Soups Ranjan: Why Fraud Is Becoming a Battle of Bots

As you know, Contrary Research's big focus is on being the best starting place to understand any private tech company. So we like to start with the simplest question right at the top. What does Sardine do? Give us the elevator pitch, and then we can dive into the details.

Absolutely. Sardine is one unified platform for solving for both fraud and compliance. We serve 250-plus customers globally in a variety of sectors, such as banks, banking as a service, fintechs, crypto companies, gift card exchanges, online marketplaces. And we solve for fraud using behavior, consumers' behavior. That's our differentiator. The second differentiator is we have combined both fraud and compliance, which would be KYC, identity verification, as well as transaction monitoring.

On the compliance side and on the fraud side, we do things like detecting if someone is using a stolen identity or synthetic identity at the time of account opening. Are they using a stolen card or stolen bank account to make a payment? Or did somebody make an unauthorized login attempt, and after that, they are draining your wallet or your account? And then finally, issuing fraud, which would be for all these new types of card issuers like the neobanks. If I have a Chime card or a Brex-issued card, did that get stolen and somebody else is spending on it?

Every founder, I'm sure, has this aha moment where they realize what they want to build and why. You have this quote when you talk about the company where you say, "I knew that I needed to start Sardine when I saw firsthand a million dollars stolen by identity fraud." Tell me about that. How did that fraud happen? What was the story that led to the founding of Sardine?

This is when I was at one of my prior employers. I was managing fraud at Coinbase. And this is circa 2016, which is when the price of Bitcoin was like $250. In those days as well, and it's still true today, if you have a stolen identity or a stolen payment instrument, the best thing you can buy is something which is crypto. Because it's instantly transferable. It's not reversible after you bought it. And then it's fungible. You can go sell it somewhere else. In the old days, if you had a stolen card, you'd drive to Best Buy and load up the highest priced smart TV. Nowadays, there are many easier ways of stealing money from a stolen payment instrument.

So now going back to the story, this is then 2016. And if you remember in those days, concepts like identity verification, they were just very new. The fact that crypto exchanges such as Coinbase were even asking folks to upload the driver license was very new. But anyway, what happened in this case was that we saw somebody had taken over someone's bank account. Another person stole an identity and essentially created what I would call a synthetic profile, in the sense that one person's identity, different person's phone number, and a third person's bank details.

And now the interesting thing here is that when we found that there was a loss to this extent and we reached out to the person who had uploaded their ID, they were like, "Hey, I didn't do it either. My identity was stolen. I filed a police report about it."

So then we realized that there's fundamentally something broken over here, which is that the world of identity verification today, it does not talk to the world of chargebacks at all. In my experience running fraud at Coinbase, Revolut, et cetera, 90% of chargebacks we would get would be from fully verified identities. I would have an SSN on file, verified. I would have a driver license on file, verified. But still payment fraud is happening.

So that was the aha moment later for me when I was searching for an idea to start a company. The aha moment was that we need one solution, which combines the worlds of KYC identity fraud with the world of payments. Because KYC is a one-time relationship. The KYC companies, they don't know anything afterwards. After you have done KYC, they have no idea of the subsequent customer journey. Payment companies, they don't have visibility today about what KYC you did. And Sardine is really unique in that we bring the two worlds together in one platform.

I want to get to the Sardine solution, but before you do that, you see this fraudulent experience firsthand, and you see that as indicative of the broader landscape. Help me understand the status quo of the anti-fraud industry. Who are the big players? Who does the bulk of this work? And then we can step into how Sardine innovates on top of that.

First and foremost, fraud is as old as money. So there have been and there are several fraud prevention providers out there. I would say majority of them, they started in the world of e-commerce fraud, like the Best Buy example that I just gave. So primarily looking at credit card as a main payment instrument and preventing card chargebacks done to buy something at an e-commerce store. In that world, even if you switch from physical retail to online, to prevent fraud, you got to look at just primarily shipping address and shopping cart as signals. Am I shipping it to their house or a PO box? And shopping cart analytics, meaning, did I immediately add the highest value item that this merchant sells?

So then the world was shifting into more of this quasi-cash type use cases, where signing up for a fintech wallet and loading money into it, or I'm loading money into a brokerage to buy stocks, or loading money into a crypto exchange to buy crypto. Then we had this realization that the actual product that you're buying has no shipping address associated with it. And that's where we first started. We first started with the digital only. So we have the top three crypto exchanges as customers. We serve one of the largest gift card exchanges as a customer. And we also now serve online retailers as customers. Because our thesis there was that if you can solve for fraud in a high-risk industry, you can solve for it in lower risk. In other words, if you live in a tough neighborhood, you learn a trick or two.

The types of customers you have are not small organizations. These are pretty sizable organizations managing a very broad customer base, and it doesn't sound like they're very well suited to deal with fraud. What exactly is the difficulty or the limitation for them that makes a solution like Sardine make so much sense?

The unique value prop that we bring in the world of fraud prevention is our focus on just users' behavior, behavior biometrics. How do you type, swipe, scroll, move the mouse, hold the phone, et cetera. And we saw an opportunity there that while it has always been talked about, behavior biometrics as a concept has also existed for at least a decade. No one was really applying it in the world of fraud fighting. They were trying to apply it in the world of account takeovers primarily, but not for payment fraud, not for identity fraud. So that's our strength.

We've invested the last three, four years into building the most sophisticated SDK, which does both device fingerprinting as well as device risk assessment. Is this a true device or is this somebody using an emulator, a script? We have proxy and VPN detection, which is world class. We can oftentimes pierce through a proxy and identify the true IP being used by a scammer.

And then on the other side, we also focus very heavily on the behavior signals. One example would be if I am creating an account using my personal info, everything will be autofilled by the browser. However, if I'm pretending to be you, Kyle, I'll context switch a lot while I look up your info, or I'll copy paste it. Another example being we have signals which tell you when someone is using a mobile phone, are they typing with the phone being upside down, which wouldn't make sense. Is there any shake when you're typing, which also wouldn't make sense? So those are very advanced telemetry signals that we get into.

You have the KYC side of the house, and you talked about payments. You're trying to bring things into one place. If it starts with tracking a user's behavior, how does that platform flow through everything that you're doing?

Going back to what I was saying earlier, identity prevention companies don't stop fraud because their relationship is one time only. What we instead do is we have continuous relationship with the consumer, in the sense that when one of our partners is integrating us, they make a call to our API at time of account opening. Again, they make a call to the same API when you are adding a payment method. And then the customer is logging in, they make a call to the same API. And every time they're just passing us some additional information with respect to that checkpoint in the customer journey.

And the API surface area is very simple: name and address, DOB, SSN at opening of the account, payment instrument info at the account payment method linking. But behind the scenes, we are doing a lot of data crunching in real time. And that's a strength. In real time, we're doing all this aggregation, cleansing of the data, post-processing. And then we produce 4,000-plus features in our internal feature store. And you essentially now get a machine-learned risk score back from us in real time at each of those checkpoints.

When I've spent time with companies in the user onboarding and KYC and AML stack, it feels like there are very specific segments. There are workflow tools that help you manage your own fraud processes. There are point-in-time solutions, like the KYC folks you're talking about. And then there are the data providers, from old-school LexisNexis all the way down. How do you think about yourself in that landscape? Are you trying to solve that entire process, integrating with some of those point solutions and being the workflow platform yourself?

One of my other realizations was that at Coinbase, I had 35 different data providers I was buying data from, managing all those 35 contracts. And then 2020, when we were starting Sardine, we realized that as new entrepreneurs are starting fintech companies, or as money movement increasingly moves online and banks, et cetera, have to redo their whole stack, starting from redoing their core processing so that they can enable faster payment methods, in both those cases, you can't really do what you're doing, as in go integrate 35 data providers. Or always keep adding one and one more and one more and one more.

So our pitch was very simple, that it's one singular API which solves for both your fraud, KYC, AML responsibilities. Simple API. Behind the scenes, we go and we acquire data from the same 35 data partners, and we are constantly looking for best-in-class additional data providers. Depending on the context, we can then enable any of those modules for you.

So in other words, we are fraud prevention using machine learning at its core as the core differentiator. When it comes to KYC, we can act as an aggregator of sorts. However, we are much more opinionated than some of the other workflow orchestration engines that you see, as in, we're not going to say you'll have access to 200-plus data providers in our platform. That's not our pitch. Because even after you have those 200-plus partners, you do still have to come back and do the work. We actually do a lot of that heavy lifting work. We choose best-in-class partners for SSN checks, sanctions checks, et cetera. And we always have two partners for everything. So yeah, in short, fraud is our core focus and KYC.

You'd spent some time at Coinbase, and starting in 2020 and into 2021, crypto as a category had a good run, and I know you had some success there. As you've seen crypto correct to some extent, or have an extended downturn, how did that impact you? Were you already pretty diversified away? And how are you thinking about the categories you're prioritizing going forward?

Building a horizontal platform, such as what we're doing at Sardine, it has multiple use cases. So our product hasn't had to change at all. Earlier in this year, we started going out categories outside of fintech, crypto. So we now have several online marketplaces as customers. We have several banks as customers now. And we have several, of course, embedded finance customers as well. And to answer your question, the platform is very modular. So it has use cases for all these specific categories very easily.

As you look at the best way to capture the value you're creating for those customers, how do you think about the business model? Are there certain flat rates? Is it based on the number of API calls? How have you thought about aligning your business model to the value you're creating?

That's a great question. Our goal is always that the cost of fraud should not be higher than the fraud rate itself. So we have a very interesting story I want to share. This is one of our customers in the gift card exchange space, one of the largest gift card marketplaces. The very first call, the entire C-suite showed up, the CEO, the CTO, the CPO. And they were like, "Hey, we're spending over $2 million a year on just the cost of fraud itself, all the data scientists, the backend engineers, all the Google Cloud costs, et cetera. And we can't keep maintaining it. This is not a core value prop at all, to be best in class in fraud fighting." So we made a decision to not buy instead of continuing to maintain what we built. And really applauded that decision, because a lot of people get emotionally attached to what they've built. And anyway, they signed with us at a fraction of what they were spending earlier, and they're a very happy customer. So we are very much aligned with that value, that we are customer first.

The pricing model itself is SaaS. There's a platform fee, which gets you access to our dashboard, which has a low-code rule builder with 700-plus rules that come out of the box on fraud as well as the AML typologies. And it also has a network graph tool, which you can use to investigate various entities which are linked together in a fraud or AML ring. And it has case management functionalities as well built in, including, for banks, we offer user activity report filing or SAR filing as well. So that's the dashboard side.

Then for our device intelligence, behavior biometrics SDK, we made a conscious decision not to charge per API, because that's what I used to pay in my prior life. And guess what? When my vendors were charging me per API call, I would be like, "Man, after two or three times this person opens up the app and does transactions, I already know they're good." So I used to actually stop calling those data providers afterwards. So we said, okay, we're not going to charge per API, we're going to just charge per MAU, per monthly active user. So that's how we charge. So even if you open up your fintech app a hundred times a month, you only pay once for that month. And then for transactional stuff like fraud or AML, it's per transaction, and for KYC, it's per user.

On the MAU side, are you able to track that more actively than other software companies might, because you're actually having to keep track of that person and enrich a user profile? So you don't need the company to report their MAUs to you, and you're not going to charge them if you're verifying the same person?

Yeah, no, absolutely. In fact, we do all the heavy lifting on the pricing. When the customer integrates with us, they actually send us a user ID, as well as every time that user is logging in, doing anything, we know that user ID. So we do the counts of MAUs for them. It's built into our dashboard.

There's a very big difference between a marketplace doing a couple hundred million of revenue and a multi-billion dollar bulge bracket bank. How do you think about those segments, and how does that inform the go-to-market motion you're using?

Our go-to-market motion is increasingly much more enterprise heavy. And that's actually very true for our product as well, because the product itself is built for large enterprise customers who have many fraud ops or compliance ops professionals reviewing cases, et cetera. But between the online marketplace serving hundreds of millions of revenue versus a bank with billions, we don't really differentiate very much, because the product is really just built for both the use cases.

The only realization we've had is that for the smaller companies, the early young startups, we have realized that you can only do enterprise. You can't do both enterprise as well as really young startups together. So we are constantly trying to figure out, okay, for these young startups, what can we offer them? And we still haven't found the perfect solution, but what we've realized is that we can't really handhold them so much, because we can't really continue to scale up our post-sales team in order to handle all the small companies out there. But we are trying to figure out the motion for the smaller ones. The enterprise one, it's a well-trodden path for us now. We have several Fortune 500s in our customer portfolio.

Do you have a self-serve product that folks can use, or does it all have to be sales-led? I'd imagine it's very difficult to just swipe a credit card and handle it yourself.

No, we don't want to do that at all. In fact, our API documentation is also not public. The reason is, fraud is a very interesting space. Fraudsters are trying to break in and realize how are anti-fraud companies solving for it. So that's why we don't have self-serve. That's why I don't have APIs that are public. At some point of time, we might look into building self-serve, but not a priority at this moment.

When you think about the types of fraud or threats out there, what are you most worried about, or what do you think are the most pernicious or the most difficult to combat? And is any element of that supercharged by things like generative AI? I feel like there's more on the phishing and cybersecurity side, but I'm curious if in fraud there are certain alarming trends.

Yeah, no, absolutely. We service both anti-fraud as well as scams, prevention of both. And I think that tools like generative AI are just making it easier to perpetrate both. Scams, even more. Because the way I differentiate between fraud and scams is fraud is basically your payment instrument got stolen and someone is spending as you. Scams is that you actually authorize the transaction yourself, but somebody conned you into making the transaction, they socially engineered you into making the transaction.

So with generative AI, we are seeing cases like folks are cloning your voice, your video. So therefore, online verification of identities becomes difficult. Voice-based authentication when you're logging in at banks, which still allow you to do that, becomes harder.

So our thesis is that the future of online verification of identities is increasingly going to be a battle of bots: extrinsic AI-trained bots versus intrinsic AI. Extrinsic AI bots would be the bots which are trained on OpenAI, clone your voice and video, because that data is in the public domain. Intrinsic AI would be how you type, how you swipe, how you hold the phone. That data is not in the public domain. And so therefore, fraudsters can do anything to clone your public domain info, but they can never clone what truly defines you intrinsically. And that is where Sardine fits in, on the intrinsic AI side.

Are there use cases where you can't apply that type of behavior data? Is it more difficult in certain types of transactions, or can you apply it everywhere?

We apply it for things like identity fraud. Like the speed at which you type your social security number. If I type mine, I'll type it fast from long-term memory. But if I'm pretending to be you, I'll type it slowly. So that's one way. Payment fraud, again, if I'm buying something online, my credit card will be autofilled by my password manager or my browser. But if I stole your credit card, I'll copy-paste it, and I'll context switch every time if I'm typing it.

Account takeovers as well. What we've found a lot of success in is, let's say I phished you, Kyle, and you entered your username, password in a site which looks like a bank. But I take the credentials and I'll replay it. When I'm replaying it, I have to do all of this fast. So I'm going to either use a script to copy-paste it into the actual bank. And then, of course, when I'm replaying your credentials, I'm going to use a different IP, like a proxy. So then we'll pierce the proxy and find out the true IP as well. So that's, again, where we find success.

There was a lot of hype in the earlier days that you can use behavior biometrics to do online authentication. But that, I don't think, has panned out yet. I don't think behavior biometrics is ready for that. We have built behavior biometrics models which can re-identify you based on how you type. But I would have had to see you at least three times before. And then for the fourth time onwards, based on how you type and how you hold your phone while typing, I can say with 85-ish percent accuracy if it's you versus someone who picked up your phone and is typing. It'll never be 99.9% like Touch ID or Face ID. So it's a fraud signal. It's not supposed to be an authentication signal.

Shifting gears, as you think about the next two, three, five years, what are some of the hurdles you need to be watchful of as you continue to build the business? Whether it's execution on your side, competing for ML talent to advance the models you're using, or increasing rates of fraud.

In any startup, I think that the biggest risk is really execution risk, and velocity of shipping is something we always monitor very, very carefully to plan against that. We are close to 100 people today, but since we were three people until 100 people, we don't do two-week sprints. We do one-week sprints. My engineering team does not do monthly product demos. They do every week to the entire company. Then my sales team and partnerships team, we have sync with them every week. And speed is utmost importance, because if you don't have speed, being slow will just kill you, or another competitor will crush you. So every single day, me and my team, we actually have an SLA of one day. We respond to every customer for the email request within a day worth of SLA.

So yeah, not concerned about execution risk. I think the only thing I think about mostly is how do we stay ahead of the curve when it comes to changes that are happening in the macro. Macro could be things like, are more and more payments just going to move to faster payment methods? What does that world look like then? Does that world then have even more scams and fraud, and how can we continue to play a more increasingly meaningful role in that space? So those are the questions I think about.

You have this interesting seat. A lot of people get excited about the progress of fintech and digital payments, and I'm sure you're glad payments are getting easier as a consumer. But every time there's a new paradigm shift in the way payments are processed, that also opens up a whole new basket of threat vectors. Are there certain things happening in fintech where you can almost feel yourself getting ready to jump in and pick up the pieces, and you need to be thoughtful of how the fraud may change?

Yeah, no, absolutely. So we're doing that all the time. Our sales process is very consultative, in the sense that if you're talking to a product manager at a fintech or a large bank, as they're launching a new product, they actually bring us in in a very consultative manner first. Oftentimes, I personally, as well as my GTM team, we'd all immediately help them understand the gaps that they might have when it comes to the new fraud vectors they might introduce. And then we present a solution to them as to how we can help them fix those gaps before they launch.

Because the key thing in the world of fraud is that there's no sort of a red teaming exercise that happens, unlike security. In the world of security, there's red teaming exercises, which identify gaps before go-live.

And it's not just a fintech which launches and fails at fraud. It happens with the largest of payment schemes as well. Look at Zelle. Do you think they predicted they would have this huge scam problem that is at their hands? Definitely not. And the more I think about it, the reason for this is that, number one, no one holistically thinks about fraud gaps before they launch. If they're thoughtful and they reach out to companies like us, we help them through it. And number two, the fundamental reason is that no one teaches you anti-fraud in schools. And that's a big gap that I'm very passionate about changing.

If you could jump forward three years and look at the Sardine platform and the offering you have, is it largely the same and has kept up with the latest fraud practices, or does the platform become more expansive into different areas and categories?

We think that there's a very interesting trend that we want to be a part of, or in fact, even define, which is that whenever there is not just fraud, but other risks as well. Of course, compliance is one of them. Then if you are thinking about managing new customers' customers, for example. That's something we are increasingly seeing, even when we're talking to the largest payment processors, or when we're talking to large B2B companies who are managing logins for their customers' customers.

So we are increasingly realizing that the platform that we have built is scalable horizontally, such that we can go after covering other use cases. We can help these B2B companies prevent account takeovers for their customers' customers. We can go after payment. We can go after folks who are trying to build merchant acquiring in-house and help their compliance teams have visibility into, again, their customers' customers.

And then, likewise, we today provide that type of visibility to sponsor banks who are managing multiple fintech programs in one dashboard. We haven't come up with a name for this yet. Internally, we just call it an operating system, which manages all your programs in one place, so that you don't have to, let's say you're a sponsor bank, you bank multiple fintechs. Today, if you wanted visibility into what your customers' customers are doing, you do an RFI, request for information. It goes over either secure email if you're lucky, or most likely some non-secure email. So there's a lot of PII information floating around. Whereas with this, what we've built here as a grandparent-parent-child setup, you have full visibility into everything that the fintech is doing, into what is the KYC policies, what are the case management queues look like, et cetera. So we want to take this concept from the sponsor bank OS to merchant acquiring, to just managing logins and account takeover risk. It was long-winded, but I hope that was clear.

That plays into what I think is a really interesting trend of people recognizing that you just can't be good at everything. Fraud is a complex, multimodal problem, and increasingly it will make sense to outsource that function to a company like yours. My main question is about companies whose whole business is built around a specific type of financial transaction, like the exchanges. Those trades are their bread and butter. Do you see a world where they completely say, "We want Sardine to manage this"? How do you balance that with somebody who I'm sure thinks of themselves as very informed when it comes to user behavior?

I'm a machine learning guy by training. And when I was building machine learning models for fighting fraud at my prior employers, I used to love data. But the mistake I saw some of the fraud companies make was that they were just hell bent on selling me a fraud score. And I would be like, "Hey, I can actually now create a model and come up with a score quite easily. What I really need is data."

We actually don't see us as a machine learning company. If you want a machine learning model, you can go and spin up a machine learning service in Google Cloud, Azure, or Amazon very easily. We do machine learning, but we don't necessarily want to only offer you machine learning fraud score. So when we work with all these Fortune 500s and some of the largest B2B neobanks or the largest crypto exchanges, we actually offer them all raw signals, all this advanced telemetry of how you type, swipe, scroll, your IP data, et cetera. We have become very good at gathering it in real time, and via our data pipeline, we pass it to them within hundreds of milliseconds. That is our core competency. So we've never encountered that as a stumbling block in our sales process. Everyone loves data. And at the end of the day, we are a feature store, feature warehouse type company.

Final question for you. We've talked a lot about how the world of fraud is always changing. When you think about the next few years, what do you see as the defining trend in the anti-fraud world, and how are you positioning yourselves to take advantage of it?

I think the biggest trend, my prediction would be in the next five to 10 years, we'll start seeing increasingly that all the faster method schemes in every country, they start getting linked together. We already see that UPI integrates with Singapore's faster payment method. In the future, we'll see all of them integrate with Faster Payments in the UK, PIX in Brazil, FedNow, RTP, Zelle, et cetera, in the US.

But then once that happens, and once you can actually use faster payment rails to go from one country to the other to do cross-border remittance, imagine the world of fraud and scams. It's going to be mind-boggling. So we increasingly are of the opinion that we need to have a system which slows down transactions just a tad bit, such that you can do those checks in time, because an average consumer doesn't really care if you added a five to six second, or even maybe just one or two seconds of a delay. But at that time, it's much better to slow down a transaction to go faster, because you slow it down so that later you don't have all the repercussions of dealing with refunding the victim of a scam.