Payment Fraud Prevention

Over the holidays, we took down a seriously sophisticated fraud ring. And the scope of what they were doing was staggering. This single ring had active accounts across: • Business banking fintechs — funneling illicit proceeds • Crypto exchanges — laundering funds • Gift card retailers — converting cash into value • High-value marketplaces — sneakers, luxury goods, even cars — Here’s how it unraveled 👇 One of our large fintech customers was hit by a massive credential-stuffing attack. At peak, 2 million distinct IPs were hammering their login flow. We believe the credentials were harvested via malware with keylogging capabilities (think FIN7 / Carbanak-style tooling). Once inside victim accounts, attackers attempted to drain balances into accounts they had created at other fintechs. Thankfully, delayed withdrawals limited the losses. But then came the real insight. — We asked a simple question: What if the destination accounts also live inside the Sardine network? They did. The stolen funds were being routed into 30+ fintech accounts across our customer consortium. And that was just the tip of the iceberg.. Using our graph engine — spanning 4B+ devices, 500M+ consumers, and 1.5M+ businesses — we uncovered the full operation: Accounts at 50+ Sardine customers Coordinated money laundering via crypto and gift cards Attempts to purchase or rent high-value goods to “whitewash” proceeds This wasn’t a one-off attack. It was a highly organized, multi-platform fraud operation. — We have created a special Blocklist for such fraud rings as uncovered by our Fraud team. The email addresses, phone numbers and other identifiers of this ring are now on this blocklist. Which means that whenever any of our customers call us at account opening or at the time of a payment, if this fraud ring is involved, we’ll return a high risk score back to you. — Fraudsters don’t operate in silos. Neither should fraud prevention! This is the power of consortium-level intelligence.

Let's build a Real Time ML System to fraud. Step by step 🧵↓ 𝗧𝗵𝗲 𝗯𝘂𝘀𝗶𝗻𝗲𝘀𝘀 𝗽𝗿𝗼𝗯𝗹𝗲𝗺 💼 Every time your credit card is used online by someone (hopefully you), your card issuer (for example Visa, Mastercard or PayPal) has to verify if it is you the person trying to pay with the card. Otherwise, the transaction is blocked. Now the question is: ““𝗛𝗼𝘄 𝗱𝗼𝗲𝘀 𝗩𝗶𝘀𝗮 𝗱𝗼 𝘁𝗵𝗮𝘁?”” And the answer is… a real time ML system! 𝗦𝘆𝘀𝘁𝗲𝗺 𝗱𝗲𝘀𝗶𝗴𝗻 📐 As any ML system that has existed, exists and will exist, this one can be broken down into 3 types pipelines 1️⃣ Feature pipelines 2️⃣ Training pipeline 3️⃣ Inference pipeline Let's go one by one 1️⃣ 𝗙𝗲𝗮𝘁𝘂𝗿𝗲 𝗣𝗶𝗽𝗲𝗹𝗶𝗻𝗲𝘀 💾  The feature pipelines are the Python services that produce the inputs (aka features) our ML model needs to generate its predictions. In our case, we have (and I bet Visa has) at least 3 feature pipelines: ▣ 𝗥𝗲𝗮𝗹-𝘁𝗶𝗺𝗲 feature pipeline from recent transactional data. - runs 24/7 - consumes incoming data from an internal message bus (like Kafka, Redpanda) - transforms this data on-the-fly using a real-time data processing engine - saves the the final features in a feature store, like Hopsworks. ▣ 𝗕𝗮𝘁𝗰𝗵 pipeline from historical features in the data warehouse. - runs daily - reads data from the data warehouse/lake, and - saves it into another feature group in our feature store, so it can be consumed by our ML model really fast. ▣ 𝗟𝗮𝗯𝗲𝗹𝘀 𝗽𝗶𝗽𝗲𝗹𝗶𝗻𝗲, so the ML model can be trained with supervised ML. Each completed transaction that is not claimed by the card owner within 6 months can be safely called non-fraudulent (class=0). We call it fraudulent (class=1) otherwise. Once we have these 3 feature pipelines up and running, we will start collecting valuable data, that we can use to train ML models. 2️⃣ 𝗧𝗿𝗮𝗶𝗻𝗶𝗻𝗴 𝗽𝗶𝗽𝗲𝗹𝗶𝗻𝗲 🏋🏽 We can use a supervised ML model (a boosting tree model like XGBoost does the job in most cases) to uncover any patterns between > the features available in your Feature Store, and > the transaction class: 0 = non-fraudulent, 1 = fraudulent. The final model is pushed to the model registry (like MLflow, Comet or Weights & Biases), so it can be loaded and used by our deployed model. And this is precisely what the last pipeline in our design does. 3️⃣ 𝗜𝗻𝗳𝗲𝗿𝗲𝗻𝗰𝗲 𝗽𝗶𝗽𝗲𝗹𝗶𝗻𝗲 🔮 The inference pipeline is a Python streaming application, that at start up loads the model from the registry into memory and for every incoming transaction > loads the freshest features from the store for that card_id, > feeds them to the model, and > outputs the predictions to another Kafka topic. These fraud scores can be then consumed by downstream services, to > Block the card, and > Send an SMS alert to the card owner, for example. BOOM! No dark magic. Just Real World ML. Follow Pau Labarta Bajo for more Real World ML

One insurer denies 3% of claims. Another denies 36%. Both sell plans on the same ACA marketplace. Do you know where your plan falls? --- KFF analyzed federal transparency data on claims denials and appeals for non-group qualified health plans sold on the ACA marketplace in 2024. From 496 million total claims, 91% were in-network with a 19% denial rate. Out-of-network claims had a 37% denial rate, resulting in a combined average of 20% for all claims. These were all post-service denials, meaning the medical service/prescription was already delivered so things like prior authorization denials weren't included in the data. --- The denial rate varies wildly by insurer: ↳ Range spans from 3% to 36% ↳ Best performers: 17 insurers (out of 157) kept denials under 10% ↳ Worst performers: 26 insurers denied 25% or more claims Why claims get denied: ↳ "Other" reasons: 36% of all denials (no specific explanation given) ↳ Administrative issues: 25% ↳ Lack of prior authorization: 9% ↳ Member not covered: 7% ↳ Benefit limit reached: 5% ↳ Not medically necessary: 5% The worst offenders by specific metrics: ↳ Oscar Health: 25% overall denial rate ↳ Hawaii state average: 27% denial rate ↳ Texas insurer: 36% denial rate (highest in country) ↳ Molina Healthcare of Mississippi: 38% of denials cited medical necessity ↳ Blue Cross Blue Shield of Arizona: 97% of their denials for lack of prior authorization/referral --- Fewer than 1% of patients appeal denied claims. When they do appeal, insurers uphold 66% of their original denials (remember this is post-service data only, not including prior authorization which has a lower uphold rate). How will you use this denial information? 🔗 KFF analysis https://lnkd.in/ee7nYg6c ♻️ Repost to share ACA claim denial patterns 🔔 Follow me for more healthcare analysis (Bryce Platt, PharmD)

Fake RFPs are the dirtiest secret in enterprise SaaS. You think you’re competing. In reality, the decision was made weeks ago. Every rep/leader knows the story: Custom demo environment, 18-page technical doc, 127 security questions answered, 4 pricing scenarios, References lined up. Hundreds of hours invested. And then: “We’ve decided to move forward with another vendor.” Not because the company isn’t buying. Because the RFP was theater. Why do reps still chase them? It’s not ignorance. It’s hope. The big logo. The big number. The career-making deal. It’s intoxicating. And that’s what makes fake RFPs so dangerous. What the Research Shows: This isn’t paranoia, it’s documented. - The IACRC lists rigged specifications and sham bidding as some of the most common procurement fraud schemes worldwide. - The OECD warns that restrictive tender specs can effectively pre-select winners and block fair competition. - A GAO review found that many “competitions” attract only a single offer, often because requirements were written to favor incumbents. Enterprise SaaS isn’t audited the same way. But the mechanics are identical. And that’s exactly why leaders and reps need to be more deliberate. Before you chase an RFP, ask these 5 questions: 1. Access: Can we meet the economic buyer? If no → column fodder. 2. Authorship: Do requirements read like a competitor’s data sheet? If yes → walk away. 3. Urgency: What breaks if this slips a quarter? No consequence = no deal. 4. Discovery: Will we get to validate pain and outcomes? If no → policy, no pain. 5. Opportunity Cost: What live deals will suffer if we chase this? Red Flags That Scream “Theater”: Suspiciously specific requirements only one vendor can satisfy. Procurement-only access, no business decision-makers. “Top priority”, but with a 10-week decision gap and no milestones. Vague or undefined success metrics (“ROI framework”). Fake RFPs waste hours and drain morale. They bloat your pipeline with ghosts. And they make you walk into a board meeting forecasting numbers that were never real. That’s why I always coach my reps on this: I don’t ask about the response. I ask: Who’s the buyer? What happens if this slips? Why do you believe we can win? If they can’t answer, we pull out. Because the truth is: If reps get burned enough times, they stop believing in every RFP, even the real ones. And that’s a culture killer. The job of leadership isn’t to celebrate activity. It’s to protect your team’s time, focus, and belief, so they fight where they can actually win. Sales leaders: what’s in your RFP go/no-go filter?

Payment systems are increasingly vulnerable to cyber-physical (IoT) threats, with contactless payment methods posing specific risks. Customers can easily make purchases without a PIN or signature, but this convenience comes with potential dangers: - Unauthorized transactions - Theft and data cloning - Vulnerabilities in mobile payment systems - Growing complexity of security measures - Limited liability protection An informative video sheds light on a critical security lapse in contactless payment systems, a popular global transaction choice. While these systems offer speed and convenience, they also introduce new attack possibilities. Here's a glimpse into a typical criminal scheme targeting contactless payments: 🎯 Criminals target a victim, focusing on passive data extraction with attention to physical surroundings and victim availability. 🎥 One criminal monitors for risks like law enforcement using surveillance equipment. 🧠 Another criminal selects a target remotely and communicates with the execution team. 💣 Data theft is executed discreetly during a distraction, utilizing skimming techniques. 🖼️ Stolen data is retrieved, and the criminal departs unnoticed. 📧 The distractor completes their role and leaves inconspicuously. This scenario highlights the importance of understanding and addressing the evolving risks associated with contactless payment systems. Stay informed to protect against potential threats. #CyberSecurity #DataProtection #RiskManagement

TL;DR: We built a transformer-based payments foundation model. It works. For years, Stripe has been using machine learning models trained on discrete features (BIN, zip, payment method, etc.) to improve our products for users. And these feature-by-feature efforts have worked well: +15% conversion, -30% fraud. But these models have limitations. We have to select (and therefore constrain) the features considered by the model. And each model requires task-specific training: for authorization, for fraud, for disputes, and so on. Given the learning power of generalized transformer architectures, we wondered whether an LLM-style approach could work here. It wasn’t obvious that it would—payments is like language in some ways (structural patterns similar to syntax and semantics, temporally sequential) and extremely unlike language in others (fewer distinct ‘tokens’, contextual sparsity, fewer organizing principles akin to grammatical rules). So we built a payments foundation model—a self-supervised network that learns dense, general-purpose vectors for every transaction, much like a language model embeds words. Trained on tens of billions of transactions, it distills each charge’s key signals into a single, versatile embedding. You can think of the result as a vast distribution of payments in a high-dimensional vector space. The location of each embedding captures rich data, including how different elements relate to each other. Payments that share similarities naturally cluster together: transactions from the same card issuer are positioned closer together, those from the same bank even closer, and those sharing the same email address are nearly identical. These rich embeddings make it significantly easier to spot nuanced, adversarial patterns of transactions; and to build more accurate classifiers based on both the features of an individual payment and its relationship to other payments in the sequence. Take card-testing. Over the past couple of years traditional ML approaches (engineering new features, labeling emerging attack patterns, rapidly retraining our models) have reduced card testing for users on Stripe by 80%. But the most sophisticated card testers hide novel attack patterns in the volumes of the largest companies, so they’re hard to spot with these methods. We built a classifier that ingests sequences of embeddings from the foundation model, and predicts if the traffic slice is under an attack. And it does this all in real time so we can block attacks before they hit businesses. This approach improved our detection rate for card-testing attacks on large users from 59% to 97% overnight. Perhaps even more fundamentally, it suggests that payments have semantic meaning. Just like words in a sentence, transactions possess complex sequential dependencies and latent feature interactions that simply can’t be captured by manual feature engineering. Turns out attention was all payments needed!

If cybercrime were its own country, it would be a $8 trillion economy, larger than almost all countries on earth. That is why job #1 for me and everyone at Visa is cyber & payment security. 24x7x365 days a year we are focused on protecting cardholders, merchants and our infrastructure. We are at the very front lines in protecting payment flows and use the most sophisticated technologies, many of which we have invented ourselves – from finger printing typing/mouse movements to deep inspection of every transaction in near real time. We have thousands of the best engineers in the world working on this across every major time zone, and our multiple operations command centers monitor every aspect of the payment flow and our global infrastructure. On a normal day we collect and analyze billions of data points and use the most sophisticated AI techniques to assist us in ensuring the security of the ecosystem we are so privileged to serve. On Cyber Monday this year, we blocked 85% more suspected fraud globally compared to last year. Our newest tools like Visa Account Attack Intelligence Score, which launched earlier this year, leverages gen AI to stop enumeration attacks even before they commence. Last year we proactively blocked $40B of suspected fraudulent transactions, and our focus on continued investment is relentless and reflected in the $11B we have spent on this over the last 5 years. With that said, the hackers are not resting. They are using cutting edge tools, AI and other social engineering techniques to try and scam you directly. The best way to stay protected is to be aware of these methods, remain vigilant and ensure you are practicing good cybersecurity habits: - Always activate every alert on all your accounts – bank, cards, emails, social media, etc. - Always have strong passwords, change them regularly and don’t use the same credentials on different sites. Ideally use a good password manager. - Activate multi-factor authentication (MFA), and better still, use authenticators from reputable companies like Microsoft, Google, or Symantec. Passkeys are another form of MFA and are supported by many organizations including Visa. Passkeys eliminate passwords and are phishing-resistant. - Lock down money transfers in your bank/brokerage accounts when you are not planning to transact. - Establish SIM PINs with your telecom providers. - Do not click on hyperlinks in emails and text messages from anyone unknown - Use a good antivirus/anti malware on your devices - Keep your applications and operating system always up to date and patched - Always confirm legitimacy of the site you are on and it is a secure ‘s’ connection (ensure the url begins with https://) As we approach peak shopping season, I encourage everyone to be aware of the latest threats and read the recent report published by Visa (link in the comments). Please stay safe and enjoy the holidays. Rest assured we will be working behind the scenes to do our part to protect you 24x7.

💳 𝐂𝐡𝐚𝐫𝐠𝐞𝐛𝐚𝐜𝐤𝐬 hurt more than profits, they can block your ability to get paid. Here’s 𝗵𝗼𝘄 𝗖𝗵𝗮𝗿𝗴𝗲𝗯𝗮𝗰𝗸𝘀 𝘄𝗼𝗿𝗸, and what you can do to stay ahead: 𝐊𝐞𝐲 𝐓𝐞𝐫𝐦𝐬 𝐓𝐨 𝐊𝐧𝐨𝐰 ► 𝐃𝐢𝐬𝐩𝐮𝐭𝐞: When a cardholder questions a charge—may trigger a chargeback. ► 𝐂𝐡𝐚𝐫𝐠𝐞𝐛𝐚𝐜𝐤: Issuer reverses funds, often due to fraud or complaints. 👉 Visa says “dispute”; others use “chargeback.” ► 𝐏𝐫𝐞-𝐃𝐢𝐬𝐩𝐮𝐭𝐞 𝐀𝐥𝐞𝐫𝐭: Warns the merchant before chargeback, enabling early action. ► 𝐑𝐞-𝐩𝐫𝐞𝐬𝐞𝐧𝐭𝐦𝐞𝐧𝐭: Merchant submits evidence to contest a chargeback. 🔄 𝐂𝐡𝐚𝐫𝐠𝐞𝐛𝐚𝐜𝐤 𝐏𝐫𝐨𝐜𝐞𝐬𝐬 𝐎𝐯𝐞𝐫𝐯𝐢𝐞𝐰: 1️⃣ 𝐂𝐡𝐚𝐫𝐠𝐞𝐛𝐚𝐜𝐤 𝐈𝐧𝐢𝐭𝐢𝐚𝐭𝐢𝐨𝐧 A cardholder disputes a charge within 120 days. The main reasons include: ► Fraud ► Consumer disputes ► Processing errors ► Authorization issues 2️⃣ 𝐏𝐫𝐞-𝐃𝐢𝐬𝐩𝐮𝐭𝐞 𝐑𝐞𝐯𝐢𝐞𝐰 Before a formal chargeback, the issuer/cardholder may: ► Run fraud checks ► Review the transaction ► Check receipts or contact info Goal: resolve early and avoid chargebacks. 3️⃣ 𝐏𝐫𝐞-𝐃𝐢𝐬𝐩𝐮𝐭𝐞 𝐀𝐥𝐞𝐫𝐭𝐬 If unresolved, alerts help merchants avoid escalation. To prevent formal chargebacks, merchants may: ► Use auto-rules ► Issue a quick refund 4️⃣ 𝐃𝐢𝐬𝐩𝐮𝐭𝐞 𝐒𝐮𝐛𝐦𝐢𝐬𝐬𝐢𝐨𝐧 If not resolved, the chargeback is filed. Merchants (e.g., Amazon) get it via their acquirer, and the cardholder gets a provisional refund. 5️⃣ 𝐑𝐞-𝐩𝐫𝐞𝐬𝐞𝐧𝐭𝐦𝐞𝐧𝐭 Merchants can: ► Accept or challenge the chargeback. ⚙️ Platforms like Solidgate automate: ► Response strategy via rules/AI ► Evidence collection (e.g., delivery proof, receipts, emails, device ID) ► Submission and process management The acquirer (e.g., Adyen) sends the response to the issuer. 6️⃣ 𝐈𝐬𝐬𝐮𝐞𝐫’𝐬 𝐑𝐞𝐯𝐢𝐞𝐰 The issuer (e.g., Barclays) reviews evidence: ► If valid, merchant keeps the money ► If not, chargeback is upheld 👉 Merchants always pay a fee. 7️⃣ 𝐏𝐫𝐞-𝐀𝐫𝐛𝐢𝐭𝐫𝐚𝐭𝐢𝐨𝐧 & 𝐀𝐫𝐛𝐢𝐭𝐫𝐚𝐭𝐢𝐨𝐧 𝐏𝐫𝐞-𝐀𝐫𝐛𝐢𝐭𝐫𝐚𝐭𝐢𝐨𝐧: If either side disputes the outcome, this step allows for further negotiation. 𝐀𝐫𝐛𝐢𝐭𝐫𝐚𝐭𝐢𝐨𝐧: If still unresolved, the dispute escalates to Visa/Mastercard, who make the final ruling. 🚨 𝐖𝐡𝐲 𝐇𝐢𝐠𝐡 𝐂𝐡𝐚𝐫𝐠𝐞𝐛𝐚𝐜𝐤 𝐑𝐚𝐭𝐢𝐨𝐬 𝐇𝐮𝐫𝐭 𝐌𝐞𝐫𝐜𝐡𝐚𝐧𝐭𝐬: High chargeback rates can lead to lower conversion, financial penalties, higher processing fees, and enrollment in card network monitoring programs, potentially resulting in the loss of payment processing altogether. Source: Solidgate - https://bit.ly/3I7DzYi More of this, and the latest Payments news in my newsletter: https://lnkd.in/dXtzP3AV Find this helpful? [ 𝗿𝗲𝗽𝗼𝘀𝘁 ] Anything to add about this subject? [𝗶𝗻𝘃𝗶𝘁𝗲𝗱 𝘁𝗼 𝗰𝗼𝗺𝗺𝗲𝗻𝘁] Nice story, Marcel. Next! [ 𝗹𝗶𝗸𝗲 ]

As a CFO, I can spot financial trouble before it hits the P&L. By the time the numbers turn red, it’s already too late. The real warning signs? They show up earlier Quiet, subtle, and often ignored. Here are 3 red flags I look for before the damage shows up in the accounts: 🚩 Cash flow timing gets tighter Revenue’s steady. Costs haven’t changed. But suddenly, we’re chasing payments and stretching payables. That’s not a blip—it’s the early stages of a crunch. 🚩 Sales growth without margin growth Top-line is up? Great. But if margin % is flat or declining, we’re running harder just to stay in place. That’s not growth. That’s dilution. 🚩 Increased reliance on ‘one-off’ explanations “We had a delay.” “There was a timing issue.” “That’s a one-off.” The more frequently I hear these, the more I dig. Financial trouble doesn’t start in the P&L. It starts in the story behind the numbers. 💬 What early red flags do you watch for? #CFOInsights #FinancialLeadership #RedFlags #EarlyWarning #CashFlow #Margins #OperationalFinance #ExecutiveStrategy

I’ve had 4 legal battles since starting my business. Could I have avoided them? Probably. But to be honest, I didn't have the funds to pay a proper lawyer, or the network of founders to ask the right questions to. I don't want that to happen to you. Here are 5 clauses I put in my contracts that might help you protect your work, your business and most importantly.. your sanity ↓ #1 Non-cancellable, non-refundable contracts. This shouldn’t even be an issue if you qualify your clients properly. BUT if someone signs, onboards, and then ghosts? We still get paid. And so should you 🤗 #2 Immediate or short payment terms Most businesses accept 30-to 90-day payment terms. I don’t. You wouldn’t work for 3 months without pay—so why should your business? Cash flow is your business’s lifeline. Protect it. #3 While we’re on payment terms… Your contract should include: → Interest on late invoices. → A clause that stops work if invoices aren’t cleared. → A guarantee that if a client delays the project, you still get paid. Your time isn’t free! #4 Your IP stays YOURS. Anything we bring into the agreement at Klowt stays ours. Anything we create for you is yours. Simple. I once ran a training session, and the client recorded it—then tried to sell it behind a paywall. Now, our contract states a £10,000 fine per breach. (And for that particular case, per breach = per view. 😅) #5 Don't work with d*ckheads. This isn't a legal clause, more legal... advice? 🤣 If someone is giving you red flags in any way at the beginning of your relationship, do not work with them. This could include but not limited to: - Focusing on immediate ROI. - Cost or discounts being a primary concern. - Pushing for work to kick off before contracts or payments. - Reaching out at inappropriate times - or in inappropriate ways. - Delaying initial payments. Legally binding contracts are a good insurance policy, but they're lengthy and expensive to implement if you actually have to go to court. So the best LEGAL advice I can give you as a 2x founder is, don't work with d*ckheads. And learn from my mistakes. It's a lot cheaper than learning from your own... trust me 😂. Was this helpful? 💜 I write a 2x weekly newsletter for founders and freelancers on topics like this. Join us here: https://lnkd.in/ejDbD94R