Duncan Malcolm http://duncanmalcolm.com/ Thu, 26 Mar 2026 17:40:51 +0000 en-GB hourly 1 https://wordpress.org/?v=7.0 Revenue Up, Risk Hidden: The Card Payments Problem http://duncanmalcolm.com/revenue-up-risk-hidden-the-card-payments-problem/ http://duncanmalcolm.com/revenue-up-risk-hidden-the-card-payments-problem/#respond Thu, 12 Feb 2026 17:15:09 +0000 https://duncanmalcolm.com/?p=400 Finance teams often treat card payments as revenue, when a meaningful portion of it is still unresolved risk. Most finance teams are carrying that exposure largely blind to their exposure levels.  Instead of treating card payments simply as revenue they should be categorised in the same way you would define risk buckets for mortgages or […]

The post Revenue Up, Risk Hidden: The Card Payments Problem appeared first on Duncan Malcolm.

]]> Finance teams often treat card payments as revenue, when a meaningful portion of it is still unresolved risk. Most finance teams are carrying that exposure largely blind to their exposure levels. 

Instead of treating card payments simply as revenue they should be categorised in the same way you would define risk buckets for mortgages or unsecured debt.

If you’re a CFO then this should be on your radar.

From a business reporting perspective, the standard reporting approach makes sense. The transaction has been approved, the funds are on the way, and the sale or transaction = is complete.

But from a risk perspective, that view is incomplete.

A portion of that revenue is still exposed to fraud, to disputes, and to scheme rules that allow it to be reversed days or weeks later. They’re also exposed to acquirer business failure, which while rare has happened.

Until that exposure has passed, funds can be clawed back by the acquirer.

Where the standard approach fails

In most businesses, card payments flow through finance in a fairly standard way:

  • revenue is recognised at capture or settlement;
  • fraud and chargebacks are treated as operational costs;
  • losses are recorded after they happen;

The issue is not that this is wrong. It’s that it hides the timing and structure of risk.

Basic risk factors

Once you start thinking in terms of exposure, the next step to consider is further segmentation.

The simplest and most useful split is by customer type.

New customers

New customers carry higher risk:

  • no transaction history;
  • weaker behavioural signals;
  • higher likelihood of fraud;
  • higher likelihood of disputes;

They are also typically where growth effort is concentrated.

Existing customers

Existing customers behave differently:

  • known patterns;
  • previous successful transactions;
  • lower fraud likelihood;
  • lower dispute rates;

The same £1 of revenue has a different risk profile depending on where it comes from.

£1 from a new customer is not the same as £1 from a returning one.

Card payments as a rolling liability

A more useful way to think about card payments is as a rolling exposure, not a fixed number.

Recent transactions, particularly in the last 90 days are still well within dispute windows.

Instead of treating all revenue as equal, it’s more accurate to think in layers or buckets of risk:

  • Age of transaction: 0-15 days, 15-30 days, 30-60 days, 60-90 days, 90+ days
  • New vs. Old customers: 0-90 days, 90-180 days, 180-365 days, 365+ days

An example risk matrix

Customer Tenure → / Transaction Age ↓ 0–15 days 15–30 days 30–60 days 60–90 days 90+ days
0–90 days (New customers) Very High Very High High High Medium
90–180 days High High Medium–High Medium Low–Medium
180–365 days Medium–High Medium Medium Low–Medium Low
365+ days (Established customers) Medium Medium–Low Low Low Very Low

Adding a second layer: region and liability

Two additional factors materially change the risk profile of a transaction.

Issuing region

Cards issued in different regions (US/EU/MEA/APAC) behave differently:

  • fraud rates vary;
  • dispute behaviour varies;
  • scheme enforcement varies;

In practice, this often shows up as:

  • some regions e.g. US, having consistently higher chargeback rates;
  • others being more stable but slower or more friction-heavy;

Even with the same product and flow, risk is not uniform globally.

Liability shift

Authentication plays a significant role in where risk sits.

With mechanisms like 3D Secure:

  • liability can shift away from the merchant;
  • exposure is reduced;

Without it the merchant carries the full risk of fraud-related disputes. The same transaction can carry very different risk depending on how it’s authenticated.

Building a practical risk view

Once you combine these dimensions, a more realistic picture emerges.

You are no longer looking at total revenue;

You are looking at risk-weighted revenue across segments;

For example:

  • new customer + higher-risk region + no liability shift → high exposure;
  • existing customer + lower-risk region + liability shift → low exposure;

Most businesses already have this data in some form. It is just not brought together in a way that informs decisions.

What finance should do differently

The value of this model is not in the categorisation itself. It’s in how it changes behaviour.

1. Track “at-risk revenue”

Instead of looking only at total revenue, consider recent revenue split by risk buckets. This gives visibility into how much exposure the business is carrying where that exposure is concentrated.

2. Influence commercial decisions

Once a model has been estbalished and the business has a grasp of the risk in each segment it can start to inform other areas.

For example, if a disproportionate amount of revenue is coming from higher-risk segments:

  • acquisition may need to be slowed;
  • acceptance criteria may need tightening;
  • more friction (e.g. authentication) may be justified;

If revenue is concentrated in lower-risk segments:

  • the business can afford to be more aggressive;
  • retention becomes more valuable;

3. Balance acquisition and retention

Growth teams are typically incentivised around:

  • new customer acquisition;
  • conversion rates;

But if most of that growth sits in high-risk segments:

  • the apparent gains may not translate into real, retained revenue;

A more balanced approach is to:

  • treat lower-risk returning customers as higher-quality revenue;
  • invest accordingly in retention and repeat behaviour;

4. Align incentives around net outcomes

One of the reasons this problem persists is misaligned incentives.

  • growth optimises for conversion;
  • fraud optimises for loss reduction;
  • compliance optimises for adherence;

Finance sits downstream of all three.

A better approach is to align around:

  • net revenue after losses;
  • or risk-adjusted revenue;

This creates a shared understanding of what “good” looks like and could help drive better governance.

5. Feed into product and payments decisions

This is not just a finance exercise.

The insights should influence:

  • authentication strategy (e.g. where to apply 3DS);
  • routing decisions;
  • acceptance logic;
  • onboarding flows;

If finance can identify where risk is concentrated, product and payments teams can decide how to manage it upstream.

The post Revenue Up, Risk Hidden: The Card Payments Problem appeared first on Duncan Malcolm.

]]> http://duncanmalcolm.com/revenue-up-risk-hidden-the-card-payments-problem/feed/ 0 Beginners Guide to Payment Fraud Detection & Prevention http://duncanmalcolm.com/beginners-guide-to-payment-fraud-detection-prevention/ http://duncanmalcolm.com/beginners-guide-to-payment-fraud-detection-prevention/#respond Fri, 10 Nov 2023 09:03:46 +0000 https://duncanmalcolm.com/?p=398 A guide for eCommerce merchants with any level of fraud knowledge. This guide has been developed for eCommerce merchants with any level of fraud knowledge. It aims to provide a full and comprehensive overview of how to detect and prevent eCommerce payment fraud. Getting fraud prevention and detection right is important. However, if you are […]

The post Beginners Guide to Payment Fraud Detection & Prevention appeared first on Duncan Malcolm.

]]> A guide for eCommerce merchants with any level of fraud knowledge.

This guide has been developed for eCommerce merchants with any level of fraud knowledge. It aims to provide a full and comprehensive overview of how to detect and prevent eCommerce payment fraud.

Getting fraud prevention and detection right is important.

However, if you are a growing merchant and have zero fraud, there is a strong possibility that you are rejecting good customers. Get it wrong the other way and let too many risky transactions through, and you will eat into your margins.

In this guide we cover

  • eCommerce Payment Fraud Trends
  • Payment Fraud Key Concepts
    • How payment fraud happens
    • It’s the card not the account
    • The two types of payment fraudsters
    • Fraud controls
    • Fraud alerts vs. chargebacks
    • Where to get fraud alerts
    • Payment authorisation vs. capture
    • Fraud features
  • Lines of defence
    • Fraud spike detection
    • On site behavioural detection
    • Off site passive fraud checks
    • Pre-checkout risk assessment rules based on your fraud risk management strategy
    • Your payment processor
    • Your orchestration layer (if used)
    • Fraud screening tools & rules engines (Rules based / Heuristic / Machine learning)
    • On site active fraud checks
    • Fraud screening
    • Chargeback dispute management
    • Offsite monitoring
  • Fraud screening tools & rules engines
    • Heuristic fraud scoring
    • Machine learning generated fraud scoring
    • Rules engine
    • Alert management
  • Vendors
  • Further help

Finally, I believe that it’s import to educate merchants rather than their adversaries. So while this guide aims to be comprehensive around concepts, specific actionable tactics are generally in member only posts.

It is currently free to sign up as a member, all you need is a valid verifiable merchant email account.

Payment fraud trends

Fraud is on the rise and the global pandemic has not been helping. It has placed increased financial pressure on individuals. The unsurprising result has been an increase in various types of fraud.

  • WorldPay’s annual risk survey showed that
    • 59% of merchants surveyed had seen a slight or significant increase in eCommerce fraud between 2019 and 2020 and only 15% had seen a reduction.
    • The same survey found at just over 37% of merchants lost at least 6% of their revenue to payment fraud in 2020;
  • Forters fraud attack index noted a
    • 55% increase in Buy Online Pickup In Store (BOPIS) fraud attacks
    • Significant increases in fraud for beauty, money services and travel products;
  • McKinsey predict that by 2022 we will see $36bn in global losses due to fraud increasing steadily year on year;
  • In the US the FTC reports of credit card fraud jumped by 107% from Q1 2019 to Q4 2020 vs 27%  between Q1 2017 and Q1 2019;

 

Payment fraud key concepts

Before we jump in we need to cover-off some basics that are important to understand.

This simplified payments flow highlights some of the key terms you should be aware of.

If any of them are unfamiliar then read on below. If they are all familiar you can skip to the next section lines of defence.

How payment fraud happens

Card fraud happens when an adversary uses an often, but not always, a stolen card, usually in combination with some stolen identity details such as: card holder address, name, date of birth.

They then use these details to make a purchase. The card holder then raises a dispute with the issuing bank that the transaction is fraudulent. This results in a chargeback and you the merchant losing out.

The two types of payment fraudsters

If you do not have effective controls in place to identify the card holder then it can be very difficult to know which type of fraudster you are dealing with.

There are two types of payment fraudster:

  • 1st party fraud – First party fraud is when a cardholder uses a card for a purchase and then informs their issuer that it was not them who completed the transaction. While this is the less common of the two it does happen.
  • 3rd party fraud – Third party fraud is where stolen card details are used to complete a transaction without the knowledge of the card holder.

Talking to the customer is unlikely to yield any useful information as knowing whether they are telling the truth or not is extremely difficult.

In some cases it can even lead to more fraud as you are educating them about your processes.

Fraud attacks

A fraud attack is a co-ordinated effort by one or more adversaries to undermine your lines of defence.

They are generally characterised by an elevated amount of fraud vs. normal levels of fraud. I have gone into fraud attacks and patterns in another post so won’t cover them here.

Payment authorisation vs. capture

Understanding the basic payment flow in fraud detection and prevention is quite important. While there are several possible actions with a payment service provider like refund and verify the two we care about are authorise and capture.

This is a very simplified flow and misses out payment service providers and other intermediaries.

Authorisation

This is when a card number and related details known as PAN data, including amount are sent via your payment service provider to the issuing bank. Assuming funds are available, the card is active and if relevant, the requisite 3DS check is passed, the issuer will authorise the transaction.

At this stage the funds are only ring-fenced on the card and the transaction will show as pending on the customers bank account. You do not yet have custody of the funds.

While the funds are authorised and before they are captured is when you will typically carry out some fraud checks.

Capture

A request to capture funds from the issuing account into your merchant account can be made once the transaction has been authorised.

Once issued it will typically take one to several days for the funds to clear.

Fraud controls

Fraud controls are things that you as a merchant can put in place to reduce your risk of payments fraud. The challenge is to have the right balance of controls that don’t overly impact the customer experience.

Type of control

  • Passive – The customer is not aware the check has happened e.g. Verifying if a phone number is valid or is linked to negative feedback from other merchants;
  • Active – The customer is presented with some form of challenge e.g. Uploading their government ID to an ID verification service;
  • Screening – An agent and/or machine learning algorithm reviewing a transaction and deciding whether to carry out active or passive controls;

Some passive controls that exist are inexpensive such as checking if a customer is using a VPN however others such as ID verification or some of the more advanced phone number checks might cost up to $2-$5 per check. As part of your fraud risk management strategy you need to define which controls are employed in different risk scenarios.

Fraud alerts vs. chargebacks

All fraud alerts lead to chargebacks but not all chargebacks are fraud. This somewhat challenging concept to grasp caught me out when I started working in payments.

  • Fraud alert – The customer has reported their card stolen to the issuer and the issuer has flagged specific transactions as having been fraudulent.
  • Chargeback – This will occur if a transaction has been flagged as fraud however the issuing bank may also request a chargeback for other reasons such as if the customer tells them they did not receive good or were double charged;

With regards to eCommerce payment fraud detection our interest is mainly on fraud alerts. They will allow you to incrementally improve your controls over time so that you get the right balance of checks and cost vs. checkout conversion.

Where to get fraud alerts

Fraud alerts are usually provided by the issuing bank to the card network e.g. VISA/Mastercard and eventually to your merchant bank. These reports known as TC40s are often delivered a significant amount of time after the issuing bank has informed the issuer. They can also be challenging to get your hands on if you are a smaller merchant.

If you are seeing significant fraud, I would recommend using a third party like Ethoca. They can provide you with significantly faster fraud alerting. This will enable you to disable and block cards faster reducing the amount of time bad actors have to make purchases.

It’s the card not the account

A lot of people get caught up with whether any given account is fraudulent. You need to remember that it is the card that is being used fraudulently irrespective of the account.

Any card whose first transaction is under 3-12 months ago is a risk given the amount of time a chargeback can take to happen.

Given this try to make sure that you consider that even ‘trusted’ accounts with new cards being added can be somewhat risky.

Fraud features

I use this concept quite extensively through this post and the blog. A ‘feature’ is any data point relating to a transaction that can be contextualised and used to understand if a transaction is fraud.

Examples would be: transaction value, number of days since a customer made their first transaction, the card issue country etc.

Lines of defence

I will outline the different lines of defence and how some of them can be used to enable effective fraud detection and prevention.

Defence in depth is a military concept that seeks to delay and deter attackers by establishing several layers of defence.

In fraud payments your lines of defence in order of usage are as follows:

  • Fraud risk management strategy
  • Fraud spike/attack detection
  • On site behavioural features
  • Off site passive fraud checks
  • Pre-checkout risk assessment rules
  • Your payment processor
  • Your orchestration layer (if used)
  • Fraud screening tools & rules engines (Rules based / Heuristic / Machine learning)
  • On site active fraud checks
  • Fraud screening
  • Chargeback dispute management
  • Offsite monitoring

Some fraud is always inevitable but the more lines of defence you set-up the less likely your adversary will be to succeed.

Equally if you place too much friction in the checkout path you could lose conversion on your regular customers and/or incur costs that eat into your margins.

Fraud risk management strategy

It might be surprising but the first thing I believe merchants should start with is a plan. That is what a fraud risk management strategy is.

It is a plan that allows you as a merchant to define risk levels of transactions and how to manage that risk. Even if you are just starting out it is a very sensible place to start as it will allow you to ensure that you are aligned with any other stakeholders you work with.

At its most basic it should include:

  • Risk levels: Low/Medium/High
  • What controls you will implement for transactions in those risk levels

There’s too much to cover here but I have written a  a step by step guide to fraud risk management strategy in a public post which should get you started. I think it might even include a template to get your started and help impress your boss.

Fraud spike/attack detection

A fraud spike is an elevated amount of potentially fraudulent activity. It is an important fraud pattern to catch early because well co-ordinated attacks can lead to the kind of severe losses that will lead you to losing your job.

The main issue with fraud spikes is that they can be masked within an expected spike of sales. Or worse might only look like a slight increase in sales.

As a merchant you will only start to feel the pain 15-30 days when the fraud alerts and chargebacks start rolling in.

An example of a spike might be:

  • Increased sales of a particular product or product line without a linked marketing promotion
  • A sudden increase in new customers transacting
  • A surge in a payment feature vs. normal

This is quite an important and also somewhat sensitive subject so I have written a full post on fraud attack detection on what to look for and how to detect spikes.

On site behavioural features

Fraud features are indicators or tells that a customer is untrustworthy or different from your regular customers. In an in-person retail environment this might be evidenced by clothing or in-store behaviour. Online we have to come up with alternatives.

Examples of on-site passive feature detection features could include:

  • Sign-up / account creation date
  • Number of cards attempted
  • Purchase history
  • Order frequency
  • Login / visit history
  • Typing speed
  • Mouse patterns (Click / browsing speed)

Your adversary will not know what is or isn’t normal with respect to any of the above. They can try to act normal but ultimately you as the merchant hold all the data to know what looks normal or not.

Offsite passive fraud checks

For offsite fraud checks there are a wealth of options from checking IP addresses to identity verification and phone number verification services.

All these checks can happen passively meaning that the customer is not aware they are happening nor do they interrupt the checkout flow.

The main thing you need to know is that most if not all data protection laws include exceptions for fraud prevention in particular financial crime. That is to say you do not usually need your customer’s consent to check their IP and other data if it is for financial crime prevention.

I am not a lawyer but these guys are and they have covered off the legalities at least in Europe.

Types of check can include:

  • IP address
  • Email address
  • Phone number
  • eVerification of identity
  • Device fingerprinting

I have a separate members post that gives the full detail of offsite passive checks and vendors.

Pre-checkout risk assessment rules

Based on the customer’s behaviour and any offsite passive checks you have completed you should have enough data to make a decision of how trustworthy the customer is.

If you have defined a fraud risk management strategy with how to treat that risk you can define some rules on what happens next.

In an in-store scenario, you might ask to see some ID or call the card company if you thought someone looked out of place or overly stressed. Online you can do this and much more.

You can take all of the data from a customer and decide whether the transaction looks risky or not. If it does look risky then you can perform additional checks.

In general, I wouldn’t expect these additional checks to happen on more than a very small percentage of customers. They should also be fully automated so to not have to manually intervene too often.

Depending on your fraud tools and eCommerce tool this may or may not be included as an option.

Your payment processor

Once the transaction process has started your processor can help reduce fraud if you provide them with the right information.

Remember that payment processors may not always have your best interests at heart with regards to fraud. They get commission on transaction volume and value and also charge a premium for each chargeback.

As a result they will generally optimise for high authorisation rates rather than low fraud rates.

What you should provide to the processor:

  • Card holder details: Name, address etc
  • Risk details: Number of purchases, payment attempts etc

After sending this data you should get a response that include amongst other data the AVS and 3DS risk data.

AVS check response

This is the most basic type of check and was one of the original security mechanisms.

The checks are:

  • Address
  • Post code
  • Name

Most merchants do not rely on AVS alone as a significant number of transactions fail one or more AVS checks and the majority are not fraudulent.

3DS check response

3DS is an evolving card security standard that helps ensure that a transaction was initiated by the card holder. Version 2.0 and subsequent versions are very effective.

The response should include:

    • 3DS version
    • Transaction challenged (True/False)
    • 3DS result

The challenge with 3DS is adoption. As it requires issuing banks to make technology changes. Not all banks support it and not all customers are familiar with it. As a result it can impact authorisation rates.

Using all of the above your fraud prevention tooling should be set-up to provide some sort of decision on what to do next.

Fraud screening tools & rules engines

This is covered in its own section below as it is quite a large subject and I didn’t feel that I could cover it completely here.

It suffices to say that you should have some form of automated decisioning on transactions as well as a way to manually review the highest risk transactions.

On site active fraud checks

Active checks are ones where the customer must complete an action. If properly set-up then these should have minimal impact on the checkout experience.

The most common checks are:

  • Completing a 3DS 2.0 challenge
    • Note this is not supported in every country or by every issuing bank
  • Uploading an ID to ID verification service
  • Completing a phone number verification via SMS

The most extreme check I have come across was a merchant who would mail a code via the postal service and wait for the customer to provide it back to them.

I think this is overkill in all but the highest risk scenarios and even then is open to potential issues. If the adversary has managed to intercept a customer’s card and home address it would seem possible that they could also intercept a code in the mail.

Fraud screening tools & rules engines

Now you have collected quite a lot of data and the customer has submitted their transaction for authorisation.

You have received a positive authorisation response from the acquirer and you need to decide whether to capture the funds and risk that chargeback.

Here we will cover:

  • Heuristic fraud scoring
  • Machine learning generated fraud scoring
  • Rules engine
  • Alert management

A lot of the all-in-one fraud tools on the market include some or all of the above along with integrations with one or several external offsite passive check tools as mentioned above.

A good model for a transaction flow is as follows:

  • Score the transaction
    • Use data gathered from behavioural, passive and any active controls to generate a risk score
    • This score can be generated via a machine learning model, a heuristic model or both
  • Use a rules engine to
    • Reject the highest risk transactions
    • Challenge medium risk transactions
      • Where a transaction passes relevant challenges allow it
      • Where there is an exception pass it to screening
    • Accept lowest risk transactions
  • Use screening via agents to review transactions against factors that cannot yet be judged by your machine learning or heuristic scoring

Heuristic fraud scoring

Heuristic fraud scoring is the process of assigning point values to different risk factors in a transaction. The resulting score can then be used in your rules engine to decide a next action.

Generally, in fraud a higher score indicates a higher risk customer or transaction.

These will be based on:

  • On-site behavioural features
  • Off-site passive fraud checks
  • On-site active fraud checks
  • Responses from payment service provider

Examples of features that could increase a score:

  • New customer
  • New card
  • Card attempts
  • Product(s) chosen
  • Value

Examples of features that could reduce a score:

  • Existing customer
  • Same card used over 180 days ago
  • Customer flagged as risky by another merchant
  • Item being delivered to cardholder address

In reality there are hundreds of different features that you can include in these scores. What is relevant will depend on the type of business you are running. I have some more detailed examples in a member post on fraud detection essentials.

Finally you should have some score bands that will be calibrated depending on how you have set up your scoring into:

  • High risk: Transactions that will be cancelled
  • Medium risk: Transactions that may require further action
  • Low risk: Transactions that will automatically be accepted

Machine learning fraud scoring

An ML generated score is one where a statistical algorithm automatically creates a score. It does this after having been train on millions of transactions, some successful, some fraudulent.

This score will be generated by looking at the same data as a heuristic score. The only difference is that if correctly set-up the ML model will adjust how much a score is increased or reduced based on all of your past transactions.

ML models can also use graph databases to see how transactions, accounts and other factors are linked together.

Pros:

  • They can reduce heavy lifting of calibrating scores
  • Models can be created to carry out screening tasks that an agent might complete

Cons:

  • It can be time consuming and expensive to create ML models
  • Your business might need sufficient scale to effectively leverage an ML model
  • You need millions of transactions to train them effectively

If you are purchasing a fraud solution whose core focus is ML, check that they have customers selling similar products and in the same regions. It can take a lot of transactions to train an ML model and you don’t want to be the guinee pig.

Rules engine

A rules engine is exactly as it sounds, a way to set some rules. There are two applications of a rules engine in this context.

You can use the rules engine:

  • Instead of a heuristic and/or ML model
  • In conjunction with a heuristic and/or ML model

An example of a basic rule might be to screen transactions that:

  • Include high risk products
  • Have a medium or higher fraud score
  • Has a basket size over $1,000

Many eCommerce merchants will start out with only a rules engine. For many this is enough to get started. It should be noted that the limitation here is that you might find yourself regularly updating and changing rules reactively to fraud issues.

A better approach is to use the rules engine in conjunction with a heuristic and/or ML model.

In that scenario a rules engine flow could work as follows:

  • One or more scores on a transaction are generated
  • Using the score, transaction value and any other factors not included in the scoring set some rules:
    • Low score:
      • Low/Medium/High value – Allow transaction and request capture
      • Very high value or high recent total order value – Consider further checks
    • Medium score:
      • Low value – Allow
      • Medium/High value – Request further (ideally automated) checks and rescore once those checks are complete
    • High: Cancel the transaction, possibly block or red flag the customer

Ideally your rules engine should be doing as little as possible and the majority of the heavy lifting should be completed via your heuristic and/or ML scoring.

Alert management

Your final line of defence before you get to a fraud alert is alert management. This is a system generated queue(s) of transactions to be reviewed by a human agent. They look at a transactions and decide whether to capture the payment, request further information or cancel the order.

In a well designed process the agent will be completing tasks not possible via automation or double checking for false negatives.

Examples of a false negative that an agent could spot would be checking an automated ID checks on a higher risk transaction. While these checks are very good they are not infallable.

Chargeback dispute management

It is possible to dispute a chargeback. A chargeback is a challenge from the issuing bank of the payment card to say that the transaction was by a fraudulent 3rd party.

If you believe that you have sufficient evidence that the transaction was actually by the 1st party it’s possible to challenge the chargeback.

The kinds of data that are useful in this scenario are:

  • Validated government ID that is not falsified
  • An IP address originating from the area where the customer actually lives
  • Other eVerification that would indicate the card holder was aware or involved

There are a number of service providers that provide dispute management as a service. If you are a reasonably large merchant then they would be worth considering.

Offsite monitoring

It seems to be an uncanny feature of humans that we like to brag about our achievements. As a result it can often be possible to find online posts about how to scam and defraud different online businesses.

These posts can usually be found on social networks like Facebook, Forums and the dark web.

Actions:

  • Search social network groups for your brand name
  • Search forums for your brand name + keywords like scam, fraud or carding

If you have some budget there are some paid services that will cover both publicly accessible as well as members only and dark web forums.

Vendors

A question that is often asked is who is the best fraud vendor? The reality is there is no one size fits all.

It can depend on:

  • Your budget and scale
  • Your existing technology choices
  • Where you want to take your payments function
  • Your businesses risk appetite

Need some help?

Fraud is a vast subject. While this guide is hopefully comprehensive it by no means covers all the intricacies and details.

If you want help with technology selection then I’d be more than happy to have an initial discussion to see how I can help.

The post Beginners Guide to Payment Fraud Detection & Prevention appeared first on Duncan Malcolm.

]]> http://duncanmalcolm.com/beginners-guide-to-payment-fraud-detection-prevention/feed/ 0 Why SaaS Companies are Becoming Payments Facilitators [PayFac] http://duncanmalcolm.com/why-saas-companies-are-becoming-payments-facilitators-payfac/ http://duncanmalcolm.com/why-saas-companies-are-becoming-payments-facilitators-payfac/#respond Sun, 11 Sep 2022 16:53:56 +0000 https://duncanmalcolm.com/?p=394 The appeal of increasing revenue in some cases by over 100% is what has SaaS entrepreneurs and their investors excited about PayFac, but how realistic is it and is it worth the effort? Becoming a ‘PayFac’ or Payments Facilitator is a growing trend within the SaaS industry. The reason this is happening is that SaaS […]

The post Why SaaS Companies are Becoming Payments Facilitators [PayFac] appeared first on Duncan Malcolm.

]]> The appeal of increasing revenue in some cases by over 100% is what has SaaS entrepreneurs and their investors excited about PayFac, but how realistic is it and is it worth the effort?

Becoming a ‘PayFac’ or Payments Facilitator is a growing trend within the SaaS industry. The reason this is happening is that SaaS vendors whose client’s process significant funds represent a real revenue opportunity for SaaS vendors.

If you are say a hotel booking software company and you charge your customers an average of $150 and the hotel turns over $10,000 per month in payments taking 60-100 basis points will net a cool $60-$100 in incremental revenue per month.

It’s a quite significant shift in business models for SaaS companies and I think is good for their customers as they are closely aligned in terms of goals.  Higher revenue for one is higher revenue for the other.

Why you don’t really want to be a full PayFac

A full PayFac is essentially a payments services provider. While on paper it sounds like a great idea in reality there’s a significant cost overhead in becoming a PSP, especially in-terms of salaries, technology and operational overheads.

In order to get to this point you have to have a couple of things that most SaaS companies don’t want:

  • Regional authorisations – Often miscalled ‘licenses’ after their banking counterparts but you’ll need to get operating authority from the financial regulators in the regions you want to operate in, in Europe this would usually be a Payments Institution (PI) or Small Payments Institution (SPI) if you were just getting started;
  • MLRO (Money Laundering Reporting Officer(s)) – You’ll need these in each country or region you’re operating in. Plus some regions like the US require you to have your MLRO and their core team locally. They act as an internal balance in financial institutions to ensure they are following the rules. Often they will require specific qualifications and may also need to be vetted/approved by the regulator;
  • Risk & Underwriting – While from a consumer perspective card payments are quite safe if you are providing card services to merchants you can find yourself liable for reversed payments (chargebacks) as well as the risks around money laundering;

If you’re turning over $1bn per year however, it might be worthwhile so read on.

Vendors and providers

There are a wide variety of vendors in the PayFac market. Within payments and finance at the basic services end of the market everything is quite straight forwards.

However, as you move up the stack there is quite significant cross-over between vendors. Not only that often finance vendors will offer services and products that they do not generally advertise.

As a result there is an ever fragmented market with emerging players and technology platforms.

There are two ways to look at the PayFac vendor landscape…

by culture:

  • Technology led: Vendors who are tech led are generally run by geeks who love building amazing API driven products;
  • Sales led: Vendors who are sales led are generally run by sales people who buy in a 3rd parties technology or who’s top engineers left a long time ago;

and by business model:

  • Vanilla: Stripe like services where you can integrate a payment flow and you make zero (0) revenue from transactions;
  • Referral: All the tech, relationships and connections are provided. Your client is charged a rate say 1.5% and you take a referral fee within that say 60-100bp;
  • Technology only: Where the vendor provides only the technology and you bring your authorisations, processes and relationships;

We’ll do a payfac vendor comparison separately as there’s probably too much to reasonably cover in one post.

Card readers and why they’re important

Today a lot of payments are taken online, largely for bookings and product purchases. However, for key industries such as hospitality, coworking offices etc. card present payments still make up a significant chunk of sales.

The majority of these organisations take card readers from their banks, occasionally from a payments startup like SumUp. Sometimes they’re getting good rates other times they’re being taken advantage of.

In a lot of cases those transactions won’t be automatically reconciling into their POS and so there’s a good SaaS value add opportunity to do that and make their life a little easier.

Technology considerations

It is essential when choosing a payments provider to look at how their card readers work as well as features available.

  • Connection: How does it connect to the internet (WiFi, 4G, Wired?);
  • Transaction initiation: Local or server-side?
  • Offline: Can the device take a payment if your app isn’t working?
  • Apps on reader: Can you install a mobile app onto the provider’s reader to provide a unique checkout experience for tipping, rebooking, account management etc?

I’ll do a full article on card readers compared as there are a lot of different options out there and while they appear similar the differences can have quite a significant impact.

How to become a full PayFac

So if all of this doesn’t sound too scary maybe you want to go for it and become a full PayFac.

A few things you’ll need to have a handle on beyond what’s mentioned above include:

  • Fraud: Fraud detection, management and possibly a 24/7 team to operationally manage held/blocked transactions;
  • KYC: A way to onboard your clients in a way that your regulator(s) are happy with;
  • AML: A way to consistently detect money laundering patterns in particular if you’re in a higher risk industry such as gaming or cross-border transfers;
  • Underwriting: A way to risk score new clients and a reasonable process to monitor them once they’re actively trading;
  • Banking partner: You will need an acquiring bank to sponsor you to be able to send transactions over the main card networks (Visa, Mastercard etc);

If you’re a SaaS company and are interested in going down this path or are on it and want some help then let me know.

The post Why SaaS Companies are Becoming Payments Facilitators [PayFac] appeared first on Duncan Malcolm.

]]> http://duncanmalcolm.com/why-saas-companies-are-becoming-payments-facilitators-payfac/feed/ 0 PCI-DSS, a Scam Designed to Catch Out Small Businesses? http://duncanmalcolm.com/pci-dss-a-scam-designed-to-catch-out-small-businesses/ http://duncanmalcolm.com/pci-dss-a-scam-designed-to-catch-out-small-businesses/#respond Thu, 09 Jun 2022 16:56:52 +0000 https://duncanmalcolm.com/?p=396 Most small businesses in particular retailers may not be aware of PCI-DSS. Why does it still exist and does it have a place in modern payments?

The post PCI-DSS, a Scam Designed to Catch Out Small Businesses? appeared first on Duncan Malcolm.

]]> If you are a business and you take card payments online you are required to complete a PCI-DSS self-assessment.

Why? And who actually completes these long questionnaires?

What is PCI-DSS

The ‘Payment Card Industry Data Security Standard’ (PCI DSS) is a set of policies and procedures intended to improve or optimise the security of credit, debit and cash card transactions and protect cardholders against misuse of their personal information.
That’s what the original intent was or at least how it was marketed.
For the vast majority of merchants it’s a self-assessment questionaire that you’re meant to complete and keep somewhere safe incase something bad happens.
PCI-DSS self-assessment levels

Self-assessment questionnaire

Several different types of SAQ apply depending on your merchant level and the way you process payment card information.  They start from a relatively short questionnaire up to over 200 quite technical questions.

  • SAQ A: For merchants that outsource their entire card data processing to validated third parties. This includes e-commerce transactions and mail/telephone order merchants. An example here would be someone using Shopify or eBay;
  • SAQ A-EP: For e-commerce merchants that outsource their payment processing but not the administration of the website that links to it. Anyone who uses WordPress or Magento;
  • SAQ B: For e-commerce merchants that don’t receive cardholder data but control the method of redirecting data to a third-party payment processor. Could also include WordPress or Magento users depending on set-up;
  • SAQ B-IP: For merchants that don’t store cardholder data in electronic form but use IP-connected point-of-interaction devices. These merchants may handle either card-present or card-not-present transactions. Anyone who has a payment terminal/card reader that talks to a computer, phone or tablet;
  • SAQ C-VT: For merchants that process cardholder data via a virtual payment terminal rather than a computer system. A virtual terminal provides web-based access to a third party that hosts the virtual terminal payment-processing function. Anyone with an app where you can type in the card number;
  • SAQ C: For merchants with payment application systems connected to the Internet (no electronic cardholder data storage). Anyone who uses a booking system installed on their computer;
  • SAQ D: For all other merchants not included in SAQ types A–C. Anyone who is confused as to which one they should complete;
  • SAQ P2PE: For merchants that use point-to-point encryption. It’s therefore not applicable to organisations that deal in e-commerce.

What is wrong with PCI-DSS?

The main issue I see today with the PCI-DSS standards is that for many retailers they are not achievable. Small retailers with limited IT skills and budget shouldn’t be burdened with the technical overhead of PCI.

Instead, the security aspects should be more than covered in application and device certification. What’s more interesting is that application and device certification is already quite rigorous.

It would make more sense to have retailers complete a short online course 20-30 minutes of e-learning each year covering the do’s and don’ts of policy and process than having them promise they’ve installed a recent antivirus.

 

Why is it a scam?

Other than the basics of not writing down card numbers and some of the non-technical process PCI-DSS is generally designed to catch merchants out. There are reams of provisions that no normal independent retailer today would likely ever be able to fulfil without significant investment.

All this to hedge risk in payment systems, software and hardware that should be secure by design without needing extra work.

The content in the PCI-DSS questionnaire in our opinion won’t really make any difference to the security of a transaction. For example, having a firewall on your network, for example, is pointless unless it is correctly and professionally installed, configured and maintained.

Card networks, processors etc push out these questionnaires with the sole intent of trying to shift some of their responsibility for security if things go wrong. If a merchant hasn’t faithfully completed the questionnaire they are an easy scapegoat.

So should you fill them out?

Well yes probably. While we think they are a scam, you’re taking card payments so you’re now part of it and if possible you should reduce your exposure as much as possible.

P.s. Please don’t take this article as formal advice, it’s just a warning that if you can be blamed you will.

The post PCI-DSS, a Scam Designed to Catch Out Small Businesses? appeared first on Duncan Malcolm.

]]> http://duncanmalcolm.com/pci-dss-a-scam-designed-to-catch-out-small-businesses/feed/ 0 Why settings and permissions could kill your B2B product http://duncanmalcolm.com/why-settings-and-permissions-could-kill-your-b2b-product/ http://duncanmalcolm.com/why-settings-and-permissions-could-kill-your-b2b-product/#respond Thu, 21 Nov 2019 10:10:28 +0000 https://duncanmalcolm.com/why-settings-and-permissions-could-kill-your-b2b-product/ It was the third call of the day: “Duncan, do you think you could help us set up this new client? We’re can’t figure out how to add permissions so that they can edit their content…” This was the topic of conversation for over 6 months. As the product became more popular and more clients […]

The post Why settings and permissions could kill your B2B product appeared first on Duncan Malcolm.

]]> It was the third call of the day:

“Duncan, do you think you could help us set up this new client? We’re can’t figure out how to add permissions so that they can edit their content…”

This was the topic of conversation for over 6 months. As the product became more popular and more clients were signed on the same issue came back to bite time and time again.

The B2B product we had built worked flawlessly for the thousands of end-users.

But the support emails kept coming in.

What we hadn’t accounted for was that it was the product’s internal sales and account management team, there was no IT helpdesk or support team.

The settings and more importantly the permissions system was unfathomably complex. Driven by a desire from the client to have an almost infinitely configurable set-up.

After talking with the client and reining in the requirements, the solution was to redesign and refactor. An extensive rebuild ensued.

That experience left an indelible mark.

Very recently I was involved in the from-scratch design of the settings and permissions in a B2B product.

When I started researching the topic I found that in the ensuing years very little had actually been written about the topic.

To that end I have written an extensive guide on permissions systems with examples from the most recent designs.

Lesson: Just because three are only two users in the persona, doesn’t mean that they’re not important.

The post Why settings and permissions could kill your B2B product appeared first on Duncan Malcolm.

]]> http://duncanmalcolm.com/why-settings-and-permissions-could-kill-your-b2b-product/feed/ 0 Do your metrics make you feel uncomfortable? http://duncanmalcolm.com/do-your-metrics-make-you-feel-uncomfortable/ http://duncanmalcolm.com/do-your-metrics-make-you-feel-uncomfortable/#respond Wed, 06 Nov 2019 15:03:26 +0000 https://duncanmalcolm.com/do-your-metrics-make-you-feel-uncomfortable/ A while ago a client asked me into their office. “Do you think you can help us set our mobile strategy for our the next version of our app?” When I looked at the reporting that was being generated it was all but meaningless. They were what is well coined as ‘vanity metrics’, created to […]

The post Do your metrics make you feel uncomfortable? appeared first on Duncan Malcolm.

]]> A while ago a client asked me into their office.

“Do you think you can help us set our mobile strategy for our the next version of our app?”

When I looked at the reporting that was being generated it was all but meaningless. They were what is well coined as ‘vanity metrics’, created to make everyone feel good.

Good product metrics should make everyone feel uncomfortable. They should be provocative and help drive positive action rather than soothe egos or just be self-congratulatory.

I put together an article on SaaS metrics for Kuwinda including the best posts and videos that I could find online.

A solid understanding of product metrics is critical to driving growth in digital products.

The post Do your metrics make you feel uncomfortable? appeared first on Duncan Malcolm.

]]> http://duncanmalcolm.com/do-your-metrics-make-you-feel-uncomfortable/feed/ 0 Why Digital Agencies steal from FinTech Startups to feed starving Corporates! http://duncanmalcolm.com/why-digital-agencies-steal-from-fintech-startups-to-feed-starving-corporates/ http://duncanmalcolm.com/why-digital-agencies-steal-from-fintech-startups-to-feed-starving-corporates/#respond Fri, 21 Sep 2018 01:23:47 +0000 https://duncanmalcolm.com/why-digital-agencies-steal-from-fintech-startups-to-feed-starving-corporates/ Ok, maybe a little clickbaity as a title. But fundamentally this concept is true from an innovation perspective. Who steals from whom? While co-founding EveryCity in 2007 I worked with a lot of start-ups, agencies and a few corporates. Over those two years the following became very clear, although to my knowledge rarely articulated together… […]

The post Why Digital Agencies steal from FinTech Startups to feed starving Corporates! appeared first on Duncan Malcolm.

]]> Ok, maybe a little clickbaity as a title. But fundamentally this concept is true from an innovation perspective.

Who steals from whom?

While co-founding EveryCity in 2007 I worked with a lot of start-ups, agencies and a few corporates. Over those two years the following became very clear, although to my knowledge rarely articulated together…

  1. Startups: Take risks. They define innovation and build bridges at a pace that incumbents just can’t.
  2. Agencies: ‘Steal’ the patterns, processes and high level concepts and sell these as services to Corporates.
  3. Corporates: Hold on for dear life. If they have the foresight they sweep up the best of the startups when they can.

After a decade in technology I’ve witnessed life from the inside of each and I can categorically assure you it’s the truth (most of the time).

The corporates however, still want on the bus, so hire agencies to bypass their slow internal processes. This can work but doesn’t always. Most entertainingly was the case of at least one product I’m aware of that was built for a bank by an agency that was too innovative and shelved.

*Side note…number of post-it notes on a wall or incubator room does not correlate with innovation.

Can incumbents pivot/innovate?

There are examples here and here of businesses that have successfully pivoted, Starbucks being one of them. They started selling coffee machines and realised that instead they needed to sell coffee.

However, there also appears to be a trend. Most of those businesses were engineering heavy and either engineering or founder led.

On the other side of the coin in the last 10 years 421 retailers who employed 305,912 people went down the pan. That’s about 1% of all people employed in the UK.

Like the knight under the bridge from Monty Python despite watching sales plummet and margins erode they have stood defiant in some belief that everything will go back to how it was. None more so in my mind than Blockbuster, who despite seeing change coming at them from a 100 miles way stood steadfast until they toppled over.

Incumbent banks are a little more resilient but the fires are being lit at the castle gates…and banks aren’t known for change.

There are of course notable exceptions in the business world. The most obvious to me would be Lego. Their CEO Jørgen Vig Knudstorp took up post aged only 35. He turned around a company who were loss making and led a 600% increase in turnover from 6.3 billion to 37.9 billion in 2016. Aged 48 he stepped down to become chairman. Many thought appointing him a risky move but in reality very sane.

The gold rush is coming…

What’s unusual/exciting/full of opportunity for FinTechs is that the market hasn’t yet hit the maturity stage yet.

It’s very clear that there’s no Google of Fintech out there yet. This is showing painfully with only 18 FinTechs acquired by US banks and the relatively low valuations in acquisitions.

If you compare consumer tech (Alphabet/Google has made over 200 acquisitions) then we’re really at the dawn of time for FinTech.

What I expect (and assume everyone else is thinking the same but would love to know your thoughts) is that some well capitalised aspiring ‘new banks’ the likes of Monzo, Revolut, Funding Circle et.al. will start hoovering up FinTechs to build out their businesses.

The post Why Digital Agencies steal from FinTech Startups to feed starving Corporates! appeared first on Duncan Malcolm.

]]> http://duncanmalcolm.com/why-digital-agencies-steal-from-fintech-startups-to-feed-starving-corporates/feed/ 0 “Product is Hard” by Marty Cagan at Lean Product Meetup http://duncanmalcolm.com/product-is-hard-by-marty-cagan-at-lean-product-meetup/ http://duncanmalcolm.com/product-is-hard-by-marty-cagan-at-lean-product-meetup/#respond Mon, 04 Jun 2018 09:08:12 +0000 https://duncanmalcolm.com/product-is-hard-by-marty-cagan-at-lean-product-meetup/ Marty Cagan heads up SVPG (Silicon Valley Product Group) and is a veteran product leader. This 1h46 talk of his at the Lean Product Meetup 25th January 2018 is really great stuff. He shares some of the key insights from his book ‘Inspired’ which is a worthwhile read if you want to be a real […]

The post “Product is Hard” by Marty Cagan at Lean Product Meetup appeared first on Duncan Malcolm.

]]> Marty Cagan heads up SVPG (Silicon Valley Product Group) and is a veteran product leader.

This 1h46 talk of his at the Lean Product Meetup 25th January 2018 is really great stuff. He shares some of the key insights from his book ‘Inspired’ which is a worthwhile read if you want to be a real innovator.

The post “Product is Hard” by Marty Cagan at Lean Product Meetup appeared first on Duncan Malcolm.

]]> http://duncanmalcolm.com/product-is-hard-by-marty-cagan-at-lean-product-meetup/feed/ 0 My Product Management Course Blackbook 2018 http://duncanmalcolm.com/my-product-management-course-blackbook-2018/ http://duncanmalcolm.com/my-product-management-course-blackbook-2018/#respond Mon, 08 Jan 2018 22:44:02 +0000 https://duncanmalcolm.com/my-product-management-course-blackbook-2018/ I’m a big believer in keeping knowledge fresh and up to date. Whether that's a course, event, YouTube video or a good old fashioned book. In this article I run through some of my favourite places to learn about product.

The post My Product Management Course Blackbook 2018 appeared first on Duncan Malcolm.

]]> I’m a big believer in keeping knowledge fresh and up to date. Whether that’s a course, event, YouTube video or a good old fashioned book.

Some of the best content that has left lasting impressions on how I approach my work have been from free or near free content. Career wise I’ve found some certifications useful from a CV perspective but less useful from a content perspective.

Getting experience

When I was younger visiting an RAF base one of the pilots told me that they reckoned 10 hours in the simulator was worth one in the cockpit. The same is probably true for most jobs including product management.

You should get to know the basic theory but then once you’ve got it the next step is to build something. Don’t wait too long.

But learn on a low stakes product where mistakes won’t be a career ender.

Getting involved with a product at work, building small side-project app in an area that interests you or going to a hackathon are probably the best places to get some hands on experience.

So here are the courses and places that I’ve found some of my best learnings…

Learn from the community

ProductTank

A global network of product managers, they run free talks all around the world. Often sponsored with few free drinks thrown in. You can hear from product leaders on their areas of speciality. Not every talk is a hit but they are almost all insightful. You’ll also get to network and meet some very interesting people.

http://www.producttank.com/

Learn first hand

Hackathons

Fancy building a new product in 54 hours? Whether it’s a start-up weekend or a more general hack event, I highly recommend going to at least one.

They are a great place to try out some of the skills you learn from courses with little to lose. If you happen to be a subject matter expert with some insight into a little problem that needs solving, then all the better.

https://startupweekend.org/ & https://www.hackevents.co/

Learn and get certified

Agile Project Manager AgilePM, APMG

Technically not a pure product course. But it is probably the most realistic framework for agile that I’ve seen work for more corporate organisations. It’s a good course to cover base product/project skills and in five days they cover a lot of content. While not the most widely recognised certification I found it to be one of my favourites.

https://apmg-international.com/product/agilepm

Certified Scrum Product Owner, Scrum Alliance

I really only took this course only for the piece of paper. Recruiters and employers like to see it on a CV. It’s two days and it’s aimed at people in corporates who want to start being a bit agile.

Overall, I didn’t find significant value it’s about £1,000 which I found to be punchy considering the scope. However, if it was the first course you ever took it could be useful. Most of the content is included in the APMG course in one form or another.

https://www.google.co.uk/search?q=scrummaster

Learn from the best

Lean Product Management, Dan Olsen for Google Ventures

I can’t stress how good this video is. Most of what you need to know about the basics of product management can be taken from this Google Ventures video aimed at start-ups.

It’s succinct and to the point. Dan’s book Lean Product Management goes well with the video and for me it’s one of the best videos I’ve seen on the subject.

https://www.youtube.com/watch?v=mIBccpqUcgY

“Product is Hard” by Marty Cagan at Lean Product Meetup

If Dan has the tools, Marty has the process and people nailed down. Well worth the watch and goes well with his book ‘Inspired’.

https://www.youtube.com/watch?v=gCYFmrvPI8Q

Mind The Product Vimeo Channel

Once you’ve covered some of the basics with Dan and Marty, MTP are the next stop. They are awesome and they post all the talks from their conferences around the world online. There’s no other place you’ll get more content.

https://vimeo.com/mindtheproduct

Learn from success stories

Mixergy, Andrew Warner

Successful entrepreneurs are considered the pioneers of product. Andrew provides an almost endless insight into successful products. His interviews provide an amazing lens into the world of entrepreneurs, start-ups and how they build their products and businesses.

You can get them as a podcast for free and you can pay for the back catalogue of courses which range on all subjects from how to find ideas for product to marketing it. I’ll probably do a separate post on my favourite Mixergy videos.

http://www.mixergy.com

Learn from online courses

Interaction Design Specialisation, Courersa University of California, San Diego

I took this full course. It’s pretty good and practical. It forces you to go through the motions of building a product including some basic research, design and some handy to know about statistics. It’s worthwhile to understand all the concepts and I found it quite fun.

https://www.coursera.org/specializations/interaction-design

Become a product manager, Udemy

I’ve not personally taken this course but I have used it to coach junior PMs core skills. It’s currently on sale for £10.99 down from £195 and is taught by two actual PMs rather than academics so is quite practical.

https://www.udemy.com/become-a-product-manager-learn-the-skills-get-a-job/

Agile Product Management Specialisation, Coursera – University of Alberta

While I haven’t taken this course, it looks to be very comprehensive. It’s covers a lot more practical and hands on day to day delivery-based content than say Dan Olsen’s conceptual product management models which is why I’ve included it.

While product managers and project managers are very different roles. The reality is that at a minimum you need to understand the working environment. More often than not you’ll find that as a product manager you’re also expected to be involved in many project manager-based tasks. This course looks to cover both off in a balanced manner.

https://www.coursera.org/specializations/product-management

Bonus: Learn strategy

Strategic Management & Innovation, Coursera – Copenhagen Business School

If you’re a little more senior in your current role and don’t have an MBA/business school background this could be an interesting course to take. Copenhagen Business school is a well reputed organisation and this course looks to show that off.

It’s aimed at senior leaders/consultants involved in more strategic projects. However, given the space of innovation I expect that it would be useful context when working with CxOs.

Note: IMHO most careers/gigs in the strategic consulting space look for a big 5 background so I wouldn’t be looking at this course as a precursor to strategic consulting gigs unless you’re currently a CxO.

https://www.coursera.org/specializations/strategic-management

I’ll try to keep this updated as often as makes sense. Post a comment if you think there are any that I really should have included.

The post My Product Management Course Blackbook 2018 appeared first on Duncan Malcolm.

]]> http://duncanmalcolm.com/my-product-management-course-blackbook-2018/feed/ 0 My eBay UI/UX Teardown & Redesign http://duncanmalcolm.com/ebay-uiux-teardown-redesign/ http://duncanmalcolm.com/ebay-uiux-teardown-redesign/#respond Wed, 22 Jun 2016 13:57:39 +0000 https://duncanmalcolm.com/ebay-uiux-teardown-redesign/ The My eBay area is a UI/UX horror show which I’m not sure has been revisited since eBay launched last decade. I believe that the purpose of the area is to allow users to review items they are buying/selling and message other users. The closest analog from a classic eCommerce site would be a basket […]

The post My eBay UI/UX Teardown & Redesign appeared first on Duncan Malcolm.

]]> The My eBay area is a UI/UX horror show which I’m not sure has been revisited since eBay launched last decade.

I believe that the purpose of the area is to allow users to review items they are buying/selling and message other users. The closest analog from a classic eCommerce site would be a basket or a shortlist.

eBay’s front end is generally not too bad. Finding and bidding/buying products works quite well. Launched in 2005 eBay has been around for a long time and is now a listed company (NASDAQ:EBAY).

Rather than rant about how bad the UI is…in this article I’m going to deconstruct and reconstruct My eBay to better fulfil user needs and improve the usability and UI aesthetics.

Why eBay and why now?

ebay logoAs part of some studying I’m doing I needed to create some wireframes for a site that I use regularly but that could be improved.

Rather than just do wireframes I figured I’d make a case study of it as all to often any work that I do I can’t release because of NDA’s.

eBay stuck out like a sore thumb.

As a regular user I often find the interface confusing and it’s surprising that such a well established company have such a painful UI. They also have a ‘Tell us what you think’ link so I thought I’d go into detail…

I should make it clear that I have no affiliation with eBay they have never been a client of mine and this work is purely my personal views and not that of anyone I work for.

Redesign goals

My background is in product management so I’ll be looking at what can be improved not just on an aesthetic basis but also with revenue and most importantly simplicity as per the 6 simplicity factors (time, money, effort, cycles, deviance, routine) as defined by user behaviour expert BJ Fogg.

The current interface is very busy and combines quite a few different task types together. This likely does not help the user achieve the action that eBay is seeking which is to buy and sell items.

eBay’s business model for those who aren’t aware is to charge fees based on final selling price of the listed item. They also make an additional transaction fee if you use their subsidiary Paypal to pay for your item.

Approach

There are many people who offer up redesigns with no rational as to why they came to the result they did. I expect that this happens because it’s much more time consuming to do a proper job than knock out some pretty mockups.

I can only imagine that this leaves some people under the illusion that rebuilding the front-end of a site is potentially more trivial than it really is.

This is mainly going to be an evaluation of unmet user needs and one of many possible solutions to meet those needs.

Steps:

  1. Consider personas
  2. Identify current challenges and key user tasks
  3. Review and update information architecture (Sitemap)
  4. Review and update interaction design (Wireframes)
  5. Update visual design (Mockup)

I won’t be going too deeply into value proposition and prioritisation of what should be rebuilt but will look at the more common areas of UX as laid out in Jesse Garrett’s now well known book Elements of User Experience.

Testing

26/04: In this post very little regarding user research testing has been mentioned. It is a step that is all to often missed. I’ve added a little testing/feedback comment at the end of each section covering the kind of feedback/testing that should be involved.

This is critical to the process. If you are not doing it you are setting yourself up to fail. And fail hard.

I know of companies that have launched products spending tens of thousands on new products without even as much as a single bit of user feedback.

More often than not those projects have failed hard.

As part of this process you should be at a minimum doing the following:

    • Personas: Researching who personas and validating that the organisations assumptions are correct
    • Challenges & key tasks: You should be interviewing as many users as you can to further validate personas as well as identify and rank the user challenges
    • Sitemap: There are many UX tools you can use such as card sorting and priortisation matrix’s
    • Wireframes: You should get these in front of users and get them to try to complete key tasks to get feedback
    • Mockups: Again more feedback to make sure you haven’t missed anything
    • Live: Once live you should be testing your new designs against control

In the fullness of time I will try to update the post to include testing and feedback on all of the above so that it is a full and realistic case study.

1. Personas

A handful of realistic personas are essential to be able to validate your design decisions. Ideally they should be based on actual user interviews combined with data. This will increase your odds of building what your users actually need.

While I’m sure that the product team at eBay have many personas I’m going to keep this part fairly simple and go with one persona.

I will however also be taking into account heavy eBay users who may have slightly different needs.

James Williams

paramedic-j

      • Age: 35
      • Gender: Male
      • Education: Bachelors degree
      • Job: Paramedic
      • Income: £35,000

“If I can I’ll buy things second hand rather than new and if I have something that I don’t work I’ll usually try and sell it. I don’t see the point of throwing away perfectly good stuff when there’s probably someone out there that could use it.”

James is a paramedic. He lives with his housemate in London. I work 5 days on 5 days off so when I’m not working I’ll often keep my eye on a few items and probably buy 1-2 items off eBay each month. Once every 2-3 months I also do a clear out to sell anything I don’t need.

Technology use:

      • Average
      • Owns a smartphone
      • Uses a tablet at home while watching TV
      • Regularly uses technology at work

Testing/Feedback

Where I have seen people fail the hardest regarding research is in their persona creation. Almost without exception both marketeers and management think that they know who their users are.

They build personas which inform products based purely on anecdotal and assumptions rather than research and data.

At a minimum personas should be built on a foundation of analytics data. This should be combined with user interviews ideally with well thought out questions/structure to build pictures of who the different user groups really are.

Hard data always wins in the boardroom so make sure you’ve got it to support your case.

Note: If you haven’t yet launched your product you might not know who your audience will be, that’s fine survey and interview your beta users before you launch (you have those right if not wtf?).

2. Identify current challenges and key user tasks

Once you have your persona, hopefully from your interviews you’ve uncovered some unmet needs or challenges your users are facing. These unmet needs/problems could also be based on feedback to your support or sales teams.

Part of the challenge the My eBay pages face is that they lacks definition. In my view it’s try to achieve too much in a single area.

As it is currently designed users can browse for new products via some of the lists (Searches you follow/Sellers you follow)…as well as act on items that they have shown an active interest in (buying/selling/communicating)

James faces problems relating to two main areas:

      • a. Navigation: Quickly finding items he has bought or is buying/selling
      • b. Communication: Communicating with other users is complicated

a. Navigation

Navigation in My eBay is confusing with 20+ sidebar menu options and multiple tabs, filters and options.

      • James often has to try multiple options to find what he wants
      • Wording appears inconsistent
      • Menu items don’t seem to follow any particular order

My_eBay Summary
My eBay. Currently My eBay tries to achieve too much in a single view and has too many options.

James wants to be able to:

      • Review status of items he is considering buying/actively bidding on/selling
      • Remove items he is monitoring for purchase or selling
      • Place new bids on items he is buying
      • Check details on items he is buying
      • Update details on items he is selling
      • Quickly find and sort through items he’s considering buying/selling

Sometimes James is interested in:

      • Viewing seller’s other items, however only when they’re mentioned in the description

The current interface allows users to:

      1. Monitor products they are considering buying
      2. Monitor items they are selling
      3. Message other users relating to items they are buying/selling
      4. Items the sellers they are following have listed
      5. Searches they are following/Saved searches
Grouped these relate to:
      • 1-3 items the user has explicitly expressed an active interest in
      • 4-5 items the user may be interested in

A better approach

      • Remove non-core areas
        • Reduce cycles: Simplifying the My eBay area will make its purpose clearer
      • Reduce number of visible filters and consolidate
        • Reduce deviance: Users are very familiar with list filtering tools in eCommerce experiences, showing every option available is not necessary
        • Reduce cycles: Having too many options (20+) makes decision making harder for user

Further considerations

      • Heavy users who list a large number of products need to be able to take a volume approach to reviewing and updating items

b. Messaging

Current approach to messaging is similar to an unthreaded inbox and James often struggles.

      • James finds it difficult to find all messages relating to a particular item
      • Replies aren’t shown when you look at messages so you have to hunt around
      • Messages are not threaded

My_eBay__Messages
My personal eBay message inbox. All of these messages relate to two items I recently bought.

James wants to be able to:

      • Quickly find communications relating to items
      • Wants to be able to see the entire conversation in one place

The current interface allows users to:

      • See each individual message received
      • Review sent messages in the sent message folder
      • Sort messages by sender/received date/item status

A better approach:

      • Messages grouped by item they relate to
        • Reduce time: Navigating between messages relating to a single item takes longer than having all of the messages in a single place
        • Reduce cycles: User has to remember previous messages
      • Conversation view of messages
        • Reduce deviance: A growing number of messaging systems use a conversation view, very few use unthreaded messages

Testing/Feedback

The question we’re really trying to answer here is what is broken?

Where I can I’ll do all of the following:

  • User interviews/surveys: Ask people what they like/dislike!
  • Record/watch users: Nothing beats seeing your user using your product and seeing where they struggle
  • In-site surveys/feedback: Whether it’s a tiny poll or feedback from customer service teams all valid information
  • Analytics: See where conversion rates could be improved or where conversion funnels are leaking

As a warning, the well known Henry Ford “Faster horse” quote comes to mind. Users often don’t have the best answer to solving problems so it’s really up to you to decipher and interpret all of the information correctly.

3. Review and update information architecture

Now we have identified some of the problems the user is facing it’s always worth mapping out the current sitemap. This will allow you to use it as a reference to make sure that you are not accidentally removing functionality as you move forwards with your design.

It also serves as a discussion tool as to what should be removed. I’ll keep this brief and will only be looking at architecture specifically relevant to My eBay.

Current My eBay sitemap

There are a lot of options. All told the user has no less than 47 different options to choose from. That is a lot especially given that the general rule is 5 options +/- 2.

my eBay sitemap
Current My eBay sitemap

Suggested My eBay sitemap

      • The menu hierarchy is grouped by task: Buying / Selling / Communication / Administration to make it easier for users to know where to start
      • The majority of the secondary navigation in Buying/Selling/Communication can be replaced with filters.
      • Messages have an additional filter called type, to filter between messages from sellers/buyers
      • There is no activity feed here as these are already handled as notifications in the header

My eBay Sitemap Suggested
Suggested My eBay Sitemap

Testing/Feedback

You might have your own opinions on how data should be sorted but it might not be intuitive. Once you have some thoughts on how data could best be sorted you need to validate your thoughts.

Tools I like:

  • Card sorting: Get users to organise how data should be organised for you
  • Sitemaps: Use them to show how current information is and could be organised
  • Mindmaps: Great way to get a birds eye view on what is going on and get everyone on the same page

4. Review and update interaction design

Now we’ve plugged out a new sitemap there’s an important question of how the users will complete the steps you want them to in order for your app/site to accomplish its goals.

This should be mapped out in terms of the steps a user should take (workflows) as well as some rough designs (wireframes) so that you can test with colleagues and possibly users to see if the interactions make sense to users.

a. Workflows

The workflows below are simplified but essentially you should map out everything a user might want to do and the order that they should complete them.

Where possible the processes should be simplified to remove unnecessary steps. You could also go into more detail than I have around how users will interact. This could include whether steps load a new page, a menu, or reload items using js/ajax…

Those tasks should then be prioritised in order of importance and how prominent they should be on the site. This could detail actions/user process that are the most important to trigger the user into doing.

As before you should have some data to help guide the importance and usage of the features/processes so that you can establish the correct visual hierarchy. There’s a great article at smashing magazine with more detail on workflows here.

Buyer workflow

The buyer workflow in eBay is pretty straight forwards. Once you’ve shortlisted or bid on items you then return to review the items and their progress later on.

Suggested eBay buyer workflow

Seller workflow

Slightly more complicated, the sellers workflow has to cater for more options and also has to cater for quite a wide degree of flexibility.

eBay seller workflow
Suggested eBay seller workflow

Messages workflow

I’m not going to map out messages as I’ve got a fairly set idea of how it could work. There’s also only a few actions, view message, send message, delete message.

b. Mockups

This is where the rubber hits the road and you can start to roughly sketch out the layout.

Good practice would dictate that you have a list of all of the processes in your workflows above and that your make sure that the user can figure out how to perform each of them.

Navigation

The current site has over 20 options to choose from. I’ve cut this right down and tried to make something that is browser and tablet friendly.

Main changes:
      • Reduced options from 20+ to 4
      • Split side bar titles between functional titles (Buying/Selling/Messages/Account) and filter items (Status/Sort)
      • Sidebar space used to show summarised list of items that user can select/scroll
      • User can see listing info without leaving page

Messages

The current messages lack a lot of context. On the assumption that 90% of messages are sent in relation to an item that’s how they should be grouped. Those that are not related to an item can just be listed as a standalone conversation.

Main changes:
      • Messages threaded to items so that there is only one thread per combined user & item
      • Additional summary information in sidebar
      • Filters to allow users to quickly get to relevant messages

eBay - My eBay.003

Testing/Feedback

Once I have some wireframes I would usually get them in front of a few potential users. It doesn’t matter if that’s a few unsuspecting people in the local coffee shop or users online.

Usually I’ll build wireframes using GoMockingBird or a presentation tool like Keynote/Powerpoint and then get feedback using a tool like InvisionApp.

It’s critical when getting feedback not to just let users click through your interface. Ask them to achieve specific tasks and measure how they completed those tasks time/clicks/effort. Did they get lost? If so where…

5. Update visual design

Last step! Now we have some wireframes and assuming we’ve done some testing, even if it’s only internal, it’s time to do some colouring in.

Now I’m not a designer by any stretch of the imagination so apologies for the quality. I built the mockup with Pixelmator rather than Photoshop to see how it would work out. The elements are spaced on a standard 12 column 960px template.

Rather than mockup the whole of the My eBay area I’ve decided to go for just one screen. Mainly because I’m short on time more than anything else.

      • Colour scheme and visual elements maintained
      • Added search filter to the items list
      • Additional actions (message & remove) via toggle in top right of list items

Before/After compared

[image-comparator title=”” left=”http://www.duncanmalcolm.com/wp-content/uploads/2016/06/myebay-before-2.jpg” right=”http://www.duncanmalcolm.com/wp-content/uploads/2016/06/myebay-after-2.jpg” width=”100%” classes=”hover”][/image-comparator]
Hint: Move your mouse of the image to see the before and after mockups.

Final mockup

My eBay 960 v0.4

My eBay 1200px My eBay 1200px
My eBay 768px My eBay 768px
My eBay 480px My eBay 480px
Hint: Click image for larger size mockup.

Testing/Feedback

Once I’ve got my final mockups again I’ll usually get them into InvisionApp and get some more feedback. You’d be surprised at how helpful users can be at spotting UX/UI bugs, typos and things that don’t work.

In the past I’ve used actual users, Mechanical turk and Upwork to find people to test and give feedback on interfaces.

Finally get it live and A/B test it alongside current designs. See if your new design performs better.

Conclusion

When eBay was launched the areas addressed above would probably have met needs. However as UI/UX has evolved expectations are higher and the current site is not meeting needs of users as best as it could.

What I’ve suggested is just one option. Before an overhaul like this I would expect quite a few more options as well as significant testing and user feedback to make sure it’s the right direction.

It has been quite fun putting together this post and hopefully someone finds it useful. At a minimum I hope that eBay update their site sometime in the next 10 years.

Let me know what you think in the comments.

The post My eBay UI/UX Teardown & Redesign appeared first on Duncan Malcolm.

]]> http://duncanmalcolm.com/ebay-uiux-teardown-redesign/feed/ 0