Apple, Google and the future of the payments market

A post I wrote about domination of the payments market and the largest players in it is live on TechCrunch (here).

Happy reading!

Fraud prevention for small merchants - an interview

Last week I gave an interview at http://www.ecommerceangles.com, a blog dedicated to small merchants. I really like this market and I also think Mike is doing an amazing job maintaining this blog and creating quality content (and since his readership is growing fast, I believe this potential is not overlooked by merchants!).

Will be happy to hear your opinions about my answers to Mike's questions, here.

PayPal Digital Goods Risk Management Talk is Live

I gave a risk management talk with a few other risk experts in PayPal's Innovate convention last October. The video is now live and can be found here.

There is also a risk best practices guide I put together with Mike Liberty from PayPal's risk management team, and can be found here [Careful - PDF!]. Mike is, among other things, in charge of risk management for digital goods and is doing an impressive job.

Merchant fraud: a Nasty Little Secret

Over the years we’ve been accustomed to talk about risk from buyers. The paradigm was simple: established and new businesses go to ecommerce to go global, expand reach and sell more conveniently to multiple buyers. Since this is a card not present transaction, the retailers are liable for risks of chargebacks and other types of complaints, and they need to protect themselves from fraudulent buyers, flakes and defaults. The barrier to becoming a merchant was pretty high almost everywhere – getting a merchant account required interaction with a bank and documents that at least looked real. The strain in this process meant that becoming a merchant was not a scalable operation for fraudsters who were looking to make a quick gain; buying multiple stolen credit cards and running them through retail websites was much easier. Sure, there were fraudulent sellers on eBay but that was a rather contains phenomenon. This is not the case anymore.

With the appearance – or should I say reappearance – of marketplace models, merchant/vendor fraud is quickly becoming a very profitable operating model for fraudsters. Companies that enable commerce around tangible goods (Etsy, PayPal, Square), services (AirBnB) or digital goods (Apple and many others) attract many new businesses that wouldn’t have existed otherwise since they wouldn’t have crossed the barrier to getting a merchant account, for various reasons. While mostly the reason is prohibitive cost (if you’re an iPhone app developer, it’s not cost effective to start a company and build your own capability to acquire payments), to some extent it is also because they strike on and sometimes much below the lower bound  of credit score and history needed to establish a merchant account. And while these marketplaces and ISOs are doing an amazing job on enabling new commerce activity, they are also very exposed: being an intermediary, they are exposed to disputes and chargebacks, and must support a dispute process that can be very costly – not to mention brand problems if their merchants are not sporting good business practices. This, and not consumer fraud and risk, is the growing issue of current ecommerce – and it’s a growing one.

So how do you control the risk from merchants and vendors? Here are three initial thoughts to get you started:

1.      Identity: you don’t want to push potential merchants away, but basic identity verification and authentication should be imposed so that they can get through the door. Don’t wait until it’s too late – real merchants should be proud of their brand identity and be able to prove it exists, as well as show themselves as individuals. This doesn’t necessarily mean doing a credit pull; it does mean making sure that their address exists, that their name is real, credit card working and domain is hosting a website that looks like more than a template.

2.      Velocity: one of the most concerning aspects of the ability to easily establish a merchant/vendor relationship with marketplaces is that returning fraudsters have a ball. Opening an account, making a few sells then not delivering then repeating this action in a new account is very common. Identifying significant links between accounts and acting on them to prevent a group of fraudsters from scaling is thus one of the most important aspects of merchant fraud prevention.

3.      Holds and graduation: while I’m not a big supporter of the escrow/delayed disbursement model, because of the limitation it places on legitimate businesses’ cash flow, it’s obvious that in many cases (especially in cases of delayed fulfillment) you need to be protected. The best advice in this case is to prevent from using holds and delayed disbursements as a blanket policy for all new merchants. Limitations should be correlated with risk level – based on transaction velocity, history, authentication level, industry and more. Tying limitations to a defined “graduation” process that in turn provides added benefit for the merchant is my personal favorite since it brings added value that compensates for the burden of coping with the limitation.

Merchant fraud is a complex issue but a few simple steps can go a long way for managing it correctly. The most important thing is thinking these things out before you start course-correcting in the midst of a fraud breakout case – that’s when the worst decisions are being made and your legitimate merchant population will suffer greatly.

Interested in merchant fraud? Looking to get more help in thought and implementation? Schedule an assessment with us through this page today!

Smart risk management: why the "factory" approach could bring you down

If you deal with payments in any shape or form, you know you’re going to end up with a “risk management” team. A lot of times it creeps up on you: volume picks up and so you know you need someone to look at orders. If you’re running a small shop it’s most probably going to be you, but a lot of companies just hire one or two folks. These people use whatever tool you have to look at transactions – most times a customer service tool – and make up their technique as they go. With time, and sometimes with chargebacks coming in, you realize that your few analysts can’t review all transactions, so you turn to set up a few rules to make queue and transaction hold decisions. Since your analysts are not technology people you resort to hard coding some logic based on a product manager’s refinement of the analysts’ thoughts, again based on a few (or many) cases they’ve already seen. Not a long while passes, and you realize that the analysts are caught in a cat and mouse game where they try to create a rule to stop the latest attack that found its way to the chargeback report, and put a lot of strain on the engineers who maintain the rule-set. Even after coding some simple rule writing interface the situation isn’t better since the abundance of rules creates unpredictable results, especially if you allowed the rules to actually make automated decisions and place restrictions on transactions and accounts.

It’s at this point that you realize you need a statistician to run regressions, so you bring someone in. Hopefully, you have enough of a data set for them to create a decent regression model, and you can just get anyone off the proverbial street since regression is a very common tool. The statistician comes on board and creates a model that has industry standard false positives, let’s say 80%. Your review volume grows with transaction volume and you have to hire even more analysts and customer service folks to deal with complaints by legitimate customers – makes sense, since placing restrictions with 80% false positives will get you a lot of incoming calls. Then you discover that the regression model’s effectiveness degrades pretty quickly since they’re trying to predict what transaction will get a chargeback, but there are multiple reasons for getting a chargeback, making it harder to predict correctly. You then also discover that to create an updated regression model you need to wait for most of the chargebacks to come in so you’d have a good enough set of problematic transactions, meaning that you have at least 3 months’ lead time before a new process can be kicked off. That’s, of course, given that you have engineers on board to code the model.

Next thing you do is buy fraud prevention tools to add to your modeling power; you start creating black lists of IPs and Emails to mark problematic transactions. This improves things a bit but leads to additional false positives since people share resources. You consider buying a platform to manage rule and model deployment but decide that cost is prohibitive and generally, it looks like risk management is taking over your dev resources. So you decide to hire more analysts to do manual reviews, and a product manager to decide on the rule and model roadmap, and a risk operations manager for the growing group of analysts, and a head of risk. The rules and models you already have in place are blocking so many transactions you start to wonder if they’re not slowing down your growth instead of helping you protect your business. It looks like risk is managing you.

There’s something wrong with this model. Sure, some of what I’m describing makes sense for a company that’s just starting out, but getting caught in the factory approach to risk management is a huge burden in later stages, one that can be prevented by realizing that risk management is just one of a series of classification and inference questions a company needs to deal with, and that those require a different way of upfront investment in building a team.

I had two very interesting conversations about this very subject last week with two very inspiring people, but there’s one thing I remember a colleague telling me a few months back when they took a new job. The person insisted on being responsible not only for the new company’s risk management efforts, but also generally for their data and business intelligence. That was based on the same understanding: with the abundance of data created by organizations’ activity, all attempts to organize that data and make sense of it should be bound together. It doesn’t matter whether you’re qualifying leads, improving conversion or reducing fraud – you’re dealing with users and their actions, and how automated decisions impact them. It is the practice of making sense of data, and it transcends using data to control the experience of bad users. Once you realize that, you start demanding more of your analysts: that they be technical, know how to generalize on trends beyond targeted rules, become sources of truth. You understand that off-the-shelf regression cannot be just carried between domains without adjustment. You build a system that can correct itself. And with that, you create a team that can win risk, and do much more than that:  develop data sources, identify trends in huge data sets, and reach actionable insights that transform the way you work with your users, both fraudulent and legitimate.

What’s missing? I think there first needs to be a critical mass of people dealing with data in a way that sees beyond “intuition” but doesn’t get lost with over complicating inference using huge data sets. It takes time for these people to develop skill and want to continue solving difficult problems; my analysis group had less than 20 people in it and a good part of them have had enough of payments risk and classification for the rest of their career. I’m not even mentioning starting a company. But when you start a risk or data team, make sure you seed it well, or you’ll find that the bad start costs you a lot more money and effort than you have planned. 

Data Myths: The Misconception of Intuitive Decisions

A lot of the discussions I hear about data and analytics revolve around what and how to measure, and many interesting startups deal with creating new data sources. We deal with clicks, interactions, graphs, heat maps and surveys. We look at networks, assess nodes and links, and analyze service providers and browser information. We create masses of (often useful) information – but what do we do to organize and make sense out of it? While measuring and tracking is important, excess data can drive people to either give up on using it completely, or turn to use complex, sometimes very unfriendly analysis tools that require a lot of effort and ramp up time.

The most common claim by those who give up on using data is that talent or experience replaces data with “intuition”, and the rest of us should succumb to the wisdom of those who have good intuition. Indeed, it is mind boggling to work with highly talented people that seem like they can make correct decisions in a split second, without really being able to articulate their decision (“I just know!”). But what is this intuition? Actually, it is far from something supernatural. As discussed in research, intuition is a result of micro-learning that one might not be able to articulate, since it differs from standard and identifiable learning setups (read more in Matthew Lieberman’s paper here. Careful, PDF for download!). We learn from example but often unconsciously, and those result in intuition that seems to transcend logic.

Furthermore, since intuitive decisions are usually taken under stress, they often have a positive effect in preventing decision biases that arise when you rationalize or over-analyze your decision. I really like the Cook County Hospital example from Blink since it’s a great case of how a succinct procedure, applied by experts, removes the potential bad effects of excess data and over-thinking. And lastly, like in everything else, there are people who are better at this learning than others; they “see the matrix”, so to speak, and understand patterns better than the rest of us. But intuition is hard to quantify, and finding people who can both understand patterns and articulate them in a way that makes sense is very, very hard even for experienced modelers. Getting the “I just know” mantra is much more prevalent than finding an expert you can use, and the result is that such real intuition is often either lost or applied only by a few that are well capable, if they are lucky enough to get into influential roles.

How do you find the right people do approach data “intuitively”, but at the same time be able to articulate what they understand? I suggest you start with your customer service reps. Generally speaking, if you want to learn about customer behavior you talk to the people who talk to them on a daily basis (and make sure that all of your people do) – obviously – but day to day interaction with users causes reps to develop keen insight, intuition, as to what this customer will do next. Granted, not all of them get it and certainly not all of them can translate that into actionable patterns – but some do. And those that do are your key to making sense of data quicker and in an actionable way. Translating this knowledge into automated, actionable insights, however, is a completely different issue.

Why don’t you become a payments provide – Part 2 – Niches and Networks

Previously on “Why don’t you become” (here): people put their money in wallets (be those banks, or just stashes). Methods then pierce a hole in these wallets and create a widespread network that allows money to be transferred easily (cash in the stash case but we also have credit, electronic checks, credit cards and mobile phones. I don’t mean carrier billing – but rather those that replace the card using a chip and NFC or similar technology). Networks then put buyers and sellers together and manage the relationship with and between them; engagement drivers build on top of methods and add an improved interface for better conversion.

Of course there’s mobility between types and it’s also clear that people who are doing X are sometimes actually trying to get to Y; Zong is my usual favorite example with their attempt at moving from being an engagement driver (mobile payments for games at a very high rate due to carrier fees) to Zong+, a direct relationship with the customer and their funding instrument of choice. But why haven’t more companies gone that route? Some companies might be waiting for a certain stage (Boku might be waiting for wider acceptance, as I learned from P.), but most don’t because it’s really that hard to create an actual, viable payments business.

Risk management is a huge issue that can make or break a company, but for the benefit of this post I won’t delve into it – there’s enough about Risk in other posts. The two other things I stated in this post are simplicity and new volume. You identify an unmet need and you answer it with an innovative, easy to use solution – you find a sustainable niche that is your core strength while you expand your business. It’s clear why payments for games, offers and carrier-billing-based payments are having troubles becoming more than engagement drivers (I like offers, but do not see these companies evolving into the next PayPal): their existence is a function of a niche that’s shrinking as the industry that defined it matures, and their business models, unless changed, are only sustainable within that niche. When limited like that, your ability to actually own a relationship with a user base is greatly diminished because your business model is only relevant in that niche. As an example, a 30% take rate in exchange for full fraud protection will only fly when your customers have a 95% margin; and as user acquisition and retention costs rise and people in games learn how to do analytics, the math stops working. So you can end up being bought in Google’s shopping spree, which is NOT a mere feat but will not make you the next PayPal; and performing the way customers in other segments expect you to is difficult. This is, obviously, why I’m so excited about Square now that I’ve learned more about it: a new underserved market segment that adopts an easy way to conduct business is a great user base to build on further.

But there are two other issues that PayPal had to deal with when it grew, that could fail other companies: compliance – the reason that PayPal (and not only PayPal) has to be a bank in Europe and something I won’t discuss in this post – is one; the other is the lack of networks to expand on.

A sustainable niche to start with and a business mode l that can expand are important, but having the infrastructure for expanding payment services is crucial. Early in its time PayPal realized that in order to maintain growing margins it needs to get people to add and use their bank accounts. The struggle to get that to happen is described in the otherwise difficult to read “The PayPal Wars” and doesn’t even cover 10% of it. So PayPal ends up with a highly useful way of using the stone-aged batch ACH processes to drive bank payments – but that’s not a network nor is it intended to be one – it is a unique capability that PayPal built for itself. Actually, the only two available network infrastructures are cash and credit card. Sure, controlled by a centralized entity and require killer fees, but commoditized, widely acceptable and easy to use. So if you want to pierce another hole in the wallet you have to do it yourself instead of working with a network; the one company that was close to creating a lower-cost credit network (Bill Me Later) was rightfully snagged by PayPal, and there’s no general solution for mobile payments – mobile payment companies are integrating with operators one by one. So to make worthwhile margins you either need to wait for a method (see why I like the idea so much?) or build something yourself. And that’s a whole new pain.

So – a viable niche to start from and real expansion capabilities is what you need to have to really play it big. That part of why I think the Klarna story is interesting; but that’s a topic for another post.