T he backbone of PayPal’s success is its fraud squad. Levchin heads a team of 100 employees, about one-sixth of the company’s personnel, who work full time fighting fraud and fine-tuning Igor’s ability to ferret out scams. By watching Igor’s constantly changing graphics for red flags, alerts and statistical anomalies, the fraud fighters can pinpoint accounts exhibiting unusual patterns of activity that signal certain transactions may be fraudulent-things like one user attempting several transactions at once, high dollar amount transfers, or payments being sent to notorious locations or unverified addresses. “The system is conducive to rapid investigations,” Levchin says. When Igor detects dubious activity, humans review the evidence and decide whether to freeze the corresponding accounts.Igor has to not only move quickly but also be right. As it tested early versions of the software, PayPal was hit with a customer backlash when Igor got overzealous and prompted employees to inactivate many legitimate users, who were suddenly unable to send and receive money. When those users couldn’t get through to PayPal’s flooded customer service department, a spate of complaints to the San Jose, CA, Better Business Bureau followed, leading to a public-relations disaster. The company has since refined Igor to hone in on only the most suspicious behavior patterns, and it has staffed an Omaha, NE, call center with more than 400 customer service specialists and operations staff to handle inquiries and quickly unfreeze accounts when appropriate.
PayPal also has several patent-pending techniques for verifying its customers’ identities. For example, when a member signs up to allow the company to directly debit and credit her checking account for PayPal transactions, the company makes two tiny deposits into that account-say 14 cents and eight cents. Once the member learns the amounts (from an online, phone or paper bank statement), she must enter the correct figures on PayPal’s Web site to activate the link. “This verifies their identity and tells us that this person has control over that account,” says Levchin.
Once the user’s account is active, Igor’s pattern detection algorithms start monitoring it. While Levchin won’t reveal much about what Igor looks for, this much is clear: Igor incorporates some of the oldest and newest techniques from the field of artificial intelligence. It is an expert system that knows a series of rules (for example, if money is being transferred from a U.S. user to a foreign one, then check whether the foreign user is in a country approved for PayPal usage). Igor also incorporates a neural network that “learns” new types of fraud over time. If a certain user keeps linking new credit cards to his PayPal account, then opens another account under a different e-mail address and attempts to link some of the same cards, Igor will learn the intricacies of that scam and watch more carefully next time.
Policing electronic payment activities is becoming more and more challenging. Last May, officials from the Federal Bureau of Investigation revealed the results of Operation Cyber Loss, a sweep of stings that led to the arrests of 90 hackers charged with defrauding 56,000 citizens of $117 million, mainly through online auction fraud, stolen credit card numbers traded and used over the Internet, and wholesale identity theft. Months before those arrests, PayPal and the FBI first began sharing data and evidence with each other. Levchin says that FBI agents have been dropping by PayPal’s offices on a regular basis, comparing Igor’s red flags with tips that the FBI collects through its Internet Fraud Complaint Center Web site.