Field notes

Lessons from building a card issuer's fraud stack.

Notes from Made Card's fraud review, from the first application on, written for fellow practitioners.

Sahasranaman Ranganathan

Chief Risk Officer at Made Card, co-founder of Truluce

1Field note

How we cut referrals from 50% to 15%

Every new vendor and signal went into our database the day it arrived. With a couple of months of applications, we could measure what each one added to the funnel.

Abandonment at the step-up was the usual problem. Some of it is fraudsters giving up, which is good. But our partners told us genuine applicants were dropping off too.

IP mismatch looked like a strong signal. In practice, phones switching between Wi-Fi and cellular made a flood of false positives.
Proxies and VPNs aren't all risky. Privacy-preserving browsers and everyday consumer and corporate VPNs are common, so look for what separates them. We considered asking applicants to turn VPNs off, and decided against it.
We tuned address checks for the channels where official records predictably lag.
Stepping up applicants for first-party fraud isn't meaningful: a document check doesn't show intent.
A timely nudge, by email or text, cuts abandonment. We built it into the underwriting flow itself.

Applications referred to review

50%

before

15%

after

So far, only false positives removed.

2Field note

A passed ID check is no longer the final gate

At our volumes, a person reviews every step-up. Twelve months of that taught me how fast the other side moves.

I learned it one case at a time, comparing two sessions, combing through dashboards and county records, and remembering faces.

Fraudulent document checks got dramatically better in a year. The identical laminated tables of the early days gave way to hyper-realistic backgrounds.
Fraudsters learn from every denial. Selfies of young adults posing as seniors were common once, and are gone now. A ruleset has to keep changing to keep up.
A face that failed a liveness test came back months later under a different identity, and passed. I knew it because I had seen the face before.
The device and network signals of the ID-check session matter, on their own and compared with the application session. It took months to learn which differences mean something.

One face, two identities

First application

Failed liveness

Months ago

Another identity

Passed

Last month

same face

3Field note

No single vendor is a silver bullet

Before our beta launch, a fraud ring found our application page. One application got through and went straight to a $20 purchase at ChatGPT.

Then came first purchases at a gun store and a golf-club dinner in LA, on legitimate identities: first-party fraud. Each lesson added a vendor, and a step to the waterfall we run in Taktile.

Read every score you pay for. Those PII risk scores and correlations? Don't ignore them.
Reject only on high-confidence signals, and skip the remaining steps for those: it keeps vendor costs down.
Approve automatically only when every vendor comes back clean. Everything else steps up to a document check and a person.
Run a retro study before you sign. That's how we chose our first-party fraud model.
Expect change. We've made 40 changes to the onboarding flow so far.

The waterfall, in Taktile

1Identity risk scores
2Identity verification
3Device and network
4Phone intelligence

All clean: approve Else: step up

Next in the series: point of sale, accounts and payments.

If something here sounds familiar, or reveals a gap, let's talk.

Talk to Sahas