Claus Lauter: Welcome to the eCommerce Coffee Break Podcast. In today's episode, we discuss why eCommerce fraud prevention solutions reduce charge pegs and how they improve the shopper experience. Joining me on the show are Harish Manipelli, Chief Technology Officer and Tariq Ahmed, Managing Director for Canada at zumigo.com.. So let's dive right into it.
Voice Over: This is the e commerce coffee break. A top rated Shopify growth podcast dedicated to Shopify merchants and business owners looking to grow their online stores, learn how to survive in the fast changing e commerce world. With your host Claus Lauter and get marketing advice you can't find on Google.
Welcome to the show.
Claus Lauter: Hello and welcome to another episode of the e commerce coffee break podcast. Today we want to dive into a very important topic for a lot of merchants out there and a lot of merchants probably have dealt with this issue. We want to talk about fraud and fraud prevention solutions.
Now huge topic fraud is on the rise. Um, Big numbers there. I just saw a number this morning saying that online payment fraud is predicted to hit 13 billion U. S. dollars by 2024. So this year, so that's huge. And to dive into this topic, I have some experts with me. With me is Harish Manipelli, um, and Tariq Ahmed.
Both are from, are from zumigo.. com and they're experts when it comes to fraud protection. So I'd like to welcome them to the show. Hi guys. How are you today?
Tariq Ahmed: Good. Hi. How are you doing? Nice to meet you.
Claus Lauter: Excellent. Maybe Tariq, start with you. Just give me in a short sentence a bit of your background, where you're coming from, and what your expertise is.
Tariq Ahmed: Sure. So, um, so I've been with Zumigo for four years. Prior to that, I've worked with companies like Western Union, Amazon, solving their fraud problems. Um, and I I think I've been passionate about solving for problems from my high school days, right? So, um, I did a project back in my school where we're trying to solve a fraud problem by, uh, now, which is famously called us to be secure.
But we are entering a pin code as a second factor authentication to a card transaction. So I've been interested in card not present fraud, uh, and I've always been interested in building out systems and tools, um, to detect or to basically deter card not present fraud. So that's my background. Uh, I've been exposed to different types of, uh, card not present fraud, payment fraud, and different fraud scenarios, and gained good experience working with some big companies and the companies like Zumigo, uh, solving these problems.
Claus Lauter: Okay. Harish, what about you?
Claus
Harish Manipelli: Yeah, thank you, Claus. Good to be on the podcast. Uh, so I've been with Zumigo for a little over eight years in two different stints, uh, building identity verification solutions. Zumigo started out with an API based platform, which fintechs, mostly banks, used. And a lot of the identity verification problems that you find in the banking space carry over quite nicely into the e commerce space, because fraudsters are, you know, they're trying to hack into accounts.
So we've solved a number of problems in the In the banking space from new account opening, uh, log in, log in verification, and we've taken a bunch of, you know, these and, you know, got them over into, into the e commerce space. So, uh, at Zumigo, I've led development in the past, and now I'm focused on e commerce initiatives, trying to build solutions for the different shopping platforms, and also building strong authentication solutions.
I was at Amazon for a little while where I was responsible for workforce identity solutions. So it's a different side of this thing where you're not necessarily authenticating shoppers, but you're making sure that people working inside warehouses, the employees are getting authenticated. So I'm kind of, you've gotten exposed to both sides of authentication.
Claus Lauter: Now, a lot of merchants out there, and that includes me, I had some cases there, you have to deal with fraud in one or the other way. And if you're not used to it, it becomes a bit of a surprise what's happening there. And as you said, fraudsters are everywhere. They're very creative. Tell me about what are the some, some of the common fraud tactics and schemes that Shopify merchants or online merchants in general, general face today?
Tariq Ahmed: Sure. I think the biggest right now is still payment fraud. Um, so it's nothing but getting access to someone's card information or banking information and using that to make a purchase, right? So that's the biggest I would still say that's the biggest cause of payment fraud. And it's very easy to get stolen credit cards these days, right?
So dark web people, fraudsters go on dark web, buy a bunch of stolen credit cards. Right. They do card testing. They try to test those cards on different platforms. They automate the whole whole thing. Uh, they're very sophisticated. Uh, so when you're thinking about foster, they're sophisticated. They have all the tools and platforms, uh, to do this, right?
So payment card has, has been the biggest issue in the industry, uh, where stolen credit cards are being used to make purchases, right? So that's one type of fraud. The other would be account takeover, right? Stolen credentials. So you get access to someone's username and password. Um, you log into the account, you make purchases using safe credit cards, safe PII data, uh, and then you bypass security, right?
You go ahead and make, um, buy an item, ship it to your address, use someone else's credit, someone else's payment instrument and details. Uh, and, uh, that leads to a charge back as well on. I think right now, uh, it's got a lot more sophisticated where, uh, synthetic idea has come into place, right? So it's stitching different pieces of legitimate information and creating a code.
Good synthetic I. D. Where it becomes difficult for fraud prevention solutions to detect this information. So that's why I think it gets becomes critical to use fraud prevention tools and up to date fraud prevention tools and technologies to deter and detect fraud.
Claus Lauter: Now, collecting customer data is a standard practice.
Personalization is a big topic everywhere. Everyone should have a personalized, um, customer experience on your online store. However, you as a business, you as a merchant, you carry the responsibility of protecting your data. What are the key challenges in balancing fraud protection with a smooth customer experience when it comes to personalization in your online store?
Harish Manipelli: Yeah. So, so the way our product plays in, there are two parts to this. So the customer facing feature is a passwordless login, right? That's where a customer interacting with the merchant engages, engages with the merchants website. The other part is an order risk verification, where there's no customer interaction at all.
It's completely transparent. When, as soon as an order is placed on the Shopify website, uh, do this. If I automatically It gets the order details and immediately does a real time scoring of the different risk aspects about the customer, about the order, the different, uh, pieces of information that are available in the order that's placed by the customer, right?
So from, uh, you know, protecting a customer's, uh, data, obviously. As a merchant, you want to collect as little information as possible, but you also want to be careful that when somebody creates an account for the very first time, right? And depending on the value of the goods that you typically sell on your store, do you want to make sure that you will let anybody with an email create an account?
Or do you want to do a little bit more verification before that account is created? Right? So it's a fine balance that depends on the type of merchant you are for higher value goods. Where you potentially require a login. To place an order. You do want to do a little bit of verification. You can collect some information, make sure that person who's creating an account is authentic.
Claus Lauter: You mentioned a score, a trust score, a score to find out, um, if you basically want to transact or fulfill the transaction, fulfill the order. What does that mean? How does this kind of score work? What kind of elements are involved too? Come to a rating.
Tariq Ahmed: I think we use a lot of, uh, data. When I say a lot of data, we get, we use data from different touch points from a customer journey.
So it's basically we, we have insights into device possession. We validate, uh, if the consumer has access to the device, we validate the name and address on a particular phone number. So we we cross reference shipping and billing addresses with the name and address provided on a phone number. We get email reputation.
We have, uh, information on. We get information and validate information on email if that email has been, uh, part of a previous suspicious transaction or fraudulent transaction. We get those flags from our data partners. We take geodesic distances, distances between IP addresses and billing addresses. We validate the payment instrument.
So we do the traditional address verification checks. If the ABS matches, we also, um, validated the name on card matches. So we, so we tie into different aspects of a transaction and we validate all that information. And. Uh, used our advanced, uh, analytics and, um, uh, algorithms to come up with the trust score, right?
So the higher the score is, the more trustworthy the transaction is, the more for a merchant, uh, they can approve the transaction or approve that order with more confidence. Uh, and then we have lower, uh, trust scores, which means this transaction is not good. Uh, and our recommendation is to decline the transaction or it's up to the merchant, right?
So we provide a trust score. The merchant has the option of declining the transaction, declining the order, or getting additional information from the consumer before processing the order. So like, I think the trust score comprises of different attributes. Um, uh, different attributes during the transaction during the order, uh, touch point.
We use all that information to validate against our real time data sources. And I think I'd like to add one point is a lot of other, um, uh, other providers who use historic data, uh, patent based recognition. So we, along with that, also validate real time authoritative data, right? So we validate if it's a yes or no question.
Does this name and address match with the name and address on a phone number provided against, uh, telco providers? Um, and does this, the billing address, name and address matches with the name and address provided, right? So that's kind of authoritative data we provide. And also, does this consumer have access to the phone number they've, uh, provided as part of their checkout?
So that's the authoritative real time data we validated along with a lot of historic and pattern based. So the combination of that too gives enough confidence for us to provide a good confident trust code back to our merchants.
Claus Lauter: Hey Claus here, just a quick one. If you like the content of this episode, sign up for our free newsletter and become a Smarter Shopify Merchant in just 7 minutes per week.
We curate content from more than 50 sources, saving you hours of research and helping you stay on top of your e commerce game with the latest news, insights and trends. Every Thursday in your inbox, 100 percent free. Join now at newsletter. ecommercecoffeebreak. com. That is newsletter. ecommercecoffeebreak.
com. And now back to the show. Well, it sounds like there's a lot of data going on and obviously it's for the best of the merchant and it's also for the best of potentially somebody who has been scammed out of his credit card details. So there's a lot of data protection in there, but how does Sumingo, um, ensure compliance with.
Regulations know your customer data privacy laws. How does that work?
Harish Manipelli: We, we adopt the common standards, the CCPA, the GDPR, uh, and there's disclosure on what sorts of data retain, how long we retain it and how often the data gets cleaned up. The merchant has complete visibility into what is stored. Uh, we have strong data protection, uh, in place where we keep the data.
So it's completely up to the merchant how long the data is stored and what is stored. And then the consumer at any point can go request for data deletion and that's standard practice using CCP or GDPR.
Tariq Ahmed: And I think, uh, just to add to that, right? So, um, we've, uh, as Amigo has been in business for over 10 years, we've, we've been working with, uh, bigger FIs and, uh, other businesses, bigger financial institutions, banks.
So we have, um, periodic audits to validate how we are storing our data. Um, we, I think we're pretty compliant on that. We go through regular audits and make sure. All the data is safely, securely, um, uh, stored and erased as per, uh, the requirements.
Claus Lauter: I think it's easy to understand why a merchant should have a, um, fraud protection system.
Can you share any kind of success stories or case studies? You don't name brands, um, from merchants that have implemented your solution?
Tariq Ahmed: Sure. I can share an interesting story where, uh, with one of our early customers, we were validating our product, uh, and we were getting feedback on every decision. So let's say we initially we're validating our product, our trust scores, we're getting feedback.
So this is a mobility company who sells electronic scooters. So, um, they noticed a transaction of between 1, 300 to 1, 400 transaction for an e scooter. Uh, getting sent and this is in Canada, right? So this was getting sent to Montreal, Quebec, uh, and we had information on the name and address being from Ottawa, the capital city of Canada.
Uh, so I think based on details did not match, right? The phone number was provided, uh, that the consumer trying to make this purchase could not validate the phone number. They provided the name and address of. The cardholder. So definitely that much, but they didn't have a device possession. We saw the billing and shipping distances were far apart, right?
It was in different provinces altogether. Uh, we provided a risk score of decline and, and then the merchant ended up calling the cardholder to validate, uh, if this is actually a good transaction. And they did say that they'd lost their credit card while on travel in Montreal. They had their wallet stolen in Montreal, right?
And they actually. Uh, call the bank to block the card, but it looks like the block did not go through. And, uh, they were not aware of this transaction at all. Like, they were not aware of this transaction, this purchase, so the merchant went ahead and immediately cancelled the order. So that saved the merchant 1, 300.
Um, actually, I would say more than 1, 300 because what would happen is if they would have processed the transaction, they're losing inventory worth 1, 300. And there would be a potential chargeback because the merchant processed a fraudulent order and in this case, the merchant is liable to return the money back to the cardholder.
Right? So, It's a significant, uh, financial, uh, impact, uh, the product cost, uh, for, um, this merchant. And I think the, the biggest attribute for us is they also had, uh, the default, um, providers, which Shopify provides. Uh, all their recommendation was the transaction is good. And that's because there was no historic, uh, fraudulent, uh, fraudulent signal on that particular transaction.
Customer or that particular order, right? So this is one, uh, small example of how a merchant, uh, merchant user trust score and, uh, I'll, uh, I'll stop a charge back in a fraudulent process of fraudulent order.
Claus Lauter: Now, sometimes transactions get flagged by the payment processor automatically. So Stripe flags it for no reason so that the guest, um, the, the, the customer did not come through and did flag the transaction.
And you're coming from the banking system, so you have a banking background. How does that work? How can you, um, protect flagging a payment on the gateway?
Tariq Ahmed: So you're right. So I think Stripe right now has a lot more rules. So as a merchant, you can configure their rules on how, so they're giving merchants flexibility to, I think they call it radar, Stripe radar.
So they're giving merchants the flexibility to add your own rules, add your own factors to flag a transaction or decline a transaction. Um, but again, I think the decision solely lies on Stripe and their internal fraud systems and models. Thanks. Eventually, if you see that, uh, this merchant has a good history of processing good transactions, um, I think, so what Stripe would do, I'm potentially guessing what Stripe would do is be a little more lenient on their fraud risk rules, right?
So two aspects of it, if you have your own fraud solution, you're sending Stripe good, good transactions to process, they don't see a lot of fraud coming from you, So the lesser the payment processor will flag your transaction. But if you see a lot of fraud volume coming from you, they would have their rules, they'll stricken their rules, you'll see a lot more transactions being flagged because potentially you're sending a lot more higher fraud volume to them.
So I think that's why it becomes critical for you as a merchant to invest in other fraud solutions, fraud providers. And before even you send the transaction to the processor, make sure that the order is good.
Claus Lauter: Yeah, I think that's, that's a good explanation that you gave there. So if you're coming with good data and you prevent fraud in the first place, it will not have any kind of negative impacts on other sites, for instance, payment gateways in your business.
So that's a big point there. Let's dive a little bit into the practical implementation of your system into a Shopify store. How does that look like? What are the steps that a merchant has to go through to get it up and running?
Harish Manipelli: Yeah, so it's um, it's an app. You go into the Shopify app marketplace, search for D RISKify, and once you, you find it, you click install.
It's self guided. There is no code integration required. As soon as you install it, you, you basically review the terms of the app, pick a plan, and we've got multiple plans based on what sort of services you're interested in. And you click sign up. Then once you sign up, it's installed. And the next time an order is placed, you automatically get an order risk indicator from de riskify.
Uh, we've got a couple of different flavors in which you can see it. One is we post that indicator directly into the Shopify. Uh, merchant dashboard, and you can also, uh, drill down, open up our UI, which is integrated into the console. So once you launch the de riskify UI, you can explore multiple different aspects of your overall business.
So we've got a dashboard which shows the total number of transactions you've performed, how many have been flagged as risky, the total dollar amount of the risky transactions. you've performed. Uh, so it's a visual tool which will allow the merchant to go make a decision. There is a summary and there's also a detailed drill down.
No code integration is required. We do have options where if a larger merchant wants to integrate with an SDK of sorts that is available from the get go, our order risk management has, um. You know, no code integration and you can get up and running within a couple of minutes.
Claus Lauter: Okay, that sounds very, very straightforward, specifically no code integration or not nothing that you need to do from your side.
I love that. Who's your perfect customer? Are there specific industries or verticals that you work more with than others?
Tariq Ahmed: Sure. I think the way we've, um, designed this no code integration is to, uh, So, like, like Harish mentioned, we also have APIs and SDKs, which requires a lot of integrations and larger enterprises would want to, uh, do that.
But with the Shopify platform, it's, uh, more with this no code integration and the app, it is, uh, designed towards, uh, mid scale businesses, small and mid scale businesses. Because, uh, they, they, they would want a fraud protection solution, but without the investment and effort of going through an entire integration, developing, Hiring engineers to develop the solution.
So the app is mainly around these kind of businesses, but that doesn't mean large enterprises cannot use the same functionality. So it is focused towards the SMB businesses. And I think we have a lot of customers. We have varied customers. We have customers who sell health devices, general merchandise, sports equipments.
So we have customers all over the place. Um, um, and. I think, yeah, so it's not meant for a specific industry or specific business. We can do this validation for any consumer, right? So we are validating a consumer, not necessarily a type of product, the ordering, but the consumer on our system. So it could be any consumer facing, um, Business and Shopify.
Claus Lauter: I want to take one step back. Um, harshly at some point you mentioned that you have a password less lock in feature in your system. What does that mean and how does it work?
Harish Manipelli: Yeah, that's that's good question. So there's like two parts to our solution, right? One is the order risk verification, which is back end only.
That's that's got pretty much zero consumer interaction during order verification. We do have a feature where Uh, verification message can be sent out to a customer where they actually confirm they bought the product. That's an additional signal which the merchant has a confidence level. So that's the one user interaction as a consumer you would see for risk verification.
On the password list, uh, you know, Shopify offers a couple of different flavors, right? One is An email based OTP login and the other one is a classic login where they say you can log in with the username and password, right? So what we've done is we've basically taken the passwordless solution and made it available as part of the deoskify where once a merchant installs the app.
You can select a Passwordless login solution, and then you can pick, uh, multiple different ways you are gonna let a consumer login to your store. Mm-Hmm, . So one, one of the, uh, cool things that we do with Passwordless login is like, typically you, you probably exposed to an OTP, right? You enter an email, you get an OTP, and then you log in.
We have, uh, amigo has, uh. Partnerships with mobile network operators all over the world and using which, let's say you're interacting from a mobile phone as a shopper and you will land at the merchants website website. You enter the email address for your Shopify account and in the background, we automatically figure out if this email address.
has a corresponding phone number in Shopify. And then if you detect, we have the ability to in real time detect if that interaction is happening from that device with that phone number on it. Right? So it's called silent network authentication, and it involves, you know, carrier carrier interactions. So in that model, You can have a shopper log in, just enter the email address and no password.
If that phone number matches with what's on record for your Shopify account, we automatically let you log in, right? That is frictionless network authentication. So that's one flavor we support. And then we also have, uh, you know, a couple of different flavors. We can send an OTP to your phone and you enter the OTP and then log in using the OTP.
And if you have, uh, let's say you don't have a mobile phone, you can't get an SMS, uh, there can be a voice call. And then you can have a voice OTP delivered, you take the OTP and then you enter it into, into the login screen, you log in, or you just press a button. Are you trying to log into this store? You say press one and you automatically log in, right?
So we're building many different flavors where a consumer landing on a Shopify merchant store doesn't have to remember a password. Email is not the only option. There's like multiple other options. That the passwordless login lets you use so the integration for the passwordless login. Obviously, it involves a customer facing UI because the customer is going to log into the website.
So we've developed the product in a no code fashion. There is no code required. The merchant installs. The app selects a login plan, and then the merchant has to go into a Shopify team editor, right? So you open up a link we provide in the instructions and click a button. Basically, it's like, Enable Zomigo Passwordless Login, Diskify Passwordless Login.
And as soon as you click the button and you hit save, your next login is now going to be completely supported by Diskify. So it's easy to turn on and turn off. Once you turn it on, you can just log in using. Your phone, um, OTP, voice call, you don't have to worry about your password.
Claus Lauter: That sounds like a very elegant and user friendly solution that you have there.
I mean, who remembers his Shopify password that you use once in a while, and then you have to look it up and it breaks the complete funnel and customer journey in your store and a lot of people I think might just drop off and look for another place to buy if they can't find their password. And, and as most.
Shopping transactions nowadays happen on mobile devices with a phone number, probably in the background. I think that's a very elegant solution that you have there. Now, how much of AI is involved in what you offer? AI is everywhere. Is AI something that is helping already, or is that something that's coming in the future?
Harish Manipelli: AI is involved. Like Tarek mentioned, we specialize in deterministic solutions, right? So I look at any problem being solved using facts, which you've got to verify the facts. Then AI is about opinions, right? And opinions are predictive based on historical data. So we use both. So in the order risk verification, for instance, every element of the order is deterministically verified with an authoritative source.
So in addition to the overall trust score, we give, uh, individual scores. That's the phone, uh, first name match with the phone numbers, uh, you know, on the, in the carrier's record. Does the address match, right? Does the email match? So we've got lots of a la carte scores. As a lower all trust course, but we also, you know, dip into past behavior.
So we've got access to past consumer behavior. Potentially flagged, uh, pro feral entries. And then we have anomaly detections, which detect for patterns. Is this an unusual way that this order is being placed? Or a login is being performed? Are you looking, are you doing it from a different location? We've never done it before.
We've never seen before, you're doing it from, you know, a VPN and potentially trying to mask your IP address, right? So there's lots of little signals that we look at, which will feed into the model and come up with predictions. So our scores, you know, will involve both data facts as well as, you know, machine learning based predictions.
And the same is true for passwordless login. You know, one of the things we do is, you know, look at past login data. You know, how has login, you know, coming from a known entity and how is it different now? So it is both fact as well as, uh, AI would choose as predictions.
Claus Lauter: I think it's very important to protect your store from fraud and scams, uh, because as Tarek mentioned, there is so many things involved that can cost you potentially money as a merchant, um, that it should be very high on your list.
Before we come to the end of the coffee break today, is there anything that you want to share with our listeners that we haven't covered yet?
Tariq Ahmed: Yeah, I think, you know, so again, I would reiterate the point that, um, like you clearly mentioned fraud is a billion dollar problem. Uh, and it is increasing, uh, one of the statistics I just read before this call is it's increasing 16 percent year on year.
So that's a huge, uh, uh, increase. And in general, the, uh, the, uh, I think this e commerce or basically commerce is moving to mobile phones, so it becomes a lot more easier to get access to basically like there's a lot of phone fraud involved, right? So SIM swaps and a lot of different ways of fraudster can get access to your phone number and mobile account, right?
So it becomes critical for merchants to. Consider all that and invest in fraud prevention solutions. And, uh, and that's, that's how we are trying to build DSK5 for the future of comm, right? So things would move into e com, uh, uh, mobile commerce, shopping has moving moved, already moved into mobile commerce, passwords, um, passwords, uh, are traditional.
People forget passwords. People, I think one of the biggest problems for merchants in retention is forgot password link. They see a lot of drop offs happen when someone clicks forgot password. The whole experience is, um, not great. Focus somewhere so they don't tend to drop off. So the way we are combining our solutions without a risk verification authentication.
So this could be a one stop solution to get the get improved customer experience as well as potentially reduce fraudulent orders.
Harish Manipelli: Then customers generally, especially when you're a new merchant setting up a store, you're focused on, you know, how pretty your website is and how quickly you can fulfill how your labels look.
So you're, you're very focused on growing your business. But the moment fraud hits you, especially when you're small, you know, you're just, you take a step back, like Derek mentioned, every dollar that you spend, which is fraud, which is affected by fraud, you end up spending two times that on fighting it. A lot of merchants, you know, start looking at fraud only after the first fraud happens, right?
And because they said, this is expensive, I'm not going to invest, but the way we've built it, it's easy, you get signals, right? Even small companies who, who just are starting their business can, you know, invest in a fraud detection solution, which is giving very valuable signals. Because somebody who is fulfilling an order, you just don't know whether this is a good order or not.
Right. And this is data that you should leverage. That I, you know, new new merchants start with, yeah, making your store really attractive, pricing attractive, but also get a fraud detection solution in there. So you're protected from the get go.
Claus Lauter: Yeah, I would highly recommend that. I have been in a situation that you just mentioned Harish, where it's like you get your first fraud order and you process it and It's really a pain in the neck on so many different levels, specifically emotionally.
So, uh, um, so you want to make sure that you're protected in the first place. Where can people find out more about you guys?
Tariq Ahmed: So, I mean, on our website, domingo. com, we have a section called D RISK FI. Or they can contact us through our contact us page on listing on Shopify on the USK5. So they can contact us or, um, our linkedins are public.
You can always directly reach out to us as well. Uh, if they want to tell if someone wants to talk to us directly.
Claus Lauter: Cool. I will put the links in the show notes. They will be just one click away. And my recommendation to our listeners, try it out, be safe, make sure that you don't get scammed as a merchant and have the right fraud protection.
Thanks so much for the talk today.
Tariq Ahmed: Thank you. Thank you, Claus. Thanks. Thanks.
Claus Lauter: Hey, Claus here. Thank you for joining me on another episode of the e commerce coffee break podcast. Before you go, I'd like to ask two things from you. First, please help me with the algorithm so I can bring more impactful guests on the show.
It will make it also easier for others to discover the podcast. Simply like, comment, and subscribe in the app you're using. Using to listen to the podcast and even better if you could leave a rating. And finally, sign up for our free newsletter and become a smarter Shopify merchant in just seven minutes per week.
We create content from more than 50 sources, saving you hours of research and helping you stay on top of your e commerce game with the latest news, insights, and trends. Every Thursday in your inbox, 100 percent free. Join now at newsletter. ecommercecoffeebreak. com. That is newsletter. ecommercecoffeebreak.
com. Thanks again, and I'll catch you in the next episode. Have a good one.