The Unreasonable Effectiveness of Logistic Regression for Busting Payments Fraud

The slippery slope of ever more sophisticated models, and how easy it is for script kiddies to keep on outsmarting entire companies

Last week’s article on the Unit of Work pattern as a tool to change the database “mid-flight” hit a nerve. I might record a video on how it works—actual code, rather than the usual article.

If you’re interested, give a like to the note below.

Now onto today’s article.

---

Something has gone terribly wrong in the payments fraud industry.

For every dollar paid online, it is estimated that around 6.5 cents go to fraudsters. This means that fraud has grown as much as the e-commerce business it relies upon.

Source: Nilson, via merchantsavvy

This is happening despite of massive investment in fraud detection engines, more sophisticated machine learning algorithms (dare I call them “intelligent”), and dedicated attention from top executives from the biggest merchants.

Right now, somewhere in Southern Asia, someone who isn’t old enough to drink alcohol legally is sitting in front of a hundred phones, tweaking a Python script, buying gift cards from Amazon with stolen cards, and winning.

Like social media’s “bot farms”, a cottage industry built by teenagers systematically bypass the multi-million dollar industrial complex engineered precisely to block them.

This should give us all pause.

I don’t think the payments industry is sweeping this problem under the rug. Rather, we’re paying too much attention to it. We’ve decided that the solution is to make our detection models more complex and sophisticated. We’ve decided that in order to win, we need to keep doing what we’re doing. But more.

What Einstein could’ve called (but never did) insanity.

Fraud isn’t a complex system; it’s a game of prediction. Fraud and its prevention coevolve in a cat-and-mouse situation. Complexity is an obstacle. That’s why building incomprehensibly powerful systems is failing the industry.

It is an insane strategy, and we need to stop it.

I’m Alvaro Duran, and this is The Payments Engineer Playbook. The fight against payments fraud is a crazy game to be in. We’ve talked before how banks often decline payments because of gremlins, and how merchants are allowed to avoid these declines with exemptions.

In fact, since the beginning of online commerce, merchants have been forced to accept the responsibility for detecting and preventing fraud. And they’ve become good at it.

But now millions of companies sell goods and services online, and billions of people buy from them. With so much data, we should have put an end to online fraud.

Why didn’t we?