PayPal Digital Goods Risk Management Talk is Live

I gave a risk management talk with a few other risk experts in PayPal's Innovate convention last October. The video is now live and can be found here.

There is also a risk best practices guide I put together with Mike Liberty from PayPal's risk management team, and can be found here [Careful - PDF!]. Mike is, among other things, in charge of risk management for digital goods and is doing an impressive job.

Merchant fraud: a Nasty Little Secret

Over the years we’ve been accustomed to talk about risk from buyers. The paradigm was simple: established and new businesses go to ecommerce to go global, expand reach and sell more conveniently to multiple buyers. Since this is a card not present transaction, the retailers are liable for risks of chargebacks and other types of complaints, and they need to protect themselves from fraudulent buyers, flakes and defaults. The barrier to becoming a merchant was pretty high almost everywhere – getting a merchant account required interaction with a bank and documents that at least looked real. The strain in this process meant that becoming a merchant was not a scalable operation for fraudsters who were looking to make a quick gain; buying multiple stolen credit cards and running them through retail websites was much easier. Sure, there were fraudulent sellers on eBay but that was a rather contains phenomenon. This is not the case anymore.

With the appearance – or should I say reappearance – of marketplace models, merchant/vendor fraud is quickly becoming a very profitable operating model for fraudsters. Companies that enable commerce around tangible goods (Etsy, PayPal, Square), services (AirBnB) or digital goods (Apple and many others) attract many new businesses that wouldn’t have existed otherwise since they wouldn’t have crossed the barrier to getting a merchant account, for various reasons. While mostly the reason is prohibitive cost (if you’re an iPhone app developer, it’s not cost effective to start a company and build your own capability to acquire payments), to some extent it is also because they strike on and sometimes much below the lower bound  of credit score and history needed to establish a merchant account. And while these marketplaces and ISOs are doing an amazing job on enabling new commerce activity, they are also very exposed: being an intermediary, they are exposed to disputes and chargebacks, and must support a dispute process that can be very costly – not to mention brand problems if their merchants are not sporting good business practices. This, and not consumer fraud and risk, is the growing issue of current ecommerce – and it’s a growing one.

So how do you control the risk from merchants and vendors? Here are three initial thoughts to get you started:

1.      Identity: you don’t want to push potential merchants away, but basic identity verification and authentication should be imposed so that they can get through the door. Don’t wait until it’s too late – real merchants should be proud of their brand identity and be able to prove it exists, as well as show themselves as individuals. This doesn’t necessarily mean doing a credit pull; it does mean making sure that their address exists, that their name is real, credit card working and domain is hosting a website that looks like more than a template.

2.      Velocity: one of the most concerning aspects of the ability to easily establish a merchant/vendor relationship with marketplaces is that returning fraudsters have a ball. Opening an account, making a few sells then not delivering then repeating this action in a new account is very common. Identifying significant links between accounts and acting on them to prevent a group of fraudsters from scaling is thus one of the most important aspects of merchant fraud prevention.

3.      Holds and graduation: while I’m not a big supporter of the escrow/delayed disbursement model, because of the limitation it places on legitimate businesses’ cash flow, it’s obvious that in many cases (especially in cases of delayed fulfillment) you need to be protected. The best advice in this case is to prevent from using holds and delayed disbursements as a blanket policy for all new merchants. Limitations should be correlated with risk level – based on transaction velocity, history, authentication level, industry and more. Tying limitations to a defined “graduation” process that in turn provides added benefit for the merchant is my personal favorite since it brings added value that compensates for the burden of coping with the limitation.

Merchant fraud is a complex issue but a few simple steps can go a long way for managing it correctly. The most important thing is thinking these things out before you start course-correcting in the midst of a fraud breakout case – that’s when the worst decisions are being made and your legitimate merchant population will suffer greatly.

Interested in merchant fraud? Looking to get more help in thought and implementation? Schedule an assessment with us through this page today!

Smart risk management: why the "factory" approach could bring you down

If you deal with payments in any shape or form, you know you’re going to end up with a “risk management” team. A lot of times it creeps up on you: volume picks up and so you know you need someone to look at orders. If you’re running a small shop it’s most probably going to be you, but a lot of companies just hire one or two folks. These people use whatever tool you have to look at transactions – most times a customer service tool – and make up their technique as they go. With time, and sometimes with chargebacks coming in, you realize that your few analysts can’t review all transactions, so you turn to set up a few rules to make queue and transaction hold decisions. Since your analysts are not technology people you resort to hard coding some logic based on a product manager’s refinement of the analysts’ thoughts, again based on a few (or many) cases they’ve already seen. Not a long while passes, and you realize that the analysts are caught in a cat and mouse game where they try to create a rule to stop the latest attack that found its way to the chargeback report, and put a lot of strain on the engineers who maintain the rule-set. Even after coding some simple rule writing interface the situation isn’t better since the abundance of rules creates unpredictable results, especially if you allowed the rules to actually make automated decisions and place restrictions on transactions and accounts.

It’s at this point that you realize you need a statistician to run regressions, so you bring someone in. Hopefully, you have enough of a data set for them to create a decent regression model, and you can just get anyone off the proverbial street since regression is a very common tool. The statistician comes on board and creates a model that has industry standard false positives, let’s say 80%. Your review volume grows with transaction volume and you have to hire even more analysts and customer service folks to deal with complaints by legitimate customers – makes sense, since placing restrictions with 80% false positives will get you a lot of incoming calls. Then you discover that the regression model’s effectiveness degrades pretty quickly since they’re trying to predict what transaction will get a chargeback, but there are multiple reasons for getting a chargeback, making it harder to predict correctly. You then also discover that to create an updated regression model you need to wait for most of the chargebacks to come in so you’d have a good enough set of problematic transactions, meaning that you have at least 3 months’ lead time before a new process can be kicked off. That’s, of course, given that you have engineers on board to code the model.

Next thing you do is buy fraud prevention tools to add to your modeling power; you start creating black lists of IPs and Emails to mark problematic transactions. This improves things a bit but leads to additional false positives since people share resources. You consider buying a platform to manage rule and model deployment but decide that cost is prohibitive and generally, it looks like risk management is taking over your dev resources. So you decide to hire more analysts to do manual reviews, and a product manager to decide on the rule and model roadmap, and a risk operations manager for the growing group of analysts, and a head of risk. The rules and models you already have in place are blocking so many transactions you start to wonder if they’re not slowing down your growth instead of helping you protect your business. It looks like risk is managing you.

There’s something wrong with this model. Sure, some of what I’m describing makes sense for a company that’s just starting out, but getting caught in the factory approach to risk management is a huge burden in later stages, one that can be prevented by realizing that risk management is just one of a series of classification and inference questions a company needs to deal with, and that those require a different way of upfront investment in building a team.

I had two very interesting conversations about this very subject last week with two very inspiring people, but there’s one thing I remember a colleague telling me a few months back when they took a new job. The person insisted on being responsible not only for the new company’s risk management efforts, but also generally for their data and business intelligence. That was based on the same understanding: with the abundance of data created by organizations’ activity, all attempts to organize that data and make sense of it should be bound together. It doesn’t matter whether you’re qualifying leads, improving conversion or reducing fraud – you’re dealing with users and their actions, and how automated decisions impact them. It is the practice of making sense of data, and it transcends using data to control the experience of bad users. Once you realize that, you start demanding more of your analysts: that they be technical, know how to generalize on trends beyond targeted rules, become sources of truth. You understand that off-the-shelf regression cannot be just carried between domains without adjustment. You build a system that can correct itself. And with that, you create a team that can win risk, and do much more than that:  develop data sources, identify trends in huge data sets, and reach actionable insights that transform the way you work with your users, both fraudulent and legitimate.

What’s missing? I think there first needs to be a critical mass of people dealing with data in a way that sees beyond “intuition” but doesn’t get lost with over complicating inference using huge data sets. It takes time for these people to develop skill and want to continue solving difficult problems; my analysis group had less than 20 people in it and a good part of them have had enough of payments risk and classification for the rest of their career. I’m not even mentioning starting a company. But when you start a risk or data team, make sure you seed it well, or you’ll find that the bad start costs you a lot more money and effort than you have planned. 

Data Myths: The Misconception of Intuitive Decisions

A lot of the discussions I hear about data and analytics revolve around what and how to measure, and many interesting startups deal with creating new data sources. We deal with clicks, interactions, graphs, heat maps and surveys. We look at networks, assess nodes and links, and analyze service providers and browser information. We create masses of (often useful) information – but what do we do to organize and make sense out of it? While measuring and tracking is important, excess data can drive people to either give up on using it completely, or turn to use complex, sometimes very unfriendly analysis tools that require a lot of effort and ramp up time.

The most common claim by those who give up on using data is that talent or experience replaces data with “intuition”, and the rest of us should succumb to the wisdom of those who have good intuition. Indeed, it is mind boggling to work with highly talented people that seem like they can make correct decisions in a split second, without really being able to articulate their decision (“I just know!”). But what is this intuition? Actually, it is far from something supernatural. As discussed in research, intuition is a result of micro-learning that one might not be able to articulate, since it differs from standard and identifiable learning setups (read more in Matthew Lieberman’s paper here. Careful, PDF for download!). We learn from example but often unconsciously, and those result in intuition that seems to transcend logic.

Furthermore, since intuitive decisions are usually taken under stress, they often have a positive effect in preventing decision biases that arise when you rationalize or over-analyze your decision. I really like the Cook County Hospital example from Blink since it’s a great case of how a succinct procedure, applied by experts, removes the potential bad effects of excess data and over-thinking. And lastly, like in everything else, there are people who are better at this learning than others; they “see the matrix”, so to speak, and understand patterns better than the rest of us. But intuition is hard to quantify, and finding people who can both understand patterns and articulate them in a way that makes sense is very, very hard even for experienced modelers. Getting the “I just know” mantra is much more prevalent than finding an expert you can use, and the result is that such real intuition is often either lost or applied only by a few that are well capable, if they are lucky enough to get into influential roles.

How do you find the right people do approach data “intuitively”, but at the same time be able to articulate what they understand? I suggest you start with your customer service reps. Generally speaking, if you want to learn about customer behavior you talk to the people who talk to them on a daily basis (and make sure that all of your people do) – obviously – but day to day interaction with users causes reps to develop keen insight, intuition, as to what this customer will do next. Granted, not all of them get it and certainly not all of them can translate that into actionable patterns – but some do. And those that do are your key to making sense of data quicker and in an actionable way. Translating this knowledge into automated, actionable insights, however, is a completely different issue.

Why don’t you become a payments provide – Part 2 – Niches and Networks

Previously on “Why don’t you become” (here): people put their money in wallets (be those banks, or just stashes). Methods then pierce a hole in these wallets and create a widespread network that allows money to be transferred easily (cash in the stash case but we also have credit, electronic checks, credit cards and mobile phones. I don’t mean carrier billing – but rather those that replace the card using a chip and NFC or similar technology). Networks then put buyers and sellers together and manage the relationship with and between them; engagement drivers build on top of methods and add an improved interface for better conversion.

Of course there’s mobility between types and it’s also clear that people who are doing X are sometimes actually trying to get to Y; Zong is my usual favorite example with their attempt at moving from being an engagement driver (mobile payments for games at a very high rate due to carrier fees) to Zong+, a direct relationship with the customer and their funding instrument of choice. But why haven’t more companies gone that route? Some companies might be waiting for a certain stage (Boku might be waiting for wider acceptance, as I learned from P.), but most don’t because it’s really that hard to create an actual, viable payments business.

Risk management is a huge issue that can make or break a company, but for the benefit of this post I won’t delve into it – there’s enough about Risk in other posts. The two other things I stated in this post are simplicity and new volume. You identify an unmet need and you answer it with an innovative, easy to use solution – you find a sustainable niche that is your core strength while you expand your business. It’s clear why payments for games, offers and carrier-billing-based payments are having troubles becoming more than engagement drivers (I like offers, but do not see these companies evolving into the next PayPal): their existence is a function of a niche that’s shrinking as the industry that defined it matures, and their business models, unless changed, are only sustainable within that niche. When limited like that, your ability to actually own a relationship with a user base is greatly diminished because your business model is only relevant in that niche. As an example, a 30% take rate in exchange for full fraud protection will only fly when your customers have a 95% margin; and as user acquisition and retention costs rise and people in games learn how to do analytics, the math stops working. So you can end up being bought in Google’s shopping spree, which is NOT a mere feat but will not make you the next PayPal; and performing the way customers in other segments expect you to is difficult. This is, obviously, why I’m so excited about Square now that I’ve learned more about it: a new underserved market segment that adopts an easy way to conduct business is a great user base to build on further.

But there are two other issues that PayPal had to deal with when it grew, that could fail other companies: compliance – the reason that PayPal (and not only PayPal) has to be a bank in Europe and something I won’t discuss in this post – is one; the other is the lack of networks to expand on.

A sustainable niche to start with and a business mode l that can expand are important, but having the infrastructure for expanding payment services is crucial. Early in its time PayPal realized that in order to maintain growing margins it needs to get people to add and use their bank accounts. The struggle to get that to happen is described in the otherwise difficult to read “The PayPal Wars” and doesn’t even cover 10% of it. So PayPal ends up with a highly useful way of using the stone-aged batch ACH processes to drive bank payments – but that’s not a network nor is it intended to be one – it is a unique capability that PayPal built for itself. Actually, the only two available network infrastructures are cash and credit card. Sure, controlled by a centralized entity and require killer fees, but commoditized, widely acceptable and easy to use. So if you want to pierce another hole in the wallet you have to do it yourself instead of working with a network; the one company that was close to creating a lower-cost credit network (Bill Me Later) was rightfully snagged by PayPal, and there’s no general solution for mobile payments – mobile payment companies are integrating with operators one by one. So to make worthwhile margins you either need to wait for a method (see why I like the idea so much?) or build something yourself. And that’s a whole new pain.

So – a viable niche to start from and real expansion capabilities is what you need to have to really play it big. That part of why I think the Klarna story is interesting; but that’s a topic for another post.

The Snowflake Complex: behavioral modeling and you

“You are not special. You are not a beautiful or unique snowflake. You're the same decaying organic matter as everything else.”

 Fight Club, 1999

Whenever a highly improbable event occurs, I’m immediately inclined to find that one missing detail that may explain it as part of a pattern; maybe a rare permutation of indicators and events but a pattern still. It’s not due to a firm belief in determinism, but rather a fascination with the observation that human experience is diverse while at the same time we all go through the same (culture- and geography-dictated) crossroads in life; these crossroads also provide us with the common grounds on which communities are formed. Examples to such patterns are manifold but let’s just call out two: Joseph Campbell’s The Hero’s Journey is the canonical textbook of myths, while Malcolm Gladwell’s Outliers is a recent, nicely written example.

Recently I had this conversation all over again while describing my new project to a few folks. Every time I talk about modeling human behavior, I get asked how I can generalize on human beings – we’re such unique creatures, and the spectrum of our reactions is immensely broad. True and untrue; while we’re all unique individuals (well, you are. I’m not), we’re limited by two degrees of constraints that make it easier to understand who we are and why we do what we do.

One is our immediate and general social environment forcing us into behavioral patterns – forget the fact that people end up succumbing to the way they were brought up, let’s talk about the present – the only difficulty here is deciding on the right frame to compare to when trying to make a prediction. Sure, you’re very smart, and you dropped out of college to join a startup. Quite a unique move in your small town, maybe, but can’t say you’d stand out in a crowd in San Francisco. Being part of a startup that was successfully sold, then relocating to the US is something that happens to – I’d say – 1 in every 10,000 people in specific areas; put otherwise, there are thousands of people with a similar experience running around.

The other constraint is much more mundane – when you try to model behavior on the web, people are just limited by the interface. Trying to create complex interaction models or make arbitrary decisions usually fails because there’s no button for that (if you ever played Sierra quests, you know what “I can’t do that” means). Even when examining seemingly more complex MMOs like World of Warcraft, you see how simple the actual interaction model is.

We want to be a unique snowflake. I hope we are. But those who want to track and understand human behavior shouldn’t let the snowflake complex hinder their efforts. Ask the guys at Hunch.

Why don't you become a payment provider? A disambiguation.

Every once in a while there comes a question about why doesn't company X become a payment provider, or what would it take for them to become one. Lately, I have seen this come up in Quora regarding Skype. Parts of what I want to say about this matter were brought in this Quora question but there are a few other issues and a couple other basic assumptions to sort out.

I'm a big proponent for competition in payments; rates are too high, systems are archaic and self-imposed limitations by incumbents are just crazy sometimes. Even Paypal can use the competition to shake up some of its ways of doing business as the 8000 pound gorilla. But before you dive right in, you have to sort for yourself where in the food chain are you going to compete. I covered this a little bit in my previous posts about mobile payments, but I see 4 links in the payments chain you need to mind: engagement drivers, networks, methods, and wallets. Of course you can play in all of them, and many companies do so in more than one, but it's important to understand them since they have different implications to your product. Once we understand those, we can really look at why providing value in payments is not as easy as it sounds; we can also understand where most people choose to compete and where other opportunities might be waiting.

"Engagement drivers" is the model for many companies in the gaming market. You're competing in driving engagement when all you do from the payments perspective is resell someone else's ability to provide a method of payments (and therefore, build on top of the second group's systems). Note - not some other company's ability to acquire payments, as the companies whose services you'll use are not banks or V and MC. As I noted in my post, I see the mobile payment providers of the world in this category, and to a large extent offer wall providers as well. Players in this category don't own the customer service liability with the customer but at the same time don't own the relationship either; their product is a promise for improved conversion and hassle free UX, and at times they act as "aggregators", presenting end users with multiple payment methods. Quite a few companies have been pushed to this part of the chain or chose to go here because Methods incumbents are too strong and the barriers to playing there are high, while the gaming industry was and still is very supportive of pricey added services as long as you can drive engagement.

Networks is where most of the big players are playing or intend on playing; this is where Paypal, Facebook credits, Google checkout, mobile operators, the future Apple product etc are in the food chain. Players in this area have a direct relationship with the buyer and the seller, and discover the joy of customer service for payments. They emerge because they either identified a new merchant and customer relation that was needed and not catered for (examples: Paypal rules in online payments and P2P/U2U, Facebook is solving virtual currency fatigue and small WePay is looking at group payments). At this level customers already have stored value accounts that are sensitive to fraud as well as may default on some type of credit you've given them. This is the true battlefield of payments to many people - and many people, in my honest opinion, are missing the point - but when question askers think about payments this is what they have in mind. And for a good reason - owning this type of a relationship, as well as identity details, is important value add that can and should be leveraged by current payment companies.

Payment Methods and Wallet is where I find things to be extremely interesting - try to draw a graph of Visa, Mastercard, Amex and banking through the world and you can realize why - how small and fragmented is the online payments world compared to this opportunity, and what opportunity lurks there. But first I must make a point about differentiating methods and wallets, since some companies might claim to be both. Here's a simple test: when your customers get their paycheck, where do they put their money? If it's in your system you're the wallet. If it's not, you're not.

I am very interested in Methods since they are the rails that enable payments, while getting a piece of the pie in a (relatively) lower risk environment. Methods connect wallets with networks and they do this, ideally, in a seamless integration. Yes, they're in the back unless they have great brand strategy, and that's a challenge for any player to solve, but the reward is huge. It's a high-volume-low-margin market, but a profitable one, and is one that is ready for competition, as long as you can bring more value than just another credit card. I can say I know at least two companies that are working in this area and will provide what I perceive as immense value, and I'm following them closely.

Lastly, Wallets are where you put your money when you get it. For regulatory and other reasons mostly this place is a bank, that then uses various other services to allow you to spend your money. While quite a few companies developed as means for helping you spend or creatively save your money (Mint would be one example), not many are trying to provide an actual wallet. While there are many barriers here as well, this is a unique type of relationship with a customer, one that has much more upside once established but a rough way until it is established.

If you're thinking about payments, you're probably thinking about one of the first two in terms of fighting for market share in a crowded space while disregarding the third. Now that we have them defined, we can look at the perils of trying to establish yourself as any.

In a future post: what are the challenges of becoming an engagement driver and a network