7 ms·

Sift Science (YC S11) raise $18M to stop credit card fraud with machine learning

95 points by jasontan 12y ago

JimmaDaRustla 12y ago
Just off the top of this article - BestBuy wouldn't be liable for that $1000, it is the FIs liability, if we're talking about a transaction at a physical terminal, not CNP. Edit: FIs also have to follow rules and regulations to monitor and predict fraud activity.
- justin66 12y ago
  That's exactly wrong. Barring some sort of insurance, merchants eat the cost of fraud. This is the incentive for some of the weird behavior and lack of progress when it comes to CC transactions in the United States. Ideally Sift's clients would be the banks, since they've got all the money, but the banks can foist most of the cost of theft onto someone else, so...
  - deleted 12y ago
    [deleted]
- zt 12y ago
  It actually depends on whether you're in a card-present or card-not-present situation. For historical (i.e. irrational) reasons, merchants are responsible for fraud in the CNP situation.
  - JimmaDaRustla 12y ago
    Correct - I always assume terminal based transactions when it comes to fraud.
- lestinkycowboy 12y ago
  You are not correct. BestBuy is absolutely liable for that $1,000. If they ship the TV to the fraudster, the TV is gone and the $1000 is gone, too. When the actual owner of the credit card charges back, the $1000 BestBuy received is automatically taken from their account (or subtracted from their next settlement). FIs do try and predict fraud, but they do a very poor job of it. In the ecommerce space, the merchant is liable for, essentially, all fraud.
  - JimmaDaRustla 12y ago
    I was meaning in a physical transaction, where the customer pays at a terminal. I guess I spoke out of context!
- jasontan 12y ago
  Jason here, op (and CEO of Sift Science). It wasn't quite clear in the article - in the example of the stolen television, there is a key difference between Best Buy and bestbuy.com. In the latter, the merchant takes the hit on fraud (e.g. $1000 will be subtracted from the bank account of bestbuy.com), whereas in the former, the merchant is off the hook for fraud. This is one of the key differences between Card Present (offline) and Card Not Present (online) transactions. I've contacted the reporter to try and clear this up.
  - JimmaDaRustla 12y ago
    Edited this comment - misread your comment. Correct, thank-you for the feedback! Edit #2 - when you say offline/online, I'm assuming you mean in terms of an online store, versus a physical retail store. I took it as if the transaction was done in realtime to the backend FI system, or if it were verified offline at a terminal. In EMV terminals at a physical merchant location, transactions can be either online or offline ;)
jliptzin 12y ago
I can think of some simple things FIs can do to prevent fraud. For example they could leverage your cell phone's GPS at the time you make a purchase to make sure you're actually in the store where the purchase is coming from. For online purchases, they could text you a confirmation that you were the one who made the purchase. Just some simple things that seem a lot less complicated than machine learning that we haven't tried yet.
- necubi 12y ago
  (Disclaimer: I'm an engineer at Sift Science). For online purchases (card-not-present transactions), the merchant takes on all of the fraud risk. This means that the banks do not have much incentive to protect against fraud. The merchants must go on the information they have, which probably doesn't include the card holder's verified phone number. Sift Science has been successfully protecting online businesses for over a year, and it turns out that machine learning is (unsurprisingly) a good tool for this sort of classification problem.
- laurenbee 12y ago
  Interesting ideas, but I don't think these suggestions would be so simple. They would put a burden on consumers to always have a phone at the ready. What happens if your phone can't connect to GPS inside a store? What if you don't have your phone with you (or if you don't have a phone at all)? Buying goods and services would be far less convenient.
  - jliptzin 12y ago
    That's true, things that sound simple on the surface often turn out to be pretty complex in implementation. I think that the number of people making purchases without cell phones on them is converging towards zero and will be there soon, so I think it's safe to think about these systems now. What about implementing a 2FA system for larger purchases (online or off), implemented in an app on the consumer's phone like google authenticator or sms? Swipe your card at checkout, if amount is > $XX (or otherwise suspicious according to current models), prompt the buyer for a one-time code from SMS or an app. I use the same system when logging into gmail, my bank account, etc - I'd have no problem (and would even welcome) a similar system when using plastic. It's at least a lot more convenient than having the txn declined and your card disabled until you call their security hotline. This way, thieves would need to steal your card and your phone to cause damage.
milkmanjr 12y ago
Awesome stuff. I use sift science, in addition to some basic fraud prevention, and what they are doing has allowed me to sleep easier at night. Kudos to the Sift Science team!
JackFr 12y ago
Calling it 'lose-lose-lose' doesn't actually make sense. 1) They lose the TV; 2) they lose the $1000 dollars they obtained in the transaction; 3) the chargeback negatively impacts relationship with the card issuer. By that accounting, a legitimate sale would count as a 'lose', since they lose the TV. 'Lose-lose' would be fine, but even by the standards of hastily written press releases, this is kind of silly.
- jasontan 12y ago
  Hi JackFr, Jason here, op and CEO of Sift Science. You have a point, but do keep in mind that the TV is going to a bad customer -- one that won't reward Best Buy with repeat business (perhaps just more fraud) and won't spread positive word of mouth (except to let other fraudsters know that Best Buy is a great fraud target). So there is some "lose" in shipping the TV to a bad customer, different from shipping it to a good customer. Does that make sense?
mahyarm 12y ago
When do you think credit cards / bank accounts will become push transactions vs. the pull transactions by a few trusted banking agents as they are now. How much will that reduce fraud?
suprgeek 12y ago
Is the fact that this is based on "no rules just data" even sensible? Or is it an artifact of bad reporting? Many Credit card fraud prevention systems such as the Falcon Fraud Manager use both Rules and ML (Neural Network modelling) to tackle this issue. I am not sure that a purely data centric approach with no rules even makes sense.
- jasontan 12y ago
  hi suprgeek, I'm the op (and CEO of Sift Science). it's true - we do not have any rules in our product. we believe that rules can serve as an effective short-term solution, or for special cases, e.g. prematurely blocking a massive wave of fraud from an IP address because you know it's coming. but, rules are rather easy for fraudsters to circumvent, and they require merchants to play whack-a-mole. with today's technologies, it's easier than ever to analyze massive amounts of data, and we believe that machine learning can go a really long way in detecting fraud. does that make sense? happy to discuss further, and we'd be happy to put you in touch with our customers if you'd like to hear more about our results.
  - suprgeek 12y ago
    Hi Jason, Thanks for replying and that (no rules just data) is a pretty cool ML + Big Data play. Having worked in this space a bit, I know where the dragons be in such an approach. I imagine that you are doing some kind of Pattern Matching: e.g. known Fraudster uses these signals (Browser +OS + Email+Time of shopping + something else... + type of Card) to teach the system what to look for. The real trick is to avoid over training and evolving the patterns to keep pace with the fraudsters by incorporating feedback from the merchants. Can you point to some blog posts/text that provides a sneak peak into the kinds of technology that you use to cut down on false positives?
- rm999 12y ago
  >I am not sure that a purely data centric approach with no rules even makes sense. Fraudsters generally follow fairly specific patterns that can definitely be picked up in a rich enough dataset, and the consortium-based approaches of Falcon and Sift allow the models to generalize pretty well. Rules are way less expressive than complex-enough machine learning methods (combined with good data).
svmegatron 12y ago
I run a product in this space (https://www.merchantprotector.net https://www.merchantprotector.net) and I'm quite impressed with Sift Science's pricing. No charge for the first 10k transactions/month is impressive.
- jasontan 12y ago
  thank you, will!
ripberge 12y ago
Anyone care to share their experience with Sift Science? How well does it actually work for you? I have been integrating it for a day or so. The documentation is slightly confusing and they've had a few minor bugs in their UI, but support has been really good thus far.
- jasontan 12y ago
  hi ripberge, would love to hear what was confusing about our documentation, and what bugs you've seen. we're always looking to improve the customer experience - can you email me (jason at siftscience dot com)
saurabhnanda 12y ago
why cant credit card transactions be mandated to go through a second layer of auth that is not present on the card? in india, the banking regulator RBI, forced this a few years ago and the CNP fraud rates tanked to negligible levels. All domestic transactions now go through a 3d-secure or OTP process.
- Tarang 12y ago
  It decreases the chances of successful legitimate transactions just as a barrier to completing payment. In India nearly 1/3 of card based transactions online don't go through successfully. I.e want to order pizza but the phone battery is dead (so no 2fa/otp)
lsh123 12y ago
The biggest problem with ML is that it takes time for it to react to the new fraud patterns/schemes. While rules engines have their limitations, they also have one big benefit: they allow to block recognized fraud really fast. So the actual question here is whether the ML for detecting fraud is better than a flexible rules engine and goods analysts/statisticians. In my personal experience, statistical analysis and anomalies detection effectively handles majority of the fraud. I would be interested to see a more detailed analysis of Sift Science performance with some numbers for false positives/false negatives for example, though (of course) it is probably proprietary information.

95 points by jasontan 12y ago

Just off the top of this article - BestBuy wouldn't be liable for that $1000, it is the FIs liability, if we're talking about a transaction at a physical terminal, not CNP. Edit: FIs also have to follow rules and regulations to monitor and predict fraud activity.

justin66 12y ago
That's exactly wrong. Barring some sort of insurance, merchants eat the cost of fraud. This is the incentive for some of the weird behavior and lack of progress when it comes to CC transactions in the United States. Ideally Sift's clients would be the banks, since they've got all the money, but the banks can foist most of the cost of theft onto someone else, so...
- deleted 12y ago
  [deleted]
zt 12y ago
It actually depends on whether you're in a card-present or card-not-present situation. For historical (i.e. irrational) reasons, merchants are responsible for fraud in the CNP situation.
- JimmaDaRustla 12y ago
  Correct - I always assume terminal based transactions when it comes to fraud.
lestinkycowboy 12y ago
You are not correct. BestBuy is absolutely liable for that $1,000. If they ship the TV to the fraudster, the TV is gone and the $1000 is gone, too. When the actual owner of the credit card charges back, the $1000 BestBuy received is automatically taken from their account (or subtracted from their next settlement). FIs do try and predict fraud, but they do a very poor job of it. In the ecommerce space, the merchant is liable for, essentially, all fraud.
- JimmaDaRustla 12y ago
  I was meaning in a physical transaction, where the customer pays at a terminal. I guess I spoke out of context!
jasontan 12y ago
Jason here, op (and CEO of Sift Science). It wasn't quite clear in the article - in the example of the stolen television, there is a key difference between Best Buy and bestbuy.com. In the latter, the merchant takes the hit on fraud (e.g. $1000 will be subtracted from the bank account of bestbuy.com), whereas in the former, the merchant is off the hook for fraud. This is one of the key differences between Card Present (offline) and Card Not Present (online) transactions. I've contacted the reporter to try and clear this up.
- JimmaDaRustla 12y ago
  Edited this comment - misread your comment. Correct, thank-you for the feedback! Edit #2 - when you say offline/online, I'm assuming you mean in terms of an online store, versus a physical retail store. I took it as if the transaction was done in realtime to the backend FI system, or if it were verified offline at a terminal. In EMV terminals at a physical merchant location, transactions can be either online or offline ;)

jliptzin 12y ago

I can think of some simple things FIs can do to prevent fraud. For example they could leverage your cell phone's GPS at the time you make a purchase to make sure you're actually in the store where the purchase is coming from. For online purchases, they could text you a confirmation that you were the one who made the purchase. Just some simple things that seem a lot less complicated than machine learning that we haven't tried yet.

necubi 12y ago
(Disclaimer: I'm an engineer at Sift Science). For online purchases (card-not-present transactions), the merchant takes on all of the fraud risk. This means that the banks do not have much incentive to protect against fraud. The merchants must go on the information they have, which probably doesn't include the card holder's verified phone number. Sift Science has been successfully protecting online businesses for over a year, and it turns out that machine learning is (unsurprisingly) a good tool for this sort of classification problem.
laurenbee 12y ago
Interesting ideas, but I don't think these suggestions would be so simple. They would put a burden on consumers to always have a phone at the ready. What happens if your phone can't connect to GPS inside a store? What if you don't have your phone with you (or if you don't have a phone at all)? Buying goods and services would be far less convenient.
- jliptzin 12y ago
  That's true, things that sound simple on the surface often turn out to be pretty complex in implementation. I think that the number of people making purchases without cell phones on them is converging towards zero and will be there soon, so I think it's safe to think about these systems now. What about implementing a 2FA system for larger purchases (online or off), implemented in an app on the consumer's phone like google authenticator or sms? Swipe your card at checkout, if amount is > $XX (or otherwise suspicious according to current models), prompt the buyer for a one-time code from SMS or an app. I use the same system when logging into gmail, my bank account, etc - I'd have no problem (and would even welcome) a similar system when using plastic. It's at least a lot more convenient than having the txn declined and your card disabled until you call their security hotline. This way, thieves would need to steal your card and your phone to cause damage.

milkmanjr 12y ago

Awesome stuff. I use sift science, in addition to some basic fraud prevention, and what they are doing has allowed me to sleep easier at night. Kudos to the Sift Science team!

JackFr 12y ago

Calling it 'lose-lose-lose' doesn't actually make sense. 1) They lose the TV; 2) they lose the $1000 dollars they obtained in the transaction; 3) the chargeback negatively impacts relationship with the card issuer. By that accounting, a legitimate sale would count as a 'lose', since they lose the TV. 'Lose-lose' would be fine, but even by the standards of hastily written press releases, this is kind of silly.

jasontan 12y ago
Hi JackFr, Jason here, op and CEO of Sift Science. You have a point, but do keep in mind that the TV is going to a bad customer -- one that won't reward Best Buy with repeat business (perhaps just more fraud) and won't spread positive word of mouth (except to let other fraudsters know that Best Buy is a great fraud target). So there is some "lose" in shipping the TV to a bad customer, different from shipping it to a good customer. Does that make sense?

mahyarm 12y ago

When do you think credit cards / bank accounts will become push transactions vs. the pull transactions by a few trusted banking agents as they are now. How much will that reduce fraud?

suprgeek 12y ago

Is the fact that this is based on "no rules just data" even sensible? Or is it an artifact of bad reporting? Many Credit card fraud prevention systems such as the Falcon Fraud Manager use both Rules and ML (Neural Network modelling) to tackle this issue. I am not sure that a purely data centric approach with no rules even makes sense.

jasontan 12y ago
hi suprgeek, I'm the op (and CEO of Sift Science). it's true - we do not have any rules in our product. we believe that rules can serve as an effective short-term solution, or for special cases, e.g. prematurely blocking a massive wave of fraud from an IP address because you know it's coming. but, rules are rather easy for fraudsters to circumvent, and they require merchants to play whack-a-mole. with today's technologies, it's easier than ever to analyze massive amounts of data, and we believe that machine learning can go a really long way in detecting fraud. does that make sense? happy to discuss further, and we'd be happy to put you in touch with our customers if you'd like to hear more about our results.
- suprgeek 12y ago
  Hi Jason, Thanks for replying and that (no rules just data) is a pretty cool ML + Big Data play. Having worked in this space a bit, I know where the dragons be in such an approach. I imagine that you are doing some kind of Pattern Matching: e.g. known Fraudster uses these signals (Browser +OS + Email+Time of shopping + something else... + type of Card) to teach the system what to look for. The real trick is to avoid over training and evolving the patterns to keep pace with the fraudsters by incorporating feedback from the merchants. Can you point to some blog posts/text that provides a sneak peak into the kinds of technology that you use to cut down on false positives?
rm999 12y ago
>I am not sure that a purely data centric approach with no rules even makes sense. Fraudsters generally follow fairly specific patterns that can definitely be picked up in a rich enough dataset, and the consortium-based approaches of Falcon and Sift allow the models to generalize pretty well. Rules are way less expressive than complex-enough machine learning methods (combined with good data).

svmegatron 12y ago

I run a product in this space (https://www.merchantprotector.net https://www.merchantprotector.net) and I'm quite impressed with Sift Science's pricing. No charge for the first 10k transactions/month is impressive.

jasontan 12y ago
thank you, will!

ripberge 12y ago

Anyone care to share their experience with Sift Science? How well does it actually work for you? I have been integrating it for a day or so. The documentation is slightly confusing and they've had a few minor bugs in their UI, but support has been really good thus far.

jasontan 12y ago
hi ripberge, would love to hear what was confusing about our documentation, and what bugs you've seen. we're always looking to improve the customer experience - can you email me (jason at siftscience dot com)

saurabhnanda 12y ago

why cant credit card transactions be mandated to go through a second layer of auth that is not present on the card? in india, the banking regulator RBI, forced this a few years ago and the CNP fraud rates tanked to negligible levels. All domestic transactions now go through a 3d-secure or OTP process.

Tarang 12y ago
It decreases the chances of successful legitimate transactions just as a barrier to completing payment. In India nearly 1/3 of card based transactions online don't go through successfully. I.e want to order pizza but the phone battery is dead (so no 2fa/otp)

lsh123 12y ago

The biggest problem with ML is that it takes time for it to react to the new fraud patterns/schemes. While rules engines have their limitations, they also have one big benefit: they allow to block recognized fraud really fast. So the actual question here is whether the ML for detecting fraud is better than a flexible rules engine and goods analysts/statisticians. In my personal experience, statistical analysis and anomalies detection effectively handles majority of the fraud. I would be interested to see a more detailed analysis of Sift Science performance with some numbers for false positives/false negatives for example, though (of course) it is probably proprietary information.