Why Leaders Choose Worse Fraud Tools

Catching up with friends is one of my favourite “business” activities. When I was a tech founder, I was pretty bad at finding time for friends. It was all planning sessions, 1:1s, and endless emails. But as an advisor, catching up with friends is 50% of the job. And what’s even nicer is that I get to meet a lot of new, interesting people as well. So here I was at the Mastercard offices, catching up with a friend I got to know through Linkedin, but actually meeting them in person for the first time. Then at a certain point in our conversation, he tells me: “I see that you recently started pushing a new narrative in your writing”. And he said that with this knowing smile. And that caught me by surprise because I wasn’t aware I’m consciously pushing any narrative. So I asked - “Oh really? Which one is that?” “Those rules are better than AI.” “Ah.” I can see why people would think that I think that. But honestly i don’t think it’s about rules vs. AI. It’s about something entirely different. Because here’s the thing - people say they care about performance, but in my experience what they actually care about is control. Here’s what I mean: I tend to talk quite often about the ongoing debate of “Rules vs. AI”. That’s because there are a lot of things to unpack here: accuracy, coverage, speed, explainability, costs, performance degradation, etc. But it all comes down to one point: control. Or, to put it more accurately, the sense of control. Here’s what we tend to forget: in fraud prevention we touch the most sensitive business processes - money movement and customer acquisition. If you mismanage one of those - you hurt your business. And why do we tend to forget about this fundamental reality? Because as fraud fighters all we see in front of us is optimization. Shaving a few milliseconds here and a few basis-points there. So while fraud fighters often want to optimize by introducing changes, leaders see the changes themselves as a risk. The risk of accidentally breaking the system. And that tension, between small optimization gains versus the risk of complete business disruption is exactly what drives paralysis. And I get it. Sometimes the gamble - what you have to lose - seems too high. Now, fraud teams, both internal and on the vendor side, often fail to realize that. They focus on what can be gained and ignore what can be at risk. And this is especially true when fraud teams push for adopting new technologies like AI or Machine Learning. Because let’s face it, the vast majority of companies don’t use AI or ML as part of their core product and they’re simply not used to it. And if they are not used to handling AI/ML, they won’t understand it. And if they don’t understand it, they won’t trust it. And if they don’t trust it, they won’t FEEL like they’re in control. And how can we expect a business to give up control over its most critical processes? So it’s no wonder then that companies choose to utilize rules over AI. It’s not about understanding the score of a specific event, it’s about having a solid understanding of how decisions are being made as a whole. Rules offer exactly that: simple heuristics, deterministic outcomes, transparent monitoring, straightforward KPIs. Are rules always more accurate? Are they always catching more fraud? Do they adapt well to mutating fraud patterns? Absolutely not. But they are safe. And “safe” wins RFIs. So, does that mean we should give up on AI? No, but we first need to think about how to have our users trust it. How? Well that’s the question I hope anyone building fraud tech is thinking about. I’ve seen some vendors who take a servicing approach. Either by offering a “bring your own model” configuration or by letting users train models directly on their platform. And indeed, being more familiar with the model definitely increases trust. But teams that have their own models are the minority. And let’s face it, these are the teams that can–and are–used to handle complexity. But what about the ones that don’t? How do we get them to adopt AI and ML? Personally I find that a big part of it is helping the user understand which strategies are available for them, and what would be the effect of each. For example: choosing a KPI to optimize around and then suggesting the user low, medium, and high risk strategies. Let’s be more concrete: Say a user wants to optimize around chargeback rate and they set the different risk appetites to be: 0.2% for low, 0.3% for medium, and 0.5% chargeback-rate for high. Now imagine if after setting these requirements, I am presented with this table: Now this might seem quite basic, but truth be told, you won’t find it in most fraud AI tools. And these are just the basics. Imagine if you could double-click on a chosen strategy and explore it further, segment it by regions, or flows, or products. That’s the explainability that matters, not why a certain case got a fraud score of 12. Because like with rules, the decisions we implement with AI are about top-level KPIs. Without knowing exactly how I change those, there’s no chance I’m going to make any changes. So HOW do we retain the sense of control while using AI? We let the user dictate which KPIs are important for them. We allow them to explore a number of alternatives. And we help them monitor the performance. No complex heatmaps, no overlapping ROCs, no fancy graph networks. Just plain answers anyone could understand. Because it’s that “anyone” who will end up making these decisions. Not the data scientist that trained the model.