Cheating Payments: The Hidden World of Game Fraud

Welcome to the Naavik Gaming Podcast, where it is our mission to explore the business and future of video games. We bring together the industry's brightest builders, investors, and thinkers to keep a pulse on current events, dissect emerging trends in games, share lessons learned, and have a great time. This podcast is also part of Naavik's growing ecosystem, which ranges from free and premium research to consulting and advisory services. For more information, visit www.naavik.co. This episode is brought to you by Heroic Labs, which powers some of the world's biggest games with its Heroic Game Stack. Its composable products are Nakama, the open-source backend game server; Hero, the game development framework for all your live service game features, including the complexity of managing offline mode; Satori, the

world-class live ops product for maximizing monetization and retention; and lastly, the Heroic Cloud to provide massive scalability. After nearly 10 years of operation, thousands of studios trust Heroic Labs to help them focus on their games and not worry about game tech or scaling for success. To learn more and reach out, make sure to visit heroiclabs.com or check out the link in the show notes. Now, let's jump into the episode. Hello everyone. I'm your host Devin Becker, and today I'm delighted to be joined by Zack Nass, the head of gaming at insure.ai. insure.ai uses adaptive AI to help games prevent payment fraud. And so today we're going to be talking about issues around handling payment and fraud in games. So just to start things off, Zack, could you quickly go over your background, the origins of insure.ai, and what you guys do today? Absolutely. Thanks for having me, Devin. Really happy to be here. So my name is Zach. I am the head of gaming at insure.ai.

A little bit about my background. I am a huge gamer you could probably tell from what's behind me. All I ever wanted to be in in games at some point, but when I came out of college it wasn't quite the behemoth industry that it is now and didn't really know what else to do. So, I went into consulting, which is a good thing to do when you don't know what to do. But, I always knew at some point I'd try to make my way over to gaming. So, an opportunity came up a few years down the line. I had an opportunity to intern at Riot. So, I moved out west and set up shop there. I spent about four or five years at Riot both on international strategy and publishing. I then moved over to Google where I did some partnerships work kind of helping coordinate all the different business units at Google and do bigger and better things for the gaming industry. At that point that I sort of got into the payment space. I joined a company called Coda Payments. It was very big in Southeast Asia. They

were looking to expand their marketplace into the US. So, we'll talk a little bit more about how to do the whole B2C marketplace trend, but that was kind of you know, my origin of getting into the payment space. And then as I got more into it I got even a little bit deeper. So, now I'm focused just on the fraud space within that broader trend. And that's what we do at insure.ai. A little bit about the company and the origins of it. It actually started out as a gift card company. It was a gift card marketplace where you could go online and buy you know, gift cards for your favorite stores and brands and things like that. And they were getting hammered by fraud and they couldn't find a solution that worked in this digital goods prepaid space. So, they ended up building their own. And over time they're like, "Huh, this is an interesting business model in itself. Kind of more interesting in some ways than being a gift card marketplace. Why don't we spin that off and you know, that that becomes insure.ai. And so that's how we that's how we

became who we are today. Awesome. Quite the origin story there for for both yourself and the company. Just this is a topic we don't get into a ton you know, around gaming which is why it makes it interesting here. And so I want to better understand what are some of the major issues with payment fraud, you know, like it's a topic that just people maybe don't think about as much. Why is it important especially today? Like what what's changed? Why is payment fraud like a big deal to to worry about? Yeah, it's a good question. I think there's kind of two main answers to that and why it's it's much more important today. The first is just being if you look at the macro lens of gaming and how it's difficult right now and a lot of companies are struggling. Um, it's really important to make sure you maximize the profit that you keep. And I think you know, if you look five years ago, the gaming industry was growing, more more eyeballs were available. Um, you know, yes, people kind of knew they were paying a lot of money to Google and Apple and other service providers and things like that. But that was okay. That was the cost of doing business and

they were growing and it looked fine. And now we're in a world where things are contracting. Um, things are budgets are tighter and so there's more scrutiny going on. Hey, am I really getting as much value out of uh, you know, my sales as I actually could be. Um, that's putting a lot more emphasis on on the fraud part. Um, and then kind of combined with that is the whole trend towards D2C as more and more companies are trying to figure out how do we go direct to consumers? How do I open my own web shop? Um, and that's the part of it, but you got to get deeper because then there's all these other aspects below that. Um, you know, how do I collect taxes? How do I, uh, you know, do refunds? And one of them being how do I handle the payment fraud that before I didn't have to worry about. They were, you know, other people were handling it for me. Now it's going to be a a part of, uh, of our operations. Makes sense as people kind of want to sort of free themselves from the shackles uh of Apple and Google and other payment processors. That also means they got to handle themselves. And then they figure out, of course, that's one of the things that was being handled for them for a pretty hefty fee. So, I

guess the question is then, you know, especially when we're talking about hefty fees or anything like that, how does Ensure fit into that process and and how does it help? Yeah, so we work uh in a few ways. Um we typically partner with either marketplaces or merchants of record. Um kind of whoever carries the bag, you would say, for that transaction and making sure that the goods are delivered and the funds, you know, are are remitted appropriately. Um and so we would partner with them to make sure that the transactions that come in are legit um and that they're keeping out the bad actors, approving as much as possible the good actors, and um keeping the chargeback flow. And there's kind of two aspects of it because on the one hand, you want to you want to minimize your chargebacks, right? You want to minimize fraud and make sure you're keeping as much money. But if you turn that dial too tight, then you're you're nothing comes out. Then you're you're blocking too much traffic and your approval rates suffer. So, you end up turning a a cost problem into a revenue problem. So, it's really hard to find that sweet spot and and find that dial. And that's exactly where

we fit in to help people figure out, you know, based on their customers, based on their traffic, um based on what they're selling, where to tune that dial appropriately. Well, when it comes to fraud prevention like in in online payments, right? There's different kinds of industries that have to deal with this in different ways. What really distinguishes fraud prevention in games from those in like e-commerce, casinos online, any of that stuff where it has to maybe deal with it differently? Yeah, so the problem that we're trying to solve is what we would call scalable fraud. And then scalable fraud occurs in a world where um there's little uh you know, KYC or or identity checking. Um the goods are delivered immediately. So, when you go on a marketplace and you buy a CD key, it's delivered to you immediately and you can immediately go and turn it around and sell it somewhere, you know, possibly on the black market or or a gray market or something like that. So, in that case, you're in a situation where you have very little time to decide, you know, is this a good transaction or not because

you know, the player you expect the code to show up in your inbox immediately. You don't want to wait till tomorrow or the next day for it to show up. You want it right away. So, that puts the pressure on the seller to really make a good sound decision in that in that instant. Yes, this looks good or no, this looks bad. In traditional e-commerce, if you're, you know, buying a TV or sneakers or whatever, there's more time to evaluate the transaction before the good physically ships. Um, there's more things you can verify in that case. You don't have that time in a digital good, you know, landscape. You have to make that decision instantly. It's similar with um, uh, casino gambling. Uh, in some ways it attracts a lot of fraudsters, but in some ways it's a little less uh, risky because you there is a lot of KYC and there is a lot of hoops you have to jump through when you're online gambling. They know exactly who you are and uh, kind of where that money goes. Um, in our case, you know, when you when you sign up, all you need is an email address. You don't really need to put your real name. You don't need to put your real address. Um, or even just your

username that you use. It's, you know, very very fast and you can uh, make a transaction easy. Okay, well, then I guess the question I have is uh, you know, in this whole payment flow system going from, you know, the user putting in payment information all the way to money being extracted and sent over to essentially the the game developer, where do you guys fit into that payment flow process? Pre-bank, post-bank, uh, after information put in, all that stuff. Where does it fit actually into that process? Yeah, there's a couple ways we can work and it depends on how our partner wants to work and um, you know, what their risk tolerance is and, you know, at the risk of boring the people out there listening with too much information in the weeds, um, kind of the the two main areas like you said are pre-auth post-auth. So, when a transaction gets sent, it gets sent to the bank and the bank does a a quick check on, "Hey, does this card have sufficient funds? Do is it a known you know set of cards that we know is flagged for fraud?" But, the But, that's about it. There's not too much more

scrutiny going into it than that. So, where we typically like to sit is after that. The The bank says, "Yep, okay. There's enough money on that card and it looks like a fine card." Um but, we haven't captured the funds yet. So, we sit in between and then it gets sent to us and we take a look at it and based on all the data that we see, we say, "Okay, yes. We agree, you know, with the bank. That looked like a good transaction. Go ahead and capture it." Or, "Nope. There's some red flags here. We don't think this is is legit. You should not capture it." Um we kind of work pre-auth, too. Some Some of our partners do like to do that because it actually sends cleaner traffic to the bank, which can have some benefits in how your risk profile looks to the issuer. The trade-off is there's a little bit less information usually that we know about the transaction at that time. So, you kind of just have a little trade-off there. But, it really just depends on how the how our partner wants to do it. Well, in the risk of of getting further into the weeds here, you know, you talk about verifying users

and and try to understand whether or not it might be fraud and things like that. Can you walk us through that process at least, you know, in level detail that makes it a little clearer how this actually works and how you analyze the user, how you analyze the payment being made, or whatever other kinds of things you're doing that's help deciding whether or not to verify that transaction. Yeah, in this new world we think that behavior is actually more indicative nowadays of fraud than what the transaction data set. So, legacy providers that a lot of people are probably using as part of the suite of services they get from, you know, Stripe or Adyen or whoever else they're using for their payment processing. Um a lot of that is is getting past transactional data. You know, what's the card number, uh does it does the billing address match what they put into the system, does the CVV code work? Um it's kind of just hard numbers and and data matching up and making sure that works and that gets done. Um it's pretty easy now to to kind of get

around that based on a lot of these fraud rings that we see and how sophisticated they are at uh stealing credit cards and finding them on the black market. So, that part has become less you know, accurate in in in saying if this is fraud. And really what we think is the future and where we're trying to push it on the behavioral side. So, understanding how does this person interact with the website? Do they look like a fraudster? Do they, you know, do they copy and paste a bunch of things really fast because time is money and they're just trying to, you know, extract some value out of it or do they act like you and me uh where we're fumbling to, you know, find our credit card number and figure out what our user ID is and what realm we're on? You know, we act very differently than someone who's uh looking at this like a job and how they're going to get money out of it. And so, it's all those signals that we can pick up on that a lot of the traditional vendors aren't looking at and that's what helps make a better decision. Um and so, all that information gets fed into an AI model that comes up with the

right answer. Yes, we think this is a good transaction or no, this looks uh this looks suspicious. You know, speaking of all the different ways that that you guys are trying to understand the user, I guess the most important one especially these days, you know, is what role AI machine learning plays in the fraud detection process like in understanding those different variables, how you understand stuff about the user, and and how you train that model really. Yeah, I think, you know, in the past a lot of it was trial and error. Um a lot of the legacy systems that, you know, we we used were rules-based, and they'd look at things and say, "Okay, if this card has been used five times in the last 24 hours, you know, add a certain risk score to it." And if the postal code doesn't match, you know, what's on file, add this risk score to it. And then at some point it crosses a threshold, and you say, "Okay, this looks bad." Um but it was kind of humans, it was kind of us in the background saying, "Well, you know, should that threshold be five times in the last 24 hours? Should it be three times in the last 24 hours? And should

it be adding 10 points of risk score? Should I be adding 20 points of risk score?" You know, it's it's a lot of trial and error to get this thing just right. And that's, you know, where the machine learning and the AI can really come in and and just automate that process and and figure out what the right answer is for that. Um and the other benefit of it is you can just throw so much more data at it. As you can imagine, when you have all these rules, uh they got all these branching paths, and at some point you kind of you lose it, right? It's too much for a human mind to comprehend. Um what we can do is we say, "Hey, throw us all the data. Throw us what the transaction data looks like. Throw us what that behavioral data looks like. Anything that looks relevant." And just, you know, let the AI do its thing, and it will come up with the best model that picks up on the the the faintest signal of fraud that would be very hard for you and I to, you know, figure out on our own. So in a way you're kind of scaling up sort of that human decision-making in a way, like where it's looking at lots of things that might be more subtle, but in

a way that you probably just couldn't do at any kind of scale with a human, like, you know, banks kind of used to try and do, and then of course they moved to more automated stuff. And maybe, I don't know, maybe they'll be using AI machine learning stuff if they aren't already in some of that decision-making, but that sounds like that makes sense. Where are you generally getting the kind of data to train this? Are you training it off real transactions that are happening with your platform, or is it ones that you have trained it on prior to it? I mean, obviously you don't have to get into the secret sauce if there is any there, but I'm just trying to understand where this data comes from to train that model. No, we we train our model on each partner specific data. And so, there's some third-party consortium data out there that that is shared across the industry and a lot of people leverage that, too, and we'll obviously look at that, but what we really find the value in it taking each customer data and looking at it specifically because there's so many differences. Even if you're a gaming marketplace, I'll I'll make it up, right? But if you're if you're selling, you know, Robux or if

you're selling, I don't know, Red Dead Redemption CD key or something like that, your traffic might look very different and your demographic might look very different. And when in-game events happen that look very different, right? And people might be saving up and you'll see like no transactions for a while, then the event will happen and boom, you get this big spike and something that's not trained, you know, to to understand that that's a normal behavior pattern in gaming would look at that spike and be like, "Okay, something wrong is going on. Let's block all that traffic." And then you get very angry gamers who are like, "Hey, this big, you know, loot drop just happened and I can't seem to get it." And we definitely don't want that to happen. So, understanding each of our partners' unique mix of business allows us to really identify, you know, what the trends are and make those more accurate decisions because because both are bad, right? You can say, "We don't want to let the bad traffic in." Of course, cuz you're going to get charged back. But it's equally as bad, you know, as a player, I'm a player, it's equally as bad if you reject legit traffic, too,

because then, you know, I don't get to play with my new skin that I've been looking forward to. So, it really does have an impact on the player experience, as well. So, when you're talking about these these transactions that are being made, if if a player has made transactions before, does that make it a lot easier to validate in the Is it Is there something where you also have to look for down the road odd behavior with a player that that has been known to be good before? Like let's say you know their card gets stolen or someone hijacks their account, which is you know account hijacking might even be something more prevalent than credit card fraud at this point. Is that something you guys are constantly checking the account every single time, but also like taking into account their previous behavior? Yeah, definitely. So I mean age of account and how many hours they logged and you know past purchases and stuff like that are definitely very important indicators that this is fraud. But you got to be careful because we see some very sophisticated scans or fraud rings where you'll have an account that's in good

standing, you know, and because what will happen is some somebody will, you know, reach out to say your grandma, you know, and you know, say, "Hey, open a an account on, you know, Roblox or whatever. That's all you have to do. Don't do anything else. Just open an account for us and that's it. And then the house will sit there for a long time. Nothing suspicious will happen. So you've got an account now that looks fine, you know, for 2 years. It seems like a normal account. Maybe there'll be a few transactions here and there that look normal, look good. And then one day, you know, boom, you'll just see all these uh spike in traffic coming on. And again, you have to know, okay, is this because uh that there's an event and this is is this real or no, this this is suspicious, you know, this account was very dormant for a long time. All of a sudden now it's doing a lot of traffic. Um how do we how do we make that decision? Um so, you know, those behavioral patterns are very important and the more data you have about the player as well as the transaction and and behavior, the more accurate your decision will be at the end of the day. What is it that's motivating this type

of fraud usually and and what kind of behavior are you seeing around it? I mean, you mentioned these sort of things where people will like flooding all these transactions, stuff like that. What is the general behavior and motivation behind that that you've seen at least so far? Yeah, it's making a quick buck. I mean, people have made lots of money um on these kinds of scams. And again, going back to the definition of scalable fraud and why that's different. So, you know, in the past you might have a phishing attack, right? And uh somebody gets your account ID and password. So, they log into your account and then they go fraudulent purchase or something. But usually you catch that pretty quick, right? And you get an email and you say you realize your account was stolen and you you close it down pretty quick. The damage is somewhat minimal and that fraudster then has to wait until they find the next victim to go after. In our case, what we're looking for are these vulnerabilities in the billing systems themselves um because uh of the transactions that allow many, many, many transactions to happen at

once. And so, you know, going back to that rule of the system, these fraudsters are smart and they're they're learning, too. So, they know, hey, this site can't use that credit card more than four times or five times. So, they just do three times and then they go on to the next credit card and just do it three times. They go to the next site and they tell all their friends, you know, in the fraud ring, hey, go to this site and you can nab nab some of these stuff. That's the type of fraud that we're looking at. Um and again, you you don't have a that much time to make a decision and it happens very fast. And in a day or two, you know, thousands of transactions could come in um that you're now on the hook for. I mean, are there any particular games or marketplaces that require a different approach or more nuanced approach? Cuz I mean, you're talking about just games in general, but there's there obviously are different types of purchases, different types of uh genres that might have different types of purchases, but then also different marketplaces, you know, talking about D2C ones or or different ways people might be purchasing things in games. Yeah, there's different risk profile that usually depending on the type of product that's behind it. So,

for instance, if you're buying something that's tied to an account, like I'm buying a skin and it's, you know, it's being delivered into a specific account, you that's wait less risky because, you know, the fraudsters basically have to have a buyer already kind of lined up on the back end and and tell it which account to go to. And that does happen, don't get me wrong. Like that still very much happens. You'll find these Facebook groups and WhatsApp groups or Telegram group that do do that kind of thing. Um, but the really risky products are more the CD keys, the codes that get emailed, right? Because those you don't need to have a buyer necessarily right away. Once you get the code, you can then go flood the market and and go figure out how to dispose them. Um, and so that's usually a riskier product. Um, you know, similar to how that's different for physical goods, right? If you're going to steal a bunch of iPhones, you got to unload them somehow, and that's hard, right? But in when it's a CD key or a code or something like that, that's very easy, you know, you just go back on on your WhatsApp group or your Facebook group, and you'll find people that are

willing to, uh, you know, deal with a shady, uh, seller to get a 20, 30, 40% discount off what they'd normally be paying. Yeah, it's interesting, you know, just the idea of like how they fence their goods essentially determines somewhat how they how they go about that fraud process and how you have to validate that. That's a good point, too, though, because, um, marketplaces too are specifically risky because they have both the buying and selling risk, right? So, if you're a studio, um, yourself and you're doing this, okay, someone steals the steals the credit card and charge back, you've kind of lost the digital good, which is bad. Don't get me wrong. Like that disrupts economies, it result in bad, um, you know, experiences for for players and everything like that. And there are plenty of people behind the scenes engineering and coding and artists that, you know, make money off the digital bits that are in the ether. Um, but it's even amplified more for a marketplace who kind of buys goods as like a

third-party distributor or something and sell them. Because they've already sunk a a real cost in, you know, securing the CD codes or whatever they're going to resell. So, now if that becomes a chargeback, they get hit on both ends. They've lost the product, and they've lost the payment. So, a lot of the the partners that we work with, um are kind of in the in the marketplace world where there's a real high risk there. That makes a lot of sense, and sounds unfortunate for for them to have to deal with as something to uh to cut into the profit. And hopefully that's something you guys can help with. But speaking of partners in general, uh I'm kind of curious how you guys work with them. Because obviously, they're not doing this in-house. Doesn't make sense for them to. And you're coming as an outside provider. How are you How do you collaborate to make sure Because obviously, you've got to get data from them. You've got to be part of their payment flow now. How do you collaborate with a game studio or a marketplace or any of these others to actually get into that process, get that data, get everything kind of set up? Yeah, so partners either come to us

with two two kind of use cases. One is, "Help, my fraud's on fire. I'm I'm you know, I just got hit by a huge chargeback. Uh would you help me figure this out? Please come help us." And that's a very obvious use case. And you know, we would ask certain questions about what happened and why that came to be, and we'd help them. The The more subtle use case, which probably is actually the larger chunk of the business that we work with, they're doing okay, right? They're saying, "Hey, my fraud rate's not that high. Um my approval rates are 70%, you know, 75%." And the market will tell you that's good. You know, they'll they'll say, "That's that's normal for gaming. That's normal for the industry." But it's really not. Uh you know, our data shows that 10% max, max would be actual fraud. It's really probably like five or two. Um but definitely no more than 10. So, you should be getting 90%, you know, at at a minimum. Um but it's going to take some extra work to get there and then all the things we

talked about, all the extra data and the behavioral indicators and all the transaction data, it it needs to, you know, be flowing in the right way. So, we like to work both with the the studio, the marketplace, whoever our partner, but we also work alongside the payment processor. They're a key part in this, too. Um, you know, some of them do have their own fraud tools that, you know, we do get compared against. Um, you know, why are we different? Why are we better? Do I really need both? Um, and the answer is, well, you'd probably choose one or the other. Um, but we don't really view ourselves as kind of competitors. We view, well, we're just different parts of the value chain and you know, an in-house fraud solution is probably fine for 95% of the industry and goods out there, but for gaming, you probably want something a little bit, you know, more hyper-focused and a little bit more tailored. And so, we would say, hey, work with us. Um, come along this journey with us and um, we have a lot of friends in kind of both the payment space and in the in the marketplace space um, and we all

collaborate together. Nice. Well, hopefully we can just globally reduce the fraud down to below that 10%, but, you know, prior to working with someone like yourself or competitor, um, do you have any tips or or strategies or ways of thinking about this for game developers, for marketplaces or anything like that to at least sort of work to help prevent the fraud as much as they can, you know, prior to that. Like, what are what are some strategies or ways to think about uh, how to adjust maybe their game, the marketplace, their payment system, anything like that? Okay, so the first thing is probably just to ask the right questions and look at your data and see how much money you might actually be leaving on the table. Uh, you know, as you mentioned at the beginning, this is something that people aren't used to looking for. Um, it's something kind of new. So, step one, you know, what are your approval rates? What are your fraud rates? And not to say that the payment processor are are hiding or obscuring the data, but a lot of times it just gets lumped together and it becomes like a small little line item that you don't really look at cuz you're kind of just looking at the the total. So, you know,

really dig in there and say, you know, what are my approval rates? Are they as high as we think they could be? Are we leaving money on the table? And then from there, you start digging into, you know, the deeper questions of why. Is it a certain product? Is it a certain geography? Is it a certain payment method? Um, you know, cuz all that can be triaged and and sorted out um to make sure that across the board you're you're getting the best results you can be. And there will be differences, you know, operating in Brazil will have a lot different rates potentially than operating in the US or operating Europe. And that's okay. But the point is you want to make sure you're maximizing what you can be getting in each of those markets and each of those products and each of those games that you're selling. So, yeah, that's step one. And then finding the right partner who's going to go along that journey with you. You know, some some kind of view it again as as competitors or they say you don't need a third-party tool. But again, you want to use the best. You want it to be with the most

optimized for gaming. So, using something that's kind of a legacy solution, good for a lot of industries, but not, you know, not set up for what what we need here in the gaming world. Oh, and speaking of, you know, deciding to to kind of go with a partner or anything like that, how would someone even notice that they were having a fraud problem? You know, some games are focused on launching, on getting these other things up, even if it's just a marketplace. It's a lot of work to do all that, especially in the sort of startup culture that we often have here. They're very focused on all of that working, on all those tech issues, putting out fires, things like that. How are they going to even notice or or know that there's fraud happening? Is it going to be mostly through chargebacks? Is it going to be a situation where they're just like suddenly see a revenue drop and they're thinking it's something else, but then they like would they even need to have like an event to detect hey there was a payment attempt and then it failed and actually have to have that in their analytics catch that like how how do people find out that this is a problem for them? Usually you find out because you get a letter from Visa or MasterCard saying

hey we noticed that there's a lot of transactions coming through that are fraudulent and you're getting a lot of charge backs so we're going to place you in this special monitoring program where if you don't get out of it you're going to be charged a lot more fees and if it keeps going you're going to get expelled and not able to accept credit cards. So that's a very scary letter to get in the mail you don't want to get that one but you know in the bad case that's kind of where when people first figure this out. I think most more commonly it's kind of that subtle approach where you're looking at your data one day and you're just saying like huh you know we sold X we so maybe we should have collected this so why is our you know net revenue only looking like this and it takes some forensic investigation to figure out where those leakages are but you know that's why this is important if you're a CFO if you're a CRO if you're a head of fraud like these are the things that you you you know should be looking for because they can be buried they can be hidden

and in today's world you know you don't want to leave any money on the table so that's kind of where it comes in you know if it's really bad you'll know there'll be a sign but a lot of times you got to go hunting for it yourself and that's sort of the education that we're also trying to do with the broader gaming industry is that this is a dial that you can turn and then it really is a dial because it's it's like saying the goal is not to minimize marketing spend right you want to optimize it you want to spend the most or the least or I'll spend the least that maximizes your return it's the same with fraud you need to accept some level of fraud because otherwise you're not accepting anything so what's that right level that you're you're pushing it to the marginal increase in fraud, you know, is getting you the maximum um return. And it is a dial, and that's what people kind of um need to understand about it. It's not Fraud is not a a scary thing to eliminate. You'll never eliminate it. It's something to work with um and make

it work to your advantage. So, in terms of the type of fraud we're talking about, a lot of times we haven't necessarily always dug into like what exactly the fraud is. Is it mostly like stolen credit cards or people that are I mean, I guess I I don't know what the other alternative be. Like what what are people doing that is under that umbrella of fraud that you guys are generally fighting against? Yeah, stolen credit cards is definitely the the main culprit here. Uh it's very easy to go on the dark web and buy a list of stolen credit cards, and they just kind of plow through them and see that that it works. Um the other area though is what's typically called a friendly fraud or or service-related fraud. And that's when people say, "Uh I didn't buy that." Or, you know, "My kid bought that." Or, um "I bought it, but you only gave me half the diamonds that uh that you said you were supposed to." Um and a lot of times, you know, the the banks just kind of accept that. Cuz think of it Think of anytime you have a problem with your bank, you complain to them, and they just say, "Okay." And they refund you the money

back, and you know, you go about you your way. Um but what you probably don't realize is that the the seller is ultimately paying for that. The bank is not eating that cost. They're passing that back to the merchant. So, you know, as a merchant now, um you know, anytime that comes through is very damaging uh to your business. You've lost the product, you've lost the transaction value, um your processor's going to charge you a chargeback fee, which can be as much as $15. So, imagine that. You the $5 transaction, and now you pay a $15 uh chargeback fee. So, now you've lost $20 uh for something that's only worth five. Um so, you know, that's kind of where it it comes into play and how do you identify those friendly fraudsters? Um, because otherwise it looks good. Otherwise the data matches, their address matches, it all looks good um, until, you know, they come back later. And so, we have a term for that. I mean, we call it liar buyer. Um, that's another fun phrase that people toss around when talking about this kind of fraud.

I like the friendly fraud because it kind of like goes to it being a often an ethical question sometimes or moral one rather than some kind of, you know, imaginary crime ring that we tend to picture when we're thinking about these things which often is is as you said. Uh, it's definitely a difficult thing. Obviously though that, you know, a lot of this is having to do with banks and the ability to sort of work with banks or prevent banks from negatively working with you. As Web3 and cryptocurrency goes up in in terms of interest, I mean, obviously, especially with the result of the US election, it it has gone up significantly at least in the short term. Um, that is something that people look at or people that are, you know, can't deal with banks for whatever reason, the unbanked, things like that. So, that becomes a big deal for processing, especially international transactions. Uh, obviously, it's a difficult thing. There's no real concept of tre- chargebacks. There's not really payment processors except to the the bank and, you know, outside the bank itself, it's kind of wild west. Um, how do you kind of adapt to that? I mean, I know it's something that might not be solved yet. Uh, how how you

looking at that space in general? Yeah, so, we do a lot of business on the crypto side. Um, you know, the three verticals that we focus on are gaming, uh, gift cards, and crypto. And the crypto's um, probably our largest one actually right now. Um, because it is, you know, very high fraud. Um, yes, there's a lot of KYC attempts and things like that and you have to scan your passport and take a picture of your face, but, you know, people find ways around that, no problem. And it shares very similar characteristics, if not more so than gaming, where, you know, once you made the transaction, you can offload that. You send that to another wallet, and it's gone, and you have You're never going to get that back again. Um so, we work very closely for the on-ramping part, so helping people take the fiat to uh the chain, uh cuz a lot of time, you know, done by credit card in that case. So, we work with a lot of um, you know, prominent uh on-ramps in that regard. Once it's on the chain, we don't really do too much um there today. It's something, you know, we might think about later, but, you know, that's a

little bit trickier because kind of the whole point of the decentralized and um you know, there's not much oversight of it going on. Um but, we definitely want to make sure that on the pay-in part, when you're getting it onto the chain, um that that's legit. And, you know, there's the upside. You don't have to do KYC to see the transaction history on that. That's true. You don't. And And we're going to get into this world where, you know, the Web3 gaming, I think, is going to collide with the crypto. So, it's very relevant to our industry, as well, um because, you know, as more and more traditional studios embrace Web3, which I think they will over time, um they're going to start dealing with these issues that they haven't dealt with before. And the again, the customer is very different. The order values are very different, right? Where you're maybe spending $5 on a skin, $10 on a skin. Uh on the crypto side, you're probably uploading 100, you know, 200,000 dollars at a time. Um so, that's going to be something new that a lot of studios are

going to have to adapt to. Uh how do we how do we change our risk tolerance and our risk profile um for the Yeah, for the realities of the crypto Web3 world? I mean, if you're dealing with the on-ramp providers, then, right? Then, you're able to sort of get some data on some KYC, maybe even, and and sort of build a profile of a particular wallet, right? As it on-ramps. And then, from there, if that if that wallet is then making on-chain transactions with a say, a Web3 game stuff, you have some information about that wallet. Is that maybe a direction you guys can go or just not maybe even that you guys just the the sort of fraud industry in general when it comes to handling this stuff is that if wallets start getting tied to KYC, get tied to banks, there starts to be some element of risk profiles associated with wallets and different ways of sort of collecting the data. Sort of the way you're already trying to do with customers in games. And then now obviously if you're looking at on-chain entirely web 3 games, it becomes even more important possibly to to handle that stuff. Is that an area maybe you guys are going in or the fraud industry should be thinking about for

the future outside of our typical kind of KYC mentality? Yeah, I think I think so. I think, you know, the the data verification, the you know, does your picture match this thing, does the number match this thing? Like it's all going to be easily spoofed, right? Deep fakes and you know, you can use We use AI to prevent fraud, but people are going to use AI to to, you know, partake in fraud. And so we're always adapting, we're always evolving and trying to, you know, keep up with the Joneses in terms of what's um what the scammers are trying to do. Um and our world they're going to collide. And um we actually are going to be working with a web 3 gaming merchant on-ramper soon. Uh so TBD on, you know, that announcement, but I think, you know, it's going to be a learning process and we're going to we're going to learn together kind of how do we uh police this world, um you know, using the technology that we do have but then picking up on those new signals. And again, that's why AI is so important here because it will pick up on those signals much

faster and much more accurately um than your eyes sitting behind the desk and trying to figure out why the transaction went bad or or not. Um so we're excited for that partnership. Um and we think, yeah, web 3 is definitely an area that we're going to continue to invest in and evolve in. Hopefully you guys can make some some headway and success there because I think that's probably one of the biggest reasons preventing Web3 from doing a little bit better is obviously the the fraud and the inability to really kind of handle and crack down on it. Not just from a government level, but just from even the everyday person trying to deal with transactions out there. And certainly a merchant, someone that's dealing with, you know, massive amounts of transactions, really has to try and do that at scale. Seems like a real big problem. Yeah. I mean, outside of just even Web3 and crypto in general, what do you see as like the the future for fraud prevention or fraud in general for gaming? Like where is it kind of evolving? What new technologies do you see being involved in this stuff? Where do you see all this going, say in the next 5 to 10 years? Yeah, I think, you know,

a lot of it's going to shift toward toward true AI, and a lot of the legacy rules-based systems will be phased out. Um, whether that's, you know, from the traditional vendors or or, you know, the third party as well. Um, automation's going to be, you know, going to be key to all of this. Um, and that's not saying that you don't need internal fraud teams. Uh, there's always going to be that human element that's going to have to police it and oversee it and say, "Yeah, you know, this is the unique thing that you don't get about gamers, you know, Mr. AI tool right now." But, by and large, a lot of that stuff, you know, is going to be automated. So, a lot of it though is going to be coming with from collaboration with the partners. I think, um, as more and more studios and marketplaces and and payment processors kind of embrace the new order of, you know, like we said, AI is prevent fraud, AI is also going to be to do fraud. Um, it has to be a collaboration between everyone involved. I mean, at the end of the day, we're all gamers, you know, we

want the player experience to be as, you know, uh, seamless and successful as possible, and we want people to enjoy the game. And anytime you're trying to, you know, make a transaction or or interact with the game and that gets blocked, you know, it hurts the whole industry. It hurts the whole ecosystem. So, what I'm excited to see is, you know, more learning, more sharing, um you know, industry um events and associations and how do we all get smarter in this? How do we work with the Stripes and the Adyens and the Worldpay's and uh the Worldline uh you know, I know you had Neon um on the show a few days ago and they're friends of ours and so we're kind of put trying to put our heads together and think through um with do that and um the Worldline and the World. You know, we're we're all just trying to come at this together. And I think we'll, you know, there'll be some exciting stuff coming on. Um but it's going to take time too. You know, as as the fraudsters get more advanced, we're going to have to step up our game and match that. Well, unfortunately uh it ends up being

an an arms race. So, hopefully you can at least stay ahead for a little while longer. If uh if not, uh the AI versus AI battles, right, have already kind of commenced, I think, at this point. So, hopefully you guys can stay one step ahead of that training and and partnerships. But uh I do want to thank you for coming on today. I appreciate it. It gets the topic that probably is a little underserved until you get that letter, as you said, and then all of a sudden it's certainly is a topic you're very aware of at that point because that's hitting literally the bottom line of a business. So, it's good to get ahead of it. Good to know that there's services like yourselves to be able to help figure that stuff out when when that panic sets in and hopefully people are doing a little bit of maybe analytics or detective work ahead of time to to get, you know, ahead of that and and catch when that's happening rather than when all of a sudden, you know, they're uh in the red at that point. So, definitely appreciate you coming on today. Take Take a look at this now so you don't come to us with that letter in hand. That's the one we don't want to see. We want to see you before that, you know, in in better times. So, um thank you for having me, Devon. It was a pleasure speaking to you and uh yeah,

look forward to, you know, continuing the conversation in the future. Awesome. Well, if you're anyone who wants to check out the the company, it's insure.ai, which is spelled n s u r e .ai, just in case you're listening to this and can't see any links or anything like that. Want to make sure people get to the right place. But definitely check it out. Lots of cool stuff. Lots of tech being involved here and pretty much trying to do what they can to to keep things under control. So definitely give it a you know, peak. See what see what you can do. And in the meantime, we'll catch you guys in the next interview, but thanks for listening. I appreciate everyone out there. And of course, if you aren't already as always, make sure to subscribe to the newsletter catch all the latest in gaming from Navic. Thanks again, Zach. Thanks audience. Catch you guys later. If you enjoyed today's episode, whether on YouTube or your favorite podcast app, make sure to like, subscribe, comment, or give a five-star review. And if you want to reach out or provide feedback,

shoot us a note at [email protected] or find us on Twitter and LinkedIn. Plus, if you want to learn more about what Navic has to offer, make sure to check out our website www.navic.co. There, you can sign up for the number one games industry newsletter, Navic Digest, or contact us to learn about our wide-ranging consulting and advisory services. Again, that is www.navic.co. Thanks for listening, and we'll catch you in the next episode.