Black Hat

Black Hat USA 2025 | If Google Uses It to Find Webpages, We Can Use It to Find Fraudsters

The session at Black Hat USA 2025 introduced a surprisingly simple technique—term‑frequency inverse‑document‑frequency (TF‑IDF)—as a powerful tool for spotting fraudsters, positioning it as an alternative to the sophisticated AI browsers and agents that dominate today’s web search. Speakers argued that generative AI tools like Worm‑GPT are lowering the barrier for attackers, leading to higher‑volume, faster‑moving fraud campaigns. Traditional models struggle with low‑confidence alerts, whereas TF‑IDF can quickly highlight anomalous attribute combinations such as unusual device‑OS or GPU signatures. Live customer demos (names omitted) demonstrated that the TF‑IDF‑based engine runs on modest hardware, delivering clear clustering of suspicious entities without an army of GPUs. The presenters also noted Google’s migration to BM25 for web ranking, but emphasized that TF‑IDF’s deterministic nature makes it ideal for fraud contexts. For security teams, adopting TF‑IDF offers a cost‑effective, scalable way to enrich detection pipelines, improve analyst confidence, and keep pace with AI‑enhanced threat actors, ultimately reducing breach risk tied to identity theft and synthetic fraud.