Max: 00:08 ’m Max Clark. This is a tale from the good old days. And I’ll title this. I’ll say this is one of the most effed up things I’ve ever seen a CEO do in a company. I was working for this company, and we had a known credit card fraud issue.
Max: 00:19 When I say we had a known credit card fraud issue, I mean, this is a long, long time ago. This is before, you know, things like Stripe were even like a consideration in the world. If you were large enough, you actually had your own credit card gateway devices like physical boxes that you had installed in your infrastructure somewhere and then you were integrating with and we had rudimentary tools for credit card processing so maybe you could do address match you know c v two was available but the problem with both these things is they weren’t very consistent so you could do an address match but your false negative rate on an address match was high enough that you were losing a significant percentage of valid transactions through it so address validation just verification very quickly became zip code only verification which also then became in a lot of cases just turned off because the amount of revenue. So this is a really interesting conversation to get through with an organization of, like, risk management of, like, thresholding. Right?
Max: 01:10 Like, hey, we can turn on address verification. But when we turn on address verification, it’s gonna block a number 30% of our credit card transactions. And of that 30% of our credit card transactions, we think 10 to 12% of those transactions are actually good. And that’s good revenue that we’re losing. So is it worth losing?
Max: 01:25 Right? Like, do the math. Is it worth losing that 12% to block that 18% or not? Right? Okay.
Max: 01:29 What happens if we we turn off, you know, a street verification? We’re just looking for city and state ZIP code. Right? And then you kinda, like, work your way down to where you’re only doing ZIP code verification pretty quickly. And then, again, there’s a conversation.
Max: 01:39 It’s like, well, we think we’re losing x percent of valid transactions. You know, it just gets turned off. Right? And when you see this happening, it’s a very interesting experience because people are making decisions to accept fraud in order to increase revenue. Right?
Max: 01:52 So this is the first kind of like checkbox. Not like when I said, like most f up thing I’ve ever seen a CEO do. This was the slippery slope that started down the process. Okay. So address verification gets turned off.
Max: 02:02 So then you have CVV 2. You have that like the 3 or 4 digit. You know, if you have Amex, the the digit codes. And same thing when you turn that on, you lose a certain percentage of transactions. Hopefully, you’re losing a very small percentage of valid transactions but you’re not really a 100% sure but there’s always this thing of like oh we’re losing x percentage of transaction so we had that on for a while and then they decided to turn it off so we got down to the situation where the only real validation that was happening was does the card type match the actual digits?
Max: 02:25 And by the way, you know, all Visa start with the same number or same set of numbers on Mastercard. I wouldn’t even call it verification. I mean, nowadays, you see really good payment systems implemented when you start typing your credit card number. It doesn’t prompt you for what the card type it is. You put in your card number and automatically will it display to you like, oh, you got a Visa card.
Max: 02:41 Right? Like, it’ll just display it to you. So one by one, all these things get turned off. So then what we start seeing happening is we start seeing people doing credit card validation against our platform. And you can see this in real time.
Max: 02:52 Like, you just hail the log file and you could just see people. And they would they would do it at certain times at night. And they would just come through. And they know, you know, they could they could enter the card. And our system would the way it was set up is it would validate the card before the actual checkout like it wouldn’t charge the card would you know pre off the card right so you could pre off the card with a certain amount of money we’d be pre off in the cards and all of a sudden you just see somebody run like a batch of just cards would just, you know, flow down the list and you knew it was just absolute garbage and we couldn’t do it.
Max: 03:22 We couldn’t do anything about it because, the point of her boss is the executives, didn’t want to disable this functionality because they didn’t wanna lose the revenue. I didn’t understand the time. I was I was still too early in in my career to really understand the corporate dynamics and the corporate politics. And what I found out later, which actually answered this question, which this leads into the second part of this is the executive team explicitly the CEO had an MBO tied to top line revenue and top line revenue growth, not gross profit, not net top line. There was no incentive structure in place for the executive team to block this.
Max: 03:55 In fact, it was good for them to have this in place because it inflated the revenue numbers. But think about that one for a second. Think about the incentive structure that exists at this company for the decision makers of this company that this was in place. So there was, my God. Just thinking about the story.
Max: 04:11 It’s just just crazy. It’s so long ago. I mean, this is over 20 years from now. Okay. So then the process gets changed a little bit.
Max: 04:16 We we know him and all and this all goes through. And the I’m just remembering another part of the story that we have to share. The decisions are made to change the pre op process a little bit. Right? So we don’t actually pre op the car until farther in the shopping cart.
Max: 04:29 And and that what that actually forces to happen is it forces a transaction to actually occur in order to validate the card, make more steps. You know, it makes a little bit harder. We think, you know, to slow down the people are doing this stuff. It’s gonna be the fix, yada yada yada. And all it really does is it just generates like, actual garbage transactions against our system.
Max: 04:46 And the hilarious thing about this is the pattern that this company then fell into was all this junk would flow through and hit the top line. It would hit our our gross revenue, our gross income number yay everything’s great and b o’s are hit you know bonuses are paid out yada yada yada and then somewhere within that next you know 90 ish days cycle the charge backs would actually flow through and the chargebacks would flow through in a way that were disconnected from the actual wind flow into the actual system was processing the credit cards with the finance team would deal with it you know this company is getting absolutely creamed with chargebacks because I mean like double digit percentages of its credit card volume When I say when I say okay. I mean, what what’s the actual math here? We were processing about I wanna say just for the website, our primary partner source for traffic acquisition was somewhere around, like, 80 or $90,000 a day. So the one of the traffic acquisition sources going to the website was about 80 or $90,000 a day.
Max: 05:39 Somewhere we’ve got an Excel spreadsheet that has all these numbers. So there’s a call $200,000 a day with a credit card transactions flowing through this stuff and double digit percentages of that is just fraud. Like just flat out like fraud. You know anything about credit card processing, the chargeback is really bad for the merchants because not only does a 100% of the charge get pulled back from you you also lose your credit card processing fees which by the way back then were very expensive and you pay penalties so if you say for every dollar processed that was fraudulent you probably lose a dollar 20 on the backside. So if you think about this in terms of what the actual so double digit percentages of fraud revenue.
Max: 06:23 So if it was $200,000 a day, 20 to $40,000 a day worth of fraud, as of $200,000 a day of revenue, you really, like, all of a sudden immediately are, like, $140,000 a day with revenue, you know, minus minus minus. Right? And again, there was absolutely zero incentive structure to fix this. There was no check and balances. The CFO was a total disaster for other things.
Max: 06:44 Obviously, the board wasn’t paying attention, and it was wild. That eventually changes a little bit. And the way that it changed introduced another incentive structure, which was the CEO then telling the finance department not to pay bills. I don’t know how this one worked out for them because it was a public company, and you have to do accrual accounting actually maybe at this point they were delisted so they weren’t reporting the same way but if you’re doing accrual reporting accrual accounting you have you know you’re you’re recording your expense when it’s actually received and booked so like so they’re not paying the bill like is a is a free cash flow issue but not necessarily like a p and l issue so I don’t know how the heck like this one got done you know for this mbo but the cfo or the c you I mean and we had the money right so the CEO would just stop paying bills like you know you could tell when we were we were pushing into whatever thing it was because there was just this, like, mandate, like, don’t pay any bills. And the company had a 300 ish person call center that was open 247.
Max: 07:36 I mean, there was I don’t know. There was, like, 20 t ones where the voice capacity feeding the the Avaya Difinity phone system that was feeding into this call center. Right? And like, all of a sudden, like don’t pay the phone bills and you’re like what do you mean don’t pay the phone bills I know and I remember this happening because when the and I didn’t oversee this part of part of the company thank goodness but when the phone bills when the phone lines got turned off and the t ones got turned out with the peer, when the t ones got turned off, I think the CEO and and the general counsel are both on vacation that I remember the the general counsel, I think, was on a cruise and had to, like, sign and note note. I was, like, sign and fax paperwork back in order to, like, wire the money in order to pay and get the the service turned back on.
Max: 08:16 And it was like the craziest fire drill of all time with this. Oh, what was the other thing I was remembering earlier that was crazy this company did? Oh, yes. I get called one day and, you know, it’s called the COO and the general counsel of the company are sitting together in office and are going through the questionnaire for our PCI audit. And the way this stuff works is it’s a self attestation.
Max: 08:38 Who knows how many pages worth of like, questionnaire online that you have to click through, and then you get to the bottom back and you say, yes. I approve it. And I just remember walking in this meeting of, oh, we’ve got fill in the blank system in place. Right? And just looking at me, like, no.
Max: 08:51 We don’t. We were talking about doing that. Right? Yeah. We were talking about doing that, but then we decided not to do it because they didn’t wanna do it.
Max: 08:57 Okay. Well, we’re talking about it. Right? Okay. So we can say yes that we’re we’re we’re gonna implement the system then go through and they’re checking all these boxes and I was like, oh, jeez, I don’t wanna be in this meeting right now.
Max: 09:06 I was hilarious about that one was I don’t know if they just filled something out that just looked completely insane and crazy or if it was a random selection, but we failed the self attestation audit and ended up with I don’t know if it was Deloitte or KPMG in our office for a couple weeks going through. And it wasn’t just infrastructures operations finance. Like, the whole company gets, like, inspected from top to bottom, And I have no idea how they convince the auditor to actually let them continue to process credit cards with the shenanigans that they were doing. They were caught doing I don’t know. Just some crazy, I mean, some crazy things.
Max: 09:35 Some crazy things. And I don’t know what percentage of I mean, it’s I that was the only time I, you know, experienced it, but I have to believe that, probably isn’t the only version of this story. If you’ve got something like this, comment below. Tell me your story. I’d love love to hear your version of this.
Max: 09:51 I bet it’s a doozy. I’m Max Clark. Talk to you later.
