Orca Fraud: Fighting Fraud Differently in Emerging Markets

Thalia Pillay is the CEO and co-founder of Orca Fraud, an anti-fraud startup from South Africa that raised a $2.35 million seed round in March this year and has been making some waves. Before entering the world of payments and fraud prevention, Thalia studied robotics engineering at the University of Cape Town, where she met co-founder and Orca Fraud CTO Carla Wilby.

The interview has been condensed and edited for length and meaning. In a few days’ time, the full-length interview will appear below in an embedded video as well as on Fraudbeat’s Youtube channel.

The Motivation Behind Orca Fraud

Ronen Shnidman: Thalia, tell us, how did you start fighting fraud and what motivated you to found Orca Fraud?

Thalia Pillay: My background is in robotics engineering. I met my co-founder Carla at the University of Cape Town where we were both studying engineering over a decade ago. And I went into banking in South Africa and then we went into payments and worked at a local fintech. And we really started to see more and more fraud in emerging markets. And when we evaluated all these amazing Western tools, we started to see big gaps in detection and prevention for emerging markets. So that really led us to start Orca in January of 2024, and it’s been a whale of a time ever since. We’ve really found big gaps in terms of the way Western tools look at different payment methods as well as different socioeconomic climates.

RS: What types of fraud does Orca Fraud tackle? 

TP: We specialize in real-time transaction monitoring. So we call it omni-channel transaction monitoring, which means we cover all payment methods. We do cards, digital wallets, mobile wallets, stablecoins, cash vouchers. So really covering the entire suite. Because what we’ve seen is that fraud is not limited to a single method or channel. It really travels across an entire customer journey. We do both customer and merchant fraud detection, especially in places like South Africa, we have a large SME business. For us, it’s less about detecting one specific type of fraud. I think by giving our clients their data, a really great rules engine, very specific models for things like account takeovers, they’re then really able to tailor the product to meet their business’s needs.

RS: So are you looking at the whole user journey in terms of the payment transaction, like pre-transaction, post-transaction, and then even post-post-transaction when it’s like ATOs and things of that nature where there’s no money necessarily changing hands even?

TP: Yes, so we look at all parts of the journey and I think it’s been interesting because initially we thought we’d only live inside the real-time transactional flow. But the reality is that fraud exists at different parts of the journey. You can build onboarding rules and you can take in your IDV KYC data and build rules on that and models on that. Most of our rules are pre and post-auth or in the real-time flow. But even now we take in non-financial events as well because a big issue across Africa is internal fraud or occupational fraud. So understanding employee logs, audit logs and then correlating that to where a large withdrawal is happening, that causality is really interesting. So even though there might not be a movement of money, the change in access relating that all into the fraud space has been one of the things we’ve seen.

Emerging Markets Fraud Tactics, Not Necessarily New Ones

RS: So you have a very ambitious solution for emerging markets.  Let me ask you then, do you believe emerging markets are a testing ground for new fraud tactics? I would argue yes that’s an obvious question but the question is what tactics?

TP: I would say that I don’t know if I fully agree. I do think that emerging markets haven’t been the focus for a lot of fraud tools. So a lot of companies don’t expand into a place like, say Nigeria, because it’s too risky. So it’s less around new fraud tactics and more just around the level of understanding of the markets. So I think the sooner we get more people understanding the data, it will demystify the fraud tactics and debunk the common wisdom in a lot of ways. 

That being said, we are seeing a lot of scam calls and stuff originate from Africa, from South Africa and from Nigeria. So yeah, in some ways we are a testing ground, but in other ways, just because people haven’t studied the data here before, so it’s not really new tactics, it’s just misunderstood tactics.

But we are seeing a lot of new types and very novel types related to mobile wallets. We’re also seeing really interesting types of agent-related fraud around commission fee gaming, ghost laundering, and things like that. And like my earlier point mentioned, I think a lot of it is to do with the different payment methods. And with new methods, we are seeing new types of fraud. But in the same way, I’m sure, in America and the US, they’re also seeing new types of fraud related to their methods.

RS: That’s super interesting. How do fraud patterns differ across regions? What is different that you’re seeing in Africa, LATAM or South Asia compared to what is expected as normal for  fraud from a Western perspective?

TP: It’s a great question and I think most of the differences can be attributed to the different payment methods. So the biggest example we always see is a lot of tools were built for checks and clearing houses in the US and they weren’t always built for mobile wallets within M-pesa in Kenya, Pix in Brazil or UPI in India. These newer methods do lead to newer types of fraud. So those are the biggest differences and challenges we see in the market today. And then secondly, just a different socioeconomic plan.

I think the way users interact with money is just so different in Uganda than even in the neighboring market of Kenya. So it’s really important to have models and tools built on data for emerging markets so that you understand user behavior, so that by knowing who someone is, you can easily tell who they’re not.

RS: So you’re saying that some of the bigger AI machine learning based tools in the market, because they’re trained on data sets that are from Europe or North America, they might not be effective in South Asia or South Africa or where have you?

TP: Yes, 100%. And I think, again, a lot of these tools are built on and for card datasets. And in markets like in Southeast Asia, we have way more payment methods. So we really need to build and train on these more local datasets. And the reality is when you’re building for these types of markets, a lot of the data isn’t even digitized yet. So you’re literally walking in in real time and helping your clients digitize their data in order to better fight fraud.

How Orca Fraud Challenges Assumptions

RS: Tell me something you’ve learned in the fraud journey you’ve had that you didn’t believe early on or you didn’t know early on, but you’ve learned since.

TP: Yeah, it’s a good question. So when Carla and I started Orca, we were worried about overbuilding and not validating our hypothesis. So what we did when we started for the first six months was we interviewed 150 fraud analysts and compliance officers on the African continent. And by doing this, it helped us demystify so many of the assumptions we had. And one of the biggest things is that there’s a massive reporting problem where for the FAF and Global Report a lot of analysts are having to spend four out of five days a week reporting, all for really valuable reasons, but I don’t think we’re realizing the amount of operational load they’re dealing with. Then we also discovered that it’s not just the detection portion that’s really important, it’s everything that happens after the fact, and just giving analysts better tools to do more, thorough desktop investigations is really important. And then we also learned that finding anomalies is one thing, but the way you report and manage them is an entirely different process. We launched it like an AI-powered platform for fraud orchestration. Every buzzword in there is imaginable. And we thought AI would replace rules, but the reality is people need a lot of explainability and interpretability. So there is a need for a very hybrid approach which gets smarter over time while still retaining that core explainability.

RS: So you have an AI-based solution, but what do you think is the biggest misconception about using AI in fraud today? I mean, everyone is doing it, but what’s the biggest misconception about it?

TP: I think everyone says they’re doing it, but not a lot of people are doing it really well, in my very strong opinion. I think a lot of companies think using AI fraud detection is going to be a silver bullet, and it’s going to solve all of their needs, and it’s going to be like waving a wand. The reality is that there’s a lot more to it. And I think fraud prevention is an industry where we’ve been using machine learning and AI for almost over a decade. So it’s really great to see how mature certain models are and where it’s being applied really strategically and well. But I think to blanket say your AI powered without understanding which parts of the system actually need the most decisioning or reasoning is a bit dangerous. And I think, especially in some of our African countries, the explainability to the regulator is really important. So when you have tools which are too machine learning heavy and just get a result of like 0.5 for the probability of someone being fraudulent, having to explain that to the regulator becomes almost impossible. So it’s really about combining what you know and your normal practices with the latest tech, but making sure you don’t get left behind in the process.

How Orca Fraud Is Built for Explainability to the Regulator

RS: Okay, so how do you deal with the issue of the regulator needing explainability? What’s your solution? Do you incorporate rules-based systems? You were sort of suggesting that earlier, but what exactly are you doing to address their needs?

TP: Yeah, so we believe that rules take us about 70% of the way there. The rest of the 30 % is filled with machine learning and anomaly detection, as well as different AR models for explainability. The reason why rules have been outdated in the past is because they become obsolete very quickly if you aren’t fine tuning them. We do that by using machine learning to identify new thresholds, suggest new rules, and then with anomaly detection, which is for catching everything else that might get through the gap, that all feeds back into rules. So it’s really about making sure you combine these more abstract technologies with very concrete decisions and outcomes that you can then strengthen and train your systems on over time and make sure that you still bake in that explainability continuously.

RS: You mentioned earlier in one of your earlier responses that presenting results to management is its own sort of forte. So what about evaluating fraud performance do people in the C-suite typically misunderstand or need help understanding?

TP: There’s so many things. I think it’s similar to startups where, you know, you’re always going to optimize for your best looking metric or value. The one we see C-suite over index on are things with false positive rates without knowing what that is relative to. We’ve seen people advertise, you know, we reduce false positives by 10%, but  what does that actually mean in terms of the quantifiable loss prevented?

The other one that we really love is analyst productivity. So like time to investigate, time to detect hours saved, just because a lot of the teams we work with are drowning in alerts before we start working with them. So just seeing the way we’re helping to reduce their operational burden is like one of my favorite things to see and measure.

What’s It Like Being a Female Fraud Solution Cofounder

RS: Fraud prevention is an interesting industry from a gender perspective because I think it’s becoming, if not equal in terms of men and women, in terms of employment, it’s becoming actually predominantly female over time. However,  in terms of the actual solution vendors, the majority of founders are still men. Why do you think that is? Is there a good reason for that or is it just the way things played out by random happenstance or what’s going on? And do you think you being a female founder has made any noticeable difference in how you run your company?

TP: I think it’s an interesting one. Certainly, in the US, a lot of my favorite fraud solutions are woman-led. I think a good example would be Unit 21. Actually, one of our angel investors is one of the co-founders of Alloy, Laura Spiekerman. 

 I love Laura. And I think it’s been really awesome to be a part of a super collaborative industry. I love our industry. And I think the women in the space have just been so engaging with us, as well as a lot of the US male vendors as well. I think everyone’s rooting for an emerging market solution to succeed.

But, in South Africa and Africa as a whole, we’re one of the only all-woman teams, not just in fraud prevention, but in fintech in general. So we’re like one of the most well-funded all-woman teams on the continent ever in start-up history in Africa, which I think is pretty crazy.

I don’t think being a woman has made things harder. I think enterprise sales as a whole is hard. I think in some ways it’s made things different, but I think because I am coming from very male dominated industries from my robotics background and other startups I’ve been at before, we really are just trying to focus on the amount of confirmed fraud we’re stopping in real time versus being a woman led business. Both are important, but at the end of the day the fraud part is the main thing we care about. Definitely our buyers are mainly men in banks, but we are definitely seeing that evolve and have more diverse teams on the continent. But in general, I think having an angel investor like Laura from Alloy, just gives me very real advice, which I appreciate just as another woman founder in this space who’s done amazing things. I th ink what they’ve built is incredible.

RS: Do you have any thoughts that you’d like to add as a concluding note? Any impressions or something you think would be interesting to the Fraudbeat readership?

TP: I guess mainly from your perspective with Fraudbeat, Luke mentioned that one of your biggest articles is a money laundering piece in Africa.

RS: Sure, money laundering involving diamonds from Africa.

Fraudbeat’s Perspective on Fraud in Africa

TP: And I guess from your perspective, what are your thoughts on fraud in Africa? Is that something that you think about often? Does it make you want to be on the ground here? How do you perceive it from the outside?

RS: I see three countries that very much interest me in Africa. They are South Africa, Kenya, and Nigeria. And I’m very curious, with Kenya’s M-Pesa and the mobile payments story, South Africa is just interesting in a whole lot of ways. And I don’t know that much about it, but it is a major economy that’s been a major economy for a very long time. So I’m curious about that. And it has migrants coming from elsewhere in Africa coming to work there. So there’s like the whole migrant payments element of it.

And Nigeria has just been a major center of fraud in terms of the so-called Yahoo Boys or the Nigerian Prince scammers and all that going back already for a long time. So it’s on my radar, but we don’t get too many African voices in the fraud industry, at least not in the major conferences in North America, nor in Europe. So I would be happy to get more voices. And even the diamond story, because I used to cover the diamond  industry from Ramat Gan, but I’m getting it from a non-African perspective. So I would be very happy to see more. I know in the industry conferences we’re getting more information from Brazil about payment methods there. I’ve been interviewing people in India and we’re getting some more from Southeast Asia. But you know, I would love to get more information about Africa because everyone is sort of saying it’s the next wave of the future in terms of the massive population growth, massive economic growth. And there’s so little that we know in terms of people who are outside of the continent. I’m interested. I’m very much not an expert in what’s going on there and I’d like to be more so.

Difference Between Global South and Western Fraud Vendors

TP: Yeah, we know a lot of our similar vendors in other emerging markets, from India, Southeast Asia, and some vendors in LATAM. And again, we always see so much similarity between the global South vendors versus what we see from the more Western vendors. And I think to your earlier point about us doing a lot in the payment cycle, when you’re building for emerging markets, a lot of people don’t understand that you need to be able to do a lot more for your client. They can’t really invest in point solutions. They need very holistic platforms, orchestration, things like that. And the markets we’re dealing with are a lot shallower than the US banks, for example. The volumes might be lower. The value, TBV, might be lower. So it’s really interesting to see the different types of vendors evolve for their different markets. But one of my favorite things about building an African solution is that we’re getting to go to such cool countries. Last year I got to go to Cote d’Ivoire, last week I was in Morocco. And just the different payment methods in every market when you open Uber or the relevant ride sharing app.

When I was in Morocco last week, you could only use cash. So it really shows you how when you have these different methods, you have different types of fraud and scams. But that’s really when you’re on the ground, you see it firsthand. And that’s really, really cool.

RS: I guess in summary, we need more emerging market voices, more emerging market solutions, and emerging market experts to share stuff with us at Fraudbeat. So, Thalia Pillay, thank you for your time.