Signifyd fraud prevention for Mexico and Canada

Online sales were a very large and growing share of Lacoste's business, but fraud exposure in some countries called for stronger controls. Every fraudulent order carried handling costs such as bank disputes and chargebacks. Lacoste had already implemented Signifyd in the US and Brazil; Signifyd scores each order before payment authorization and takes on the liability for the orders it approves. As digital project manager for North and Central America (NORCAM), responsible for the Mexico implementation and then Canada.

The challenge

Fraud exposure on the Mexican web store called for stronger controls, and every fraudulent transaction brought handling costs such as insurance and bank disputes. The goal was to replace the existing fraud checks with Signifyd, improve the acceptance rate and reduce the chargeback liability. Signifyd's model is to guarantee the orders it accepts, so Lacoste would stop handling unpaid orders itself.

The same project had already been done for the US and Brazil, but their documentation was not detailed enough to simply repeat it. Much of the work was re-deriving those methods and adapting them to a new country, with technical teams in France, business owners in Mexico and me in New York.

Solution design

The web stores run on Salesforce Commerce Cloud, which captures online orders and talks to the warehouses. Card payments go through Cybersource, which sends the amount and payment method to the banks for authorization. I designed the integration so that Signifyd is called before the Cybersource authorization:

1. The customer places an order on the Salesforce Commerce Cloud store.
2. Before authorization, the store calls Signifyd through a web-service/API interface with the order data.
3. Signifyd scores the risk using the customer information, location, payment method and history, order and delivery address, email address and email history, cross-referenced with its own network.
4. The accept/decline rules I configured turn the score into a decision.
5. The order then continues to the Cybersource authorization step with Signifyd's decision.

I identified every technical need (interfaces and Salesforce configuration points), took part in the interface design, co-wrote the detailed technical specifications and reviewed each document before presenting it to Lacoste's IT leads.

Historical data: the burn-in period

The most important part of the project was not the interface but the data. Signifyd's algorithm relies on history: a customer's first-ever order scores lower, as does an email address that differs from previous orders. Going live with an empty history would have meant declining good customers.

• I extracted as much order history as possible from the Salesforce database with SQL queries and, with the team, built files in Signifyd's format.
• Signifyd's plugins were also switched on before go-live to send live data into its base (the burn-in period). During this phase we had to resolve data consistency issues in the data extracted from the payment provider.

Project organization

Two risks I tracked closely were a go-live date right after a sales period and an IT code freeze over the same window.

Difficulties and how they were solved

• High decline rates after go-live. Initial results were disappointing, with very high decline rates. I analysed the causes with the data collected and worked with Signifyd to adjust the algorithm settings, relaxing some criteria and raising the acceptance rate. The improvement was very visible to the business.
• Status mismatches. Some orders showed as pending in Lacoste's systems although Signifyd had approved them. I corrected them manually first to keep orders moving, then proposed a permanent fix.
• Post go-live visibility. I monitored with Signifyd's reporting tools and sent the business a daily status (online sales, accepted, declined) with the bug list and resolution status. For the first time the business had real accepted and declined numbers instead of estimates, so it could set fraud-reduction targets and understand where fraud came from.

Canada

Because the US and Brazil documentation had not been enough, I documented every action, configuration point and development during the Mexico project. When Lacoste launched Canada after Mexico, I reused that material and delivered Canada in half the time.

What I learned

Fraud tools are only as good as the history they start with. Planning the data load and the burn-in period as a workstream of its own, and documenting the implementation so it can be repeated by country, mattered more than the interface build itself.