Last July, TechCrunch reported that customers of several fintech apps couldn’t access the virtual dollar card service that these platforms provided. In addition, customers couldn’t create new cards, fund existing ones, or make online and in-store payments and purchases with them.
At the heart of this issue was chargeback fraud that Zambian startup Union54, whose API allows companies to issue physical and virtual local and dollar debit cards to their customers and employees without needing a bank or a third-party processor, was battling. The YC-backed startup, which had raised over $15 million from global investors, including Tiger Global, served as the default card partner to 100 fintechs serving the region; halting its services affected many startups for several weeks before they found alternatives.
The event, more than ever, spotlighted the need for better KYC/AML compliance checks in the card-issuing space (in fact, fintech in general), as inconsistent due diligence for cardholder chargeback claims could invoke more fraudulent activities.
Union54, as an official Mastercard issuer, underwent a compliance audit and expected to get its platform up and running in no time, two months at best. However, it hasn’t, at least not yet; instead, it is biding its time before it re-enters Africa’s harsh fintech market, where it intends to apply the learnings from the event and its current nine-month hiatus which, co-founder and CEO Perseus Mlambo told TechCrunch in a recent interview.
Mlambo talked candidly about the issues Union54 had to contend with, how the company was at risk of a total shutdown, and why fintechs need to be more transparent with fraud exposure. Excerpts from the conversation below have been lightly edited for length and clarity.
TC: It’s no news that Union54 suffered from chargeback fraud; however, no detailed explanation has been provided. Can you share what happened?
Mlambo: A few days before the article went live, we noticed a lot of fraud being attempted on our platform, which we detected and stopped. What people were trying to do was effectively use funds that they didn’t have. And just to give you an idea of the amount of fraud that we stopped, they were trying to use the cards for over $1.2 billion of attempted fraud. We did the numbers; this volume was 600 times larger than our typical daily volume.
So we provide API access to fintechs and they give card access to their customers. One of the companies we were working with was operating in a new region on the continent, and because of the way they had configured things on their end left them vulnerable to this attempted fraud. And what we saw was that people were trying to buy one specific crypto on a particular cryptocurrency website. So that’s kind of maybe a little bit easy to identify quite quickly that this was very unusual.
How did Union54 tackle this issue with this said company?
We’ve got several customers that use us and one of the things that we do is to work with them and let them know that these things are also affecting them. So what we did with that company was bring it to their attention and say, “Hey, we’re seeing a lot of volume coming from your end. We highly recommend that you take a look.” At first, they were adamant that this was normal and a part of growth; they were even shocked that we were surprised by the volumes coming in. But after a few hours, they said, “You know what? Something is wrong.”
Ultimately, what ended up happening was that as the cards were being used, we were declining them. We would see a transaction coming through and say there is no corresponding balance for this transaction, so we stopped it. And because we kept stopping all of these transactions, it led to a degradation of our overall product because merchants like Netflix, Google, or Spotify would also write to us asking us why we were stopping all of these transactions as it affected business.
It got so bad that we just kept denying every transaction during that period using our automated rules, users kept re-attempting these transactions, which lengthened the process of stopping this fraud.
So Union54 stopped all transactions, including from people who wanted to buy stuff from these international websites, because they occurred during the fraud incident?
Yeah, and that led to another complication, which I think we were maybe one of a few companies to go through it. So every time a transaction is stopped or declined by our rules or system, we still have to pay for that transaction because there are so many different parties involved in the lifeline of a transaction and we need to pay our suppliers. To give you an idea, we had invoices coming up to half a million dollars from canceled transactions at the peak of this activity.
We took the view that maybe one of three things was going to happen. Either we would spend all of our operational funds paying for these fees and then run out of money, which is not good because our fundamental rule is to stay alive. Or that we would go back to these affected fintechs and say, “Hey, you owe us half a million dollars,” knowing fully well that they don’t have half a million dollars. Or we would say, “you know what, we’ll be able to recoup this from our suppliers to get these refunds later on when we appeal.”
At the end of the day, we chose the third and had to pay for these declined transactions with our funds. Afterward, we told our investors that we didn’t think it wise to continue operating the product until we solved all these issues.
In retrospect, couldn’t Union54 have booted out the company (ies) causing this fraud?
So we tried that. But what was happening, and another thing that we learned, was that as soon as we kicked off this company, the attackers attempting this fraud would figure out that we were enabling another fintech to issue cards and would try to go through them.
It was quite a sophisticated attempt, and kicking off one fintech wouldn’t have ultimately helped because this constantly happens with even global fintechs. I think it’s time we start having that conversation in Africa. Fintech in Africa is hard, and most stakeholders still pretend this is child’s play. They’re not talking about the real issues. And I think by coming out and saying, “you know what, we detected fraud and we stopped it, it just gives confidence to other people as well because these things happen all the time.”
It’s a bold move to come out and share learnings because most African founders typically don’t like to talk about failures or, in this case, setbacks.
Honestly, when you’re going through it, it feels like the world is falling apart because you build something and then suddenly, you’re losing control and people start spreading rumors.
It’s also a bit of a wet blanket when the market you live and operate in is dragged through the mud. And I feel like that’s why many people don’t talk about these issues because they feel like it’d be doing a disservice to the whole ecosystem. And that’s one of the reasons why we didn’t say anything at first. We also didn’t refute anything when the allegations came out because it meant that for some of our customers, it was a very life-and-death situation where if we said anything, they would have to contend with whatever we said. So we just observed our legal obligations, did right by our shareholders and then continued to build our new product, which can give us sustainability.
Regarding the new product, sources told me late last year that Union54 was working with a few customers in stealth. What was the outcome of that process?
Since we work with card schemes, what we were doing during that period was switching access to the API for about three fintechs to measure and make a case for us to get specific refunds from one of our suppliers. And for us to be able to get that data, we needed to prove effectively, like a baseline, reopen access to the product and say, “on a normal day, this is what the chargebacks look like and this is what transactions look like and this is the impact of the fraud that we had seen.”
By having those comparison points, we’re then able to go back to our supplier and say, “Look, we want ultimately to develop a company that can help anybody anywhere in Africa issue cards and these are some of the things that we have learned; for instance, we were able to determine that it was inflexible to work with bigger companies because they take longer to settle disputes. Also, we figured we needed to address our KYC processes.
The scale at which Union54 was operating was fascinating because we would find fintechs in each country and give them access to the API as they are regulated in that country and would do KYC themselves. And because of that, we were able to onboard over 100 companies and create solutions that work in Ethiopia, which was at the time opening up, as well as Zambia, a unique market where ID documents are laminated and you can’t easily scan them using a phone camera.
But still, we needed to be able to serve clients all around which affected us in the long run. Some fantastic companies have emerged in the KYC space but mainly operate or serve a niche geography. The last time we checked, there’s yet to be a company that can provide Cape to Cairo coverage of KYC database. Hopefully, by the end of next year, we’ll have somebody who can do that. And that would be a game changer.
We’ve also got maybe two or three companies doing U.S. dollar virtual card issuing. But there are still complaints about their services, showing that a Union54 with better KYC processes is still needed because the issues haven’t gone away. The utility of the Union54 is just getting much broader and people are still emailing us to ask when we’ll start issuing again.
Is there an answer to that?
We’ve grieved over the last few months because losing something is never easy. But then after that, we took heart knowing that we’re still well-funded and we’ve had the time to develop something that can last whatever shock is happening currently in the ecosystem. And for us to be able to issue again, we’ve made several adjustments there that we will launch with our next product.
Meanwhile, one of the other things that we learned is that despite all of the layoffs and devaluation news coming out, the fintech scene in Africa is still vibrant and there are a lot of good products being developed and lots of great companies. Still, it will take some time before we have a mature ecosystem.
After chargeback fraud debacle, Union54 CEO says fintech in Africa ‘isn’t child’s play’ by Tage Kene-Okafor originally published on TechCrunch