Session: How To Prevent D2C From Wrecking Your In-Game Economy - Jeremy Waxman, FastSpring.

[music] [music]
This is the first track first session of this track. So, how to prevent D2C from wrecking your in-game economy. Um, if we welcome our speaker up on stage.
So excited to be here based on that welcome. Uh, so uh, hey, want move to the front. Let's go. We got 2 minutes. Everybody move to the front. I can't see you. We won't be able to get to the question and answer. Come on, come on. Come on, who wants to move to the front? You guys don't want to sit in the back? I wasn't a front of the room guy either, but like I can't even see you guys with

this blinding light in my face. So, uh, so this is our Well, let me get the clicker, I guess, right? Um, how to prevent D2C from wrecking your in-game economy, right? So, you know, a little about me, then we'll go into what this thing is all about, right? So, uh, obviously I used AI with my picture to make it look gaming. It's pretty good shot, right? I thought that was pretty good. Um, 25 years in payments. Uh, I work for FastSpring GG with a leader in in direct to I call it D2P, but it's D2C direct to player direct to consumer. Um, over 25 years, almost 30. I know I act like I'm 20 years old, but I'm much older than that. Um, uh, so, um, you know, we we I lead payments within the organization, strategy, implementation, operations,

uh partnerships, etc. Um Enough about me. Uh let's just get into the the agenda here. So, there's a couple things that I'm a big believer in when we talk about, you know, payments, it's terminology alignment. And that's the first thing that I typically do on every talk in whatever industry I'm speaking in uh because that's how we can all speak the same language and it's highly highly misconstrued, all the different things and all the different terminology that's out there, right? So, then we'll talk about how D2C can wreck your economy and then it's, you know, why your targets and, you know, ultimately how to protect yourselves and protect the web store, right? Um And and caveat, D2C is still very valuable for you, right? This is an education session of the things that you have to worry about when going into D2C and because it's different. The in-game economy of apps is entirely different than what I'll

call e-commerce, right? Web store. So, here's here's a couple of major things. Now, there's a lot of text on these pages. Please, please, please don't feel like you have to read them all. We'll have time at the end or you can catch me after and I can go further into some of these things if you'd like. Um you know, good versus bad, right? Good player wants to buy your stuff. They have a good payment method. It's not stolen. It's not their parents' method. You know, they are buying and they're authorized to do so. Now, a child could also be authorized to do so, right? Like my kids buy things in their app games using my credit card cuz they're 10 and 7 and they don't have their own payment method yet. Uh bad, you know, unauthorized, abusive, right? Anything you can think of that word that goes with the word bad, that's it, right? So, good or bad is probably the easiest one to understand. When we get into players, buyers, and bad actors, right? The player, the

person who uses the game. The buyer, the person who actually buys the stuff within the game, and you guys know that could be three different components. Your self, the player could be the buyer, right? Could be the same person. Parent, spouse, could also be the buyer of the player, right? Like if my wife wanted to gift me, you know, EA Sports you know, FC 2027, she'd be the buyer, I'd be the player, cuz she doesn't even know how to turn on the PS5, right? Um bad actors, they could be they're typically not players, but we'll go into that. They absolutely could be players as we go through this presentation. Um but they're the people who are are going to damage your ecosystem, right? And the difference between web store and app or in app, you have more visibility and more exposure in the web store than you do in the app, because the apps the app

store sort of protects you and shields you from not only the data and the the customer information, but also some of the bad actors that are out there. Dispute chargeback alert, a dispute, somebody calls their financial institution or payment company and says, "Hey, I don't know what this is. I'm disputing that." Right? The result of a dispute can be a chargeback or an alert, and we're specifically talking credit cards here, cuz they're still that's still the largest portion of payments in the industry and in the world. Um chargeback, it goes back through the ecosystem back to the uh to the the from the issuing bank through the ecosystem back to the buyer uh back to the payment the the the merchant that sold it and says, "This is not a real payment, give me my money back." An alert is something that avoids the actual chargeback from occurring, but in the ecosystem, a dispute, a chargeback, and alert should be treated in the same way, right? If you get a fraud alert where a fraud a chargeback,

both are you should be treated that player as a bad bad actor or that or potentially the payment method is a bad actor. And then proactive versus reactive refund. Dispute chargeback, you got to give your money back to the to the issuing bank, right? The person who was the uh the either the person who bought it or the person who uh was a a victim of fraud. Proactive refund is, "Hey, I got a chargeback uh from this player. They have 10 other transactions that I know are going to be a dispute or chargeback later on. I'm going to proactively refund those to avoid any, you know, repercussions or chargebacks or disputes cuz that cost you money, just like the last uh presenter said, there's money in there's there's cost in chargebacks. How can we wreck? How can D2C or D2P wreck your in-game economy? First off, the upside's huge, right? Um you know, 17 billion,

15% me uh of median share in mobile revenue is now D2C, you know, 92% of publishers uh expect D2C revenue to grow. And that's because there's not just revenue associated with it, right? There's also player data, direct interaction with those players, right? So, there's there's non-monetary value that comes out of that. Ultimately, there's six major ways, and like I said, there's a lot of text. Don't worry about reading those in detail. You know, there's distorted numbers, right? Uh fraudulent purchases can skew your reports, not really understand the lifetime value of your customer, right? Um and those are good and bad players can also be good or bad buyers, right? Um rigged outcomes in play-to-win situations, you know, um fraud bought items, you know, can boost and swing players in one way or the other using fraudulent credit cards or

stolen credit cards, etc. And they're not really uh it it's and then then that player gets thing pulled back. And, you know, uh uh you know, if there's limited release of items, they can actually gobble up all your limited release items and not allow your real true players to go there. Um you know, then you've got the gray market resellers. Um you know, they're selling it on you know, uh of of Reddit or any of these Telegram sites, they're selling their stolen goods to real players, right? Cuz real players buy these things cuz that's but they're buying at a discount. So, it's devaluing your solution and that's also allowing your customers to violate what essentially is your terms and conditions to buy those things through you or through the web store or through the app store through through the web store. False positives, you know, the more, you know, potential volume you get through going through your web store, there's always a a fine line of you stop

all fraud, you stop all transactions, right? That's the rule in payments. So, there's always going to be a level of fraud and bad actors that go through your ecosystem. The more you have in there, the more false positives you have. That means that the the higher risk rules you have, the more good players you're blocking, right? And the the players the uh the providers out there that are very good at this have a a history of of protecting the ecosystem and can identify good versus bad and block less bad buyers uh sorry, block less good buyers and uh block more bad buyers. And then cross-store exploits, right? Gaps between mobile and D2C, um let the players boast uh let players buy and pass stock items and and fueling inflation, right? So, it's it's thinking that these items are more valuable, you may raise your prices, and in reality, they're just driving up the cost because there's no real value. They're They're selling them to the black market, and it's bad actors that

are buying it.
Why is gaming such a popular target?
Well, it's because there are multiple ways that you can get into, and it's just like eco I mean, web store is e-commerce, right? So, you're now opening yourself up to all of the ecosystem of where bad actors live. Two of them are uh two of the top five are what we're going to cover, right? First-party misuse and card testing, right? Card testing is somebody has a million different card numbers, and they're just trying, and they're banging your system to try and see what goes through and what gets accepted. Because a lot of the gaming are microtransactions, they're going to be very targeted for fraud. Because these bad actors, even if they're just testing cards, they want to test cards at low dollar amounts because then if it goes through, then they have all of these other They can then sell the remaining value on the card on the black market, right? They don't want to

buy something for a thousand dollars if they're just testing cards. They want to They want to test a card, get it to go through, and then sell all of these in the back market. And then first-party misuse is something we're going to talk about uh in a minute. Bad actors, what are they after, right? We talked about this, card testing. They want to validate stolen cards. They want to know that the ones they have are good, and then they can sell them, or then they just buy more and more and more and So I said before they could go and sell those cards, they could and that's why gaming is such a high target because of the the microtransactions, right? The 99 cents, the dollar, the two dollars, right? Um cash out fraud, you know, they buy with stolen credentials and then convert it to money, right? Transferring skins or coins, creating fake gaming accounts. They're basically using those stolen cards to buy goods and then sell them on

the black market. We see a lot of this in on Telegram where you can buy discounted, you know, packs or lives or or coins. And then self-serving fraud, right? Um Interesting enough, this is uh an interesting dynamic because to when a player is a good player and uses stolen credit cards to buy something, they're kind of using the to boost their game, right? And get further in the game. However, they also are associated with the gaming account. So as soon as that fraudulent activity is identified, that whole account's going to potentially be stopped, right? So this is less common, but it does happen. Um and it actually uh falls into friendly fraud, too, which we're going to talk about on the next slide because this is common with children, right? I It My son could take my credit

card out of my wallet and buy stuff, right? Friendly fraud. These are two two uh this is a very big term for you guys to understand in this space. It's a real player, real payment, and then they say, "Nope, wasn't me." So we see this a lot in the industry. Somebody goes and they say, "I'm going to start playing this game." Everybody has games that you play for a couple months, maybe a week, 2 weeks, 3 weeks. Well, in we see this that players get frustrated. They can't pass a level. They decide, "I'm done with this. I don't like this anymore." And they call their bank and they say, "Ah, that wasn't me. I didn't make those charges." It's It's ridiculous because you played it for 3 months, but then you said it wasn't you. And because it's fraudulent, a large percentage of the time, the issuing bank or the payment method is going to side with the customer calling,

right? So, I'll ask, who is Who is the customer of the gaming company? The player, right? Right? Which we'll say in this case the player is also the buyer, right? Who is the customer of the issuing bank? The player or the buyer. So, when I call the issuing bank and say, "Nah, it's 3 months of charges that I just put into game ABC, that was me." Who are they going to believe? The gaming company that is not a client or customer of the bank, or me? A good good Jeremy that has a good account, that has a savings account, a checking account with the bank. They're going to believe me, right? So, remember, in the chargeback and issuing space, the judge, jury, and executioner is the issuing bank, right? The people who gave you their credit card.

So, these are things you need to remember. That's why friendly fraud is so high in e-commerce in general, but in in in in gaming specifically, because there is a use it and be frustrated or done with it, you know, methodology, right? Sus- suspicious, but not fraud, right? These are good players that look bad, just like friendly fraud. Right? These are false positives. Right? Those people that you're you are potentially blocking or putting, you know, um speed bumps in the place to purchase because you think they might be bad actors. Right? Because, hey, you know, something like my son, if I give him a prepaid card, and he goes to buy, you know, um you know, uh gems, and he spends, you know, he spends the $20 prepaid card, and then he has that card saved, and he keeps hitting buy,

buy, buy, buy, buy, because he's 7 years old and doesn't have the concept of insufficient funds, which by the way, this has happened before. He's spamming the system, but in reality, he's not doing it because he's a bad actor. He's doing it because he's like, "This is not working. I don't understand it." And he can't he can't actually read the responses very well or comprehend them cuz he's 7 years old. Right? So, that's important, you know, or another situation is where he's got three prepaid cards from Christmas, one for me, one for my parents, one from his other set of grandparents, and he uses all three within a 4-minute period. That can look like suspicious behavior because he's cycling through multiple cards, even though it's a really good person. Right? And then you could compound it where he's hitting it after it declines, and he's using three cards. Friendly fraud is 100% on the rise.

Right? And that is everywhere. Right? Because, like I said before, the issuing bank sides on the side of the the cardholder. Right? And the same thing with payment methods, PayPal, all of them that are out there. So, 64% uh of of you know, sellers report increasing rates of first-time party misuse, right? And then one in five disputes, and we remember what fraudulent disputes are. We talked about fraud, we've talked about disputes, are believed to be first-party misuse, right? So, first-party misuse, friendly fraud, all the same thing. Well, you probably ask yourself, what can we do about it, right? And I will I will I will emphasize we because in the payments ecosystem, in the fraud and and risk, and I call it

trust and safety world, we all work together. There's a lot of collaboration, right? And I I go back to a point back in the day when I worked for another company, and Samsung and Sony were sitting across from each other at the table talking about how they can protect help collaborate to protect each other against bad actors, right? And that's what's important in this space. Collaboration is key. Know your players. Right? Um, you know, strong authentication, identity systems, you know, two-factor authentication. Uh, there are games that require, you know, may not use a username and password, but after they're created on the gaming system, you then have to authenticate through an email, right? So, there's there's a bunch of different factors that can come into play. If you can do that, that will really help. Um, you know, even in payments. You guys were in Europe, right? 3D Secure, right? Pretty big popular uh protection here. That's a perfect form of how you can protect your ecosystem, you know,

and you know, other verification systems where they're where where um where the risk is high. And then close out the cash-out loops, right? Transferring items leaves you open. Right? I I understand it has to happen. I I I love it when my parents buy, you know, Fortnite skins for my kids and they transfer them over. I really I end up having to buy them cuz she doesn't have an account. But like my mother-in-law will say buy this and I transfer them. So it has to happen in a lot of systems, but really you want to make sure that you're monitoring that and managing how many can be transferred from what account to what account. Have accounts that are buying things ever played before, right? Things like that. Uh no selling of accounts, locking them down to either devices or, you know, uh non-transferable and email addresses, etc. And, you know, no path forward to monetization. And I use monetization in this term as a bad term as opposed to the monetization of your your web app.

You don't want to allow them to be able to sold be sold, you know, to get gains, to get cash, right? On your web store there's four pillars. And I'm ahead of I've got 3 minutes, right? Yeah, yeah, perfect. Um just checking time. Uh there's partnerships, not vendors, right? Some you want to make sure that not only are, you know, you you are referring to the the companies that you deal with as a partner. It's a two-way mutually beneficial relationship. I have that same relationship with all of our payment processors on the back end. They are partners. If they are not a partner, they do not work with us. They need to understand we're in it together, and that's where you need to look at when you're looking at your your D2C uh ecosystem, right? Monitor proactively and reactively. You need to look at the

front end, what's happening with your with your buyers, looking at trends, etc. And then on the back end. Where are you seeing trends coming in for disputes, for declines? Uh where do you need to proactively refund? We talked about that. And where can you use what you're seeing on the reactive side to continue to feed the proactive, right? It's a It's a It's a You need to complete the life cycle or complete the ecosystem so they continue to learn from one another. Be strategic and targeted, right? Like I said before, not all fraud is a bad thing. Right? You stop 100% of the fraud, you stop 100% of the good people that are buying. Remember that. Um and then leverage all of your data, right? In-game data is a key component to helping stop bad actors, right? How many times have I seen uh gaming accounts that have never played a game never played a minute of the game, but they buy a thousand dollars

worth of items and then never play. And then buy another thousand dollars worth of items. Well, what's happening with that, right? So, you have to understand these data points that can help uh feed your fraud fraud logic, I should say. And, you know, like I said, this is the key thing you need to take away. This is This common across all payments industries. You need to make sure that if you want to stop all the fraud, you're stopping all the good stuff as well. And if I have to leave you with five things, here's your five takeaways. Ensure that you're speaking the same language to whomever you're partnering with in this ecosystem. Ask them to define certain things. Buyer success, authorizations off rates, order success, right? These are all terms that you'll hear. Just make sure you're talking the same thing. You know, it hits your economy and not just your P&L. Um

know your threats and identify who's actually risky and who's just a false positive in your threats. Um build identity in, design cash outs out, and partner, monitor, target, and use all your data. That's it. If you have any questions, we're right outside the door by coffee, which is always a good thing. Uh happy to talk to anybody after, but I appreciate your time.
Okay. Cheers. Thank you. That was great. [applause]
I'm going to grab this out of your way.
[music] [music] [music] [music]