That being said, do you differentiate on the type of fraud? Fraud is not fraud. I guess my question revolves around real fraud (stolen cc data being used), and friendly fraud (me charging back a transaction fraudulently claiming I never received a service). I'd be curious to know if you are handling that, and how. Is it merely a case of asking the people using your system to rate a particular transaction a certain way and putting into the pool of data to be processed? Or do you do something more?

Also, you mention skipping verification steps. Do you do things to recommend specific extra steps, or do you just provide a score and then let the client figure it out? For example, a score of 90 might be reached in different ways. In some ways, you an automated phone call could alleviate much of the concern, while it in other cases, it wouldn't. I guess the question really comes down to whether you provide guidance on which verification steps to take.

Google search detection system that identify a real user from a bot has always failed when the user travels through the Tor system. Thus, it looks to me that any machine learning system, even those produced by someone with immense amount of data, will always have a high false-alarm rate. This is also obvious if one look at gmail when it wrongly mark legit mails as spam, and at IDS/virus market. How will Sift Science will deal with the issues of false-alarms, and how should website owner act regarding the score. Should they automatically follow the score given, or just flag suspected users. What is the suggested best practice? If its a webstore, should they block, delay, or just observe the transaction?

> “But as we talked with people, we realized that it wasn’t solved at all,” he says. “Nobody was using them, and there were a couple of holes – things that existing products didn’t do. And one was ease-of-use.”

FWIW, the reason I am not using any of these providers is not because they require talking to sales people (I generally consider having dedicated sales staff and account managers a feature), and not because they require SOAP (I do not understand why that is a big deal... there are many libraries, and I'm a software developer ;P), but because I did not know that this class of company existed: when I have asked other companies that are similar in any way to mine how they handled fraud (such as Etsy), they always tell me they are using an internal solution (often even one that they say "we are considering licensing to others"); I thereby have been planning my way down that same path. I then wonder whether there is some other systemic reason why this is the case? (Such as, maybe the economics don't work out? Maybe there are legal concerns?)

On that last point: I guess I'd have some reservations about sending personal user data to you in a way that you aggregate, that I'd then have go through legal review on; so, even if I were sold that your service would be epic, it might be that after review I feel like I cannot be legally compliant with various privacy laws or security certifications I have to maintain at the same time as use your product. (I notice you have nothing on your website touching on this specific problem.)

> Beyond the first 5,000, it’s 10 cents per user per month.

What kind of customer are you targeting as your primary customer? I see the mention that you are getting large marketplaces, payment processors, and "top 500 retail websites", but you also seem to be going down the "freemium and no sales people" route (which I associate with trying to pick up the long tail, ignoring the larger players). Then, as you have an actual sticker price (which is maybe something I'm reading too much into, but if you are going to provide a price there's probably some reason behind it), I go to review it, and I find an inconsistency as I can't imagine that many payment processors--companies that generally deal in tiny percentages of transactions--would be able to afford that per transaction: that's as much as the entire fee charged by many of these companies (even with a 20% discount).

As a more personal example (as I am interested in your service), I process tens of thousands of dollars a day in transactions, and I would absolutely love to be able to outsource fraud detection (and despite having reservations about some of the other benefits listed by this TechCrunch article, most of which seem to be about picking up smaller customers, your "we use machine learning, others don't" is enticing to me); but, my margins are low enough (on a $3-$4 average ticket, 70% upstream licensing, then various transaction fees, costs on the disbursement of the 70% itself, various costs related to the various forms of sales tax compliances I have) that I doubt I could handle $0.10 to do a fraud score on every single transaction (although I haven't analyzed this fully yet). (This might, however, be because a good brunt of my fraud management problem is already currently either outsourced to a third-party payment network or simply absorbed as a cost by them, such as the case with Amazon Payments, which does not charge for chargebacks, despite having an insanely large number of them.)

> Fraudsters often operate in far-away timezones, so activity late at night is correlated with fraud.

How account-specific are your rules? I ask this, because what is going to look like fraud for one site is not going to look like fraud for another site. As an example, I have a worldwide userbase: I would be concerned about even a theoretical increase in the false-positive rate on users from Europe, or somewhere like Saudi Arabia (which has an inordinate number of my paying customers).

> Every site has some unique fraud patterns. You can train Sift Science by sending $label events, and you can also explicitly provide detailed feedback via a trainer page:

Is there a way to get large amounts of old information stored into your system for rapid training? Information on chargebacks often takes over a month to receive, so attempting to start scoring things based on transactions that only begin as of right now is going to require a rather long time before any real training can begin.

> The other big issue with the existing systems, Ballinger continues, is that they use a fixed set of rules. That is, they would flag transactions over a certain dollar amount, or every transaction from Nigeria, for example. But using fixed rules is a problem because Internet fraudsters don’t play by a fixed set of rules – they’re always adapting their tricks to stay ahead of the preventative techniques.

Do you know what the actual effectiveness gap is? Like, are we talking "the alternatives are simply not effective" (which seems highly unlikely)? If not, I presume it would be something vaguely quantifiable like "we catch X% more fraud than alternative solutions", which would be useful for attempting to compare your product to alternatives (as if you are 5% better at catching fraud but cost twice as much, then maybe it isn't worth it if your business model is setup in a way where fraud isn't that costly to you).