New year, same risks?

The last few years have been interesting for risk and fraud teams, to say the least. A global pandemic, market volatility, and advancements in generative AI have increased the amount of fraud and complexity of suspicious cases that companies face. However, the last few years have also introduced interesting opportunities for mitigating SMB risks.

Here are some trends we’re keeping an eye on. Think we missed something? We’d love to hear your predictions for 2024.

AI: a double-edged sword for risk management

Recent advancements in AI present both new challenges and opportunities for SMB risk.

Generative AI can make it easier to commit fraud, and it can generate increasingly complex instances of business impersonation that are harder for conventional fraud detection methods to catch. For example, fraudulent actors can use generative AI to forge identity documents that are convincing enough to trick existing algorithms and experienced fraud analysts.

On the flip side, LLMs offer a novel way to tackle a long-standing problem within SMB onboarding and underwriting: unstructured data. While there’s been a proliferation of SMB data in the last couple of years, it’s been difficult to extract risk insights from this information because it is unstructured and required manual analysis. LLMs can parse unstructured SMB data at scale and capture its semantic meaning, without losing important context.

‍Merchant Real Industry is the first tool to leverage LLMs for SMB risk detection. It’s a GPT-4 powered model that instantly predicts a business’s Merchant Category Code (MCC) and six-digit NAICS code.

Rise of SMB fraud

While several players are trying to tackle consumer fraud, hardly anyone is addressing the growing challenge of SMB fraud.

Companies serving businesses are facing two main types of SMB fraud:

First-party fraud: A fraudulent actor uses their real identity in a business application, but intentionally misrepresents their business or their intentions in order to gain access to the platform.
Third-party fraud: A fraudulent actor uses someone else’s identity in order to open a business application for their own material gain. This is also known as business impersonation fraud.

Both types of fraud are on the rise. Research indicates that 50% of fraudulent SMB loan applications possessed signs of first party fraud post-hoc. Most companies lack the tools to identify these signals in real-time.

On the third-party fraud side, fraudsters are deploying more sophisticated strategies to impersonate legitimate businesses and bypass conventional checks. Many fraud detection tools don’t catch these signals. For example, a tool might check whether an applicant’s email address is associated with a suspicious domain, but it won’t check to see if the email is truly associated with that business.

In recent months, we’ve increasingly been hearing about these challenges from our customers and prospects. We’re excited to address this problem head-on very soon.

Software platforms shifting risk management in-house

We speak with countless software companies, and recently we’ve been hearing the same pain point: they want to start managing risk in-house and own the full customer experience, but they don’t know how to set this up.

Software companies possess valuable contextual data for understanding their SMB customers. However, most of their partners don’t factor this information in when making decisions, leading to frustrating experiences for their SMB customers. For example, let’s say a platform offers payment acceptance through a PayFac-as-a-Service (PFaaS) provider. If one of the software platform’s long-standing SMB customers signs up for the payment product, the PFaaS might mistake them for just another new merchant and might add friction to their payments experience. It’s not the PFaaS’s fault: it’s their first time interacting with said SMB, and they have no way of capturing the platform’s prior history with that customer.

When software companies bring risk-management in-house, they can leverage their proprietary data in risk decisioning. They can use this data to improve customer experiences (e.g. faster payouts based on “good” behavior) or add friction when they detect meaningfully unusual activity.

Most software companies don’t have the knowledge or engineering resourcing to build this risk management strategy from scratch. Coris helps software companies build customized, automated risk management strategies using Fuzio. Platforms using Stripe Connect for branded payments can even automate key payout decisions or handle various payment exceptions with our native Stripe integration.