By Sarah Beldo, Sift Science

You may have heard that account takeover (ATO) is on the rise for all types of companies, from e-Commerce merchants to SaaS businesses. The first step to protecting your business is understanding the problem. Let’s take a look at why ATO is growing.

What Is Account Takeover?

ATO, also known as account compromise, is just what it sounds like: a bad actor getting access to a good user’s account. Once that access is achieved, the fraudster can use the account for all kinds of opportunistic and malicious ends. As part of the ATO, the fraudster may change the user’s password to lock them out, and change their email address so the good user doesn’t receive any additional communication about activity on their account.

Some of the ways fraudsters profit from ATO include: using up stored credits or rewards points, making high-value purchases, buying digital goods, scamming other users and phishing, creating fake listings, spamming, selling the credentials on the black market, extorting money from the legitimate account owner and assuming the identity of the real user.

Why Are Fraudsters Attracted To ATO?

ATO can be more profitable than credit card fraud. First of all, many businesses do not have a robust solution in place for stopping ATO, so the window of time for exploiting the information before detection is typically longer. Furthermore, a credit card can only be used until it’s canceled. But even once an ATO is discovered, the fraudster still has access to the credentials or personal information, which can be used to create a new fake account or a synthetic identity.

ATO also provides fraudsters with the advantage of built-in trust. New accounts are more likely to be flagged for fraud or given more scrutiny. If the account already exists and is connected to a legitimate user, the fraud is more difficult to detect and the fraudster has more time to operate before they are discovered.

The Era Of Data Breaches

According to the Sift Science Fraud-Fighting Trends report, 48% of online businesses observed a rise in ATO last year. How did ATO gain such traction over the past few years? You need only look at the big cybersecurity headlines to get a clue. We’ve entered the era of the data breach.

From Equifax to Yahoo, from eBay to Tesco Bank, the scale and sophistication of breaches is growing. Some 554 million records were compromised in the first half of 2016 alone, according to the Gemalto Breach Index. The downstream effect of more data breaches? A rise in ATO. With 59% of people reusing passwords on multiple sites, it’s easier than ever for criminals to leverage all of the data available on the dark web to cash out.

Latest Trends In ATO

Like so many other types of fraud, ATO is increasingly committed at scale by bots, as well as manually. Hackers write scripts that test various combinations of stolen usernames plus potential passwords across multiple web sites and apps, until they find a way in. These brute force attacks are helping fraudsters move as quickly as possible and focus on maximizing the value of each successful ATO. Researchers at Shape Security found that criminals can have as much as a 2% success rate by using these automated attacks.

Want to learn more about how to prevent ATO? Download our free e-book, The Complete Guide to Preventing ATO.

Today our portfolio company Sift Science announced not only their $30 million Series C, led by Insight Venture Partners, but also several new product offerings. This is exciting because it reveals the team's larger vision of "Powering Trust Online" and makes that concrete by going beyond payments fraud to address content, promo and account abuse. These products have been developed with customers and are available now (content abuse, promo abuse, account abuse).

Sift's execution is a great illustration of what I refer to as having a "big vision and an on-ramp," when people ask me what it takes to build a big business. The idea of fighting many different types of fraud and thus helping to create trust on the internet was always what excited the team and us as investors. But when you have a very big vision it can often be challenging to get started. A common failure mode for startups is to try to solve lots of problems all at once and as a result not solve any of them well.

Instead, Sift Science remained focused on payment fraud as their on-ramp for several years. This focus helped build a superior service and a wonderful customer base and along with it a massive data set. Sift applies machine learning techniques to this data to provide realtime decisions at scale. As we had originally expected, it turns out the same approach and much of the same data works well for other types of fraud.

TL;DR: Building a design culture in an engineering centric organizations requires designers to first seek to understand, then to be understood.

1. Good design requires non-designers.

Designers can put together mocks and prototypes, sketches and wireframes. That doesn’t really count as shipping – not without engineers writing code, product managers writing specs, marketers writing press releases, sale folks showing demos, support team educating customers. A well designed product is delivered by a whole team, through a collaboratively built pipeline. If folks along the pipeline doesn’t understand the value of design, some part of the customer experience will fall through the cracks.

2. Learn your counterpart’s Language and Motivations

Engineers want clean and maintainable codebases. Sales folks want a easy to explain and attractive product. Marketers want a coherent and relatable product story. Support teams want well documented error states and messages. Everyone wants to serve customers, and all of them measures their success in their own lens. Design isn’t necessarily top of mind, until and unless you can frame how design helps your teammates succeed in a way that they can see and understand.

Getting your teammate to see the impact of design is therefore itself a design problem.

3. Give non-designers a framework for thinking about design

... or at least a framework for interacting with you. Start with the basics of empathy, e.g. 

people have short attention spans (therefore products must earn their attention)

people have pre-existing mental models for understanding their problems (therefore frame ideas in customers’ existing mental models where possible)

And the basics of the design process, e.g.

It is iterative and intuitive (so trust the process and keep at it)

practice beats theory (so prototype it and show it to customers, then listen)

Help the team understand that design is not colored pencils and magic, but a deliberate practice of making products fit how customers understand/solve their problem.

4. Build a network of design-minded non-designers

Give your framework to everyone who would listen. Not everyone will, but with just a few people on each team with this mindset, it will become a lot easier to deliver good design. You won’t have to run around advocating for design yourself, you will have nurtured advocates.

Keep that network going. Check in with your new, distribute (across functions) design team. Your sales designer will pass along customer feedback. Your marketing designer will come up with new product framings. Your support designer will find and patch (!!) edge cases you never thought of. Your engineering designer will tell you about new possibilities that the new stack is about to unlock.

5. Start with conversations

All of that sounds like a lot, but it doesn’t need to be. It just needs to start with conversations. My go-to opener is, “How are things in Marketing/Eng/Sales/whatever-land?” then followed up with attentive, inquisitive listening. People love to be heard, and people love to help. Both of those things happen more often when conversations are happening, and when people feel that a relationship has been established.

End Notes: Tactics for Building Design Culture

Jump in on other teams’ needs at hackathons. Every hack I’ve done at Sift were for one team or another. It helps build credibility, and shows that you actually care about your counterparts’ success. It’s also a great way to demonstrate the value of design applied to their problems.

TL;DR: Today was my last day at Sift Science. It’s been a heck of a ride, and I’ll miss the team dearly.

I joined Sift two and a half years ago, when it was a small team of mostly engineers in a small office just above Market and New Montgomery. A really talented, really humble and really hungry bunch, looking for a data-vis oriented designer to go along for the journey.

I barely knew anything about machine learning. I knew nothing about online fraud. I had never done b2b design before. I didn’t even think I was done living in New York. Yet, it was an interesting and compelling enough risk that I had to sign on. There are lots of writing on start-up experience – the grind, the up and downs, and fiendish puzzles – but reading about it is nothing like experiencing it.

That’s not to say there wasn’t grinds and ups and downs and puzzles. There were plenty. Accidentally great designs? Check. Blotched launches? Check. Hard won product insights? Yup. Design culture drip campaigns? I like to think I won some of those. I even somehow got a whole component past code review and merged.

The much stronger impressions though will be the team. Credit to Jason, Fred, and Liz – Sift Science has built a team of kind, humble and collaborative people. Folks respected and worked on the level of ideas, not personalities. Teams respect one another across functions, and reached across for feedback and support. It was that way when I joined with 11 people in the office. It is that way when I left today with 40+ folks. It’s hard not to be friends with people here – and I know for sure that many of my friendships here will endure.

So Sifties. Thank you. I leave with distinct notes of pride and pre-nostalgia. Sift Science is a good place. We did good work here, thwarted a bunch of fraudsters, helped build a good close knit team. There’s just so many lessons and memories and friendships I am privileged to take with me. I can’t thank you enough.

A number of people expressed surprise at my choice to work with a data science startup instead of some of my other options. I admit I would be surprised too if you told me three months ago. So I want to document my rationale (sprinkled with premortem notes e.g. worse-case-scenarios), to see how good my reasoning turns out to be a year from now.

The Lens

There were roughly five different lens I evaluated my options through. They were:

Meaningfulness (or Do-gooder-ness)

Kind and Gracious People

Risk and Upside

Scariness (or oh-shit-will-I-make-it)

Realness

Meaningfulness

Meaningfulness in my mind is the question, "will my work benefit the less privileged members of society?" It stems from a haunting awareness of my incredible and underserved privilege in society. There were a number of do-gooder options i.e. going to work for non-profits. The clear leader of the pack here was IDEO.org. It was clear from their mandate that they were working very directly on alleviating poverty and lifting up the developing world through design. There were other places i.e. education startups where I felt their mandate was clearly good for a large number of people in the world.

Of the five lens, this is the one through which Sift Science makes the least sense. I will freely admit I still have trouble reconciling this one, except to commit to working on non-profit work in my spare hours. As a premortem note, if I am unhappy at Sift in a year's time, my prediction is that difficulty reconciling my day-to-day work with societal meaning will be a big part of it.

Kind and Gracious People

When I reflect upon what made graduate school so pleasurable, I found it was always the kindness and graciousness of the people I was working with everyday. I wanted to find an environment where I believe the people will be as awesome as my mentors and classmates. 

This is very much a gut judgement. I was lucky that quite a few of the places had people who seemed kind and gracious, but Sift was among the best of them. Every person on the team I interacted with (and I interacted with quite a few of them) came off as sincere and earnest. They ask interesting questions, and were open and enthusiastic to unexpected questions of mine. Indeed, I doubt I am wrong about this one.

Risk and Upside

Having read Antifragile recently, I have been asking myself, "Am I taking the right kind of risks?" It's kind of an obvious idea that one should take bets with small downsides and big upsides. The antifragile idea is to look for upsides with unpredictable/combinatorial upper limits. This is where a lot of the bigger corporations I spoke to started looking less interesting. Big corporations are places where the downsides are minimal, but upsides are quite predictable, and capped.

In my mind, this is where Sift Science felt really promising. Sift Science sit at the intersection of two macrolevel trends in the world. One is the rise of applied data science, and two is the rise of online commerce. Sift, or something like it, will create a ton of value, and Sift being a YC and USV company gives me a lot of confidence that this is a good bet. I am taking a bit more of a risk than if I were to go to a bigger corporation, but, really, just coming out of school it is a small enough bet that I can afford.

What's the premortem here? We find out Sift is too early in bringing data science fraud detection to the mass market, I learn a bunch of things, and take another job somewhere else in the YC or USV network. Really can't go wrong here.

Scariness

Related to the idea of risk is the feeling of subjective scariness. How afraid am I of taking on a particular set of responsibilities? (e.g. how often do I feel like "Oh shit oh shit will I live up to their expectations of me?") There were a number of options that didn't scare me at all, which to me means I likely won't be stretched as much as I ought to be. Whereas at Sift (and some of the other startups I considered) I felt a bit more nervous. Will I really be able to advocate for good design in a startup environment where I am the only designer? Will I be able to make design sensitivity and language a part of the organization's culture? I felt like I have a very real, non-zero chance of failure, and the thought was invigorating.

Premortem: That I cannot adequately articulate the value of design to an engineering-centric company, end up being a front-end design implementer, and don't bring a lot of value to the team. This would be the nightmare scenario, and will teach me that I am a poor judge of company culture. Fortunately, if this is the case I suspect I will know rather quickly, and can go beg for a job elsewhere.

Realness

Realness has been my short hand for the combination of these three questions:

Am I making something real that people can use in the near term?

Is there a way for me to frequently measure/understand whether my design was effective? (i.e. real feedback)

Is there an opportunity to iterate based on that feedback in a focused and in depth manner?

I understand this is a luxury. There are lots of worthy projects out there where this kind of short feedback loop is not possible. Nonetheless I felt that inorder to develop a better intuition for how people respond to interaction design, I want to live in a rapid and sustained feedback loop. I want to be exposed to real constraints, e.g. user whims, limited time, and limited money. Albert at USV put it succinctly when he said, "I think you will learn a lot from (dealing with) market discipline."

Sift has a functioning product with a strong value proposition, and some customers who undertand that proposition. It's also evident to me that interaction design and data visualization will substantially affect the effectiveness of the product. The circumstances are ripe for doing this kind of in depth product design iteration that I've been itching to do. This is frankly what I am most excited about.

Premortem: I suspect of the five lens this might be the one that I am overweighing the most. At graduate school I was perfectly happy working on theoretical projects. I was also perfectly happy hopping from project to project without diving really deep. It may turn out that in 18 months I will be sick of working on the same problem all the time, and long for the variety that comes from a consultancy like IDEO.org.

Probably Overthinking It

All these were the overwought thoughts of the rational mind. Ultimately, I had to ask myself, in my gut which options did I feel good about? At the end of alcohol infused evenings, when the rational mind loosens its grip, I noticed I was most excited to talk about Sift Science and IDEO.org - and those were my final two contenders.

The final tie-breaker was the idea of optionality. Would it be easier to leave Sift Science to go work at a place like IDEO.org? Or to go from IDEO.org to find a fit like Sift Science. It certainly seemed like a promising, early stage startup like Sift would be harder to find, so the choice became Sift Science.