Inside the world of 'PayPal's AG'

• Key insights: PayPal's size and digital-payments model makes it a target for digital crooks.
• What's at stake: The firm is adding AI and collaborating with law enforcement and trade associations to combat crime.
• Expert quote: "Given the 'smallness' of the world and the proliferation of social media and AI, there's more opportunity for fraud and scams to grow," PayPal's David Szuchman said. 

To battle crooks that target a large firm that handles trillions of dollars worth of digital money transfers, it helps to have been on the front line yourself. 
David Szuchman is the head of global financial crime and customer protection at PayPal, but his background is in law enforcement, not payments, and that experience gives him a better feeling for where the attacks are coming from and how to combat them.

And the attacks are coming, in ever larger and more sophisticated ways. Financial crime has grown into a $4.4 trillion industry, and the perpetrators have become organized on an industrial scale. For PayPal, that translated into a 600% spike in attacks just last year. What the company needs is somebody like Schuchman, who understands the threat and how to fight it.

His background and expertise allows the company to tap into the information networks that law enforcement agencies use and then build that into its own protection systems, he said. And what has become increasingly apparent is that as large an industry as financial crime is, it relies to a large extent on the smallest of exchanges. Most of the attacks at PayPal, for instance, involved phony emails telling consumers they need to change their login credentials to continue using PayPal, offers of fake gift cards and urgent requests to review invoices. 

"Given the 'smallness' of the world and the proliferation of social media and AI, there's more opportunity for fraud and scams to grow," Szuchman said.

Who is David Szuchman?

Szuchman, a lawyer who is based in New York, does not have a traditional payments background. 

While he has been in different roles at PayPal for about nine years, he spent about 20 years in jobs related to law enforcement, including a stint in the Manhattan District Attorney's office in units dedicated to cybercrime and identity-theft investigations. He's also worked for consumer affairs departments in New York and New Jersey."My prior work created a 'North Star.' We were always looking for ways to stop bad actors and help people," he said. "I've been able to continue that work here."

At PayPal, Szuchman says he and his team proactively share information on potential cyber threats and other vulnerabilities with local and national law enforcement, and also rely on law enforcement, bank and fintech partnerships to broaden the company's scope in mitigating payment crime.

"You have to have a great relationship with law enforcement," Szuchman said, adding  law enforcement are often investigating and chasing cybercrime, providing a source of intelligence on trends and emerging threats.

"You have to be thinking about battling this type of crime with multiple steps and partnerships. You can't do it with blinders on," Szuchman said. "This sharinginforms product development as we have tried to think differently about this problem,"

PayPal additionally engages with social media platforms to assess the intersection of payments and other activity such as message or other forms of data sharing that occur on the platforms.

"We're looking to see where the grooming is occurring," Szuchman said. "They are seeing what we don't see."

PayPal, which did not release details on the volume of attacks it receives and thwarts, has also partnered with trade associations as part of its security strategy.Its recent collaboration with AARP includes PayPal's staff using the association's BankSafe suite. PayPal and Venmo are one of the first fintechs to deploy BankSafe's range of education and technology training to investigate potential fraud, how to use fraud-detection technology and ways to stay current with state and federal regulations.

"It's not a judgement, but seniors are the group that's most victimized from a scam perspective,  they are the most easily socially engineered," John Meyer, a managing director at Cornerstone Advisors, told American Banker, noting improvements in voice recognition and AI are making fake emails and texts more plausible. "The new attacks use language that's more recognizable and also have a sense of urgency. If a 'grandson' is asking grandma for money, the message now seems more likely to be legitimate." 

AARP research found that 75% of consumers  50 or older want their P2P service to educate employees on how to combat fraud. The AARP found that 17% of all adults are targeted by fraud on P2P platforms yearly, with 60% losing some amount of money and 20% losing more than $5,000.  

"We want our elders to be online, but to do it safely," Szuchman said. 

The payment company is battling an earnings slump – it recently fired its CEO Alex Chriss  – and cannot afford large losses due to cybercrime. "Even as PayPal's global payments volume grows about 9%, we see economic value accruing to a subset of companies, including Stripe, Checkout.com and Adyen. This creates a zero-sum game," analysts at William Blair said in a note about the competitive pressure on PayPal. 

AI battle

Artificial intelligence is at the forefront of most business discussions, including security. 75% of security professionals saying they plan to boost AI investments.

PayPal, which has increased its overall investment in new forms of AI in recent years, has upgraded its internal fraud system to monitor more than 500 data points including purchase, history, device and location to generate risk scores. This is designed to detect suspicious patterns directly before checkout.

The payment fintech's scale – it has 440 million consumers and a 44% share of the global online payments market – also plays a role in training its AI fraud systems. To mitigate fraud losses, PayPal recently added an AI-powered scam detection system for PayPal and Venmo payments, which spots and sends alerts about potential scams and losses."What we want to do here is tell the consumer 'are you sure you want to make this payment?' if we find something suspicious," Szuchman said. "We want to be on offense and defense." 

Staying relevant with AI and new payment analysis is an obvious necessity, according to Meyer, adding banks and payment companies can't rely on telling consumers about scams and notifying them to be alert.

"Education is good but it's still not enough," Meyer said.