Klarna talk at Finovate is live

The 7-minute demo I gave at Finovate together with Jakob Soderbaum is now on their website. Catch it here:

 

We pride ourselves in the success of the company and the numbers we are able to share. Indeed great job by the founders and the team!

Signifyd launches its Risk Management and Fraud Prevention training program

One of the questions I get asked regularly is "where do I learn more about fraud and risk management for payments?".

I usually recommend the MRC and an eBook called "Detecting Malice" for first steps but honestly, there's not a lot of material out there. That's why I started this blog in the first place.

Today, Signifyd is launching a new training program for risk personnel. I'm excited about it since it's the first program I saw that I can really relate to (I advise to Signifyd although I was not a part of creating the program). I hope it will draw a lot of attention to what this up and coming team, led by Rajesh Ramanand and Michael Liberty, is up to.

Good luck to the team, and please take a look at the program!

What's Missing in Data Science Talks

On January 28th, 2008, the $169M sale of Israeli FraudSciences to eBay's payments division PayPal was publicly announced. I was part of the 65 person crew and head of the analytics group at the time. FraudSciences became PayPal's Israeli R&D center and is still a thriving team spanning more than 100 people and providing great value to the company. Our story has even been mentioned on StartUp Nation, in an inspired-by-a-true-story style dramatization of events.

The sale and its ramifications is not what I want to talk about, though; what I do want to talk about is the events that led to that sale, and more specifically the test that PayPal ran us through. You see, PayPal had to see whether our preposterous claims about how good our algorithms were held true, so they threw a good chunk of transactions at us to analyze and send back to them with our suggested decisions. Long story short, our results had an upside of up to 17% over PayPal's own algorithms at the time, and the rest is history.

How did we do that, then? We must have had a ton of data. We must have used algorithm X or technique Y. We must have been masters of Hadoop. Wait - no. 2007. Nothing of the sort. Everything takes forever. To get to these results we didn't even use the two famous patents FraudSciences viewed as huge assets since they required some sort of real time interaction with the buyer. What we did have were roughly 40,000 (indeed) well-tagged purchases, good segmentation, and great engineered features all geared at very well defined user behaviors. What we had, plain and simple, was strong domain expertise.

Domain expertise, or lack thereof, is exactly my issue with the talk about Data Science today. Here's an example: I recently had a friend, a strong domain expert, rejected from a pretty nascent startup filled with very smart engineers since they didn't really know where to place his non-developer profile in their team. Were they wrong to not hire him? Maybe, maybe not. I can't judge. Were they wrong to make the decision based on coding skills? Most definitely. It's a very common passion for data and ML geeks such as ourselves to embark on the (in my opinion) hubris-driven task of building an artificial intelligence that will solve all problems, the Generic SkyNet. We neglect to admit the need for specific knowledge. It is then when discussions of volume and structure of data sets replace keen understanding of what people are trying to achieve - when complex tools replace user research. Unsurprisingly, these attempts either fail or scale down to take domain by domain. They can still take over the world - just with a different strategy.

When I read people on Kaggle, in itself an amazing website and community, list the tools they threw at a dataset instead of how they led with a pure analysis of pattern and indicators, I cringe a little. This is a craft fueled by excess - in space, in memory, in computing power, even in data. While often times highly useful, almost as often does it  make us miss the heuristic just in front of our eyes. I think that analysis and Data Science need to incorporate this realization as well, to become a real expertise.

Fraud detection and prevention and Credit issuance, the stuff we deal with on a daily basis at Klarna, are areas where this is an obvious issue. High fragmentation in geographies, payment instruments and products creates smaller training and validation sets than you'd ideally want. The need to wait for default or a chargeback limits the time between iterations. The presence of bad signals is scarce compared to other types of classification. Operational issues and fraudsters' strong incentives to hide (as well as abuse or "friendly" fraud) cause "dirty" performance flags. And still we have a shop that uses a number of instances per segment that Data Science teams would frown upon to make some accurate decisions. How is that? The same way FraudSciences gave PayPal's algorithms a run for their money - we use domain expertise to distill features that capture interaction in a way that automated feature engineering methods will find hard to imitate. We use bottom up analysis of behavioral patterns. We add a sprinkle of behavioral economics (but building a purchase flow is a completely different story).

This aspect of what we do is available to any Data Scientist out there - I've written extensively about finding domain experts. They're around you. Use them - and don't get hooked on the big guns just because they're there*.

*Well, only if you want to get better results quicker and are acting under market and product constraints. If you're a contributor to an open source project - carry on with your great work!

The "New PayPal": two things to note when thinking about PayPal's latest moves

Today PayPal announced a new digital wallet following announcements about supporting offline retailers, improving its mobile app and others, as well as PayPal Here, its new Square competitor. This could be waived off as yet another attempt to go into the coupon, Social-Local-Mobile-Offline-Small-Business trend that's flushing payment providers in the US. It can also be perceived as a hasty response - much like a lot of others' - to Square, a company whose effective PR machine turned it into the elephant in the boardroom for almost any financial services company (I think Square has a lot of potential, but also that a lot of companies don't understand where they're going. But that's a different discussion). But there are two things to take into consideration here that are unique to the Gorilla in the market of online payments.

Unlike other providers outside of banks or credit card companies, PayPal is the only company that can make money from the fact that people and companies want to move money around efficiently (that's why trying to compete on price is an effort that's doomed at inception). Even in cases where the source of that profit looks flimsy (such as FX arbitrage) it is not really the case - PayPal's global reach is not an easy position to attain and barriers to entry are high. No other contender has this ability as a financial institution or the deep understanding of regulations and how often they change. But I digress.

The way I see it, PayPal is doing what it's doing since its leadership understands that the company's long term growth can be stifled by two major components: its third party ecosystem, and the threat of shrinking margins.

Over the first 12 years of its existence PayPal focused on the actual move of money while growing an international presence. For its unique advantages it charged (and still charges) high fees. As a result of that focus, services grew around PayPal offering it as a payment options as part of a payment "wall" or some broader "checkout" solution. So PayPal enjoys a smaller share of wallet and a smaller share of revenues in return for all types of user acquisition channels - since the higher margin services are provided by these third party providers. From what I'm hearing behind the scenes, PayPal is cracking down on these services, forcing them to, for example, stop using a single bus account for all of their sub merchants and creating a direct relationship with these merchants, who are now forced to have their own PayPal accounts. In addition to the company launching more merchant focused features and acquiring relevant IP, I believe this is an orchestrated effort to reclaim the ecosystem.

The other part of margins. PayPal converts users to ACH to reduce transaction fees and be profitable. Google, ISIS et al (let's say these two are in the same league) do not have the same ability. No other company knows how to use ACH effectively, not to mention Bill Me Later style credit (trust me, we at Klarna know how difficult that is). But even with all this PayPal is feeling the shrinking margins - it was not able to bring BML to a large enough crowd; plus, its reliance on card associations is putting a strain on margins - despite the Durbin amendment making debit cards cheaper in the US, costs in the rest of the world don't really favor direct debit over cards. In addition, despite a lot of efforts PayPal hasn't found the formula the have people keep substantial account balances - and its customer care reputation doesn't help, either. The new digital wallet initiative is a smart way to bring BML to consumers, branded differently - not as a financing solution but as a flexible lifestyle solution.

Like any other payment company, PayPal has to worry about two major issues - user acquisition and access to capital. However, at its size and status and if it wants to continue growing, PayPal needs to be worried about a few unique challenges. While it's catering to its users needs, the company is also making a few smart steps in order to set itself for success in the future. 

A quick point about buyer psychology

There are multiple things I need to worry about beyond just fire fighting, but the thing I keep getting back to is users' mindset and how we are impacted by it. It fascinates me to what extent and how much deeper we need to go in understanding customer psychology. I wrote in the past about how much easier it is for people to steal online because of anonymity and distance from actual face to face human contact; one of the folks here at Klarna equates this to an open cookie jar in an empty room. Would you take one?

Most people would. That's the amazing, oh-so-human day to day situation we need to work with. The difference from your usual eCommerce payments risk situation stems from the fact that instead of trading tokens of trust issued by other financial institutions (issuing banks in the case of credit cards, for example) we basically establish and sell trust between buyers and sellers on our own, based on our data and inference (more on how this impacts the multiple facets in a payments business - maybe in a future post). That's a very different ball game when not only is the customer's identity not a given, but their mere ability or willingness to pay could be in doubt.

So instead of focusing on identity verification given a credit card (with a sprinkle of repeat offenders and hackers on top) we must look at a broader spectrum of credit and abuse issues. And the question about the customer's current and future mental state (future being upon receiving the request to pay) determines our ability to approve a purchase no less than the question whether this is a real person or not. The levers we need to pull, then, expand beyond identifying bad guys. Can I instill financial responsibility in a first time buyer  through a well designed buying experience? Will the busy businesswoman forget about our payment request in her busy schedule?

The other interesting thing is that since Klarna owns the stack (we issue credit, acquire merchants, manage reminders to pay) I have many more touch points with the customer. That calls for more negotiation and, actually, relationship building that both sides are interested in (buyers keep coming back to Klarna-powered checkouts). That's a plus in many ways since I can control the buyer's experience and correct earlier mistakes, be them false positives or false negatives. But the question remains - and it's a complicated one - how do you impact the buyer's mental state within a very short sequence of clicks and without hurting conversion?

Have I mentioned that I love my job?

(BTW, we're hiring)

What I Hoped Would Be Announced At Innovate2011

Late post, I know. Hyper-growth life (yes, that was a #humblebrag).

I went to x.commerce (ex-PayPalX-Innovate) to check on industry trends, meet friends and exchange ideas. I didn't have huge expectations but I did hope to see a couple of things emerge from the whole x.commerce effort that will extend both the Marketplaces and PayPal divisions beyond where they are today. This has yet to come in full, but some early signs are still visible and look promising.

eBay has made some very interesting acquisitions which have an obvious synergistic quality to them, and it seems that it's managing these integrations well - as in, not forcing them to immediately assimilate but rather trying to make their products available within the greater eBay portfolio context. Now the question is whether all of these acquisitions can be actually leveraged together into a coherent, complete set of products and services. This leads me to what I was hoping to see.

The two things I had hoped to see coming from eBay were (1) An integrated social commerce suite that allows commerce to go anywhere - basically showing that if sellers don't come to marketplaces, marketplaces will come to them. Preferably, this would be integrated with FB's open graph and allow real personalization based on social data. (2) A real transactional identity strategy and toolbox that allows PayPal's data and identity assessment to be extended by commerce sites to tie past purchasing behavior and enhance user experience. I was hoping for these two things since in my POV, both would have shown that the Marketplaces and PayPal divisions understand the limitation of their business model (mainly, the need to own the experience on eBay.com and the consumer relationship for PayPal) and they are willing to partner and really provide access to some of their assets for others to expand on them. x.commerce, in general, was the right evolutionary move from PayPalX, since payments alone are not enough to build a really big and vibrant developer community - the problems a more flexible payments API is solving are not big enough (vs a new payment rail, but that's not what PayPal was offering).

While both were sort-of touched upon and generally speaking the direction is impressive, both the general x.commerce vision in general and the PayPal Access product specifically seem, still, a bit limited. In the x.commerce case, demanding that all capabilities communicate through the "fabric", as well as the way APIs expose information about the buyer (categorical answers such as "engaged", "casual" etc) demonstrate how eBay is trying to maintain as much business logic behind the APIs rather than provide raw data based on varying permission levels (at the consumer's discretion). PayPal Access is very similar in that sense - as one participant noted, currently looking a bit like a re-branded Express Checkout with a nifty sign-in module. I (hope to) see both of those concepts evolving more in the coming year as eBay incorporates more feedback from users, and becoming more open with its data and services. There's really a lot to be done in social commerce if eBay wants to continue being relevant, and I think it recognizes that. Time to take the big, platform agnostic, open-web-style leap.

Identity Theft - Whose Problem is it?

With Fraud Awareness Week happening this week, one of the main things I hear about (apart for, obviously ZEUSZEUSHACKEDMACHINESFRAUDZEUS) is identity theft and ways to deal with it. I wrote in the past about issuing additional secrets, basically, I don't believe in it - and the more I hear about two factor auth, the more worried I become. The problem is that because traditional methods fail, identity theft stops being the individual's problem and become society's problems.

Why?

When large entities (read: governments) realize that issuing secrets doesn't work (even digital passports and IDs get stolen and forged), they start thinking about solving that in the most obvious way (if you're a gov official): storing something-you-are type authentication factors. This is how biometric repositories are created (and then hacked. But that's a different story). If only everybody would be more laid back about behavioral profiling based on available online identities... but then again, this isn't a product nicely packaged with a nice RFP that gov and banks can understand.

Oh well. Don't come asking for my finger prints.