is actual stories and success metrics from an in-production deployed to actual customer's AI-powered product. So, we've got this quote up on the board: “We have all, at some point, confused doing something, anything with actually solving the problem.” Anyone know where this is from, by the way? Anyone hear this? It's actually from “Mulan.” I thought it was just apt because, when it comes to AI, it really feels like this is a summary of the AI space: pressure to do something, anything to feel like they're part of the crowd of folks who are working in AI but not really knowing to what end.

And so, what we need to remember and grounding, hopefully, this presentation is that AI isn't the end, it is just a tool. We don't buy hammers to go around finding nails; we approach each problem that we approach or that we encounter with the desire to create a meaningful outcome that ultimately drives, in this case, a business solution.

And so, yes, AI widespread, it's awesome. If you're experimenting with Perplexity or ChatGPT or any of the other generative solutions, it's inspiring what it can solve for at an individual level, at a team level and, ultimately, at an organizational level, but we always have to ground ourselves in the job to be done, otherwise, we're going to become a modern meme as we chase AI. What we should be thinking about is, number one, identify a high-value problem to solve, then we can select and implement the right tools to solve that problem, and then we can observe, measure the impact of the tool that we selected, the solution that we've created and mature and evolve it from there. That's the way product development happens. That's the way we create progress in technology in our work.

So, first, I wanted to start with identifying a high-value problem, one that is hopefully worthy of everyone's time and attention. So, this is a bit of a pop quiz, but it should not be very hard for anyone to figure out what the answer is given the title of the session. So, what do we think is responsible for $20 billion in annual losses with losses growing at a rate of more than 12% year over year and a problem or activity is increasing by 40% year over year and is experienced by 70% of financial institutions? It's check fraud. Check fraud's bad. And the fact that we all have been talking about getting rid of checks and how checks are going to be replaced by ACH, the pervasiveness of check using, it might be going down but fraud is still super high and growing.

So, as we all know, and this is where we get to positive pay and the different solutions over time that have been deployed to solve this problem, this is not a new thing, solving for payee match and positive pay type solutions is not new. We've had solutions for quite a while, and they've evolved as the art has evolved. So, number one, you can imagine back in the day, someone would deposit a check and, in order to investigate a potential fraud, you would actually have to find that check that was deposited and cross-reference it with a transaction and say, “Oh, manually investigate this,” which is super time-consuming. “Is this fraud?” So, a lot of human time was spent on the act of finding the check and matching it.

And then solutions emerged that would allow you to capture an image of a check. So, you deposit, an image was done, in Canada—that was some Canadian, sorry—through a company that would work for all the big five banks and would create an image of every check and they could pin that to a transaction. So now the human work wasn't spent actually searching for a physical artifact but was spent reading the check and making sure that the values match and the payees matched.

And then OCR came around. So, OCR is optical character recognition, and what it did to accelerate the time of investigation is extract the data from a check so now we can see if the characters from the check data extraction matched the value in the transaction ledger. So the work was now being moved from the human operator transcribing what was on the check to actually just making sure that they matched and, wherever there was a mismatch, they would flag it. So while OCR represented the state of the art and is a big part of positive pay and payee match, it is prone to error.

And so for anyone here that has used OCR-based solutions, whether it's in the positive pay and payee match case or in just their everyday life, you know that it's susceptible to breaking down when you get check stock that might be fairly complicated. It does a poor job of recognizing things like handwriting, low-resolution images—it will break down and so forth. And the failure with OCR is not just in the fact that it didn't match, it's that it provides the illusion or it can provide the illusion of that safety net. So false positives, for example, can be very high, and so you come to trust a solution because of its technology prowess but it actually might undo the impact that it is making, it creates. It's the case of the cure being worse from the disease.

So, what we did was we looked at the state of the art in OCR and we took the problems that were associated with it—low-resolution images, check stock that can be very varied, handwriting on checks—and we ultimately sought to build a more accurate way of extracting data from checks, a more scalable way because now we don't have human operators investigating every single false positive or exception and something that can, as a consequence of that, be far more compliant. So we chose machine learning, in particular, transfer learning to do that.

And so, what machine learning allowed us to do was, number one, handle different types of stock as you see here and deliver an explanation for how we got to those answers as you saw in the previous form. Provide a signal that isn't just an operator making a guess as to whether the value is matched but actually providing you an insight in what it believes is occurring here.

And we can also detect handwriting. You can also see there somebody wrote “Victor Torres” on a check, and we can see that that was something that was added to the check via handwriting, and it created a mismatch. And we sent a signal back to the operator that said, “Hey, you have to investigate this. There's not a match.”

The point of all of this is that we have created something where the operator is no longer responsible for making the match from reading an OCR, but the operator is now responsible for training or updating a machine learning model as new exceptions occur so that the model can do a better job. And so, net-net of all of this is we have a solution that is better at fighting fraud, is more compliant because we can explain how we got to the answer in every single case, and gets better over time because the operator's job is now to train it to get better.

So, now to what I think is the real meat of this presentation, the good stuff, in other words, I think it's best to start with resetting what is positive pay and the purpose of payee match. So, Louann, would like to throw it over to you to explain to the audience who all probably knows this very well, but, in your words, positive pay, payee match, what is it?

Louann Habenicht

Yeah. So, positive pay, I think we're all familiar with it, it's a fraud prevention tool that our clients use through online banking. So, they're running their business, they write all their checks, extract that information and upload it to online banking, and then we match that information against it. It's been around for many years, matching the check number, the date of the check, the payee and the dollar amount. However, the payee match now that we have is what we're seeing that is catching so much fraud because, since 2020, during COVID, we saw people were writing checks more and they also were taking and erasing the payee name and using a chemical to take off the name, put their own name. So without payee match, positive pay was still working. Still verifying the check number was the same, the dollar amount was the same, the date of the check—but the payee was changing. So, what was happening is those items were clearing and, if they were to clear, it could become the bank's loss. So, that's where payee match has really come into play and save the bank lots of money.

Corey Gross

So, I know we talked a little bit about the process over time of administrating payee match. How has that changed from before this new enhanced version of positive pay that we've shown to after? How has the role of administrating payee match changed?

Louann Habenicht

Yeah. Well, it was creating lots of exceptions or false positives, if you will. So, you could have a check that was payable to ABC Tire—for example—LLC, but it's truly the client had inputted as “ABC Tire, Inc.” So then that became an exception and the client had to work that. Or, obviously, now with payee match that it's changed, so when they have an exception or a false positive, it truly is an exception that warrants that client's time to actually look at that image of that check and verify it and they control that.

Corey Gross

So, you talk about being able to flag and catch false positives and be able to distinguish them from actual fraud. So, what has been the biggest change since we put the new payee match into effect? Has it been the reduction of those false positives? What has been the impact on the operator and how have they used that time?

Louann Habenicht

Yeah. Definitely the reduction of false positives. It's really, honestly, about 100% less than it used to be compared to now.

Corey Gross

So, I want to get into some actual case studies that's like a table setting of what is the solution, how is it a bit different. But we talked about some specific examples that I thought were incredible tales from the trenches, real cases of businesses feeling the impact of fraud and the impact the payee match solution can make on their business. So, the first was a staffing company that Susser supports. I'd love to hear a little bit more about that story. I think everyone would really like it.

Louann Habenicht

Yeah, for sure. We have a staffing company that's a medical staffing company in DFW (Dallas-Fort Worth). They average 2,500 to 3,000 checks a week. They've been on positive pay for quite a long time, but their exceptions were still very high because of fraud. And so, that client, when we actually implemented, our team implemented positive pay payee match, they were like, "We love you, thank you so much because you have no idea how much time that that has saved." And again, when there is an exception or it calls it to their attention and they truly know it's an exception, something's wrong, fraud is happening.

Corey Gross

So, now that we're talking about so many checks a week, what does the exception load look like from before something like a machine learning solution to after it's being implemented?

Louann Habenicht

Oh, my goodness, I can't even begin to tell you how many items they had. Hundreds some days, some other days, maybe it was 30 or 40 items that the client actually had exceptions. They’ve got to pull it up and look at it and verify that information and either pay or return that item. But, at the end of the day, it's administrative and they had to look at it and take their time. Now that they don't have to do that, it's been life-changing for them and save them so much time spent running their business versus looking at exceptions.

Corey Gross

So, another case that we talked about that I thought was really interesting and it speaks to the COVID-era check manipulation is one where I think folks were breaking into people's mailboxes, stealing insurance claims, replacing the payee information and trying to run it. So, how does something like that get through before and how does it get caught now?

Louann Habenicht

Yeah. Well, before, again, the check number and the date of the check matched so it would just go through the system. But now with payee match, it truly causes that exception and catches those altered checks because there has been a huge ring, actually, relatively across America but experienced in the DFW area, we had a lot of clients that were having checks taken out of the mailbox. Actually, we had a client, a business customer in DFW that they came out in the middle of the night and used a welder and cut off the mailbox, took it back, took all the checks from all the businesses in the business park and, obviously, wrote checks, stole, fraud, it just went on and on and on. So, payee match stopped that 100%.

Corey Gross

Handwriting. So, before we took on this project, our Director of Engineering Daniel Wagner, I see in the audience, he was my VP of engineering at Sensibill, which was my company that was acquired by Q2 about 2 1/2 years ago. And we were a machine learning AI company, hence, why they tasked us to work on some of these projects that very well could see value from AI.

We didn't know how pervasive handwriting on checks would be because we thought it was crazily silly that you could literally doctor a check with handwriting and submit it through and be like, "Oh, no one will notice this, this is great," even though it's comically clearly a fraudulent case. So, how pervasive is this? I would love to get your perspective on how pervasive is it and, now that we've implemented a solution that can capture it, how meaningful is that? These aren't trivial efforts to build these types of solutions, but we always want to know how meaningful is the problem that it's solving.

Louann Habenicht

Well, in our opinion, it's very meaningful because clients are still writing checks and sometimes, even though they upload their checks and use their accounting system to create checks, there's always a time that the CFO needs to physically write a check or handwrite a check, obviously. And so, the fact that it can catch those just blows your mind because it could still, again, be a check that has gone through the accounting system and then they take that check and then write Susie Q's name on it and it catches it. It blows your mind. Blows your mind.

Corey Gross

So, that's all great. Ultimately for us, what's always been very fascinating to hear is how folks, fraudsters are always trying to get ahead of the systems that you build and it's this cat-and-mouse game. But so much of the goal of technology is to play just a part in solving a more ... Being part of a more holistic solution. So, as we get to setting up positive pay for success, I think that something that I've always been very appreciative of in Susser Bank’s case that I think that this entire room can really benefit from is seeing the technology—the AI—as not the thing, the silver bullet, but one of the lead bullets that makes up a much more holistic solution.

So, I want to ask you about your approach to positive pay in particular and how you design this more holistic approach so that it includes everything from business process, reengineering and training, and customer notifications and even just the interface from how you access the solution. What have you done to make customers aware of this and make them successful at using this?

Louann Habenicht

Well, our treasury team is amazing, first off. They're the trusted advisor. They're visiting with the customer and educating them on fraud. But in the first quarter of '24, we took a bank initiative that positive pay was going to be at the forefront. And so, starting at our CEO to the treasury officer to our treasury team, the banker, where it's a partnership, it's understood that it's a conversation that we have with every single client that we meet to educate them. And it's actually embedded in our agreements. So if our client chooses not to get on positive pay, they're signing a Hold Harmless at the beginning. So, these are clients that haven't even had fraud occur yet. It's starting at every single brand-new client that we're coming on board. And then, as we do maintenance throughout the life of the relationship, then we're having that conversation again and the customer signs that declination, if you will, that Hold Harmless that they have turned it off and the banker, the account officer, is signing as well.

So, we work together as a team. Our front line understands how important positive pay is and, like I said, we have the support and, honestly, it's the only bank I'm aware of, and I don't know if any of you guys are aware of any other bank, that takes that approach.

Corey Gross

We talked a little bit earlier about how sometimes they say, “No, thank you. Thank you but no thank you.”

Louann Habenicht

True, mm-hmm.

Corey Gross

How do you manage through that especially as the pervasiveness of the problem persists? How do they come back around? What makes them come back around other than, oh, my gosh, a $15,000 check just came through?

Louann Habenicht

Honestly, it's when that fraud happens that they come back around. We have a really great—not really great, I guess a success story—a real live action that just happened about a week ago. So, we had a client that our treasury officer has talked to them four times about positive pay, and they're in the room today. They talked to them and educated them and they're like, "No, thank you, I just don't …" Because it's an extra step for the business. They're running their business; the last thing they want to do is extract their checks and upload it to online banking because it is an extra step—until they have fraud. And so, the story changed when the client had fraud and they're like, "Yes, I want positive pay." So, it happens, it's not a matter of if, it's when.

Corey Gross

We talked about some of the configurations that you've done, so defaults, this whole sense of setting it to pay or setting it to return. So, how have you determined what's right for the bank and how do you coach clients along that journey so that they feel like this isn't just something that Susser is doing to protect itself but they're doing something that's actually in my, the client's, best interest?

Louann Habenicht

Well, our default is return because we wanted to protect the client, but we want to protect the bank. So, with that being said, it's less than 10%. We just looked at the numbers yesterday to confirm that I was correct that it is less than 10% of our clients that have chosen to pay. And it's whatever is right for them but, again, we want to protect the client but we want to protect the bank. Because if we return, if we pay an item and it's fraud, that's a loss to the client at that point.

Corey Gross

When we first started talking, when I know that it was ... What lit you up was the idea of having the availability of notifications in the mobile app and just the tooling that helps provide confidence along the way that there's a system in place for you to be able to monitor even when you're away from the office or you're on vacation, etc. So how have you set that up so that clients can feel like they're always protected?

Louann Habenicht

They're managing that?

Corey Gross

Yeah.

Louann Habenicht

Well, we've done a couple of things. One is, when the client logs into online banking, it's on the homepage on the right-hand side that they know right then that they have exceptions. So, that's forefront in front of them and, in addition to that, through the app. The app, our clients love it because I use the example they're on the tarmac fixing to leave to go somewhere out of the country and they can see that and they get a text alert that they know that they have exceptions that they haven't worked and so they can do that right then. So, we're giving them all the tools in addition to training.

Corey Gross

Yeah, I want to double-click on some of the best practices and the training because, to me, this is an area where technologists aren't necessarily thinking about the scaffolding that makes a solution successful, and I think this is a case where the scaffolding is almost more of the solution. Positive pay is obviously strengthened by the modern state-of-the-art tools that you can leverage, but it's really all of the ... It's the apparatus that has made this successful. Can you talk about the guides, the training, the customer comms that you have assembled to make the impact that it has?

Louann Habenicht

For sure. Again, it starts at the beginning. Most people are visual so that training is so important. Our treasury team does an, again, amazing job. We couldn't do it without them, so thank you. They take the time and they train that client, they'll let the client ... We do Zoom calls and we go in person sometimes depending on the situation, but I'd say 90% of the time since COVID is via Zoom on the training. So, we let the client log into online banking and let them drive. So, through that, we also provide a user guide, a positive pay payee match user guide and walk through the steps for that process. And in addition to, we turn on positive pay a few days before they're live so they actually have exceptions to view. And once we've done that, they're just coasting because they have it all set up for them.

Corey Gross

How has the operator side of the training played out for Susser? So, as we're talking about the journey, the role of the operator is so key to this solution. So, the role of the operator was once going through, like I mentioned, searching for the paper check and matching it, and then it was reading the OCR, and now it's training the machine learning system. So, how do you get the operator comfortable with their new role as technology has evolved?

Louann Habenicht

Well, we just talk about the risk of fraud, it's on the news all the time. The FBI, Secret Service are continually showing all the different fraud rings, so it's education. Again, it starts at the beginning of that conversation, preventing fraud before it actually happens and setting up positive pay at the beginning. Getting the customer buy-in because it is an extra step. So, we show them how to extract that information from their QuickBooks or their accounting system and then also show them how to manually enter a check, but they control those exceptions daily and they can watch that and they make the decision to pay or return that item immediately, stopping fraud before it ever happens.

Corey Gross

So, now I want to get to some of the numbers. So, all good stories, really an exemplary example of how AI is a part of this solution. It's a tool that helps you deliver an outcome but it isn't the entire solution, it's not the whole part of the stack. So, I want to talk about the impact of this solution holistically for Susser, and I'd love for you to provide context as we go through this. So, the first, 335,000 checks—I think it's less than 1% of those checks have been flagged as false positives; 100% of true fraud has been caught; $12 million represented; and 46% of growth in treasury onboarding. So, no question, I think this is an example of how to do positive pay right and, again, a small part of this is the AI. A large majority of this is all the stuff around it.

So, can you provide context for this for folks in the room and how this helps build Susser's reputation? What does it mean to you? How do these numbers stack up for you based on your experience of handling this kind of problem for many, many years?

Louann Habenicht

Well, again, the support starts at the beginning with our bankwide initiative, making that conversation with the client a little stronger. This is best practices. You're running your business. Again, we want to help protect you and how strongly we recommend positive pay. So, we do that at the beginning and that sets our team up for success and the client. These numbers are for 2024 and, again, we're located in every major market in Texas, and so it shows a lot, again, to the team because of the conversations that we're having, and the initiative has really made a big difference.

Corey Gross

Yeah. The one that we try to work on the hardest to push down, and Daniel could speak to this or you can mob Daniel after this presentation to grill him on the ins and outs of the payee match solution, but it was moving down the false positive rate while keeping your false negative or fraud rate very, very strong. And that's that tug and pull between do we optimize for experience or do we optimize for catching fraud? And it's a pendulum that you're currently always trying to navigate. And so, that's the one, I think, that sticks out to me when I was reviewing these metrics for Susser. But how does this ultimately buoy your reputation and how does this help you to attract customers, maintain your existing customers, and compete?

Louann Habenicht

Well, it's really the training, I really think it is. It's setting our clients up for success, which our team does—I keep saying it over and over again—an amazing job to setting up the customer for success and educating them. A lot of businesses and a lot of treasury teams just go and they set up their services. It's “What products do you need, let me check this box and then we move forward.” But our team really works with the clients and wants to understand the business, and that just helps improve our reputation. We do that in every area of the bank.

Corey Gross

So, I want to touch on a little bit about where positive pay and payee match and this solution, type of solution goes from here. Where does it go from here? How could we use the same technology and apply to different problems or problem statements in this area?

And so, the first is we talked about handwriting, but the next is signature detection, and that's a whole other ball of wax. And so, what you can expect from positive payee match next is check signature detection so that we can create, ultimately over time, this idea of a check verification network. And this is being able to identify common fraudsters as they move from committing fraud at one FI to another will be able to detect, hey, this matches a pattern so we should be able to stop that immediately without even undergoing further investigation because we will have seen that this is a previously identified fraudster.

The next that we talk a lot about is this expansion of coverage. So, one of the problems of OCR was recognizing low-resolution images, remember, and different stocks. And so, as we, as Q2 expands geographically, being able to identify new stocks, different types of checks is going to be part of positive pay growth because I think it is an important throughline of the evolution of this technology to catch fraud and solve for this problem is a possible agentic approach to payee match.

So, if you think of that evolution of human being wrestles to find paper check, human being, their work is now extracting data from an image or at least looking at an image of a check that's been appended to a transaction and their work is actually ensuring the match. And then the next is human being training the model to make sure that it is as accurate as it can be in identifying a match. Now we're going to have a human being overseeing an agent whose job is to analyze and monitor fraud.

So, the role of the operator is what's changing over time here based on the technology that's available. So, that's the progression of technology that we see here but I did want to close with you, Louann. Where do you see check fraud based on ... You've seen this from one end of the technology spectrum to now. Where do you see check fraud in three years, and how do you see the tools evolving?

Louann Habenicht

Yeah. Well, check fraud's not going away. I would love to say it is. We thought checks were going away for a long time, and they haven't yet. But I think, as the technology evolves, and I think it will, the signature piece of this that's really going to really change the way that we look at fraud and, again, protecting the bank and protecting our clients. So, I think, again, the adoption will increase, the more bells and whistles, if you will, that we have available through payee match is really going to make a difference utilizing AI.

Cheryl Brown

And that's it for this episode. Be sure to take our short survey at q2.com/podsurvey and give us your input about the topics you'd like to hear. Subscribe to the show wherever you listen to podcasts, including YouTube, Apple, and Spotify, and you can see our archive of podcasts at hub.q2.com/podcasts. Until next time, this is Cheryl Brown and you've been listening to The Purposeful Banker.