Minter Dialogue with Aaron Painter
As someone deeply focused on the human element of business, Aaron’s practical insights are shaped by a global, multicultural career. His latest book, “Deepfaked: Restoring Trust in the Age of AI Impersonation” (Fast Company Press, October 2026), picks up on the urgent issue of deepfakes, questioning how we verify truth and identity in a world where AI can mimic nearly anything—or anyone.
Our discussion delved into how technology, particularly AI, has complicated or even upended basic notions of recognition and trust, not just for companies but for individuals too. What happens when cybercriminals exploit these gaps, and how can both companies and people adapt? With sharp stories—like the near-miss that involved his own grandmother being targeted by an impersonator—Aaron brings alive the very personal, human cost of digital distrust.
3 Key Points:
- Earning Trust Across Cultures: Aaron described navigating environments where he didn’t look or sound like anyone at the table, underlining that listening deeply—with intention and respect—was foundational to building genuine trust, even when language and cultural markers differed sharply.
- The New Challenge of Digital Impersonation: The conversation focused on how deepfakes and AI-driven impersonation represent a new, formidable threat, rendering traditional signals of trust—like facial recognition or verbal cues—unreliable, and pushing the need for stronger verification in digital interactions.
- Verification Versus Recognition: A key theme that emerged was the difference between simply recognising someone (relying on familiarity or voice) and actually verifying identity. In today’s world, robust verification processes, often employing modern mobile technology, are vital for both security and a good user experience.
To connect with Aaron Painter:
- Learn about Aaron Painter and his book, “Deepfaked: Restoring Trust in the Age of AI Impersonation,” on his eponymous site here
- Learn more about Nametag at getnametag.com
- Find/follow Aaron Painter on LinkedIn
Further resources for the Minter Dialogue podcast:
Meanwhile, you can find my other interviews on the Minter Dialogue Show in this podcast tab, on my Youtube Channel, on Megaphone or via Apple Podcasts. If you like the show, please go over to rate this podcast via RateThisPodcast! And for the francophones reading this, if you want to get more podcasts, you can also find my radio show en français over at: MinterDial.fr, on MegaphoneFR or in iTunes. And if you’ve ever come across padel, please check out my Joy of Padel podcast, too!
Music credit: The jingle at the beginning of the show is courtesy of my friend, Pierre Journel, author of the Guitar Channel. And, the new sign-off music is “A Convinced Man,” a song I co-wrote and recorded with Stephanie Singer back in the late 1980s (please excuse the quality of the sound!).
Full transcript via Castmagic.io
Transcription courtesy of Castmagic.io, an AI full-service for podcasters
Minter Dial: Well, this is the way I wanted to start this one. Are you the real Aaron Painter?
Aaron Painter: I think so, but it is good to ask, and it is even better to verify often when you jump on a video call with anyone.
Minter Dial: Indeed. Well, Aaron, we’re going to get into this, but my usual way of starting is to ask, who is Aaron Painter?
Aaron Painter: I am a business executive. I spent most of my career working on the intersection of sort of trust. I spent 14 years at Microsoft, mostly outside the US, having a chance to work in different countries and geographies where I often didn’t look or sound like anyone at the table, but having to earn trust with employees and with customers in those local markets. And then I had the privilege to run a company that was based in the UK called Cloudreach. It was helping big companies move to the cloud and trust kind of their critical infrastructure and with new sort of technologies and a new, kind of a new world with what cloud computing brought. And then 6 years ago, I founded a company called Nametag, and we do high assurance identity verification for really kind of high-risk moments that employees or contractors or members of a company often have where bad actors take advantage of those moments typically to commit cybercrime or to impersonate others. And I wrote a new book that’s coming out on October 13th, focused on deepfakes. Its title is Deepfaked: Restoring Trust in the Age of AI Impersonation.
Minter Dial: Groovy tunes, Aaron. So, let’s go back to some of your work overseas, gaining trust. Having also learned multiple languages, I have, and worked in international, it’s different dealing with internationals and people from a different place. How did that inform your ability to develop trust?
Aaron Painter: Yeah, it very much, I think, is different. There’s certain similarities in human nature in some cases, and often I find some values can be aligned, but values can also really differ culture to culture and country to country. I, you know, I had this experience where I would move somewhere new. I had the chance to live in France for several years, the UK for several years, Brazil for several years. And then with Microsoft, at least China for 5 and a half years, 2 in Beijing and 2 in Hong Kong, and then 3 and a half in Beijing. And then a ton of, ton of travel and visits to what we thought of as emerging countries and emerging markets in the years in between. And, you know, this common theme was that I was someone who often didn’t look or sound like the people there. I often didn’t speak the language. When I was at Microsoft in particular, you know, people thought I was almost like a spy. you know, sent in from the headquarters. And these were really difficult environments to sort of earn trust in general. And so, that became kind of the focus of many years of my career and learning techniques and ways to do that, many of which became kind of the focus of my first book in 2017, talking about the power of listening and how listening could be used as a tool to eventually earn loyalty.
Minter Dial: Well, the challenge with listening I mean, as we know, there’s nonverbal communication. There’s the, the diction and dialects and, and, uh, and, you know, one word could be different. Uh, anger could even be differently expressed, or shame, embarrassment. Um, and those are different words. And, and so you’re trying to put a name on, on emotions, trying to figure out What’s going on in front of me? Is it me? Is it them? How do I establish that trust when your vocabulary somehow isn’t quite the same?
Aaron Painter: Yeah, one of the takeaways I had was that when people feel listened to, they feel respected. And respect to me is a fundamental primitive in this sort of journey of earning trust. And listening can happen even if it’s nonverbal. It can be, it can be sent with deep intention. When you’re really focused on someone, you’re really trying to understand what they’re saying, even if the language might be slightly different and you’re not getting every word. People feel like you’re trying. They feel like you are genuinely curious and you have a desire to understand what they are saying. And when they feel that way, even if you’re not getting the exact words, in my experience, they feel respected. And if they feel respected, then they might walk away and feel like this is someone that I can build a trusted relationship with. And so, often I’d be in environments maybe where somebody would help translate or fill in words, but it wasn’t about me just passively waiting for a translator to say a few words, or it was about how the person felt I was listening to them when they were trying to express themselves. And so, that was often nonverbal, and it was often an emotional response. But so, often communication is actually are the emotional response and not the substance of the words themselves. And so, those were, those were just some of the practical environments I found myself in and some of the techniques I found that were sort of useful in, in trying to earn trust, particularly in, in new relationships or in new environments.
Minter Dial: And of course, you can even have the same challenge when you’re dealing with English, English as opposed to American English or English culture. And so, it doesn’t have to be just Chinese versus American. Yeah, this idea of gaining respect and showing that intention, that is sort of that deeply human element. I mean, I write a lot about empathy, and the challenge with listening, of course, is, A, can you really understand the person? But then, you know, maybe you can’t, but if you reformulate, that helps them to understand that you’ve been listening. And the thing, Aaron, that it strikes me so often is that rather than listen, the other person will quickly jump on their version of the story. Like, oh, last night I had dinner with some friends. Oh yeah, me too. Well, I had dinner with some friends and we completely move the plot over to the other person as opposed to stay, stick with them. And I suppose that that, in the end of the day, is true listening.
Aaron Painter: Very much so. And I, some, I just draw that distinction between, you know, listening to respond versus listening to understand. And often I do feel like people jump to their instinct as I, they don’t want idleness. They don’t want quiet. Let’s say in a conversation, they want to be interesting or seen as interesting. And so, yeah, they might immediately, as they’re, as you’re saying something, they’re trying to process what to say next to keep the back and forth going of a conversation as opposed to a true curiosity to, and listening to understand. And that is very much one of the distinctions I wrote about in that book. And I agree with you very deeply.
Minter Dial: All right. Well, I want to get back, I want to get into your new book, but Nametag, how happy were you to come up with that name? It seems like a perfect name available, you know, finding brands and all that. Tell us the story behind the creation of the name of your company?
Aaron Painter: You know, the name arose out of a challenge, which was that in the start of the pandemic in 2020, I had a bunch of friends and family members who had their identity stolen. And I said, I’d be a good friend, I’ll be a good family member. I’ll jump on the phone, we’ll figure this out, we’ll get things straightened out. And every company we’d call said, well, before I can help you, I need to ask you some security questions. And that often meant, what’s your favorite color? What’s your email address? What street did you live on in whatever year? It was either too hard and complicated to remember or too easy such that it was sort of readily available information. And what happened is that someone had called before us in that case, and they had answered those questions and they had taken over their accounts. And what coupled that with this experience I had had a few years earlier where, you know, my grandmother had someone call her when I was living outside the US and pretend to be me. Yeah, they used my voice, they used a little bit of my likeness, and they claimed that I was in trouble and I needed money, and, you know, she’s the only one who could help me. And fortunately, at the end of the day, just before she was about to kind of give in to this sort of con artist, my grandfather overheard part of the conversation, and he recognized some word that I used which didn’t sound familiar to him. It’s like a nickname that I used for his son.
Minter Dial: Yeah, grandfather.
Aaron Painter: Exactly. He doesn’t call me that, you know, that’s not it. And so, they, you know, my grandfather convinced her to hang up the phone. And then when I went to see her for Thanksgiving, which, you know, was sort of our annual rite of passage, we’d always get together over Thanksgiving no matter where I was living. She ran up to me and she was so just, you know, distraught. And I had no idea why. And then I learned more about what had happened in this experience. And I realized in those years, and then I compared it with what was happening at the start of the pandemic. And I said, wow, in today’s world, you really don’t know who’s behind the screen. And with the advances in AI technology, that’s only going to get worse. And so, it can— the idea was, you know, could we find a way to help protect people by being able to verify who’s on the other end of the screen? And then to your point, it was this sort of this naming journey. Well, what do you— how do you categorize that? And what is the right thing to call that or to call a company or to call a product? And we thought about the physical world. I thought a lot about what does it mean to be in person? You know, coincidentally, you would go maybe to an event or a convention or, you know, a new meet and greet of any kind, and people give you literally a name tag, a sticker or something you wear around your neck that sort of says, hi, my name is this. But interestingly, there’s often someone sort of at that check-in experience. They know who you are. They invited you to that. They maybe they’ve asked to see your ID or your business card, and they’re kind of vouching for you so that, you know, anyone you kind of meet in that social environment has kind of been verified. They’ve been vetted, and there’s it’s sort of safe to get to know them, and they’re not pretending to be someone else. So, we said, can we take that same concept of the physical world and the idea of a name tag and bring it to the digital one? So, you could have the same sense of sort of trust that might come from seeing someone’s name tag, that they have verified who they are, and that you can therefore trust the, the phone call or the Zoom call or Teams call, whatever it might be, or a transaction that’s about to happen with someone digitally. So, that was sort of the, the impetus of the idea of, of Nametag.
Minter Dial: Well, So I’m thinking with a name like Aaron Painter, there can’t be a million Aaron Painters around. So, is that a good thing or a bad thing? And then secondly, when you’ve done so much and been out there so frequently with your voice and your travel, does that also make you more prone rather than be sort of discreet, private, Not available, don’t publish anything. It’s almost like this world of distrust is pushing us to want to hide behind John Doe and not be public anymore.
Aaron Painter: Yeah, a large part of me really resonates with that. In fact, you know, a lot of our earliest employees, me included, were really kind of privacy fanatics and we really cared a lot about privacy and data protection and protecting ourselves and our families and those around us. And You know, so it’s something you have to come to terms with a little bit if you’re going to be a bit of a public face and start a company and, or do things that are meaningful. You by default have to become a little bit more of a public person. But interestingly, you don’t have to be a public person these days to be impersonated. And often it’s people that, you know, might just have a certain access in a company or have an interesting job or role who are the best targets for bad actors. to impersonate them because they can use the likeness of them to often take access to— to get access to their calendar, take over things that are important to them, and you might never even know about it. And so, it’s increasingly this idea of AI being used for impersonation is what I see as one of the greatest risks of this sort of AI age that we have all entered.
Minter Dial: The story that you start with in your book about your grandmother Is shocking to imagine, and I can only imagine for you and your grandmom and your grandfather, that someone went to this effort to pin down your identity, your voice, and then connect that identity with your grandmother. It wasn’t by mistake. It was very purposeful. Did that feel like some sort of major violation? It did.
Aaron Painter: But what’s scary is that this was several years ago, and the technology to do it and to find out that information about people has advanced so much. And what’s happened is that every day in the news, you read about a new data breach or, oh, your information was exposed. These aren’t even things that maybe you’ve publicly put out there. It’s just that other companies have been sloppy or victims in terms of how they were managing your data. And the bad actors now have access to that. And just like if you happen to use GPT or Claude and, you know, you feed in information and then it’s helpful using that information, bad actors are creating their own sorts of language models around your personal information. So, they’re taking the information that’s been leaked by others. They’re buying it at a low price often on, you know, kind of the dark web and information sharing sites. And they’re using it to get very tailored profiles of the people that they’re targeting with incredibly high quality. And so, it’s not uncommon for a bad actor to be able to pretend that they know more about you than someone you might know quite well, all without your knowing and all without you necessarily being an intentional public-facing figure.
Minter Dial: Yeah. Well, so, but that brings up the issue of being a weird name. Sorry, Aaron. And a higher profile person. And it means, you know, they can zero in on you because if your name is It’s much harder to sort of isolate you and put you out. So, what did that experience, this, your, with your grandmom, what did it reveal to you about trust that typical executives don’t get that, you know, no board-level cybersecurity presentation ever could represent to them?
Aaron Painter: Yeah. That experience pushed me to really understand the space and understanding how the technology was advancing and how it was being used such that if you fast forward a couple of years, let alone today, what we started to see is just massive cybercrime related to this impersonation technology and people, bad actors using AI to impersonate people who they want to target. And it’s many different ways that this can be done. But one of the most visible is it’s so low tech, it’s almost shocking. But It’s the idea that a bad actor can call the help desk, you know, the IT support desk of a company where you work and say, hi, I am locked out of my email. I am locked out of my account. I can’t log in. My multifactor authentication’s not working, or I got a new phone, or my password, this or that. And it’s a very human process. But suddenly this person on the other end of the phone or chat or whatever it might be has to make a very important judgment call. And they have to say, based on the signals that they’re getting, is this person who they claim to be? Are they the rightful account owner? And that’s a very human judgment call because those help desk reps traditionally have not had good tools or methods to verify. A lot like my example earlier with friends and family at the start of the pandemic where they just had these sort of security questions. And all too often, again, these people got in the business trying to help others. They’re not there to be identity interrogators or to investigate you. And they often might ask a few questions, but then they default to letting you in. And if they let the bad actor in, the bad actor then essentially has unfettered access to whatever you might have had with your email credentials or your login. And so, they can go wreak havoc. It’s not cybercrime as we once thought of, you know, we’re seeing the movies about breaking encryption and advanced algorithms, and it’s literally old-fashioned, like being a con artist. But today we call it social engineering, and it means that you have really advanced tools at your disposal to be able to trick that person who’s sort of the gateway to someone getting into your account or not. And unfortunately, it’s being used at incredible scale and to incredible detriment at companies all over the world today at enormous speed.
Minter Dial: It strikes me that we are, that the issue of trust Or the thing that is causing distrust has changed. We’ve had a trust, trust agents, Chris Brogan. I mean, there’s lots of talk about trust and how we no longer trust our big institutions. We don’t trust companies. Sometimes we no longer trust doctors anymore. There’s— then there was the information that allowed us to, to go to the doctor and say, well, I know what I’m doing. But it, it feels like now we’ve got another seismic undoing of trust through deepfakes and AI was such that there was already a terrain where we didn’t trust anybody, but now it’s just gotten exponentially worse.
Aaron Painter: I think you’re absolutely right. There is this enormous distrust already in so many elements of society, but there used to at least be something that was somewhat pure and that you, you could recognize someone. It’s a very human sentiment, a very human way of being. You see someone in person, you can say, oh, nice to see you again. You recognize their face or their voice or the way they came across, or, you know, maybe there is in a work context, you’ve seen that colleague before, you’ve seen the barista at the cafe before, you recognize someone even if you don’t know their name. Unfortunately, in the digital world, that recognition concept no longer holds because it has become so easy to use this new technology to recreate someone’s likeness, their voice, their video, whatever it might be. So, in the digital world, it is even more difficult to trust what you are seeing and what you are hearing. And as our— so much of our society and our economy and our lives have moved to these digital channels, That is an absolute new level, this crisis of trust that we are already experiencing as a society.
Minter Dial: So, if you and I were having this conversation in real life, in an office or something like that, or in your backyard, you know, where we could shake hands and I could smell you and feel you, what proof do I have right now that I’m speaking to Aaron Painter, the real person? How, what, I mean, it feels like we’re now into this point where I can, I could even suspect that you are some digital impersonation, you know, Narendra Modi putting up some sort of augmented version of you. You know, help, help me through and, and help others think about what, what it is to be real.
Aaron Painter: You’re, you’re so spot on. You know, in that in-person scenario in the backyard or in an office, you might not trust what I’m saying. Maybe that’s something I say is wrong, or I’m, I’m, I have a background I’m pretending that I don’t have. Okay, fine. But at least, you know, you kind of know the person in front of you is real. And okay, that person’s sort of accountable for, for being there like that. That is an element. Maybe their name is wrong, but at least that person is there. They, you know who you’re talking to. In this digital world, it is kind of existential. It’s a lot to process, but you actually can’t trust that this audio and visual signal you’re seeing today is, is me. You get not just to the level of trust of what I’m saying, but you can’t trust the identity of the person because it’s gotten so easy. The platforms that we rely on, Teams and Zoom and other things, have made it so easy to connect. But they really didn’t design— they weren’t designed to prevent against impersonation. So, just like you could choose a different camera or microphone setting, we’re all used to that. It’s, oh, I have an external microphone. I want to use a different camera. You just toggle it over and switch. A bad actor can do that same switch and toggle over to a third-party piece of software that can create a real-time representation of whoever they want to be. So, using the technology has gotten remarkably advanced. And then the technology itself to create that likeness has gotten remarkably advanced and gets better at this incredible pace such that now with only a few seconds even of someone’s audio or video, you can create a relatively realistic impersonation of the person you’re targeting, let alone if you happen to have a lot of good audio or video material. And so, you, you really, unfortunately, again, it’s so crazy to think about because we rely on these digital channels so much, but you actually can’t trust that you know who you’re speaking with anymore.
Minter Dial: All right. So, your mother had a situation in your book that you talk about where she lost her password or something or other and, and then couldn’t say, this is me, and allow access back into the email. This happened to me and I’m going to, the specific thing is minterdial@gmail.com. You know, I had that email, but then I lost the password and there’s no way Google’s allowing me back in. And yet, you know, there are— there is no other Minter Dial on this earth. Not that I’m sort of saying I’m amazingly unique, but that is a name that doesn’t come up twice. Aaron Painter, the same. And, you know, so aaronpainter@gmail.com, you know, for me, imagine that the issue is. And so, how does a company— I mean, it feels like help desks are measured on the wrong kind of Metrics. You know, it’s about speed, resolution, showing empathy, and they no longer are able to verify Binter Dial is Binter Dial. So, how does a, you know, if an executive is listening to this, what do they need to do? I mean, and this goes to the heart of your book around verification versus recognition. What kind of things do companies need to be thinking about? in order to allow Minter to have his email back or your mother to have her email back, as opposed to going through, you know, the long checklist of things that they think is the right way.
Aaron Painter: But you’re right. And the anecdote you’re referencing is, you know, kind of sad, but actually still a real problem. It was the largest email provider in the world. I will leave them out of it. But it was roughly a 14-day process for her to try and get back into her email. And it paused her life and all of her commitments and doctor’s appointments and nonprofit commitment, everything, because she was locked out of her email. And they wanted her to fax copies of a utility bill. And I mean, just absolute nonsense, archaic things, which obviously also wouldn’t help ensure it was really her. But it also took 14 days for them to eventually give in and say, okay, we’ll let you back into your account. And that’s often the norm for many companies today. It’s a, it’s a list of security questions following a very large cyberattack a couple of years ago, the big casino in Las Vegas, MGM. The best practice became, you know, if someone’s locked out of their account, you should get on a video call with them. You should have a Teams or Zoom call and kind of look and maybe have them hold up their ID and see if they’re real. But as we’ve talked about, those channels can’t be trusted. So, while that’s a necessary, it’s a, it’s a path, it’s not necessarily a secure path. And people have taken advantage of that. And so, now as the technology has gotten better and better to really impersonate anyone on those calls, it’s just a time-consuming effort. It means now everyone who’s locked out suddenly has a multi-hour delay to schedule a video call and then has to go have this call. It’s expensive, it’s time-consuming, and it’s not secure. And so, first thing is for, I, I really want companies and business leaders to understand how this technology is being used. I want them to understand that a lot of the processes and the tools their employees, let’s say at the help desk, might have are probably not built for this modern era. And then there are solutions, actually. There are better ways to do this. And so, you know, one of the things when I founded Nametag 6 years ago was, was to try and create technology to prevent this. And actually, one of the biggest breakthroughs we found was modern mobile phones, because modern mobile phones are equipped with a lot of technology and advanced cameras and sensors. which can really help us here and defeat someone who is trying to use a deepfake to impersonate you. It’s a lot like— the analogy I often make is that you have a physical check and you want to deposit it. You can bring it into the branch, or you can use your mobile phone and your secure mobile banking app and take a photo of that check, and then the bank processes it. There was never, you know, upload PDF of check to website and hope for the best. That wasn’t good enough for the banks. But for this idea of identity verification, that was kind of the standard until we brought this idea of using the same advanced cameras, phone sensors, and other things to be able to ask someone, let’s say, to scan their government-issued ID, like a driver’s license or a passport, and to take a selfie. And if we use the advanced cameras on the phone, we can do that in a way that a bad actor couldn’t. And that lets us at least know who’s calling. So, you can imagine that help desk rep, instead of asking security questions, they might send you a link and say, hey, I just need to verify it’s you. The end user then taps that link, and they go through a quick flow on their phone, and then the help desk rep gets back positive confirmation knowing who’s really there. That basic step alone was sort of some of our earliest technology. We’ve now taken that to many fun new areas and solving other threats, but it also changes the social dynamic because the help desk rep is no longer this one interrogating you. They’re now the one that’s positioned to say, hey, this other thing’s going to verify who you are. Now I can focus on helping you. So, it actually, it’s, it’s helped us. People love it because it, it creates a much better tone and experience in those calls. It also happens to be much faster, and it also significantly matters because it improves security.
Minter Dial: One of the key distinctions you write about in the book, which took my head a little bit of time to get around, is the distinction between recognition and verification. Talk us through what that concretely means materially in terms of how a help desk or a company can change the way they operate to, to make sure that the deepfakes don’t go and trap us.
Aaron Painter: Well, let’s say you’re walking into an office building and you maybe you’ve been there before and maybe the security guard at the front desk recognizes you. It’s one thing to say, hey, it’s you, I’ll buzz you right up, pass through. And it’s another to say, hey, I need to, I need to see your ID. I need to make sure it’s you. We follow process. I need to verify that you’re actually the intended person. That’s the concept. And you see it, you know, you talk to even small boutique firms, you talk to people that have had the same clients for a long time. Ah, I recognize the voice of my clients. I would know it’s them in an instant. I know my executive’s voice when they call me. I can always help them out. Those are things of recognition. That is, I recognize their voice. That is, I know I’ve seen them before. They seem familiar to me. And sort of the theme again is that those elements don’t hold up in this digital world. And so, what we propose and what I recommend is that we move to this world away from pure recognition to one of verification. So, just like it’s, hey, I need to see your ID before you can enter the building, it’s, hey, I need you to take another selfie, or I need to see your ID or some related element. in order for you to do this important thing, approve this thing, access this thing. That’s a world where verification can help us have more confidence in what someone’s doing digitally, whereas recognition alone just unfortunately is, is no longer trusted.
Minter Dial: You, you describe a human directory not as another database, but as an ongoing cryptographic thread 3 key moments in someone’s relationship with an organization. My wife and I were just discussing, why don’t we have some code words that only you and I know, such that if that, you know, the telephone call from Asia, Minter, you’re in trouble, you know, hey, my wife, I need your help, send me some money. What is, what are, what are the code words that we can establish to verify that this is you, Minter? Does it— is it something that we should all be thinking about, is having these sort of special code words that, that allow us to always authenticate who we are?
Aaron Painter: I think code words could be a great technique for, for a family or a couple or others personally and on phone calls. I think that’s a great, um, and like casual, easy technique, um, you know, especially if it’s things that aren’t known or that aren’t public. I think that’s a great one. The human directory concept is a bit more advanced and it’s sort of the evolution. One of the things we talk about in the book is this really a lot of the history around trust in these digital channels and directories themselves. And if you think of one of the most classic directories was actually a phone book, right? You used to get these printed large phone books of White Pages or Yellow Pages. And if you were in it, you were somewhat legitimate because the phone company came out and they installed the line and, you know, they ran credit checks and they helped set up an account and you kind of an official person or business. You could be reached at a certain phone number. Often there was an address associated with it. Let’s say if it’s the Yellow Pages and you’re a business. And so, it had this sort of air of legitimacy. In the same spirit, email addresses were that way. In the early days of email, you had an email address associated with a government organization, an academic institution. You went in person, you know, you went to an information desk and they gave you that email and they knew who they were giving it to. And so, if you got an email from someone at, you know, .edu, you could kind of trust that that represented a person, probably the person behind that account. And those were okay. It’s efficient in the early days of digital communications. What started to change was the Gmail address you mentioned earlier, or the Hotmail, or the Yahoo, or whatever it might be. Once it became easy for anyone to create an email address, to create as many as they want, and kind of to be anyone they want, Email as an identifier kind of went out the window, and so as something that we could trust, it’s no longer a reliable source of knowing who the person is. So, to protect accounts and digital accounts, we added the passwords, and then we added multifactor authentication, you know, getting an SMS code sent to your phone or having a rotating code, maybe in an app on your phone. Things like that were meant to harden the login because you couldn’t trust the email anymore. for it. And that became sort of the modern way that we, we do these things. The challenge was that, and all those different accounts you have, you might have an account with one provider. If you think of in a, you have different accounts for your medical records and different for your, your bank and different for your, you know, the newspaper subscription or the food delivery service, whatever it might be, each are separate logins. In a large company, in an enterprise, the average employee also has accounts in many different places. They might have an account in the system they use to apply for the job. They might have an account in some sort of Microsoft-based, you know, directory that stores their email information. They might have an account in certain services they use for their job or certain pieces of software. There are all these different accounts. And what bad actors have found is they can go at those gaps. They can say, see, obviously I’m an employee. I’m in the email directory. but I’m locked out of my payroll system and I want to make a change on my debit details. That’s 2 different accounts and there’s a gap in between. And so, the, the bad actor says, we’re just going to target that. And you call the help desk and say, well, I’m locked out at this one, but I have access to that one. And again, the, the help desk agent doesn’t necessarily know. So, where I see the world going is, and that’s this idea of sort of a human directory, is that let’s think about people and knowing who the human is knowing does their face match their name, do we have some level of trust in that? And then we can map the different accounts that they might have. And so, you have sort of a human-first as opposed to an account-first view of a person in your environment. And I, to me, that just feels like the inevitable path we’re on because we all have so many different accounts in our lives, but we’re still the same person. Now you have to be thoughtful on privacy and data security and different ways to structure this and architect it and where the data lives. And there are a whole bunch of really important nuances to get right. But I see a world moving towards this directory of knowing who’s human and which human that person is, especially in a world where we have a lot of non-humans or AI agents going out and doing things on our behalf.
Minter Dial: So, Aaron, it wasn’t something I was planning, but you who have worked in China, Hong Kong, where in that Asian world the super app exists and the way verification and accounts are based more on credit cards than in the West, where we tend to sort of work on emails as our sort of unifying identity. Do you feel with your experience that the Asian world, where the credit card is so embedded now into the identities, that they have a step ahead of us in terms of in the West, where we tend to stick with the email as our identifying—
Aaron Painter: Unit? Yeah, it’s a great question. And this really, this is a very developing area and it does change, you know, country to country. The 2 largest worth noting, particularly in Asia and the Asian region broadly, are India and China, just because the population numbers are so high. And they both have very different approaches from each other, but also from what we use in many Western European countries and certainly in the US today. And In China, it’s largely based on phone number, interestingly. But the government has put in very high requirements for someone to get a phone number, a lot like that example of the White Pages we were talking about before. But they’ve made it a high bar for someone to get a mobile phone number. So, when you get a mobile phone number, you can’t do it anonymously. There are not the idea of burner phones like you see about in TV or movies, or, you know, you walk into the telco store and just get a new SIM card or a new phone. which you can do in the US today. In China, getting a phone number requires high-level proof of who someone is. So, therefore, then whatever you do with that phone number helps the government have a sense of knowing who’s behind it. And then many systems have relied on that. You know, there are sort of microenvironments like WeChat and others that are also telephone number linked. And then those private companies have amassed significant amounts of information that’s almost like a credit bureau profile built on top of that phone number. So, they’re also able to make judgment calls on is this person who they claim to be. The sensitivity of where that data lives has been a hot topic in China and China’s view of, in some cases, friction with some of those private companies because they have their own sort of large amounts of data at this point. In India, it’s, it’s really quite phenomenal. I mean, India invested in the last 15 years in essentially a digital identity platform. It’s called Aadhaar. And it operates a lot like the US Social Security number system in the US, except way smarter. And if you think of the US, the idea that you have a Social Security number, let’s say you call your doctor’s office and they ask you for, quote, your last 4, or they ask you for your Social Security number. The problem is, if you know someone’s Social Security number, you just say that and that’s it. There’s no, there’s no additional step. The India equivalent is you have your Aadhaar number like your Social Security number. And you’ll see you type that in. The next thing it’s going to do is it’s going to say, well, we need to get consent from someone that you can actually share. Someone can look this number up. And so, let’s say they might send you a text message. If it’s in person, they might ask for a fingerprint or an eye scan, in fact, to verify that it’s actually you and that you consent to sharing the information the government has in its, its identity database with, let’s say, the company who’s asking, or for the transaction that’s that’s in front of you. And so, this existence of this system is phenomenal. It’s, it’s at enormous scale. And its scale has actually also become one of its strengths because 99.x percentage of the population today in India, including rural populations, have an Aadhaar number and they have these Aadhaar accounts. And that matters because it’s not like it’s a few people and it’s experimental, because if it’s a few people, someone can’t say, tell me your Aadhaar number, let’s use Aadhaar. You say, oh no, I’m just going to use this other method, which is less secure. So, the existence and the sort of the, the strength of that program is partly that it’s thoughtful and well-designed and works well, but also that everyone uses it. So, in the India example, the whole of the country has been able to develop its financial services infrastructure and many other things on top of Aadhaar, because it turns out if you know who someone is with high assurance, if you’ve solved kind of identity, you can move on to other more complicated threats. Now, Aadhaar’s got its own challenges in the world of deepfakes. You know, it turns out the system wasn’t quite designed perfectly to solve for that. We’ve been doing some really interesting, some work with those systems to be able to kind of complement it and close some of those gaps as it pertains to deepfakes. But the existence of that system is incredibly advanced. And if you think a very far cry from certainly how things are in the US today, where, you know, every state has its own identity database, You can’t really query that database and get back a photo of the person to know if someone’s using a fake ID. Passports are a different system and they’re parallel. And yet you’ve got people from all over the world that might be giving in a state or attending a certain university. It’s, you know, we have a patchwork system that’s incredibly dated, particularly in the US. And so, it’s in some ways the opposite of the infrastructure that India has created today.
Minter Dial: And I’m guessing you are quite familiar with the Estonian situation as well, where they have the singular digital identity which links with my doctor, my bank, and my driving, my credit. Everything is linked in. And we think we’re very advanced in tech in the US, but it does feel like the way we’ve configured ourselves, we’ve— leaves us with a lot more of these gaps that you were talking about.
Aaron Painter: That’s absolutely right. Estonia actually has some really great advances. Singapore has some great advances. You know, there are smaller nations that have done some really smart things. It’s, it is partly the idea of the government thinking of that as an infrastructure that is critical to build trust in, in a given economy or society. And the EU more broadly is taking steps to try and advance some of that with kind of digital identities. But it, it, the identity itself is interesting and it’s important, but it’s kind of then being able to apply that in these different use cases. So, if a government has a, a great digital identity platform, amazing. But how do you apply that to when you’re calling the help desk, right? Or how do you apply that when you’re applying for a job? And you’ve seen some work to apply that to when you’re opening a bank account. right, to your example. But extending that into other really important high-risk digital services is, is where we see a need because it’s where we see the bad actors targeting today.
Minter Dial: So, if, if a CEO or someone at the top of the business is listening and they’re worried about whether they are vulnerable to deepfake fraud, what, sort of question should they be asking their head of human resources or a CISO or a customer experience leader in order to discover whether their organization is vulnerable to deepfake or deepfake-enabled fraud?
Aaron Painter: You know, one of the best things is actually to ask, how do we verify people? Let’s say when they call the help desk or when they apply for a job or when we’re onboarding a remote hire. Simple things, questions like that often kick off a whole line of of exploration today where many companies don’t realize that they haven’t zoomed in on those processes, and they might not realize how susceptible they are. When you get to the actual then security layer of it, let’s say once you find out how you’re doing it today, you want to assess, does that, is that working for you? And, you know, the simplest way I’ve seen people call, you know, help desk and pretend to be whoever, including being themselves and seeing what the process is like, let’s say to get their password reset or going to apply for a job and seeing what that process is like on their company’s website. And in more advanced ways, we see companies often hire other firms to do what we call penetration tests, you know, where they literally impersonate an employee, they call the help desk, and they, they try and sort of break their way in doing that.
Minter Dial: Sort of like white hat. White hat.
Aaron Painter: Exactly right. Exactly right. It’s very typical in other forms of security in the cybersecurity world. You hire, like, white hat hackers or, you know, firms to do these penetration tests to say, hey, try and break into our systems. But this is, it’s security-oriented and it’s IT, but it’s kind of the least technical way because again, you’re not breaking cryptography or hacking into the company. You’re just what we call socially engineering your way. You’re kind of conning your way into the company by jumping on the phone with someone who might work there or applying for a job and speaking to a recruiter or the like.
Minter Dial: Well, one of the things that you turned me on to in your book is this fake hire situation where people are enabling their identity, or at least their recruitment, to think that this is a real person I’m hiring. The one I’ve been facing, Aaron, and I suspect you’ve also had this, is now the fake recruitment. So, the fake recruiter comes and says, hey, Aaron, painter, you’re amazingly positioned to fill this job that I have. And they look at— they’ve scanned my identity and say, well, Minter, you know, you’re perfectly suited for this job with your experience and this and that. And they make it look like it’s absolutely— you are the exact person for this job. And so, back to this notion of trust, we basically, we can’t trust anything. And the question I have at this point, Aaron, is to what extent are all these deepfaking— they’re not just killing truth or trust, but they’re killing spontaneity?
Aaron Painter: Yeah, I think you can still have elements of spontaneity, but I think the scenario you’re highlighting is a really important one. And it’s one we’ve seen kind of just go wild, particularly in the last 18 months. You know, there are upward of 30,000 North Korean operatives. It’s really what they are, who are sitting in centers, and we, we see them. We, we, we’ve learned a lot about them. And it’s, it’s wild how sophisticated and advanced it is. And they basically just apply for jobs, particularly in US companies and remote. They say, hey, I’m a remote worker, and they fill out an application. They jump on Zoom or Teams interviews. They use a, a deepfake creator so they look or sound like someone else. Often create a fake LinkedIn page or the like to have kind of a little bit of a track record, or they target someone who is real and let’s say has a real LinkedIn page and it’s actually them, and they just pretend to be that person, you know, maybe with a slightly different email address, and they apply for jobs. And often they get hired, which is what’s shocking. Most of the Fortune 500 has a large handful of these folks, and they come in and it’s what was surprising to watch is they’re not all after, you know, data stealing and data exfiltration and holding the company ransom. Some cases, in some cases, they might be doing that for later. But many of them are actually just interested in getting paid. They want to exist and they want to be that employee for as long as they can. So, they get on payroll, they get paid, that money gets transferred back to Bitcoin, back to the North Korean state. And it’s a huge money-making operation right now for North Korea. And a huge amount of risk for most companies that are employing a sanctioned nation, violation of sort of, you know, OFAC or foreign controls lists. Like, it’s a major penalty. So, companies are shy about this. They don’t necessarily want to talk about it. They’re embarrassed. Colleagues are embarrassed, because imagine getting to know someone and working with them, and then to find out that they’re fake, or they’re a North Korean operative, and you had no idea. It’s not a conceptual thing. It is happening today at enormous scale. And again, it’s interesting because the bad actors are just exploiting the gaps between systems. HR is trying to find people. They do interviews. They hire. Let’s say you move to hire someone. And the next thing you know, most IT people, IT teams send out an email. Dear Gmail user, you know, you just got hired. For all practical purposes, we think your name is this. Welcome to the company. You know, click here to set up your email login and your password and your MFA. And then that person’s in, right? It’s sort of this gap between HR and IT that the bad actors are exploiting. And so, one of the solutions is to verify, like, know who’s applying for the job, do verification then. Gartner, you know, industry analyst firms recommend you do identity verification checks 2 to 3 times during an interview process. Make sure it’s the same person showing up for different interviews. Then make sure it’s the same person who you’re onboarding. That’s the concept and sort of this level of verification that companies are now moving toward to protect themselves in this era of just rife AI impersonation?
Minter Dial: It does feel like spontaneity is the risk here because if you’ve got to constantly reverify, wait a second, bloody Aaron, this is Minter, you know, and I need to move on and we need to be able to trust one another. If we, if everything we need to double verify. Am I, is this still Aaron speaking with me? Is this still Minter? Or how, how does, how does trust in reality come through when we’re in constant distrust?
Aaron Painter: Yeah, I don’t think it’s actually that different than what we do in other elements of society today. It just maybe works better. You know, for example, logging into things, you often have to go find the password or you save somewhere or type in the password and then get an MFA code sent to you and then put in that code in order to be able to log into something. Or every time you open your phone, you do a Face ID to make sure that you’re the person who held the phone and that it’s the same face who enrolled in Face ID as the one using the phone. I think in many ways in our life, we’ve actually gotten used to re-verifying ourselves. It’s just that we haven’t applied that technology consistently. I can re-verify, you know, companies that work with us can re-verify you with as easy as another Face ID selfie. It’s just that they’re able to compare that selfie to earlier selfies and back to the government-issued ID. So, it’s not silly to say, hey, before I can help you with the help desk, or when you show up for work today, you’re going to take a quick selfie like you would with Face ID to be able to access something. We’re used to friction. It’s just that the friction that’s been introduced today is actually not providing the security benefit that it needs to in today’s digital world. I think you can do better and with the same or less friction actually offer even more assurance?
Minter Dial: Well, I don’t know, but it seems like a lot of companies don’t have it right. One of my most read blog posts is about Chase Manhattan Bank, which is— I’m a Chase customer, but the amount of effort that I had to go to get an answer about my own account is off-putting. And so, many other people are having these bad experiences in this notion of identity verification. And it’s giving a lot of bad customer experiences. So, Aaron, if that weren’t enough to get someone to check you out, to stimulate people to want to know who is Aaron Painter and Nametag, what kind of go-tos and links would you like people to, to go to, to check out your book, maybe hire you, your company, to get better verification and improve this customer experience that is so awash, in my opinion, especially in the West.
Aaron Painter: I appreciate the invitation. You know, aaronpainter.com has a lot of information about the book coming out October 13th. It can be a great way to kind of educate yourself and learn more and share with others. Our website is getnametag.com. Learn more about what we’re up to at Nametag. And then I publish a bunch on LinkedIn and kind of other platforms and really just try and educate people on what I’m learning, what we’re learning, because I feel like the bad actors have gotten incredibly good at sharing amongst themselves. And I think as good actors, we can do even more to share what we’re learning if we’re going to have a chance to defend against those with bad intentions.
Minter Dial: And just to finish, the instinct that your grandfather had, what can everybody lean into In order not to be nagged or tagged with deepfake and rendered vulnerable. What advice would you have for everybody who’s listening to figure out how to make your grandfather’s instinct the right instinct for everybody?
Aaron Painter: I think you need to have that level of curiosity and sort of caution. You know, often, let’s say, even in personal life, if I think about the context, I think about the channel, What I mean by that is if, you know, I normally talk about sports with a friend and suddenly they’re asking me information about our business, I’m skeptical. That context is different. That’s not how I know that person. Hey, this is sort of unusual. If I always chat with someone on text message and suddenly they say, hey, let’s switch to WhatsApp, you know, I’m a little bit skeptical. It’s a change in the channel that we’re used to communicating on. Same thing for things that you see, you know, on the news or online, like what you see and what you hear through digital channels doesn’t deserve the same level of trust you might give it to if you saw it with your own eyes. So, I think we all need to be skeptical, give it a sense of pause, and curious then to understand. And to your point, take the time, break through the spontaneity so that we can build greater trust and confidence in what we’re seeing or what we’re hearing.
Minter Dial: Superlative. Well, many thanks, Aaron, for coming on. I encourage anyone to go get your book Loyal or your new book, which comes out in October on, on, uh, go visit your site, go visit Amazon, because it’s going to be out there, Deepfaked. Many thanks, Aaron.
Aaron Painter: Thanks for having me, Minter.
Minter Dial
It’s easy to inquire about booking Minter Dial here.
