Fraud 3.0: From risk mitigation to revenue enablement

Candice: Foreign. Welcome to the voice of MP 2026 uh, edition with a, uh, special guest, Adam from Adam Davis from Forta who is the director of AI and um, we're going to be talking to you today around Fraud 3.0. So moving from risk mitigation to revenue enablement. Um, just in terms of positioning our chat today, um, the biggest risk in fraud prevention stay isn't actually the fraud you're accepting, it's the good customers you're actually rejecting. And that is a really, really big problem that I'm seeing at the moment working um, for US bank with a lot of merchants. Every legitimate customer that's declined is a moment of broken trust and often a lost customer for good. I think one in you that get turned away for no real reason don't come back. So for years fraud has really been a kind of defensive problem. Something that merchants try to minimize and see as a massive financial burden, sort of compliance, security, uh, you know. But as we're moving more and more into digital and I guess as we move towards agentic this, there's a big shift underway and I think that fraud prevention and sophisticated fraud prevention is, is really being perceived now by a lot more merchants as a strategic, um, revenue enabler. So part of an optimization strategy. Um, so what I tend to call this is Fraud 3.0. So really moving from fraud and risk mitigation to fraud as a revenue driver. So what I'd like to do with you today is sort of explore what that means for merchants, uh, from your perspective with all your expertise. Um, so let me ask you, if we rewind 10 years and we look at the fraud conversations and they're almost entirely about stopping losses, how have they changed? Does that feel much different now?

Adam Davis: Yeah, I think, um, well, first of all, great, great to be here Candice and uh, thank you for having me.

Candice: Certainly.

Adam Davis: Um, we're seeing that shift and the mindset change in merchants from uh, fraud and payments as a cost savings center to actually seeing fraud decisioning as a, ah, revenue optimization tool. Um, now of course merchants are still absolutely trying to stop fraud, but what they've done is they flipped the question from how do I block bad actors to how do I or who can I trust right now and how do I simply get out of their way and give them a good chance to convert successfully. Uh, because as you're right, you're absolutely right. Ten years ago you fraud programs were judged uh, almost entirely on loss rates and chargebacks, the kind of tangible minimization of loss. But uh, one could Argue that to minimize fraud losses, you could simply decline all transactions. And of course we can all agree that that's the wrong outcome good customers are trying to transact with your business. And that's obviously what generates, uh, the revenue for these businesses. So it's really about finding that balance. If we're not declining everyone to eliminate losses, uh, we shouldn't, uh, by an extension of that logic, we shouldn't be over declining the good customers, even if it's just 5% of transactions that we're disrupting. If fraud, and the genuine fraud risk represents far less than 1% of transactions and you're blocking 5%, then it stands to reason you've got more than 4%, uh, of those transactions are actually good revenue that you're turning away from your business. And by optimizing your ability to make trust decisions, you can unlock immediately that 4% of your transactions that you're kind of leaving on the table today as revenue growth for your business. And that's obviously a material increase, uh, in revenue for many merchants. So focusing on how we optimize, and at forta, of course, we anchor everything around identity intelligence, tapping into our network of billions of consumer identities across hundreds of billions in merchant payment volume to actually understand can we trust this individual rather than are there some suspicious signals or flags for this specific transaction at this moment in time, can we contextualize those suspicious flags as rationalized because of our understanding of the customer? We know that this customer regularly travels. We know that this customer regularly uses a vpn. So the fact that they are transacting from another country using a VPN service, um, which in old stacks, old fraud stacks 10 years ago, May have led to a decline because that's multiple high risk flags. Actually, if we can contextualize that based on our broader understanding of the identity, then you can explain away uh, those signals that might otherwise trigger, you know, red, red alerts in the system.

Candice: And I think looking at uh, that breadth of information and those signals right up front in a process is, is becoming more and more important because as you say, sort of trying to stop bad actors, almost like tuna fishing. You're catching all sorts of things in your net and those good customers. And I think what I have seen in terms of, um, quantifying that issue is it's costing industry about 300 billion in chargeback losses. But in order to stop those losses, merchants or the industry are suffering maybe 600 billion. So it's really that trick to optimize and rebalance that equation for merchants. So I Think some of the things you have in your toolkit, ah, are really going to help that conundrum. Um, so do you think that the industry still underestimates the cost of those good customers that get turned away, those false positives as we call them?

Adam Davis: Ah, absolutely. I think it's still quite badly underestimated even by the very sophisticated merchants. Um, most teams can quote their fraud loss and chargeback rates to the decimal, but they don't have an equally rigorous view of the good revenue that they're turning away. Um, and what we see in the market, which we actually published in a report uh, with PwC recently, is that for every dollar lost to fraud, uh, other currencies are available, of course, but for every dollar lost to fraud, um, the average business loses around $30 in legitimate revenue by falsely declining good customers. And when an established enterprise merchant partners with Forta, it's not uncommon, uh, when we look at their current setup to uh, see that actually tens of millions in annual revenue is being left on the table. Uh, and that could be through a mix of pre auth risk declines that are being over triggered because of reliance on rules that are so broadly defined that yes, they're blocking the fraudulent transactions, but they're also blocking uh, a large number of good customers as well. Um, or it could be things like unnecessary 3Ds friction, which we see very commonly here in Europe because Of course, uh, PSD2 uh, demands a higher rate of 3ds usage. But uh, PS2 exemptions are a key method that merchants can utilize to reduce that friction. So ensuring that throughout the value chain you're making good quality decisions on how do I avoid 3ds friction through the use of exemptions. How do I, uh, fine tune my pre auth risk decisions? By taking all of that into consideration, we ensure that we're reducing those false declines. Um, now interestingly the problem here is so complex because it's also so distributed. So we've talked about, uh, the fact that it can come from a little bit of over declining in the pre auth fraud setup. It can come from a little bit of over challenging, perhaps in 3Ds. Uh, but there's also a little bit of over conservatism from the issuer. And of course the buck really stops with the issuer when it comes to the authorization decision. And so uh, we're actually investing in partnerships with issuers to ensure that we're sharing more data with the issuer side of the ecosystem in real time to actually improve the quality of their Decision making and reducing false declines at that end of the value chain as well.

Candice: That is really um, great to hear and it's sad because people think that the decline happens at the merchant. But there are so many players, fraud tools and networks and issuers and uh, each point in the journey um, you may penalize a good customer. So that's really great. And it also helps, as we said, sort of stop the bad things, reduce those false positives, but then reward your good customers by adding further optimization capabilities like exemptions and using these technologies. Um, so there's often a misconception that security um, reduces fraud but damages conversion. But I think really the shift for 3.0 is all about this being a growth lever and ensuring uh, optimization. So a little bit more about identity, um, the goal is really recognizing genuine customers as you say. So fraud gets a lot of noise, but the genuine customers being declined and never coming back, that's kind of invisible. And that's the real problem. Um, so Forta talks about recognizing trusted customers across um, the ecosystem. And how does network intelligence fundamentally change how fraud decisions are made?

Adam Davis: Yeah, I think, uh, and maybe briefly just to expand on that point around the verbiage of kind of network level intelligence. Because of course in payments network uh, can mean many things. Uh, when we think about it, of course it's really around building this consortium of identity insight, um, from multiple merchants. So building the network of trust if you will. And the focus there is really on shifting the question from this transaction on this site to this person across this ecosystem and how can we find trust in that individual? And it links a little bit to what I was saying earlier around. If we can understand an identity and how they've behaved in the past across other merchants, what traits or characteristics are associated with that individual, then we can turn signals that might at first glance appear to be a red flag into actually just an articulation of what that identity is doing. Whether traveling for work or they're using a VPN or any other, uh, reasons ordering something to be shipped to your parents, uh, and so there's a billing and shipping address mismatch. By understanding that connected, uh, understanding of identities and the associations between identities has a lot of value. Now of course, by contrast, in a single merchant world, uh, a first time shopper can look very risky. It's a new device you haven't seen before. It's maybe a high basket value, it's an unfamiliar geography perhaps. Whereas in Fortress Network, bringing the trust and identity network to the table, that same shopper is likely to have been seen dozens, if not more times across different merchants in the ecosystem, in our ecosystem. And so a shopper that is new and appears risky to a single merchant is actually known to our network and therefore much easier to facilitate that trust decision. And it's no longer a question of does this one transaction have traits that make it look suspicious. But it's given everything we know about this identity that we've seen tens and tens, if not hundreds of times before. Um, can we trust that these traits for this specific transaction signal legitimate behavior for that identity?

Candice: M. Yeah. And it's interesting because it also helps you to reward the good customers. Um, bad actors, they're like snakes, they shed their skin, they try not to leave trails. But good customers actually do. And having that purview across the whole of the ecosystem sharing data, uh, I think that is a very, very powerful, um, way of ensuring identity.

Adam Davis: Absolutely. And actually I would uh, briefly add on there that the same rings true on the fraud ring side. So uh, the network and having that kind of consortium view of identity makes it much easier to spot coordinated abuse or coordinated tactics from fraud rings because there's no longer one merchant seeing a piece of the puzzle. It's a network seeing the full scale of the attack and understanding the tactics and the attack vectors there.

Candice: Yeah, no, it's really powerful, um, stuff and it is very exciting to see it unfold. And it isn't really just about seeing which transaction we can block. This the sophistication of being able to say yes quickly and safely, not know quickly. So that's very um, powerful. So in five years, do you think merchants will look back and realize that fraud prevention was actually one of the most powerful and underused revenue optimization capabilities they had in their armory?

Adam Davis: I think so. And I do think actually we're, you know, taking the optimistic viewpoint, I suppose, but uh, I think we're already starting to see this shift in merchant mindsets. Certainly at the enterprise level. Um, when you're an enterprise merchant, a, uh, few basis points of revenue growth can be valuable for ahead of payments or ahead of fraud or whoever. The relevant stakeholders that are owning this internally at the enterprise level are for them to realize that I can fine tune my risk decisions and perhaps ensure move from disrupting 4% of my traffic in the name of risk prevention to fine tuning that down to one and a half percent of my traffic, uh, you've then unlocked a significant revenue increase that's far beyond basis points in terms of improvement. It's the kind of impact that you can Drive by perfecting these decisions and switching the question from how do I block whenever there's a risky flag to how do I justify that risky flag with an understanding of the identity and the broader context. Then there's a better ROI there than can be seen for some of the biggest R and D initiatives that these merchants are working on. Uh, so it's very quickly becoming top of mind and recognized as that priority. And I think to your question, in five years we will definitely see a continuation of that trend. And those merchants that haven't already started thinking about this or haven't made that mindset shift in five years, they'll be looking back, uh, with regret perhaps, thinking, you know, there's five years worth of revenue that I've left on the table. Customer relationships that never got off the ground because the first time they tried to interrupt my business, I uh, gave them a poor experience and they never came back.

Candice: Absolutely right. You know, payments is a fundamental aspect of any experience. Everything ends in a payment, sadly. But it is part of your experience. So you do it frictionless and you don't um, and you're a genuine customer that you don't get turned away at the gate. Um, and interestingly as you say, sort of being very sophisticated with your capabilities and ruling out the bad things, the costly chargebacks, not um, turning away what could be good customers by reducing your false positives and letting the good ones go through. 1% increase in acceptance and 1% decrease in the chargebacks for a large scale merchant is literally millions as you say. You know the, the numbers are astonishing. Um, so I hope people will um, hear all the things you've got to say and understand that it really is a growth lever. So just um, I guess closing um, vision here. Um, we've heard a lot about AI and she's director of AI and agentic, uh, coming along, the future of uh, Fraud 3.0 as we're entering the AI arms race. And if we fast forward five years, what does Fraud 3.0 look like in practice for merchants?

Adam Davis: Yeah, I think it's a great question and we are at a very exciting kind of inflection point for the industry with the emergence of agents, uh, and agentic commerce. I um, mean before even talking about uh, the implications of agentic commerce, I think it's worth acknowledging the uh, fact that simply these AI tools in the first place, regardless of whether it's an agent acting with autonomy, um, but the availability of LLMs and these AI tools that have emerged over the last few years, uh, have Effectively supercharged the capabilities of fraudsters. And if you think about what it means to transact then via an agent, uh, well I have a tool now that is inherently untraceable because the device that I'm seeing is maybe a Microsoft virtual machine that the agent is running on. The um, IP is perhaps showing uh, a data center in San Francisco or some kind of icloud private relay. Um, the behavior is inherently autonomous because it's the bot interacting with your site. So many of the traditional signals when it comes to managing fraud, from the cyber intelligence in terms of understanding the device and the network, um, to the behavioral intelligence in terms of how they're interacting with your site, that all disappears. Uh, this is where it becomes very important to understand the emerging protocols that agents can use to actually interact with businesses. There's a few different flavors of protocols, uh, from kind of what I would call scraper agent protocols which enable agents to assert to a website that hey, I know I'm a bot, but I'm one of the good ones. Um, uh, and then you have the full stack agentic commerce protocols like ACP and UCP which actually enable an agent to bypass the website entirely and interact with a, uh, merchant's backend as if it were a, ah, server to server communication. Um, in that flow, uh, of course those protocols are facilitating some uh, exchange of data for the purposes of risk management. But there's still a little bit of a way to go I think in terms of refining the data that is available, uh, in terms of what exists in the customer to agent interaction at the top of the funnel and how much of that persists through the flow to the agent to merchant interaction in the middle of the funnel so that the merchant is empowered to still make their own risk determination, identify those trustworthy customers. And without that there's a risk that this new agentic channel, which has so much promise in terms of driving new revenue flows and revenue growth for these businesses, if it becomes impossible to identify trustworthiness due to a lack of data being presented by the agent, then uh, what we're going to see is a continuation of this problem around false declines. You might have legitimate customers that are simply unable to signal their trustworthiness, uh, with sufficient data to merchants. So at forta, that's very much our focus is how can we partner with the ecosystem to ensure that the data is persisting through the value chain, uh, whether that's via the protocols, via doing some clever uh, initiatives like embedding identity intelligence into agentic tokens that are then passed to the merchant or various other means, uh, of kind of working around the data leakage that an agent creates. But certainly I think uh, as we look to the next five years and the evolution of AI, the emergence and the growth of this channel, um, it's something where merchants are kind of going to look back and say fraud was uh, our fraud service could have been uh, the engine that let us safely embrace this new channel and grow faster than our competitors by tapping into the agentic commerce ecosystem. Or it could be the service that let them down and actually drove customers away from using this channel because they were over declining. And so really optimizing the quality of those decisions, basing it on trust and identifying those legitimate transactions and just getting out of the way, giving them a chance to convert, that's really uh, really going to be important in the world of AI driven commerce.

Candice: And that is fraud 3.0. The new world we are moving into for years has just been seen as a compliance burden and an unnecessary uh, overhead. But as you say, it's going to really be at the core of everything as maybe human in the loop is you know, sort of moving further, further back and considering it as every step of that process is really going to be the route to revenue. So um, and about recognizing good customers even when they are your agent. So I would like to thank you very much Adam Davis from forta, Director of AI for all your insights.

Adam Davis: Thank you Chandice for having me.

Candice: It's been a pleasure. And um, thank you. That was uh, the voice of MP episode on fraud 3.0 turning um, driving revenue uh, for MP 2020.