Boost Acceptance Rates with AI-Powered TRA Exemptions

0:01
So good morning or good afternoon and welcome to today’s talk titled boost
0:06
acceptance rates with AI powered TRA exemptions. My name is Melis de Mual
0:12
publisher of the papers and I’m delighted to be the co-host of today’s
0:16
session with our partner Sift and thank you so much for tuning in today. So
0:21
what’s the story? Well, PSD2 SEA was fully enforced across the EA region by
0:28
spring summer 2021. And although PSD2 SEA and TRA exemptions are not new
0:34
topics, there is still a need for a deeper understanding of how to optimize
0:40
TRA exemptions and improve acceptance rates. Ultimately, our goal is to
0:45
maximize approved transactions while minimizing friction leading to greater
0:50
customer satisfaction and retention. So, should you request exemptions for
0:55
all transactions? And if not, what is the best strategy to maximize approvals?
1:01
Well, before we explore real use cases and best practices and explain how you
1:06
can leverage AI scoring to optimize TRA exemptions, we will start by walking you
1:12
through the regulations and discuss which transactions qualify for TRA
1:17
exemptions. So joining me today for this discussion
1:21
are Brittany Ellen, senior trust and safety architect at SIFT and Carmen
1:27
Cabalero, digital payments platform group manager at Nestle.
1:31
And before Brittany and Carmen will tell a bit more about themselves, some quick
1:35
notes regarding timing and logistics. The discussion will take approximately
1:41
45 minutes and we will have 10 to 15 minutes for a Q&A at the end of the
1:46
webinar. On the right side of the screen, you can see a chat panel which
1:50
includes a chat room and a Q&A widget where you can ask questions at any time
1:55
throughout the discussion. We will compile the questions and Britany and
1:58
Carmen will take as many as possible at the end of the discussion. We also have
2:04
subtitles available for this webinar. You can activate them by clicking the CC
2:08
icon located on the top right hand side of the webinar room. The subtitles are
2:13
available in several languages from English, Spanish, Italian, German,
2:17
French, and Portuguese. So, hi Brittany and Carmen. Uh, I’m
2:22
really happy to see you today. Uh, we have been in panels and webinars before,
2:26
and I I highly value your expertise and the insights you share. So, could you
2:31
tell the audience a bit about yourself and your roles?
2:35
>> Um, Britney, could you start?
2:37
>> Yeah, I’ll jump in. So, hi uh Britney Allen, senior trust and safety architect
2:41
at SIFT. I’ve been here for a little over four and a half years, but a
2:46
majority of my career has been spent as a merchant working on trust and safety
2:51
and fraud prevention teams. So, I got my start at Etsy, also worked at Airbnb,
2:56
spent some time fighting luxury fraud at First Dibs, and then lastly was at
3:01
LetGo, which is a secondhand sales platform owned by Ox before I ended up
3:05
joining Sift. So I’m excited to be here today. Wonderful create. Uh Carmen,
3:12
>> hello everyone. Thanks Melisand for the invitation. Super happy to be here.
3:18
Yes. So I’m managing e-commerce payments and fraud for Nestle. I’ve been
3:25
in the payments and fraud industry for the last 10 years, seven years at
3:29
Nestle. mainly in working for an espresso but also we help
3:36
other Nestle brands.
3:39
>> Great. So for the audience don’t be shy. Don’t do reach out to Britany and to
3:46
Carmen. They have tons of experience in this space and would love to take your
3:50
question and help you really optimize these TRA exemptions. So let’s run
3:54
through the agenda of today um and go to the next slide. So, oh one, so what are
4:03
we going to discuss today? Well, Britany will start explaining the TR exemption
4:07
rules because it’s that’s the key understanding how this rule works. Then
4:11
we will give some real world examples both from physical goods and digital
4:15
goods merchants. We will examine some real life examples from the deep and
4:20
dark web of how fraudsters attempt to bypass 3D 3DS with very sophisticated
4:27
tools. It’s it’s scary. Um and we will end with some best practices for you to
4:31
take away after this webinar. So, uh Brittany um can you walk us through the
4:37
PSD2 SEA regulation and um explain what are these TRA exemptions? How does this
4:44
work? And are there other SEA exemptions as well?
4:48
>> Yes. All right. So, let’s dive in. Now, we’re going to keep this a bit high
4:53
level because there’s an assumption for how many years it’s been out that quite
4:57
a few of our attendees today are familiar with the core concepts of SCA
5:02
and therefore TRA exemptions, but we would be remiss if we didn’t at least
5:06
include one slide to make sure that we’re all on the same page for these
5:10
concepts. So TRA stands for transaction risk analysis and it’s a fraud
5:15
prevention mechanism under the PSD2 regulations that allows for low-risk
5:20
transactions that are in scope for PSD2 and that’s important to bypass strong
5:25
customer authentication. And of course there’s some particularities for example
5:30
SCA uh applies to all payment methods but 3DS applies to credit cards only.
5:35
But what we’re really focusing in on today are just how can we take these
5:39
low-risk transactions that do qualify for TRA exemptions and help those
5:45
customers bypass that process and have a more friction-free experience. Now, a
5:50
lot of that then hinges on the transaction value and on the fraud rates
5:56
of the acquirer that you as a merchant are using. So, if you look at the
6:01
numbers there at the bottom, TRA exemptions are based on the acquirer’s
6:04
fraud rate. And here are some examples of those particular fraud rates and then
6:09
tied to the maximum transaction value that could qualify for a TRA exemption
6:15
with those particular rates. Those are things that you should be discussing
6:18
with your acquirer. We’re going to get into more detail for that later
6:22
obviously, but TRA is really valuable in how it’ll allow for transactions to be
6:27
analyzed in real time and it’ll also help you when you know your customer a
6:32
little bit better than the bank might to get those transactions moved through
6:37
more quickly. So, also I want to keep saying if there are any questions no
6:42
matter you know how big or small please keep putting them in the chat while we
6:46
go through this discussion. All right. So, you might also be
6:50
familiar with other exemptions. It’s not just risk that can exempt a transaction
6:56
from SCA requirements. I only call out two on the slide because they’re two of
7:02
the most common other alternatives and these are ones that you’ll use together
7:07
with TRA exemptions to bypass those SCA requirements as appropriate for your
7:12
inscope transactions. One would be low value. So if a transaction is less than
7:18
€30 or the other equivalent in G uh in British pounds etc. As long as the total
7:25
amount for payments is made by that card holder with these other few you know not
7:30
regulations but parameters then you can also have it bypassed for low value. Uh
7:35
another pretty common category would be from merchant initiated transactions
7:40
which would be payments made on saved cards and the most common example is
7:43
recurring subscription payments. So, we also call these out in tandem with uh
7:48
talking about TRA because you need to know what within your business could
7:53
actually qualify for various exemptions to know where that best path or routing
7:58
should go. And of course, there are some other exemptions uh as well. I think I
8:04
couldn’t tell if Melisandre was about to speak up or not.
8:06
>> Yeah. Shall we
8:07
>> Okay. Shall we um because like you just mentioned it’s important to so we really
8:13
wonder what is the percentage of inscope transactions that that you know the
8:18
merchants or the audience in the in the in the audience um sent for TRA
8:22
exemptions. That was um basically a poll question that we would love to launch
8:27
here because indeed not all transactions um um are in scope but what percentage
8:35
of your incope transactions so what Britany just explained do you send for
8:40
TRA exemptions are these is this less than 10% 10 to 50 50 to 75 or more than
8:46
75 I guess the answer very much depends on the type of industry you’re in but
8:51
what what do you typic typically See Carmen within your business what
8:55
percentage what is in scope do you typically send
9:00
>> so in our scope in the case of an espresso um
9:07
we send over 75% of the transactions in scope to TR
9:13
exemptions.
9:15
>> Yeah. So that’s massive. and and what do you typically see Britany or before we
9:19
launch what the audience typically does but what do you see in your network?
9:23
>> Well, so we see quite quite a variation between different you know business use
9:28
cases and just also personal risk tolerance when it comes to the
9:32
individual setting those scopes. Uh but we did have a stat from Visa where they
9:40
said that per their you know assessment of e-commerce transactions by volume
9:45
they think that 40 to 50% could be exempt from SCA to some degree. So I do
9:51
think there is an opportunity to you know have merchants consider putting
9:55
more of their transactions through an exempt flow.
9:59
>> Yeah. So let’s see what the uh what percentage the audience typically sends
10:04
through. So it’s basically sort of in the it is
10:09
very evenly spread
10:10
>> distributed.
10:11
>> Yes.
10:14
>> Wow. Okay. Well, that means we just have a lot of different approaches in the
10:18
room with us today. I
10:20
>> guess so. Yeah. So let’s move on. Thank you.
10:23
>> All right. So why even bother looking for these
10:29
exemptions? Why take these, you know, extra steps? Why not just send it all
10:33
through uh the 3DS process? Well, there are quite a few benefits. And if we
10:40
start at the top of this list here in yellow on ways that you could leverage
10:44
AI to drive growth by utilizing these exemptions, the first would be to
10:49
prevent fraud before routing to 3DS to try to keep as many of your potentially
10:56
fraudulent transactions from even becoming transactions by identifying
11:00
fraud at an early point such as at account creation, at a login or at any
11:06
other maybe uh site activity before you even get to that transaction point.
11:11
Also, there’s the importance of then being able to focus on your most
11:15
important risk signals, like really understanding what fraud looks like on
11:19
your platform and not just sort of relying on another party, sending all of
11:24
your traffic along through SEA to see what information you get back. You can
11:29
also then accelerate your approval rates by sending, you know, fewer transactions
11:33
through a friction experience, reduce card abandonment, and improve the
11:38
customer experience. I’ve heard from other merchants at conferences this year
11:43
about how clean traffic or the percentage of clean traffic sent to
11:47
acquirers can increase their approval rates. So, we’ve definitely heard real
11:52
stories of that being shared. And there’s also an opportunity with this
11:58
flow and with these benefits to really see where some of your pain points are
12:03
for potentially having, you know, increased fraud. I know there was one
12:07
merchant who presented uh at a conference earlier this year who brought
12:11
up the fact that their mobile 3DS approval rates were far far lower uh
12:18
maybe up to 40% lower than their other platforms for transactions. And so they
12:24
ended up really focusing in on an increased level of fraud for their
12:29
mobile orders, which I think makes sense to a lot of us who accept mobile orders
12:33
and know how much fraud can exist there. But at this point, I think we’ve got
12:38
another poll for our audience.
12:44
>> Yeah, it is.
12:45
>> So go ahead.
12:48
>> Sure. So, what is your biggest challenge with implementing TRA exemptions? Is it
12:54
identifying those low-risk transactions? Is it balancing fraud prevention with
12:58
customer experience? Is it the compliance with SCA regulations or lack
13:03
of automation tools? And it’ll be interesting. I wish we could tie these
13:08
together to that previous poll to see of the people who send quite a few through
13:12
exemptions, what did they do or what is their biggest challenge uh versus the
13:17
other? Um, I don’t know, Carmen, if you were to
13:21
answer this poll today, which one of these would you select?
13:27
>> I would say that the biggest challenge is probably
13:34
>> identifying lowrisk transactions. Yeah.
13:38
>> So, being able to know what fraud exactly looks like and making sure that
13:42
you’re stopping that as early as possible and not trying to exempt those.
13:46
Yep. I don’t know if that’s going to
13:51
influence anyone’s answers. Or maybe I shouldn’t have done that. Maybe I just
13:55
influenced the poll. Okay. Shall we see what what we get?
14:02
Let’s launch through.
14:04
>> Ah, so tied for the lead. Balancing fraud
14:09
prevention with customer experience and also those the lack of automation tools
14:13
having to do all very manually. I completely identify with that. Great.
14:24
Okay. So, let’s keep going. All right. So, for maximizing your
14:31
chances for successful TRA exemptions, I want everyone to remember these three
14:36
points as we go into the specific use cases because this is what we’re really
14:40
going to be highlighting and focusing on over and over again. The first is a
14:45
merchant relationship with your acquirer. So we said early on in SL a
14:52
couple slides back that the amount of a transaction that you’re able to send for
14:58
a TRA exemption is determined by the fraud rate of your acquirer. So being
15:03
able to assess that, have open communication about that, and in some
15:06
cases maybe look for an alternative acquirer for you to use if you feel like
15:11
you’re being held back. This open, you know, level of communication and
15:15
understanding is really vital for TRA exemptions. In the middle, we’ve got
15:20
lowrisk transactions. So, like what Carmen said, big challenge, knowing what
15:25
is low risk for you and making sure you’re confident in identifying those
15:30
transactions that should be exempted from the process. And then three,
15:34
frequent returning customers. You’ve got your most valuable customers that have
15:39
the most lifetime value for your company. How can you focus in on them
15:45
and giving them the higher chance of being exempt under TRA and making sure
15:50
you provide enough data and information about their activity to show their
15:54
trustworthiness. Now, I do want to pause briefly before we go on because we did
15:59
get a uh got a question that just jumped into the Q&A and I do think we can we’re
16:05
going to show some examples later on of how we could send a transaction to TRA.
16:11
Um, but if we want to briefly pause here and just just answer that one, Carmen, I
16:17
don’t know if you could maybe sum that up in a couple of sentences before we
16:20
show some of the examples. Yes, you can send um so the question is
16:25
how do you send a transaction to TRA? This is the first time I heard of TR. So
16:29
great, thank you for the question. H you can send the exemptions either in the
16:35
authentication request to your PSP or in the authorization.
16:42
>> Great. Thank you for clarifying that uh Carmen. So and thanks Britany for this
16:46
very useful introduction to this topic. Yeah, as we can see there are still
16:50
people in the audience that really need to be educated on this topic. So great.
16:55
So let’s dive into the practicalities and how TRA exemptions are managed
16:59
within different verticals in the industry. So let’s start with um
17:05
yeah a bit of an overview.
17:07
>> Yeah. And this is definitely helpful to also answer that question that we
17:11
received about sending on TR because if it doesn’t it doesn’t answer the how. It
17:14
just shows a possibility of when or where you could send it along. So
17:19
knowing the how. Now, this is an example of the routing that you might use to get
17:25
that exemption. So if we start on the left with an event of an order being
17:30
created on your platform, if you were to then use machine learning to
17:35
differentiate the low to medium risk transactions from the high-risk, you can
17:39
see how we have the high-risisk transactions here immediately ending.
17:43
You know, we’re not sending those along just to see what result we get. We’re
17:48
saying that we’ve identified true fraud and that stops there. Now for the ones
17:52
that are low or medium risk, there’s of course that question of in scope or out
17:56
of scope for PSD2. Is this a transaction that involves a customer in the EU, a
18:02
customer in the US? What is the transaction value? How did it initiate?
18:07
Was it customer initiated or merchant initiated? when you know that it is in
18:11
scope for PSD2 then separating that out into low-risk
18:16
or sea required transactions that very top uh green star of request exemption
18:24
that’s what we’re focusing in on for these transactions where we can remove
18:28
that friction from being in front of the customer. So with that said, uh we
18:33
definitely want to hear now from Carmen about a case study and her experience at
18:38
Nestle with just this challenge.
18:41
>> Thank you, Britney. So at Nestle in particular in Espresso,
18:45
which is the biggest direct to consumer brand at Nestle, if we go back to when
18:51
PSD2 enforce strong customer authentication
18:55
in 2021, we already had low fraud h levels. Okay. So for us this enforcement
19:03
of SCA was really a drawback for us because we were we were already not
19:07
sending much traffic to 3DS on e-commerce.
19:11
So the experience was great before the enforcement.
19:18
Of course, you know, there are some exceptions because they’re more mature
19:22
countries for 3DS like the UK for example where you know 3DS was not a
19:26
problem but in the rest of Europe. So we operating in espresso in 20 countries in
19:33
Europe and the difference were huge. So for example in France it was not that
19:38
easy for our consumers to pass the 3DS step up. Okay, we had many calls to our
19:45
customer service asking what you know what was that you know even consumers
19:50
you know if the bank of the consumer um was sending a notification to their app
19:57
it could be that the consumer didn’t have even the banking app on their phone
20:00
you know so it was impossible to pass this 3DS step up and overall what we saw
20:08
is that there many inconsistencies in the
20:14
implementation of a strong customer authentication you know there’s lack of
20:21
standardization and that’s why each issuing bank implemented this SCA in a
20:27
different way okay because for example we saw that with American Express where
20:32
they you know a unique player they’re the issuer they’re the acquirer the
20:37
shopper experience was great for SCA so they’re There are big differences.
20:43
>> Yeah. So, SEA is not necessarily a bad thing. If you look into payment methods
20:48
like Ideal or or or bank apps, it’s it’s it’s
20:51
really smooth. Um there’s there’s hardly any friction. But with the problem here
20:57
in this in this sea for for for cards for credit cards is that it’s really not
21:01
consistently implemented. And since there is now basically policy makers are
21:06
working on PSD3 um you know what would you what what
21:11
would you what type of where do you think they really need to improve that
21:15
that because if you talk to the regulator they say well it’s amazing we
21:19
stopped fraud it really worked if you read all the reports but what is the
21:23
thing that really needs to be improved
21:28
>> so for me I I really fear a PSD3 three because it
21:34
took us years you know to integrate the 3SD2
21:42
from the different you know gateways that we have across Europe and I’m not
21:49
sure what it will happen if there is a standard you know do you think that all
21:52
the money that also all the Asian banks you know spend on you know their banking
21:57
apps their notifications their ACA step apps suddenly there’s just I mean if
22:03
there’s any standardization and all the banks need to comply with that let’s see
22:08
how it goes.
22:09
>> Yeah.
22:10
>> But um yeah I don’t have my expectations
22:14
>> low expectations and indeed it might it might take long as it did for PSD2
22:19
before all banks all issuing banks have implemented the new standards. But we
22:24
>> sure and also the um the concept you know the concept of SCA is great. PSD2
22:29
is also great you know more secure e-commerce you know protection for
22:33
consumers so the objective you know 100% agree on the concept but it’s the
22:40
problem the implementation where it’s not working very well and um
22:47
yeah so for me the first thing that merchants need to
22:52
do is understand of course you know their consumers understanding their data
23:00
have you know very good reports where you can see you know where the
23:03
percentage of the orders that you have in scope of TRA what are different
23:09
payment methods that your consumers would I mean pay with
23:14
for example one thing that we did when whole you know sea was enforced was to
23:20
mitigate for consumer I mean for countries where the drop in conversion
23:24
was higher was to promote other payment methods like digital words, right? So,
23:29
for example, PayPal had an amazing user experience.
23:33
>> So, we saw PayPal orders increase significantly in the countries where SCA
23:38
was very poor implemented. Okay. So, for me, it’s know your data, know your
23:45
consumers because the whole what I said the objective was that we would send
23:50
over through this, you know, authentication, authorization, all these
23:54
3D data.
23:56
>> Mhm.
23:56
>> Through our PSPs. So the issue banks could really assess the risk of the
24:02
transaction and the what it was sold to merchants was that everything was was
24:08
going to be frictionless and you know risk-free
24:13
but yeah the reality was friction but the good thing was that you know TRA
24:20
exemptions exist so if you very important
24:25
screen for fraud erh all your transactions
24:30
pre-authorization to like Britain said do not send you know fraud over to your
24:35
PSPs or you know back I mean to the issuers do not do that because it
24:40
doesn’t work so we’ve been using sift for many years
24:46
now and we can send in our scope almost 90% of our cards we
24:54
send with exemptions in Europe and we get granted the majority of them. But we
25:00
just send what is you know low risk.
25:03
>> That’s what that’s that’s the key. Okay.
25:06
>> So you use CIF to do that risk analysis which helps you basic clean pre-off
25:12
which helps you sending clean traffic through the uh the fire
25:15
>> and and it takes a while. So when you start you know with you know higher
25:19
fraud levels and you starting you know screening for fraud preoth it takes
25:25
months you know to warm up to even talk to issuers so they understand that
25:31
you’re not sending any you know fraudulent transactions
25:36
>> and authorizations keep improving so I think it’s you know this trust
25:42
relationship with your payments partners and
25:47
even up to the issue. I mean we had a case many years ago in France where we
25:52
saw that you know authentication of author rates were lower than in any
25:56
other you know big issue bank in France and we you know talk to them what is
26:01
that what’s wrong is there something we need to send on
26:07
and this is something that your acquirer can facilitate that conversation but for
26:11
that you need data.
26:13
>> Yeah. Yeah. a great insight. So really work closely together with your partners
26:19
um through your acquirer talk to issuing banks that have low performance
26:24
uh and again but firstly understand your data and have access to your data create
26:29
great insights car
26:30
>> and and also to the question of airing how do you send a transaction to I’m
26:35
just thinking that also your PSPs can do that for you on your behalf you know
26:40
>> so talk to your gateways acquirers PSPs you know and understand what is the best
26:47
way for you to integrate TRA exemptions and flag those transactions as low risk.
26:53
>> Yeah, great great insights. Carmen Brittany Sift works with a wide variety
26:59
of merchants being one of them. But could you share a use case from a
27:03
different uh industry? I can and I have brought along two of my own photos for
27:10
this because you know the the other companies aren’t here today to speak for
27:13
themselves and so I just decided oh why not I’ll use my my own photos and share
27:18
a little bit. So that first photo there on the left uh believe it or not those
27:23
are all carved pumpkins that is from the great Jalantern Blaze which is in Croin
27:30
on Hudson just north of New York City where I’m based out of. And every year
27:34
they take thousands and thousands of pumpkins and carve them and make a a
27:38
walkthrough sort of diarama. So there’s some dinosaurs there. There’s a fully
27:41
working carousel. It’s actually pretty cool to see and really represents how
27:46
America is tied, you know, so closely to Halloween. But I’m using this photo
27:51
because an example I have to share for digital goods and services is about a
27:55
ticketing platform that uses SIFT. and they are a ticketing platform that works
28:02
mostly with some smaller events and they have a very common use case of people
28:06
buying tickets and then needing to use them within a minute such as driving by
28:12
something like this great Jacko’Lantern Blaze and saying, “Oh, that looks so
28:16
cool. we should go in parking their car and then buying a ticket via let’s say
28:22
the mobile app or or via something online because maybe there’s a discount
28:26
or otherwise it’s easier for them to do that on their phone right then and
28:30
there. So the time to make a decision is very short. Someone may be in a location
28:35
they’ve never been in before, but hopefully they do have, you know, enough
28:39
device info and enough of a history or at least um visibility into the signals
28:45
of their account like the age of their email address, all those other potential
28:48
signals that this ticketing platform can quickly make a decision and decide
28:54
what’s going to work best for that customer who is right there with their
28:57
family walking into this event. Is it better for them to go through some kind
29:01
of authentication flow? Is it better for us to maybe risk having their
29:05
transaction rejected uh after going through SCA or could this be something
29:11
where we apply an exemption? And they specifically flipped most of those
29:16
transactions into an exemption flow just to remove that possibility of it being
29:22
cancelled out of their hands by the issuer. Uh second example I’ve got here
29:28
is also one of my photos. That’s me driving on the aisle of Harris in
29:32
Scotland. And I wanted to represent this for car rental because there’s also a
29:38
car rental company we’ve had conversations with about what of their
29:42
transactions could be exempted through TRA. And for them, it’s a much different
29:47
discussion because a lot of car rentals cost more than that 500 euro ceiling.
29:54
And so they do have, you know, quite a few orders that just are never going to
29:59
qualify for an exemption. But what about people who rent a car for a day trip?
30:04
Now, I had my car for a little bit longer than a day, but let’s just say in
30:07
theory I’m renting it for a day trip here. The value of that vehicle doesn’t
30:12
change based upon how much I spend to rent it. So, if I only spend €75 to rent
30:19
it for a day, they’ve still got the risk of a, you know, 30,000 40,000 euro
30:27
vehicle, however expensive it is. Maybe I’m going and getting something really
30:30
fancy. They’ve still got that risk because I’ve left with that vehicle. And
30:34
so, you’d think that they would send as many of their transactions through SCA
30:39
as possible, even if those were ones where they knew something about the
30:44
customer. Maybe they still just want to be extra careful, but even they are
30:48
working through the process now of considering more TRA exemptions because
30:54
it’s that same level of immediacy where I’m right there, I’m renting a car, I
30:59
want to take it for a day and they don’t want that transaction to get stuck
31:05
because maybe I’m at an airport and I have the choice to go to five other
31:09
rental car companies. It doesn’t have to be them. And so in that instance,
31:15
they’re still finding opportunities to use these exemptions even though maybe
31:21
they wouldn’t be an industry you would off the top of your head associate with
31:25
using exemptions like that.
31:28
>> No, but I guess it’s it’s it’s it’s as important in this on demand industry.
31:34
People, you know, want to buy it instantly. They have no tolerance for
31:37
friction. And to your point, there is always lots of maybe not for the event,
31:42
but there’s plenty of car rental companies there on the airport. So, get
31:46
it done fast. Great examples. So, sea as it does uh it stops fraud,
31:55
but we all know there’s no silver bullet. Uh there’s no single solution to
31:59
completely stop fraud. So, Britany, you and the SIF team have a deep
32:03
understanding of what’s happening in the dark and the the the deep web. How do
32:07
fraudsters, how are they even capable of bypassing a 3DS?
32:13
Walk us through this type of um Yeah.
32:16
>> Teach you to become a fraudster. I get it. Teach you how to commit fraud. Okay.
32:20
>> Yeah.
32:22
>> So, this is definitely where I, you know, really settle into my element. I
32:26
run the team that does deep and dark web investigations here at SIFT. Uh we’ve
32:31
been working, I I guess, for almost the entire time that I have been here. And
32:36
these examples all come from our research. But the main goal is to show
32:40
you that fraudsters are fully aware of what authentication procedures are in
32:47
place at merchants and they’ve worked on how to bypass that. They can bypass SCA.
32:54
They can trick somebody into completing it. And here’s a look at some of the
32:57
tools and some of the ways they would do just that. So again, please use this
33:01
knowledge for good. Uh, but let’s dive in with the value of aged accounts. So,
33:07
I’ve got quite a few examples here. These are all from fraud groups on
33:11
Telegram, which is a secure messaging app. So fraudsters feel more comfortable
33:16
communicating there and they have migrated there to some degree from the
33:20
dark web because they’re able to then reach more customers, more newbie
33:25
fraudsters who maybe have found out about a potential um vulnerability on
33:32
Tik Tok, on Instagram, on Reddit, on any other social media platform and they’ve
33:38
shared their Telegram group link and brought in those customers. Well, what
33:42
are some of the things that they might be offering for aged accounts? We’ve got
33:46
anything from accounts that can be, you know, used to complete Airbnb bookings.
33:51
We’ve got Google Voice and Gmail accounts for sale. I think the oldest
33:56
one there is from 2006. So, quite an old potentially trustworthy account within
34:02
any kind of fraud prevention rule system. And then we have some financial
34:07
accounts that are all being sold as aged over there from Chase to PayPal. You
34:12
know, a lot of times when I give these presentations, I’ll obuscate various
34:16
brand names, but in this case, I didn’t do so here because simply it’s a risk to
34:21
everyone and every company out there. Now, fraudsters have many options to
34:27
monetize these accounts, and I think the value of having an aged account when
34:33
you’re, you know, going onto a site is just very clear by seeing the the big
34:38
array here. I think someone was speaking up. Was that
34:43
you, Carmen? Nope. Okay, I’m going to make sure to pause for any questions,
34:47
but this is just an example of the value of aged accounts. So, let’s say that we
34:51
have uh an awareness of what potential fraud signals are. We’re using an older
34:58
Gmail so that we don’t trip any notifications for new email address. Um,
35:02
we’re using an older login for a particular site. How are we going to
35:08
potentially bypass the SEA requirement if that SCA requirement is to enter a
35:16
one-time password that might be sent to you via SMS? So, just to to break that
35:20
down more, we’re in somebody’s e-commerce account. We want to make a
35:25
purchase. There’s a verification step and it’s going to send an SMS code to a
35:30
phone number that we don’t have access to as the fraudster, but the victim
35:35
does. Well, in that case, we’re going to use an OTP bot or a one-time password
35:41
bot. We’ve got a few different examples here of two different merchants on uh
35:46
Telegram that are selling this. I want to call out a few things that are
35:50
interesting to me. One is when you really get deep into the research of how
35:54
fraudsters work together, you’ll find that it’s not all happy and uh
35:58
trustworthy. So, as you see that example on the left, it starts with an
36:02
explanation that the last bot was sabotaged by an old team member. So,
36:06
here we’ve already got some conflict and strife. Yeah, I don’t feel bad for them
36:09
at all. But here we’ve got some conflict and strife within this particular group,
36:13
but still offering a bot that in the next screenshot you’ll see has a tiered
36:19
plan with varying costs for access. $10 for a day, uh, even down to $2.50 for an
36:26
hour because you may not need this bot for very long. If we move on to the
36:31
Apollo bot, it’s also got a lot of sort of marketing techniques in its listing
36:37
talking about its uptime, talking about all the different features. And then
36:42
lastly, it’s fully automated as you see in that screenshot on the right where
36:46
the fraudster doesn’t even have to be there to help deliver or help walk you
36:50
through the use of the tool. They’ve built a bot on Telegram that will do
36:53
just that for you. So, if I’m a fraudster and I have these accounts, uh,
36:58
let’s say I have a 100 accounts and I am then trying to use the stored payment
37:04
credentials trying to make purchases and I know I’m going to run into a situation
37:07
where I get prompted for that password because or that one-time password, the
37:12
OTP code because of SCA. If I run these bots, what happens is they will either
37:19
send a text message or make a voice call to the victim pretending to be either
37:25
that merchant or their bank. It’s configurable to how the outreach
37:29
happens. And we’ll then tell them, give us the code.
37:32
>> Don’t, you know, enter the code elsewhere. Give us the code because
37:36
we’re keeping your account secure. Now, I know the messaging from their bank
37:41
will say something like, “Don’t share this code with anyone else.” But if the
37:45
fraudster gets to them first potentially by doing that voice call instead of a
37:49
text, there is going to be some level of success and that’s what I’m waiting for
37:53
on the other end. This bot will then tell me which of those loginins was
37:58
successful and I can proceed with fraud at that point. So, you know, it’s sort
38:03
of like a a wide range of attack. you’re going to have some success points with
38:09
people who don’t understand what’s going on and think that sending the code to
38:14
that other point of contact is the right thing to do.
38:18
>> Scary. So, it’s it’s pretty I mean it’s it’s not too costly to do this. Um yeah,
38:23
basically just need to trick um ignorant users. I mean, in the end, it’s all a
38:29
matter of educating users, but that’s never the never the solution because
38:33
some people um yeah, it’s just hard to educate everyone.
38:37
>> And this is also where part of that conversation about AI comes in with
38:40
fraudsters using generative AI to create more realistic and believable scripts or
38:46
um yeah, using sort of that technology to also then have voice calls seem like
38:51
they’re real customer service agents. Like there’s ways of them making it more
38:54
and more convincing that will unfortunately trick people even who
38:58
might think that they are aware of these scams.
39:01
>> Yeah. No, it gets even every day more sophisticated.
39:05
>> Yeah.
39:07
>> So then let’s say that I instead of, you know, having those stolen accounts that
39:10
have the store payment methods, what if I’m in need of the credit card itself,
39:14
in need of a payment method? Well, there’s plenty of options and places
39:18
where I can make those purchases. And what I want to call out in these
39:22
screenshots is the wide sort of breadth of data that comes along with buying a
39:28
credit card number. If you aren’t actively involved in researching fraud,
39:32
you may think some of those stolen credit card numbers are still just only
39:35
the number and then maybe the CVB and you maybe a name or one of those two
39:39
pieces of data. But it’s really robust because a lot of fraudsters will obtain
39:44
these credit cards by creating fishing sites. So, a site that mimics a
39:48
merchants’s platform, looks like a legitimate e-commerce site, and somebody
39:53
goes there, enters their card to make a purchase, and then all of their data is
39:58
sent along to the fraudster. So, if you look at the two screenshots on the right
40:04
under just paste, that is an example of some of the data from one particular
40:09
fraudster that comes along with purchasing a credit card from him. And
40:12
as you see, you’ve got all of the IP address details. uh you’ve got location,
40:17
you’ve got device information down to user agent. So that’s enough for them if
40:22
this is a sophisticated fraudster, if that’s what I am, to then be able to
40:27
mimic the legitimate card holders activity when we’re making this purchase
40:32
or using this this card on a platform. So, there’s other services that have
40:37
also been offered that automate this entire process so that the signals that
40:42
you’re a majority of the time you’re sending to a merchant look exactly like
40:46
the legitimate card holder. But we’re also going to have behavioral signals
40:51
that the fraudsters can’t mimic. And that’s why, you know, we’re here talking
40:55
to you about using AI and machine learning to identify fraud and separate
41:01
it out from low-risk transactions because if you’re just relying on
41:04
certain static data points like IP and device, that’s something that fraudsters
41:08
readily have available. And here are some examples that show just that.
41:15
>> Great. Thank you.
41:16
>> I know I’m a downer. I’m a downer at all the parties, but uh we’ll we’ll end with
41:21
these examples here. So, you know, I was just saying that fraudsters are
41:25
extremely good at mimicking legitimate customers. Let’s look at a few more
41:29
examples. So, for the cookies that we have in the first and second
41:36
screenshots, those are again ones where they probably made a man-in-the-middle
41:42
attack or had a fishing site. in some way they were able to capture the
41:46
legitimate cookie data that a merchant would generate for a customer and then
41:51
replicate it to make themselves look more trustworthy. Now, as a fraud
41:56
vendor, the screenshot on the right is one that I find to be sort of the most
42:00
troubling. That is a screenshot from the dark web from a particular uh forum
42:06
where somebody was sharing the scoring rules from a particular fraud vendor
42:11
that they had scraped. I’m not quite sure exactly how they obtained it.
42:15
Obviously, I uh obiscated the name of that vendor and this information is
42:21
something that could then be quite useful to a fraudster if I wanted to
42:26
proceed with using that. What I might do is go to the vendor site, see, you know,
42:31
what customers they work with and then see, you know, what I can do. And so
42:35
it’s extremely important to be monitoring that information as a vendor
42:39
and to see if there’s, you know, any strategies or methods about your
42:44
platform that have gotten out to the fraudsters. And, you know, that’s some
42:47
searching that my team regularly does. And in this particular instance, I do
42:51
want to call out that the amount of information that was available here was
42:55
not sufficient to bypass that particular merchants’s, you know, full fraud
42:59
prevention suite. But it’s still indicative of exploring and trying and
43:04
the attempts from fraudsters to learn more about how exactly the e-commerce
43:10
structure works when it comes to a payment and fraud flow.
43:13
>> Yeah, it’s fascinating and thank you so much for for sharing these scary
43:17
insights Britany that you and your team are gathering from the dark web. So
43:22
let’s now look into the best practices in optimizing TRA accuracy and
43:27
exemptions um and and and basically the do the dos and the don’ts.
43:32
>> Perfect. Yeah. So with those takeaways in mind from DDW, yeah, let’s dive right
43:38
in. So up top the for the risks of sending
43:44
fraud through TRA we brought this slide uh into our discussion today because you
43:51
from the various merchants that I’ve talked to I’ve seen everything from a
43:55
merchant who wants to send like no traffic through 3DS if they can possibly
44:00
avoid it like let’s exempt every possible thing we can possibly exempt
44:05
and then others who fall into the camp of you know I I don’t really know how to
44:10
do that. I don’t know what to do in approach to it. Let’s just send
44:13
everything through sea. I’m not going to worry with exemptions. Well, this is
44:17
some of the risks of sending fraud through of trying to see if it gets
44:22
approved or not instead of just rejecting it outright early. First of
44:27
all is that merchant reputation that your company will have. Sending clean
44:32
traffic to acquirers can boost overall TRA exemption approvals. Um there’s a
44:36
metric that you can monitor called issuer exemption granted rate and you
44:41
know otherwise you could then put yourself into a situation where more of
44:46
your exemption requests are rejected because your reputation is not strong.
44:52
Two, we’ve got your inadequate fraud detection. So you know if you’re sending
44:56
everything through it looks like you’re not being able to stop fraud. You’re
45:00
sending to some degree more success signals to the fraudsters. You’re
45:04
letting them know if there is some potential fraud that does get approved,
45:09
then you’re letting them know they can work on your site with impunity. They
45:13
can try their methods and they’ll keep trying their method. So, you’re actually
45:16
then working potentially to increase the presence of fraud and the attention of
45:20
fraudsters on your platform. Three, we’ve got loss of TRA eligibility. So,
45:26
the fact that you could be even cut off from using that exemption process if
45:31
you’re sending too much fraud through. And lastly, that leads to financial
45:35
losses because if you’re you’re not allowed to make exemptions, you then
45:39
must put more friction in front of customers. You are can be left with that
45:43
fraud that we got in number two where we attracted more fraudsters to our
45:47
platform and that just leads to more financial loss. So I’ll I’ll pause there
45:53
um because you know Carmen, you’ve worked with this in real situations.
45:58
>> I would never Yeah. never recommend sending food traffic to TR exemptions
46:04
and also your aquarius will have a problem with you because they will
46:08
detect that you’re sending fraud and it also impacts their fraud rate for the
46:13
rest of the merchants
46:14
>> and you will have lower off rates for your good traffic because issuers will
46:20
not trust that you’re sending good traffic.
46:23
So it’s for me it’s a no no worth it.
46:31
I like to hear that. All right. So, what are you know some potential steps that
46:35
you can take then? So, here’s an example of one of the ways that we will do it at
46:39
SIFT where we have multiple models and therefore multiple approaches to using
46:47
machine learning and AI to combat fraud. So here we have an example of a customer
46:53
using a custom model that is trained on their specific data set. Then using
47:00
let’s say if they are a payment or fintech customer like if they’re a PSP
47:04
using a particular cohort model that is trained on the entire SIFT customer base
47:09
within that vertical and then lastly a global model that looks at all signals
47:14
overall in our entire user platform. So that takes their ability to identify
47:20
fraud from just what they see, widens it to what do their um you know industry
47:26
cohorts see and then even broader to well if somebody was committing fraud on
47:31
a fast food restaurant website or a car rental website when they come through
47:36
this PSP in another manner, how then can we use that information to identify
47:42
fraud? So this is just one way of enhancing TRA accuracy via all of those
47:47
various signals that can be done quite quickly and doesn’t rely as much on
47:52
automation. I’m sorry doesn’t rely as much on manual work and does rely on
47:56
automation which is what this example in this next slide here shows. So let’s
48:03
just say you still wanted to bring in business roles because understandably
48:07
you’re you know testing what you’re most comfortable with. you’re trying to see
48:12
uh exactly how you can optimize using these exemptions. So maybe you set up a
48:17
flow like this where you look for things that have a particularly high or risk
48:23
score. You’re looking at a particular payment amount level and then you’re
48:28
adding in other functions that fit fraud trends that you have seen or user
48:34
behaviors that you’re trying to encourage or discourage. But this would
48:38
be one way of stacking those various um points to still then have a little bit
48:44
of business rule control along with the score. Now, can you use a risk score
48:48
just completely by itself? Absolutely. But this is, you know, just one example
48:53
out of many. And I did have a call out on the side for pinpointing exemptions.
48:58
You know, if you do have VIP lists, if you do have uh any customers that fall
49:04
into those most trustworthy, highest lifetime value customers, you can add
49:08
and ingest that data as well to make different rules or paths to try to
49:14
increase the exemptions for those particular customers.
49:19
And then that just brings us to a big checklist with takeaways for what you
49:24
can do to improve your accuracy. So, most of these are hammering home the
49:31
data points that we’ve already uh talked about,
49:35
but I still think it’s useful to see them sort of all on one screen here. Um,
49:40
notice of knowing your acquirer, reporting on your data, understanding
49:45
the rules, making real- time uh risk assessments, and as we’ve been saying
49:49
over and over again, don’t send fraudulent traffic through for
49:53
exemptions. So now what could that look like as a
49:58
point of success? So here at SIFT um we have seen an up to 30% reduction in the
50:06
necessity to send transactions through 3DS by using TRA exemptions. Um we
50:14
called out you know a little bit earlier that according to Visa Europe TRA
50:18
exemptions could allow 40 to 50% of e-commerce transactions to bypass SCA.
50:23
So there is a lot of potential for improvement there and reducing that
50:27
friction increasing payment acceptance rates and reducing you know the overall
50:32
cost of 3DS. So it’s going to be a unique experience for everyone in
50:38
attendance because you’re going to use different acquirers have uh different
50:43
processors and different numbers of processors in your payment setup. You’ll
50:47
have particular use cases for your customers, geographies that you work out
50:51
of. But this is still something where we really encourage the adoption of TRA
50:58
exemptions whenever possible because that does drive these benefits for your
51:02
organization. And with that, I think we have one last
51:09
poll and then questions.
51:11
>> Yeah. Well, thank you so much, Brittany and Carbon. And I think sort of the key
51:16
takeaways here, do not send all your transactions to your acquirer. Um, do
51:22
them, make them um, basically clean them free off. Um, because there’s basically
51:29
a system in this ecosystem that you will get penalized when you don’t you less
51:34
trust from the issuer, less trust from the acquirer. You’re basically help
51:38
fraudsters to even um, yeah commit more fraud on your website. Um so thanks for
51:45
all these insights and before we go to the uh Q&A to the questions because we
51:50
have some questions from the audience. We have a last uh poll question for the
51:54
audience which is would you like a sift rep to follow up with you on how to
51:58
improve TRA accuracy accuracy and exemptions through AI scoring? He said
52:04
yes. U please reach out after the holiday
52:08
seasons or no I’m not interested. Um so thanks for taking this one and
52:16
um here I would like to start with a question for
52:20
um for Carmen because one of the top topics you addressed is that it’s really
52:26
keen to understand the fraud score of your acquirer also in choosing an
52:31
acquiring to work with or or having sort of a fallback scenario. Um so how do you
52:37
how do you measure that? How do you get insights into the the fraud score of
52:42
your acquirer?
52:44
>> So we talk directly to them regularly. I mean we have really
52:50
partnership with you know our BSPs acquirers and for me this is part of the
52:58
virtual virtual circle right that you build this trust and it’s an open
53:04
conversation what is your fraud rate and also you will see that in your data how
53:09
many exemptions you request through this acquirer and how many get gr get granted
53:14
right
53:16
>> yeah I guess this Um and you mentioned also that basically you are the
53:20
acquirers you work with also help you you know starting these discussions with
53:24
with issuing banks where you see that um yeah basically there’s there’s low
53:30
conversion um
53:33
the the data about your acquirer is that how is that accessible for is that can
53:38
you get that type of data from can you find it on the web if you just want to
53:42
know okay I’m looking for another
53:45
>> I’ve never found it on their website but we I mean for the bigger aquirers that
53:50
we work with we are in kind of you know weekly bi-weekly contact so for us um
54:00
it’s something that it’s it’s part of our partnership you know that they they
54:04
will notify us I mean in 2021 they were coming to us like proactively saying our
54:10
fraud rate is this one you know you know move more traffic to us right
54:15
and now it’s part of our you know conversation I mean yeah
54:19
>> what is their fault rate
54:22
>> um I see another question is what is the penalty for sending transactions with
54:27
TRA exemptions when above the 0.13 threshold
54:35
>> there no there’s no penalty is that you will get the SCA step up
54:42
>> so it’s like you don’t sign the exemption
54:46
Um we talked about
54:49
>> sub decline soft decline and then the 3D is a step up.
54:55
>> Um yes there is another questions. Um it’s about the the PSD3. Uh we talked
55:04
about it briefly during the the presentation.
55:08
What is what do you expect Britany Carmen? I don’t know who could talk to
55:13
this about the um the impact of the PSD3 on the requirements for for TRA
55:21
exemptions. Will it be easier? Will it be harder? Are they actually looking
55:27
into this whole, you know, exemptions uh topic? Um who could take that question?
55:35
I can speak a little bit to it just from the the angle of fraud prevention and
55:39
sort of what I’m most excited about or what I’m looking into and that does
55:44
drill down to the refinement of SCA that’s being proposed under PSD3 and PSR
55:51
and one of the the points of refinement that uh I would like to hear more about
55:56
when we see that that final proposal would be for identifying vulnerable
56:01
groups. So we we talked earlier in this presentation about you know having a
56:06
user base that maybe doesn’t have a banking app downloaded on their phone
56:10
you doesn’t have as much awareness of fraud and certain risks and you know can
56:14
only work in a lower tech interface when it comes to some authentication methods
56:21
and I know that there is going to be a uh improvement in the definition which
56:26
is currently weak for vulnerable groups and I would like to see sort of more
56:31
protection and attention there because you know I don’t think we can go a day
56:35
without hearing about social engineering scams or you know a fraud within the UK
56:40
especially and knowing that they are highly targeted by the fraudsters you
56:45
that I spend my time researching and that I presented on today. So I I’m
56:49
really looking for I know there’s not going to be major changes to sea but
56:53
those improvements to refinement especially when they come to consumer
56:56
protection. So that that’s my two cents.
57:00
>> Great. Thank you Britney. And in the end that’s the whole purpose of this
57:03
regulation and to protect consumers and particularly the more vulnerable
57:07
consumers from fraud. There is a last I think great question uh because net slay
57:13
obviously is a is a big merchant but how is that for smaller merchants? How do
57:18
you send a transaction to TRA? Um um if you don’t have that or how do you
57:24
basically work with your acquirer if you don’t have that close of a relationship
57:28
with your acquirer because you’re simply sort of a smaller merchant?
57:33
Any any thoughts on that? I think one important call out would be
57:38
you still should have a relationship with your with your PSP with your
57:43
payment processor. I know there was one point in time when I was at LetGo and I
57:47
was working with much, you know, fewer resources uh than what Carmen has at
57:53
Nestle and we were able with our PSP to still make some routing designations on
58:00
what we wanted to send through 3DS and what we didn’t. So, you can have that
58:04
conversation with them. Now, I don’t know if they would in all cases be able
58:09
to, you know, also facilitate conversations with your acquirer.
58:12
something that you need to do, you know, directly,
58:15
>> but there are still those opportunities just looking at what your entire payment
58:21
stack is and it may not be a immediate discussion with the acquirer. You might
58:26
instead start with your PSP. Um, but you know, it is, you’re right, you’re
58:30
probably not going to have, what did you say, Carmen? Were they recurring like
58:34
every two weeks your meetings?
58:36
>> Yeah.
58:36
>> Okay. That’s that’s quite frequent. I don’t think I ever spoke
58:40
>> to our acquirer in the two years that I was at at LetGo. Um, but we did most of
58:45
our communication through our our PSP instead.
58:48
>> Okay,
58:49
>> great. Well, for now we are at the end of the webinar. So, Britany and Carmen,
58:53
thank you so much for sharing all these insights on TRA exemptions. I think
58:57
there was a need to explain it and to to unpack what it means and what the best
59:03
practices are. Um so thank you also for the audience to tuning in with us. What
59:08
we will do is we will send you a link to the webcast of this webinar shortly and
59:12
we will follow up on questions that we did not have time to include in this
59:16
webinar. So for now wish you all a very good rest of the day. Thank you.
59:21
>> Thank you.