Security is core to the product: How Novo protects small businesses money
"Protecting our SMB customer accounts and their money is sacred to us.”
Sardine crunched the numbers on account protection
Sardine works with financial institutions facing growing fraud and AI-enabled threats, and regularly tracks customer performance. When analyzing its customer base, Sardine found that small business financial platform Novo averages fewer than one account takeover per month, with less than 0.0004% of accounts, or about four in every million, accessed without the account holder’s permission.
Account takeover (ATO) rates vary significantly by industry and platform, with a median account takeover exposure rate of 1.4% across large digital platforms (5 million to 300 million users), while high-risk sectors like ecommerce and digital media experience attack rates 2.9x to 3.4x higher than the cross-industry average.
With an ATO rate of less than 0.0004% of accounts, this ranks Novo in the top 1% in the industry. We sat down with Novo’s CEO, Jackson Barnes, to understand how they think about this problem.
Why this matters
For small business owners operating on razor-thin margins, they often only have a median runway of 28 working days. Financial protection is not only critical to the growth and success of their business, it’s often tied to their personal livelihood.
Novo treats account protection as a key part of the product, a position that runs against much of the fintech industry. "For our customers by and large, it's the owner's money. Either it's their profits or it's their seed capital," said Barnes.
How fintech learned to tolerate fraud
Much of the fintech industry inherited its instincts from software and e-commerce, and Jackson traces a good part of the industry's fraud problem to that inheritance.
Teams with these backgrounds focus on faster checkouts and easier onboarding, which means checking fewer signals. In many cases, they treat a transaction as carrying no risk at all. That habit works for lower-stakes apps, where a break-in is embarrassing. In banking, that level of risk is not acceptable
The incentives reinforced it. Fintechs scale with revenue, and losses are a cost that gets reimbursed later. But that reimbursement does not undo the experience: the customer still sees a missing balance, still panics, and does not get the money back immediately. Unfortunately, many fintechs scale at the expense of their customers by passing risk along to them.
Why Novo made security core to strategy
For Novo, the goal is to avoid damage to three parties: its customers, itself, and its counterparties. Avoiding losses for counterparties is not a widely held success criterion in the industry, where many fintechs are content as long as they are not the ones holding the bag.
There’s also a competitive reason. Signs point to the software side of banking becoming commoditized, and security will only matter more as AI makes account takeover, identity theft, and impersonation cheaper to carry out. Small business owners don’t always weigh security heavily when choosing a bank today. This may shift as more people receive scam calls and see family members impersonated, or experience a security lapse firsthand.
How Novo protects accounts
Shared intelligence beyond Novo's own customers
Novo closes the data gap with Sardine's consortium data, behavioral biometrics, and a synergistic machine learning + decision engine strategy. When another institution has already flagged a device or an individual, Novo's team sees that history too, so they understand what individuals they shouldn’t do business with.
One of the biggest advantages that Sardine provides is its consortium data, because rules can only catch what a team has already seen. With that data, a team can now "stop a threat before you even know it's a threat." Participating in a data consortium means cooperation with other institutions for the greater good.
One initial check across every system
Novo runs several systems, and all of them route through Sardine first. Inside Sardine, Novo has configured which signals move an action into each threat level and how the system responds at each one. Some actions proceed based on the initial severity level alone, while others are stopped outright.
Rules the fraud team controls
Before working with Sardine, many fraud rules at Novo were originally coded into the services themselves, so any adjustment required engineering time. This is a challenge when the people who understand fraud best, the investigators on the risk team, do not read or write code. When engineering capacity is scarce, a request to protect existing customers competes with initiatives to win new ones, and the revenue request usually has the louder advocate.
Sardine's rules interface moved that work to the team that owns it. Engineers can still use the command line, but a consistent, readable interface means they no longer have to be involved in every rule change.
Step-ups and deliberate friction
Novo's controls learn each customer's normal behavior. An owner who regularly travels for business will establish that pattern over time, and the system treats it as ordinary. An owner who has never done so and suddenly tries to wire $20,000 from overseas triggers follow-up checks.
Those checks cost the customer time, typically 15 to 20 seconds and sometimes up to two minutes. Novo accepts that cost whenever it has doubt about who is at login. Customers may be annoyed by a few minutes of friction, but they’ll find a new bank if all their money is drained out of their account.
Advice for leaders weighing growth against controls
Jackson's advice to fintech CEOs under pressure to loosen controls starts with the bill that eventually arrives.
"When it comes to risk management writ large, there's no such thing as a free lunch. It may seem like that's the case, but somebody always pays. If you are sloppy, or if risk management and fraud is an afterthought for your organization, eventually those chickens are going to come home to roost and it's going to become a real problem."
He lists three places the cost lands: trust with customers, trust bank partners, and the relationship with regulators. He considers the last the most dangerous. Anti-money laundering and Bank Secrecy Act obligations, he says, are "actually tools of national security," because regulators rely on them to keep laundered money and sanctioned individuals out of the U.S. financial system. For any company that fails them, "you will be held to account. Maybe not right away, but eventually."
What's next: A security center customers configure
Novo is building a security center that lets each customer choose a level of protection above a required minimum. Security always involves friction, and people tolerate different amounts of it. Some owners want faster access with fewer checks. Others, such as elderly customers who are more susceptible to fraud, may want tighter controls, like a monthly face scan to access the account.
Think of it like this: some people live in a place where they do not lock the door. Some have a deadbolt, and others add cameras and guards. Novo intends to let customers choose where they sit. Supporting that will require deeper integration with Sardine's controls and more personalization at the user level.
The product requirements document is written, and the engineer assigned to the project was due to start the week after the interview. Jackson would not commit to a year-end release because the project is difficult, but the target is early 2027. Outside security, Novo just launched embedded payroll, tax filing for small businesses and 5 million dollars in FDIC insurance in November.
Sources
- Flare, The Account and Session Takeover Economy (2025), via The Hacker News, April 2025, thehackernews.com/2025/04/customer-account-takeovers-multi.html.
- Security Boulevard, “Account Takeover Statistics 2026: Why Ecommerce and Media Companies Cannot Wait,” May 2026.