When It Pays To Accept More Fraud
J. Michael Bradley
Strange as it may seem, sometimes online merchants can make more money by loosening up their fraud controls. The
beginning of wisdom—and fatter profits—is knowing when and how to do this.
There’s a certain e-commerce irony at work in a lot of companies selling online today. As these firms zealously hunt down fraud,
many of them are unwittingly limiting their profitability.
Hyperstringent management of fraud, as it turns out, is good in concept but can also be detrimental to revenue growth and
profitability. Viewed solely through the fraud-reduction lens, these companies look well-managed. Every quarter, their measured fraud
rate goes down. But in many instances, getting to that lowest fraud point has meant errantly rejecting valid orders and increasing the rate
of manual review, which, in turn, has increased the cost of sales.
Many of us in the business of enabling e-commerce believe the best-practice approach to fraud management is to view the issue
not as addressing fraud loss, as so many do, but rather as focusing on profit loss. The appropriate, if slightly heretical, goal for ecommerce and finance managers today should not be to minimize fraud, but to maximize acceptance of valid orders, and hence
maximize profit.
As we’ll see shortly, it is possible to determine the profit-optimization point—the level of risk e-commerce managers can tolerate to
optimize profits—for almost any business.
Optimizing Profit
We encourage merchants to adopt a business-activity-pipeline view of risk management. Managing order acceptance is a process, not an
event. To maximize profit, managers must focus on the end-to-end financial impacts associated with the entire process. If you are
focused only on chargebacks associated with fraudulent orders (or, in a more general sense, solely focused on fraud loss rates), you are
managing only a portion of the costs associated with just one stage of the process.
Over the past several years, online-fraud rates have decreased as merchants have aggressively managed that part of the process. For
the majority of merchants, fraudulent orders are significantly less than 1% of total orders, and formal chargeback measures are even less
than that.
Calculating your company’s profit optimization point
Fact: Fraud management is about managing trade-offs:
►You can never totally eliminate fraud (unless you close your business) and, any automated means of detection will result in some
valid order rejection.
►Any manual process increases overhead costs, limits scalability, and presents its own detection-accuracy challenges.
But looking at the broader process, online merchants are rejecting about 4% of their online orders due to suspicion of fraud,
manually reviewing up to a quarter of all online orders, and ultimately approving about two-thirds of the orders reviewed
(CyberSource Corp. 8th Annual Online Fraud Report, 2007 Edition). Costs associated with these inefficiencies—rejecting valid orders
and needlessly reviewing orders manually—seriously impact business profitability and scalability.
Consider the following: On average, for every fraudulent order detected, approximately four orders are rejected (some of which are
valid, of course). In most cases, more profit can be found by decreasing the valid-order reject rate than lowering fraud loss rate another
few basis points. And it is unlikely any business can afford to carry the review overhead required to keep pace with the 20%-plus
growth rate in e-commerce sales. Another perspective is required.
Your goal as an e-commerce provider is to operate as closely as possible to what we call the profit-optimization point (POP), given
your company’s level of detection accuracy, review costs, ability to absorb loss, and so on. Embracing the POP may require counterintuitive thinking. In some cases you will actually want to tolerate higher levels of accepted fraud in order to increase overall
profitability.
The task is to constantly manage the financial trade-offs between actual losses, opportunity costs (mainly forgone margin due to
valid-order rejection), and all costs associated with the order-acceptance process. To do this, you calculate the adverse profit impact
curve that characterizes your business. The bottom of the curve marks the point at which profits are optimized, meaning losses due to
opportunity costs and fraud loss are at their lowest point. This approach incorporates costs associated with manual review as well.
At this point, there is a balanced rate of tolerated (“accepted”) fraud loss and rejected valid orders. Assuming that your frauddetect rate and other process efficiencies remain at, or close to, the modeled level, you should not single-mindedly focus on driving
your fraud rate any lower. This does not mean you should not strive to further decrease costs, but it does mean you must do so with an
end-to-end view of managing all process and opportunity costs associated with that reduction.
Margin Matters
Your POP can be found by constructing a statistical analysis that calculates adverse profit impact and correlates it to an indexed rate of
fraud loss. The resulting table is referred to as an order-acceptance decision table (see below). Before constructing this table, you must
understand your fraud-detection and valid-order rejection rates. These are calculated using statistical modeling techniques based on
your fraud-history data.
While all process variables play into the analysis, the component with the greatest sensitivity is gross margin. The chart below
shows the difference in acceptable fraud rates between two businesses, one operating at a 38% gross margin, the other at 15%. (For
simplicity we have held all other process variables constant).
The business having the 38% gross margin actually optimizes profit at a level of tolerated fraud acceptance that is 26 basis points
higher than the business having a 15% gross margin. Thus, assuming all other variables are equal, a line of business with higher gross
margin would have a higher target rate of fraud loss than a line of business with lower gross margin (the fraud-acceptance target shifts
to the right as gross margin increases).
But since it is unrealistic to manage to the exact point of optimization, a decision must be made as to which side of the curve you
want to err on.
You will note that your adverse profit impact curve is not symmetrical. One side of the curve is steeper than the other. In the
example above (an enlargement of the inflection point of the 15% gross-margin curve), the curve is steeper on the side of valid-order
rejection than it is on that of fraud loss.
In this example, which comes from a real-world engagement, the business is better off erring on the side of tolerating more fraud
loss than it is rejecting a valid order. This is because a 10 basis-point shift to the left costs the company about $40,000 in profit (due to
opportunity costs associated with lost revenue), whereas a 10 basis-point shift to the right (accepting more fraud) costs the company
only around $5,000 in profit (costs associated with fraud loss).
The impact of erring on the side of tighter fraud rates is eight times more detrimental to profit optimization than erring on the side of
order acceptance. Obviously, this sample case may differ from other low-margin businesses. But the principle holds true. The profit
“loss” associated with opportunity cost is significantly magnified when you take into account recurring-billing business models, such as
digital subscription services. Companies would be wise to consider the lifetime value for each order rejected when assessing the
tradeoffs between valid-order reject rate and fraud-loss rate.
By constructing your order-acceptance decision table, you can make conscious financial decisions regarding your target fraudacceptance rate and whether you should err on the side of valid order rejection or greater fraud control.
Companies must rid themselves of a strict focus on fraud-chargeback reduction and instead adopt the broader concept of profit
optimization as their goal. With this mindset, e-commerce operations can develop a financially sound approach to setting appropriate
targets and business controls.
Mike Bradley is director, managed services, at CyberSource Corp., Mountain View, Calif. Reach him at
mbradley@cybersource.com