A New Age for Underwriting

Vetting a new merchant takes a lot of work, but the plethora of nontraditional data may make it a little easier.

How do you tell the difference between a bot applying for a merchant account and an actual human doing it? The answer might lie in social-media profiles and a little understanding of human nature.

Underwriting is a venerable and vital part of signing up merchants to accept payment cards. And it, too, like so many other aspects of acquiring, is changing at a record pace. The process of ensuring a merchant applicant is who she says she is is important because, without verification, bad actors can access the payment network. That can destroy revenue channels and harm the industry’s reputation.

Fortunately, new underwriting methods have emerged to make the job a little more effective. In today’s culture, for example, the prevalence of social-media profiles—68% of U.S. adults use Facebook and 45% use Twitter, the Pew Research Center says—is a bonus for underwriting. It can be an asset to independent sales organizations, payment facilitators, integrated payments providers, and others.

The basics—such as legal name of business, a credit-background check, site visits, and checking that the merchant applicant isn’t prohibited from connecting to a payment network—are still essential, and indeed required by acquiring banks.

Other traditional types of information and methods include a merchant’s history, verifying the business structure, examining prior processing statements, verifying that inventory reflects the sales volume, and operational data like average transaction amount and chargeback history.

But now this core information, coupled with the nontraditional data, informs underwriting decisions for more and more payments providers.

Some online methods, as outlined in the second edition of the Electronic Transactions Association’s “Guidelines on Merchant and ISO Underwriting and Risk Monitoring,” include conducting an eBay Inc. member search, reviewing message boards like Scam.com or RipoffReport.com to view consumer comments, and making a reverse phone search using Superpages.com. The ETA advises that any negative information found does not represent an attempt to discredit the merchant.

Asked And Not Asked

At PaySimple, a Denver-based payments provider, the nontraditional data can help fill in what merchants don’t say. Merchants use PaySimple’s Simple Sign Up online application to provide the information PaySimple needs.

This information forms the nucleus of the underwriting assessment, David Sharp, PaySimple’s president, tells Digital Transactions. “We can get a full picture of what they provide to us and what they didn’t provide to us,” Sharp says. “We evaluate and score everything.”

PaySimple performs the basic review of a merchant’s application, such as checking out the merchant’s Web site to see if it aligns with what the merchant purports to be selling. But PaySimple’s underwriters, too, will examine what wasn’t asked about.

“What we’re not asking is what time of day did [the application] take place and if it was in the merchant’s local time zone,” Sharp says. “Is that out of the ordinary for the industry?”

Other considerations might be how soon the application is made after inquiring about a PaySimple account or the geolocation of the application. Does that location align with where the merchant is based? Sharp says a merchant who applies while, for example, on vacation in Europe for her U.S. business might not warrant an automatic rejection. Instead, PaySimple will ask for an explanation in most instances, he says.

All this is vital because PaySimple, with 10 years of experience using its Simple Sign Up online service, has reviewed thousands of applications. “We’ve mapped out the buyer’s journey and what the characteristics look like,” Sharp says.

One tactic that PaySimple employs is defining its ideal client profile. Each merchant application is measured against this profile. If a merchant application is below that threshold and presents peculiarities, PaySimple dismisses it.

‘Extra Credentials’

This tactic of collecting data and vetting it against what the merchant says and what it doesn’t knowingly reveal is vital even for value-add services sold by independent sales organizations and acquirers.

At FundKite, a merchant cash-advance company, vetting merchants is just as important as it is for a merchant-account provider, and it also relies on determining the validity of both traditional and nontraditional data.

“Everything besides business history and credit score is ‘nontraditional’ in the sense that it wasn’t primarily used 10 years ago, but most funders in the industry use the same extra credentials,” says Alex Shvarts, chief technology officer and founder of New York City-based FundKite.

In his company’s case, nontraditional methods might entail calling the merchant’s landlord to verify the business location, asking what the merchant wants to use the money for, considering the seasonality of the business, asking for projected revenues, making a site check, and asking about other advances the merchant might have taken.

“The merchant interview is crucial and really highlights how important underwriting is,” Shvarts says. “Seeing how much a person knows about the business and the way it makes money is one of the most important things in determining if the business is profitable and will be able to pay us back.”

It’s the combination of traditional merchant data with the nontraditional that’s necessary today and has the potential to produce the best decision on the merchant’s application, say both lenders and payments providers.

“While FundKite heavily factors in numbers, financial statements, bank verification, payback months, and credit score, there is so much else that needs to be looked into about the individual and the business,” Shvarts says.

Catching Bots

Indeed, some merchant types aren’t as easily evaluated electronically and require some atypical vetting. The cannabis industry, for example, is dominated by cash transactions because of the uncertainty surrounding the legality of accepting card payments.

These merchants would need more than bank statements and credit sales, Shvarts says. “While FundKite considers cannabis businesses to be too high-risk to fund, other alternative lenders rely on nontraditional sources to provide that industry funding,” he says.

At PaySimple, nontraditional data is growing in importance, Sharp says, not just as possibly useful fringe data but as a larger part of the decision-making process. One reason for this is that the proliferation of data, even the stolen kind that ends up on criminals’ computers, presents challenges. That wasn’t always the case a few years ago.

“One of the things we learned is that if it was a pristine application a few years ago it might be let go for auto approval,” Sharp says. “What we’ve found recently is, if it looks too good to be true, it probably is.”

But that doesn’t necessarily mean an automatic denial. It’s at this point that nontraditional sources prove their worth. PaySimple will visit the applicant’s Facebook page and check that the marketing done on the social network matches with what the application says. The demographic data will also be checked and any differences noted.

Another nontraditional tactic might be to use a CAPTCHA—an acronym for Completely Automated Public Turing test to tell Computers and Humans Apart—to determine if the application is being completed by a human or a bot.

The sure sign of a CAPTCHA is the sometimes pesky dialog box that requires a person to select all the cars in the image or type in a code. “There are ways to trip up a bot,” Sharp says. A simple way might be to include a hidden check box on the form. If checked, that signals further review of the application, he says.

This is a special hazard to PaySimple because most of its customer-acquisition effort consists of digital marketing. “When you put out that amount of digital marketing, you encounter fraud,” Sharp says.

Interestingly enough, any detected fraud is examined to see what digital marketing campaign it came from, he says. “If we detect fraud coming from a campaign, we’ll adjust our campaign.” Typically, PaySimple reviews its campaigns monthly, not only for potential losses but for what is working well.

‘The Final Say’

It’s vitally important that the vetting process be complete and accurate, especially for companies like FundKite, which can send money immediately into an approved merchant’s bank account.

“Part of why the [cash-advance] industry is booming is because of how quickly funds can be transferred,” Shvarts says. “With immediate money wiring and [automated clearing house] deposits, businesses can get money ASAP. The use of Docusign also allows us to fund over the Internet by having legal documents signed within minutes, no matter what state the business is in.” Docusign is an electronic document-signing service.

Sometimes the nontraditional information isn’t electronic. “Red flags also can come up over the phone,” Shvarts says.

Interestingly, questions that may seem alarming at first blush really aren’t. “Someone who asks questions about being unable to pay back or is concerned about being over-leveraged isn’t a sign that their business isn’t doing well, but rather that they are logically thinking about numbers and whether their business can take one.”

Instead, what provokes concern is the quiet applicant. “Someone too eager for anything, asking no questions and blindly accepting funding is a sign that this deal is a risk,” Shvarts says.

Interpreting that kind of information, as with PaySimple’s efforts to determine if a bot or a human completed an application, requires human intervention. That’s where the one inviolable element of the entire underwriting process reigns supreme.

“The underwriter holds a lot of power in that they have the final say,” Shvarts says. “It is absolutely the most important part of funding a business.”

Even with conventional underwriting data, an underwriter must review key aspects of a prospective merchant. For example, Visa Inc. wants the acquirer to verify that a merchant has credit and return policies that say how they handle this part of their business.

If it’s an e-commerce business, even if the merchant already accepts cards in its brick-and-mortar store, underwriters have to ask for and review specific information. This may include verifying Web-site ownership, ensuring customer-service information is clearly visible, and checking to see that the merchant has all the necessary terms and conditions, and similar policies, on its Web site.

Companies like PaySimple and FundKite automate as much of the process as feasible. But the human aspect is not going away any time soon.

“The process can’t be automated yet because you can’t just look at numbers, you have to factor in many other aspects to calculate the overall health of the business, and it takes a human eye to check for fraud statements from fake or lying businesses looking for ‘free’ money,” Shvarts says.