In philosophy, there is a famous question: which came first, the chicken or the egg? While we're not any closer to answering this question, this line of thinking has been adapted to the payments field. In fact, it has become a question that many payment providers have asked themselves; should we build a customer base that will drive merging signups or should I drive a merchant base and therefore create more customers? Regardless of the strategy employed, there is 1 truth: both segments can pose sufficient risk and loss to the payments provider. In the shape of customers, this would include standard fraud modus operandi but from merchants, this could include using payment facilities to defraud cardholders and payment providers. The reality is that a merchant with bad intentions can cause damage to thousands of customers not to include the almost irreparable damage that they could cause to the payment provider. Having said that, let's dive into how to realize that a merchant is going bad.
An analogy that we had Dicorm like to use is that a risk team are bouncers at a club. Not only must they stop disruptive or potentially disruptive customers from entering into the club but they also have to keep an eye out for customers who are getting rowdy and could or are causing problems and ruining other patron’s experience. In both circumstances, the bouncer’s job is simple, identify these people and either prohibit entry or remove them from the club as quickly and efficiently as possible.
This is the exact same set of responsibilities a risk management team has: identify a potential problem and mitigate it as quickly as possible. In order to do this, risk management professionals must be alert, conscientious, and a strong decision-maker after considering all the telltale signs of trouble, much like bouncers.
Generally speaking, there are four main indicators that any risk management professional should pay attention to when identifying when merchants who could be going bad. Let’s go over them.
Explosive Growth
Explosive growth covers situations and instances where a merchant’s transaction volume spikes drastically. For example, say a casual dining restaurant receives payments totalling somewhere around the low thousands from each week using a particular e-wallet. Then, one week, the restaurant experiences transaction volume in the tens of thousands. This is explosive growth.
The concern behind explosive growth is that a merchant could have been processing normally for 3 months and stockpiling card information only to create fraudulent charges on all of those cards and exit the funds before they can be stopped.
One of the most difficult elements of explosive growth is being able to identify when something is genuine explosive growth and when it is just regular seasonal spikes. Seasonal growth and spikes tend to be experienced around Mother's Day or Valentine’s Day or during the Christmas period, or following a marketing campaign. In modern times, viral eCommerce products such as the hoverboard, fidget spinners, and novelty socks have added an element of randomness to spikes. This makes this timeframe ideal for merchants to turn bad as their activity would be camouflaged by the legitimate spikes of other merchants. The main difference between the two would be that bad merchants are likely to see spikes at around 200% or higher as they would want to maximize the return on their “investment”.
Finally, the duration that the merchant’s account has been active with the payment provider could be a good indication of the intent of the merchant. The rationale behind this is simple - once a merchant turns bad, their account would be terminated and their registration number blacklisted so only good merchants would have a strong history with the payment provider.
It should be noted that at this stage explosive growth as a stand-alone while a good indicator, shouldn't be considered as the only indicator of a merchant turning bad.
Concentrated Buyer Exposure
The second indicator which should be considered when looking for merchants that are going bad is where the money is coming from. Namely, fraud professionals need to ascertain who is paying the merchants ie: is it a large group of customers or are the funds mainly coming from a small handful of buyers? This is typically called concentrated buyer exposure by established payment providers.
The concern here is 2 fold; either the merchant has used stockpiled payment information or that this merchant is being targeted by fraud rink attack designed to make the merchant think that they are experiencing growth when they are in fact victim of credit card fraud and will be used as a means of exiting the funds from a stolen credit card.
Similar to explosive growth, matters are complicated when normal customer spending patterns are taken into account. For example, if a store sells cleaning supplies and 9 of 10 sales are for detergents, and 1 person buys a vacuum cleaner. Using normal price points, the 1 person would have contributed to more than 50% of the merchant’s revenue and the account would be flagged for concentrated buyer exposure. Worse still is when a merchant is a victim of a fraud ring. In these circumstances, multiple buyers make multiple purchases from the same seller. The value of the items are rarely high so as to not trigger alerts and since (going back to our cleaning supply store from earlier), 9 out of 10 buyers now purchase vacuum cleaners, the fraud is disguised as ‘normal’.
However, a simple sanity check of the information can help in the decision-making process. For example; customer W purchases a vacuum cleaner on Monday, 2 bottles of detergent on Wednesday, and a broom on Thursday. Meanwhile, customer A purchases 2 vacuum cleaners on Monday and another 2 on Thursday. Both A&W’s spending patterns might be suspicious but it is very unlikely that 1 person would buy 4 vacuum cleaners in 1 week meaning A’s transactions are worth looking into.
Concentrated Buyer Exposure is rarely the only indicator that a merchant is going bad and should not be relied upon as a sole indicator.
Deviations from The Norm
A third indicator and perhaps one of the most important are deviations from the norm. This covers everything from a change in average selling price to a change in withdrawal patterns.
As merchants conduct business, patterns can emerge which gives the payment provider insight into the merchant’s traits. This allows the payment provider to establish a baseline for each variable ex: selling price. When a merchant is going bad, they would in general not stick to the same behaviour they exhibited whilst attempting to build credibility with the payment provider. For example; Gee’s Jersey Garage sells jerseys online with an average selling price of $45 and the merchant withdraws funds every 2 days from between 8 pm - 11 pm. This pattern emerges after about 3-4 months of him processing with the payments provider. However, one day, the average selling price jumps to $70 and his withdrawals change to multiple times an hour.
The concern here is that the merchant is trying to exit as much of the funds available as quickly as possible. This behaviour contradicts the established pattern and could be a signal that the merchant has begun acting with bad intent. For merchants with online businesses, another strong indicator is a change in the duration of order fulfilment as it signals that the merchant is placing less emphasis/efforts on fulfilling orders or that they have received payments and made off with the funds without intending to fulfil the orders.
Sometimes, these changes could be down to business model changes like a shift in the nature of the goods, ex: from jerseys without printing to jerseys with printing. Delays can be caused by a new supplier and increases in withdrawal patterns could be due to cash flow management problems. Therefore, it is vital for a fraud professional to be alert to all the deviations that the merchant is experiencing and to apply critical thinking into the equation. For example; if the merchant has a change in their business model, is his old industry closely linked to his new industry? If the merchant is withdrawing funds more frequently - what caused the merchants’ sudden cash crunch? These questions could help guide the fraud professional better and enable them to make better decisions.
This is one of the most telling signs that a merchant’s intentions have shifted and if experienced, should be examined especially if coupled with an additional indicator.
Outward Communication
The final indicator that a merchant is turning bad is the merchant’s outward communication, in particular any messaging designed to camouflage byproducts of the merchant’s shift in intent.
As we have covered before, one of the most important things for a merchant who is going bad is to create some sort of camouflage to cover the signs that they are going bad. One of the easiest ways to do that is by communicating with your customer base via social media or online. For example, let us take Buffy’s Car Care Center, a retailer of car accessories operating both online and in a brick and mortar store. After 10 months of steady processing, Buffy’s launches an end of year mega sale with items going for 20%-35% lower than the normal selling price. Soon, sales volumes begin increasing at an alarming rate as do their withdrawals. It isn’t long until Buffy’s Facebook page starts getting comments on a daily basis of people asking where their items are. Shortly, Buffy posts a message on their Facebook apologizing for shipping delays and offering free shipping for all purchases and store credit for all purchases not yet delivered. Buffy has, in effect bought more time for him to receive more payments before folding the business entirely without fulfilling any orders.
This indicator should be considered strong as it involves the merchant acknowledging a problem and publicly stating their efforts to resolve the issues. Regardless of wheater or not the merchant intends to abscond with funds, the act of addressing a problem and attempting to calm the customer base down indicates that there is a problem that the merchant is facing. This problem is most likely a supply chain or logistical problem and this is an early warning sign that chargebacks are on the way. The only difference between a merchant with good or bad intentions in this regard is how many chargebacks are filed.
Identifying a merchant that is looking to go bad is only the start of any merchant monitoring program. Risk professionals then need a system to investigate flagged merchants and to mitigate any posed risks. Contact Dicorm now to understand how we can help you with this process or to have a no-cost, no-obligation consultation with our experts.