Don’t Spin The Wheel: The Fight Against Malvertising

We’ve all seen it — maybe some of us have even fallen for the trick — you’re on an ecommerce site and a big “Wheel of Savings” pops up. This innocent-seeming discount offer, though, isn’t what it seems, and it’s doing damage to the end-user spinning the wheel, and the site the wheel pops up on. 

The world of malvertising and browser extensions has been causing headaches in the ecommerce world for years and brands are constantly looking for ways to fight back and regain control of their websites. Matt Gillis is helping with that mission. Matt is the CEO of clean.io, which offers real-time protection against malicious actors and code for some of the most-trafficked websites in the world. 

On this episode of Up Next in Commerce, Matt takes us through some of the methods bad actors are using to install malicious code on ecommerce sites, and he gets into the nitty gritty of why browser extensions like Honey and Wikibuy are hurting brand bottom lines, and why those extensions are making marketing attribution nearly impossible. But he also offers some solutions, too, so that ecommerce brands can finally win back control of the user experience. Enjoy this episode!

Main Takeaways:

• Good Guy or Bad Guy?: Traditionally, malvertising is done by bad actors who infiltrate websites and take over through ads. But in the world of ecommerce, the bad actors are actually manifesting in the form of Fortune 100 companies that profit from website extensions like Honey and Wikibuy, which disrupt the user experience of the customer on the original ecommerce site. Solving that problem is the challenge for ecommerce brands that want to take back control.
• Sneakily Effective: In the malvertising world, the bad actors are at the top of the marketing game. They can achieve a 100% click-through rate at little to no cost because they are using sly, untraceable strategies. Targeting and eliminating those malvertisers is critical in order to level the playing field for ecommerce marketers to have success moving forward.
• Last Line of Defense: Publishing platforms hold most of the responsibility for the end-user experience. Everybody has a role to play in minimizing the risk of malicious buyers or advertisers, but ultimately, the publisher is the last line of defense against malvertising moving into the user experience, and they should be held accountable.

For an in-depth look at this episode, check out the full transcript below. Quotes have been edited for clarity and length.

---

Up Next in Commerce is brought to you by Salesforce Commerce Cloud. Respond quickly to changing customer needs with flexible Ecommerce connected to marketing, sales, and service. Deliver intelligent commerce experiences your customers can trust, across every channel. Together, we’re ready for what’s next in commerce. Learn more at salesforce.com/commerce

---

Transcript:

Stephanie:

Hey everyone. And welcome back to Up Next In Commerce. This is your host, Stephanie Postles co-founder at mission.org. Today on the show we have Matt Gillis, the CEO at clean.io. Matt, welcome.

Matt:

Stephanie, thanks for having me. I'm excited.

Stephanie:

I am very excited to have you here. We were just talking about how cool your background is, and I think that's actually kind of a fun place to start of where you're at in the world. And tell me a bit about your background.

Matt:

Yeah. Hey, so I'm in Baltimore and we actually just took possession of this office in February, right before the pandemic. And so the irony is I've been here every day since the pandemic started pretty much.

Stephanie:

By yourself?

Matt:

But I'm by myself. So we have 4,000 square feet. We just did the mural right before the pandemic and no one on our team has been able to experience it pretty much. But yeah, cybersecurity company located in Baltimore, we're about 45 people, I guess you could say solving this problem of untrusted and malicious JavaScript that is ruining user experiences in revenue across the internet. That's us in a nutshell.

Stephanie:

Cool. Well, I am really excited to dive further into clean.io. Before we do that though, I was hoping you can kind of go through your background because I saw you've worked at places like AOL, you've been in publishing. You've been in ad space. Tell me a bit about what you did before you came to clean.io.

Matt:

So full disclosure, I'm old. And so I've been around a little bit. I've had some fun. But yeah, I think key things I've spent probably the last 20-ish or so years in a couple of different capacities. Right out of university, I started in the mobile industry and mobile at that time was just making phone calls, that's it. There wasn't even texting then.

Matt:

In fact, my job back in those days was I would stand on a golf course at a golf tournament and let people make free phone calls because that was the cool thing to do then. No one had cell phones and if they did, they were like those brick ones. You remember those ones that you couldn't fit in your pocket?

Stephanie:

Yeah. And you were the cool guy like, "I've got access to an awesome phone, anyone want in?"

Matt:

Yeah. And listen, men and women would come up to me and they'd be like, "Can I call back and check and see if I have any messages?" And so that was the cool thing to do then. I know it sounds so crazy that was a thing at some point, but yeah. So I worked at mobile operators in the early stages of my career.

Matt:

So I worked at Bell Mobility in Toronto, Canada. I'm from Toronto. And then I moved down here to work at Verizon Wireless. And at the end of my tenure at Bell Mobility and my tenure at Verizon, I was focused on some of the services that you live by on your cell phone today. So this was in kind of late '99 and then the early 2000s of things like video on demand on your phone, playing games on your phone, downloading ringtones on your phone, I'm sure you did that.

Stephanie:

Oh, ringtones, yeah [inaudible].

Matt:

They were, obviously a huge business at some point.

Stephanie:

Now if my phone rings I'm like, "Stop it, what are you doing? Who's calling me? Don't call me, text me."

Matt:

Put it on mute. Yes, exactly. So I was kind of part of the foundational days of things that you would do with your phone, before the iPhone. And then I went and took a swing at being an entrepreneur and joined a little small video game company. Our biggest game was Who Wants to Be a Millionaire? We did a lot of TV game shows. So we did, Are You Smarter than a 5th Grader? And things like that.

Matt:

So I kind of walked the mile as a publisher for a while and then Capcom, which is the Japanese video game company acquired us. So I ran their publishing business for a few years and I got to experience what it's like to be a publisher and how hard it is to make money.

Matt:

And that was kind of in those early days of the iPhone where I'd say to people, "You'll go and spend $5 on this latte, but you won't pay $5 for unlimited use of a game over a period of time." And this is back in 2008, 2009. And so we had a real struggle and people weren't wanting to pay for our games. They want them free and free became kind of the thing on the iPhone.

Matt:

And so recognizing that struggle, I actually joined this company called Millennial Media, which was one of the earliest mobile ads platforms for app developers, helping app developers make money with ads. Some of our biggest customers at the time were like Words with Friends, if you've played Words with Friends-

Stephanie:

Yes, I have.

Matt:

... ads in every game. So we were kind of one of the foundational tech partners with folks like Words with Friends and various other games across the internet and apps. Did that for eight years through an acquisition with Verizon and AOL. And then we acquired Yahoo. So I ran the publisher platforms business at the combined entity of those companies, which was awesome.

Matt:

And one of the biggest problems in my time over that period was this thing called malicious ads, or malvertising as they call it. You probably are familiar with when you're scrolling away on your phone and all of a sudden it redirects you and says, congratulations, you won an Amazon gift card. And you're like, "I didn't click anything." Or spin the wheel for your chance.

Stephanie:

Yeah. I did that once I fell for it. I was like, "Oh, I spun it." I couldn't help it.

Matt:

Never spin the wheel, Stephanie.

Stephanie:

I only did it once, but yeah, afterwards I'm like, "That was a bad call. Why did I do that?"

Matt:

Yeah. So it was a big problem in my past life. And there were a few folks that were solving this problem and two of them were folks that I had worked with at AOL. When I left, it was called Oath at the time, which is Verizon Media now.

Matt:

I went and had lunch with these guys and they told me that they were spinning up this company called Clean Creative and set to solve this problem of malvertising. And I didn't have a job and it was getting too cold to golf. And so I said, "Hey guys, can I be an intern?"

Matt:

And so I came and hung around for a couple of days a week. And I was like, "You guys are really onto something here because this was a massive problem in my prior life." And so I said, "Hey, can I have the keys?" And they obliged. And that's how I'm here, started as the CEO two years ago. And we've kind of been blowing it up ever since. That's awesome.

Stephanie:

Yeah, such a fun story. So what is your day to day look like now? And what's your best day in the office look like while you're there by yourself? Are you around skipping around bicycling around the big office? What is your days look like?

Matt:

I do pace and I get my steps in over there. Day-to-day, we're startup, so we're small. And so as any of your listeners would know at a startup you do everything, and you take the trash out and you sign big contracts, hopefully you raise money. You kind of do run the gamut. So it's a little bit of everything. If you've worked at a startup you know that generally speaking, there's epic highs and epic lows. And so you have those days where you are the king of the world and you and your team are high-fiving and celebrating. And that's a little different now because you got to do it all virtually.

Matt:

Part of being at a startup is you get that culture of everybody generally speaking, being in an office like this, but we're a widely distributed culture now. We were before the pandemic where we kind of had, I don't know, five or six or seven locations among all of our people, but now we have 40 locations. So it's just like any other gig except there's really no net underneath you. You're walking this tightrope and hopefully you get to the other side.

Stephanie:

Yes. I definitely feel that.

Matt:

It's fun though. Isn't that why you do it?

Stephanie:

I mean, yeah, it's definitely really fun. Other times you're like, "Oh my gosh, I'm responsible for so many lives." And then other days it's like, "This is fun." So it's a good balance.

Matt:

Yeah. I mean, I won't lie. I had months of sleepless nights when we were raising money. We most recently raised our series A and we started raising it in March, right at the beginning of the pandemic. And yeah, all these people's jobs, for me, the pressure was on me to make sure that we could raise money and continue on this mission.

Matt:

The reality is, is the people behind the scenes are the ones that actually made my job easy because they're the ones that enabled me to go and tell the story of our massive revenue growth and our massive traction and our product market fit and all of that sort of stuff.

Matt:

Startups are hard, but there's a reason that many people once you leave the big company and you actually go and take your swing, that becomes the thing that you keep doing and doing and doing because you like having that euphoric feeling.

Stephanie:

Yeah. No, I definitely agree. And I mean, I think it's a good reminder too, as the CEO at any company to kind of get out of your way and hire a team that can support you and do things, but then let you do the higher level things like selling, raising money, such is a good point for, I think a lot of business owners who want to kind of stay attached to, "I've always been coding." Or, "I always did this part of the business." You need to step away and find people who can step in for you so you can go on to the next thing.

Matt:

Yeah, and focus on your strengths. Don't try and overcompensate and really... We did this thing called StrengthsFinder with our leadership team. And it was really about figuring out what are the strengths across this group of people that are practically leading the company. And you go, "Okay, well, I'm really good at this, this and this. And you're really good at this, this and this. Wow. We compliment each other. I should continue to keep doing this stuff. And boy, we should just let you handle all of this sort of stuff." So yeah, hire a diverse team and hire people that are way smarter than you and you'll be successful.

Stephanie:

So how have you seen the digital security landscape change? Maybe even over just the past year or two, what new things are popping up, what should e-commerce owners be aware of right now that maybe wasn't happening last year or two years ago?

Matt:

I would say that where we cut our teeth was in this malvertising space and what it is, is malicious JavaScript that's kind of being injected into the user experience through ads. And what we've seen is that the bad actors, the people that are doing it, are getting even more sophisticated over time. They have figured out how to get around the systems. They've figured out how to get around the checks and balances.

Matt:

And we kind of stumbled into this e-commerce world where we were protecting, we're protecting some of the biggest websites on the internet. There's seven million websites that run our code. Probably many of the websites that you go to everyday either to get your news or to read entertainment gossip, or that sort of stuff if you do.

Stephanie:

No.

Matt:

I'm not saying you do Stephanie, but we protect all of those sites; every single page view on those pages, we make sure that the user experience is protected and revenue's protected. And by the way, in that world, it's folks that I would say, delivering malicious JavaScript. What we started seeing in the e-commerce world is there's this whole phenomenon of what I would call untrusted JavaScript.

Matt:

Now in either case, the premise is you own your website. You should be able to control everything that executes on your website. You should be able to protect your user experience. You should be able to dictate your user experience because it's your website. On the malvertising world, what we saw happening was if folks had ads on their website, they had lost control of the user experience. They had lost control of revenue because any bad actor could just buy an ad and take over the user experience and get you to spin the wheel.

Stephanie:

Only once, but yes.

Matt:

Only once, but it happened. And so in the e-commerce world, what we've noticed is there's a lot of stuff happening on e-commerce sites, just like there is in any website that is without the permission or without the authorization of the person who owns the site. The biggest problem that we kind of dug in and gone to solve for is, if you ever heard of these things called Honey or Wikibuy?

Stephanie:

Yeah.

Matt:

So these are Chrome extension, Safari extensions, Firefox extensions. They sit resident on the user's device and Stephanie, when you're out shopping on your computer and you get to check out, Honey will pop up and say, "Hey, I've got coupons for you. Do you want them?" You as the user you're probably like, "Yeah, I'd love to get a discount. I'd love a better price, if I can get it without having to do any work." Honey does all the hard work for you.

Matt:

We think that's not really in the best interest of the merchants because they own their website and now someone is injecting code in and disrupting the user experience, disrupting your revenue. So just like it is in this malvertising world, the same phenomenon is happening over here. The difference is Honey is owned by PayPal. Wikibuy is owned by Capital One.

Matt:

So the folks that I would call "bad actors" in this world are actually fortune 100 companies. They're folks that you would expect to be able to trust. And what they're doing is they're actually injecting code in to disrupt the user experience and disrupt revenue. And so that's the problem that we've gone out and solved.

Matt:

We just launched our product that's called cleanCART. And what it is is it's a Shopify app and it gives Shopify merchants the ability to protect their carts at checkout and make sure that they can prevent this sort of code from disrupting user experiences in revenue. So it really is giving control of the websites back to the merchants.

Stephanie:

Oh, interesting. So when you implement that you just can't get coupons or are there other pieces that it kind of protects as well, or the user can't see coupons from a Honey or something, or are there other things that your app is also protecting against?

Matt:

So we're in, I would say the second inning of the baseball game. So early stages. We're really focused on to start is blocking the automation of these coupons. So we don't want to block you as a user going in and manually inserting the coupon. We think that's the intended use case. But what we think is unfair is that someone is standing beside you at checkout and handing you a mitt full of coupons and actually not even handing them to you, they're actually giving them and just scanning them all to make sure that they all have a chance to work.

Matt:

If you think about this analogy, the grocery store would never let someone come and stand beside the checkout and save you 30% off your grocery order while you're already ready to pay. And I think that's the phenomenon that we're trying to solve for in the earliest days, which is, let's prevent the automation from happening. Let's not prevent people from manually inserting coupons. Let's give control back to the merchants because it impacts them in so many different ways. Obviously, it impacts them from a revenue loss perspective.

Matt:

I talk to merchants every day. Many merchants are complaining that these injections are literally scraping and pulling 30% off of their cart value at checkout. So someone who had $100 cart, they go to checkout, Honey runs and it knocks their cart value from $100 to $70. That's kind of bad for the merchant, especially if that person was going to convert anyway.

Matt:

The other key thing is Honey and Wikibuy and these other discount extensions have made it really hard for merchants to have discounting strategies that they can track. And so what's happening is that promo codes are ending up in the wrong hands. It's creating an attribution nightmare for merchants where they think that this social media influencer or this Instagrammer, or this YouTuber is driving tons of sales and lo and behold, Honey has grabbed that coupon and is injecting it.

Matt:

And now every order that comes through where Honey was present on the page is applying that person's code. And so now the merchant not only has bad data that is going to ultimately drive their marketing decisions but now, they're also losing revenue and they're paying out affiliate fees to folks that generally didn't deserve that affiliate fee. So I think it's created a bit of a nightmare.

Matt:

And so, we felt this kind of pent up demand for this product. And that's exactly what's happened is that no one has solved it. We think we're first to market. And we think it's important that people are fighting for the merchants. There's been 10 years of growth in e-commerce over the last year. The pandemic driving a lot of that.

Matt:

And we think it's important that merchants really get control of their websites, get control of their margins, get control of their revenue and really get the right data to make the right data-based decisions of how they're going to run their marketing programs.

Stephanie:

Yes. I think that's a really cool story. You were just talking about how you were looking at a problem that people were complaining about, and then now you guys are like, "Well, let's solve it." Because I've read, I'm trying to think where this was, where they're talking about going to Reddit and looking at some of the threads of people talking about problems that keep occurring and occurring and how you could build businesses just based off Reddit threads. And you guys did that, just looking at problems with what merchants were struggling with. So a really cool example of how to build a business is look at all the problems that are going on and jump at solving it.

Matt:

Well, and I think the other key thing here is as you know is solving the problem, but also during that process of your hypothesis that you're going to develop of what you're trying to prove, it's you also need to prove that people pay for it. And that's, I think part of the foundation of what we've built here, obviously on the malvertising side, but also on the e-commerce side is it's a big enough problem. People need to protect user experiences.

Matt:

If you think about just in the internet in general, it's very expensive to create content. It's very expensive to drive traffic. And once you've done those two things, why would you leave it to chance that someone might come to your website and have a crappy user experience? Protect your user experience.

Matt:

It happened last week on the Harvard Crimson on the crimson.com where somebody was on Crimson and they got one of these redirect ads that took them to this landing page that said, "Hey, you're a Verizon customer click here and take the survey and answer these nine questions and you'll have a chance to win." And this user actually took to Twitter and said, "Hey @thecrimson, which is, I think their Twitter handle, you've got a crappy user experience. Why are you letting this happen?"

Matt:

I never even saw a reply from the Crimson. But when we did some investigation on what was going on, they don't even have protection on their website. So it almost feels irresponsible at this day and age to not be protecting your asset because your asset generally speaking, isn't your website, your asset is your users.

Matt:

And so protect your users, make them feel confident that when they come to your site, they're going to have a great experience. And so that's really what we've focused on is just delivering technology that solves a problem that people are willing to pay for. Because obviously without that, we don't have a business.

Stephanie:

So when thinking about like the Crimson example, that's all from a bad ad being run on their website, correct?

Matt:

Mm-hmm (affirmative).

Stephanie:

Someone was able to buy that ad unit have bad JavaScript, and then that's when they were sent to that Verizon survey. I'm I thinking about that, right?

Matt:

You're totally thinking about that right. And what's interesting about the thread is that when this woman went on to Twitter and said, "Hey, this is what happened. And here's a screenshot," there were a whole bunch of people that piled onto the thread of like, "Oh, here's what I think is happening." "Oh, you have a virus on your computer." Or, "Oh, you have a bad extension on your computer or whatever." Everybody had a hypothesis of what's happening.

Matt:

And so we actually went and captured the threat and reverse engineered it and said like, "Here's exactly what's happening." And yeah, it's all coming through ads in that case. And there's so many great things of the open programmatic ecosystem.

Matt:

So programmatic media being able to buy a single oppression at a time by single user real humans, real devices, real networks, like you know I'm having a one-to-one engagement with this person and in the malvertising world, that's a feeding ground for bad actors because they get to do the same thing.

Matt:

And quite frankly, they're better at it than any other advertiser out there because they're the ones who know how to pay 20 cents CPM and buy an ad and actually get 100% click-through as opposed to the rest of the world that's just hoping that they get a half a percent click-through rate. And so they figured out how to buy that ad, that ad renders on your device.

Matt:

And then usually it's like an onTouchEvent. So when you actually just touch the device, they put a transparent overlay on your device. And that turns into a click or they'll auto click something on your behalf, or however they decide to inject their technology. But yeah, it's as simple as that. And I think it's lucrative, otherwise-

Stephanie:

They wouldn't be doing it, yeah.

Matt:

What they do is they try to do it at the lowest possible level without getting caught. So if you think about sophisticated marketers, what do you do? Well, you pick the right users, you maybe frequency caps so that you don't lambaste them with ads. You want to hit them at the right time with the right message and all that sort of stuff.

Matt:

And so these bad actors have figured out how to very elegantly and in a sophisticated fashion, they'll hit you with that ad. But the reality is they'll probably frequency cap you to one so you can't reproduce the experience and that's how they evade getting caught in most cases.

Stephanie:

Yeah. Very interesting. I didn't understand the whole backend of how that works. I mean, I do spend a lot of time thinking about building incentives for advertisers because we build up our own ad networks to advertise our podcast and we bring on partners all the time.

Stephanie:

And it's really funny thinking through how to build incentives for especially newer advertisers when you might say something like, "Oh, we'll incentivize you based on a download." Then all of a sudden you're getting all these fake downloads. No, not downloads. We'll incentivize you based on consumption. Like, does someone listen to the episode? They wanted to hear it.

Stephanie:

And then you see instead of actually having good people come through and consume the episode, the advertiser will say, "Okay, I'll pay you to review the ad or review the podcast, which makes it show that you were consuming it because you had to for maybe a minute to then be able to review."

Stephanie:

And it's always interesting trying to figure out, I mean, and these people are not good actors maybe, I'm not really sure. But it's always very interesting thinking, how do you incentivize people to do the right thing and actually deliver and not try and always get around the rules and just meet a number which I'm sure a lot of the platforms deal with the same kind of thing, but-

Matt:

It's interesting you use the word incentivized, and that was a dirty word in the early days where most advertisers didn't feel that the word incentivize was a good user because they didn't truly have the intent to do the thing that you want because they were being paid or a bounty or whatever the thing is.

Matt:

I saw the evolution of incentivized in my mobile career where it became really hard to get people to consume video commercials, like 15, six second whatever that metric was. And in the games world, they figured out this thing and they actually rebranded it instead of calling it incentivized video, they actually called it rewarded video. And-

Stephanie:

I feel like that's a little more, I don't know.

Matt:

Well, listen, and so I talk about one of the apps that I love is this app called Candy Crush. And I've been playing candy crush for almost 10 years now, I think. And when's the last time you played the same game for 10 years? Like never?

Stephanie:

Yeah. That's impressive.

Matt:

But they've artfully integrated video into their app. And I think if you run out of lives, you can watch a 30 second spot that is unskippable. So you have to watch the whole thing. And then if you, do you get rewarded with that extra life or whatever it is, maybe a lollypop, I don't know. But yeah, so I think there's different ways to approach it. But you're right, usually when you figure out the bounty, everyone else figures out how to capitalize on the bounty.

Matt:

And I think the interesting thing with Honey and Wikibuy is they've figured out how to get paid for the bounty or get credit for the bounty when lo and behold, they didn't really do anything. All they did was they had code that was resident on the machine that allows them to kind of get credit for that user purchasing when I think it's questionable whether they had any influence on that.

Stephanie:

Yeah. I've kind of thought that too, when seeing different Instagrammers with their promo codes for e-commerce site. And I always thought like, "Oh, how does that attribution work?" Because I mean, she's sharing it here, but I'm sure it's very easy for someone who doesn't follow her to also find that code outside of a Honey, but just be like, send it to my friend, "Hey, use this code." They never even followed her and now, they've got 25% off or something. So it does seem like attribution can be tricky, even if someone's not using Honey. How do you think that world's changing right now to make it easier for merchants to track where their sales are actually coming from? It feels very messy.

Matt:

Oh, I agree. I think it's a total mess. That's why we focused on the automation because I think that's one of those low hanging fruit, but big problems. Honey will tell the world that they have 17 million or so users. I don't know if Wikibuy which is now called Capital One Shopping, I don't think they announced how many users they have. But what I can tell you is both of those companies are spending a tremendous amount of money acquiring new users.

Matt:

Every time I log into Twitter, usually the first ad that I get is from Honey. All throughout the Christmas season, the holiday season just recently Capital One which owns Wikibuy Capital One Shopping, they were running TV commercials for this product with Samuel L. Jackson and John Travolta. So there's like a tremendous push for them to grow these user bases.

Matt:

In talking with merchants and we've got, I don't know, we've got maybe 25 merchants using our product right now. And we're in closed beta. That problem that you just mentioned, which is, "Hey, I worked with an Instagrammer and I gave them a code. And all of a sudden two days later, I've had a vitamin company tell me that story. I've had a sporting goods company tell me that story. I've had a toilet paper company tell me that story.

Stephanie:

They're using Instagrammers?

Matt:

They're using Instagrammers. They're using YouTubers. They're actually using podcasts as well.

Stephanie:

I mean, interesting to see how they're partnering on toilet paper.

Matt:

Because they're partnering for the audience on these podcasts and they're hoping that they can get that audience to find out about their product and again, then they're incentivizing them to come and become a customer. It's basically the same net story. The vitamin company told me they're like a supplement company. They partnered with one of the biggest triathletes in the world.

Matt:

Let's just say they had 50,000 or 100,000 followers, but you've got to imagine they're probably rabid followers. If you're into that, then that's probably the gold standard of who you would listen to. And that person did some blog posts and did some Instagram posts and posted their code and as soon as it happened, they saw a surge in sales attributed to that person.

Matt:

Now, the marketing person at the company was like, "Oh my gosh, we figured it out. We nailed this. We knew that people would be rabid about that person's content. We knew that person had so much influence to get people to come and buy." And then they're like, "Oh my God, it's Honey." Because literally they went from zero sales to 80% of their sales that had coupons was that person on Monday.

Matt:

I think it's a frustrating problem. And I think the sophisticated marketers have woken up and are like, "Man, we're bleeding money." One merchant told me that when they started kind of parsing out the attribution that Honey was costing them. They did about a million and a half in revenue online per month, so call it a $15 million business give or take. They believed that these promo code extensions were costing them about 150 grand a month, 10% their overall value.

Stephanie:

I mean, we just had a guest who they ranted about their hatred of Honey, I mean, even on the show. So I think it's maybe a couple episodes before maybe when yours is going to go out.

Matt:

Call me. We can help.

Stephanie:

Yeah, I'll send the link so you can hit him up.

Matt:

Absolutely.

Stephanie:

He was not a happy dude about Honey. But I guess when I think about promo codes, it kind of feels archaic to me. Maybe this is just a me thing, but it feels like where QR codes were where all of a sudden they're gone and you don't even think about them anymore. Promo codes kind of feel like that to me too of just, it feels like a manual old way of attributing things.

Stephanie:

How do you think about attribution when it comes to influencers and stuff or anyone, without having to use a code? Are you guys even thinking about a new way of doing things or do you hear of people trying new ways of attribution that isn't like I'm putting in a manual like Stephanie 20, to get my 20% off? Is there a new way of doing it?

Matt:

I mean, we're thinking through all those things. I think the challenge is specifically if you're using these one-to-many mediums. In a perfect world, I think you'd have a unique code for every user and so you'd have to authenticate. We'd know that that code went to you Stephanie and if you redeemed it, I would know that you actually bought something and you bought something because of this engagement that we had. I think in these one-to-many mediums it's, how else can you do it? And some of the challenges that the one-to-many mediums like think of YouTubers.

Matt:

One of the companies that we're working with has a problem where they have a very high dollar ticket item. Their item that they're selling is about 1,000 bucks. And obviously, if somebody grabs a code of 20% off that you're losing 200 bucks, it's a lot of money. Their problem was that they were doing YouTuber videos and they were publishing a code within the YouTube video to reach the audience. And for them, it was extreme sports, the audience that they were going after.

Matt:

Well, literally the next day, and I don't know if you know how Honey works. If you have a Honey on your machine, the very first thing that Honey does is it scrapes out anybody who manually puts a code in. So in order for Honey to be able to grab that code, it has to happen once where a real person saw the code and was motivated to go and type it in and buy.

Matt:

If that happened to me, if I got that code, I would go in and type it in. And if Honey were on my machine and then I hit okay, Honey will scrape that code out and now everybody who comes after me gets access to that code whether they saw that YouTube video or not.

Matt:

The problem for this company is spending a lot of money engaging with YouTubers and creating videos and obviously, doing the presentation layer of these offers. Well, once Honey gets a hold of the code... And what they've also found is that Honey and the other extensions, are not very merchant friendly. The relationship between Honey and these merchants is actually quite adversarial. And so it leaves them with no other option.

Matt:

I guess the two options: one, you just keep running your YouTube thing and you resign yourself that you're going to be paying out a 20% discount to everybody who comes and has Honey; which that stinks, that doesn't feel right or you need to reach out to the YouTuber. You need to recut the video. You need to recut the voiceover. You need to kill that code. You need to put a new code in. And so it's made this sort of marketing endeavor with YouTubers and Instagrammers and you name it very hard, because you're actually turning off codes.

Matt:

We saw one email which was interesting. I always say to people, let's remember we're all consumers too, you and I buy stuff on the internet, even though we're deeply entrenched in the businesses that we're running. I have Honey on my machine, so I can understand what that user behavior is, so that I can actually talk with merchants.

Matt:

One of the folks on our team bought a pair of shorts from one of these companies that advertises on Facebook and Instagram. And they were out of stock after he had ordered it, so they sent him an email. And they said, "Hey, listen, sorry you didn't have it but guess what, here's a code. You'll save X percent. But please, make sure you use it within the next 48 hours because Honey has been grabbing our codes and we're going to shut this code off."

Matt:

How can people market, if you constantly have to play whack-a-mole. And if you now think of the analogy, it's back to what we do in the malvertising side. If you aren't going to solve things with software, you're basically playing this long cat and mouse game that you won't win.

Stephanie:

I mean, that's why I think about merchants turning on and off codes.

Matt:

It's a nightmare.

Stephanie:

We were handing out swag and me just trying to... I had unique links that could work for more than one person and just thinking, "That could be tricky and go really bad." But I guess that's why I just think codes just feel, like I said, a little bit archaic. Why can't I just go to a YouTube video?

Stephanie:

I mean, the internet knows so much about me and where I'm at anyways. It should say, "Hey, Stephanie watched Matt's video where he was talking about this toilet paper." And then all of a sudden she's at our website, you can say, "Stephanie, a 20% coupon awaits you when you go here."

Stephanie:

And then when I get there it should know who I am and then be like, "Your coupons applied. And it will be applied for the next three days on this website or whatever, because I know where you've been and what you saw and where exactly you came from." Why can't it just work?

Matt:

I mean, I wish it was all that simple. Listen, we are taking obviously, technology solution to what we think is a longstanding and challenging problem. And in the malvertising world, the people in ad operations were literally playing whack-a-mole. Like, "Let's figure out where this bad ad came from." "Turn that demand source off." Or, "Turn that buyer off." And guess what, the bad actors, they just pop up again.

Matt:

And so we believe that, and I've seen and talked to merchants who are like, "Listen, here's how I solved the Honey problem." And they're like, "We actually created promo codes for 10% off, but the promo code was Honey is stealing your data."

Matt:

Because if you use Honey, you know that when Honey pops up it'll actually tell you the codes that it's implementing. They went on a mission to discredit and put the fear of God in their buyers that Honey was doing... They were like, "Honey is doing nefarious things with your data." And guess what, Honey D listed them as [inaudible].

Stephanie:

Well, there you go. Now, you know how to do it, I guess.

Matt:

The irony is, is that was three months ago that I talked to that merchant. And yesterday they cameback in and said, "Listen, we have a problem again."

Stephanie:

Honey added us again.

Matt:

No, this time they've got a Wikibuy problem. The problem is going to be never-ending, I think. Ultimately, we're hopefully going to give e-commerce companies the tools that they need to go out and be able to operate their business and focus their time on the things that really matter, in my mind, which is driving incremental revenue; not playing whack-a-mole with your promo codes and having to go recut YouTube videos. Hopefully, that's one of the big things that we help solve for.

Stephanie:

That's cool. I mean, I do like the idea of that one merchant you were mentioning where they said, "If you act within the next 48 hours or whatever, it'll only lasts this long." And I just had a guest yesterday who said that. I think it was either Burger King or McDonald's made it so if you're within 20 feet or something of a McDonald's they would send you a code and say, "You have five minutes to get to a burger King to get a free burger or something."

Stephanie:

And I'm like, "That's interesting." That's a good way to make people act quickly if you know something's expiring, I know I act a lot quicker. But I mean, of course, solve the problem that's number one. But I do think that's an interesting marketing tactic too.

Matt:

And make it measurable. I think that's the key thing is that... I often say, "What gets measured gets managed." And so hopefully, what we're doing is we're taking one of the things out of the equation that is making measurement really challenging for merchants. Again, using the triathlete example, yes, the marketer was high-fiving the rest of their team going, "We finally solved this." And then when they actually looked at the data they were like, "Damn it. I guess we got to go back to the drawing board."

Stephanie:

It's also just so tricky too, knowing how much of those people would have bought otherwise or not. So even looking and being like, wow, we have all this attributed to this one promo code and maybe it was because of Honey. But how many of those people would have bought if there wasn't some promo in there? It's just hard to know.

Matt:

We're solving that problem. We're giving merchants some deep analytics on exactly what's happening on their site, because we think there's a blind spot there where they don't know. For instance, how many users actually came to your site that actually had an injection capability? One of the extensions of Honey, Wikibuy, Piggy, Amazon Assistant, you name it. So we give them that lens.

Matt:

And then we give them the lens of, what were all the promo codes that they tried to inject? What was the most popular promo code? And stack rank those things and then going deeper down to conversion rate. And guess what, what we're seeing in these early days is that when you block Honey and Wikibuy at checkout, the vast majority of users actually still convert.

Matt:

And so that to me is the icing on the cake which is, guess what, you take control back of your website. You take control of your margins. You take control of your revenue. You now have the data you need to be able to go out and drive incremental sales. We think that's pretty powerful.

Stephanie:

I mean, that makes sense. I've heard a couple of times that also, discounts don't matter as much as you would think. I think they were talking about, they did a study between 10% off and 20% off. And actually, they were kind of the same when it came to consumer happiness. And what can be worse though, is if someone has the ability to go in and put a promo code in or something and then it doesn't work.

Stephanie:

I don't know if you remember those days of just going to the internet promo code for macys.com and trying out 10 different promo codes and all of them failing. I was way more unhappy then, than just not having one at all, just buying at full value.

Matt:

Let me tell you the opposite of that which is the worst-case scenario, in one of our merchants experience and that's why they're using our software. They're in the home interior space, so they do drapes and carpets and wallpaper and all that sort of stuff. And they were trying to build favor with interior designers because they wanted interior designers to know their site and know their stuff and all that sort of stuff. And so they did a very exclusive but unfortunately, a promo code that Honey got ahold of that gave interior designers 50% off.

Matt:

Well, lo and behold, as soon as one designer used that code and also had Honey on the machine, that code then got swept up in the Honey and everybody, every order that had Honey was now getting 50% off. Their customer service nightmare was that they couldn't afford to give every consumer 50% off, so they actually had to cancel orders; believe it or not.

Matt:

They called customers and said, "We can't honor your order with that coupon because that coupon was not intended for you." Created a customer service nightmare for them. And that's what they want to do is, they want to control their user experience. They want to control their revenue and their margins.

Stephanie:

Oh my gosh, that's horrible.

Matt:

Out of control. But think of that disaster of having to call someone and say, "Hey, I know you wanted to spend $500 with me, but only pay me 250 bucks. I can't give you 50 off but I can give you like 15 off, that's kind of what you were probably entitled to." So anyways, just trying to get control back in these merchants hands and let them control their destiny.

Stephanie:

I love that. When thinking about back to the now advertising piece, how much do you think it's on the publishing platforms? Is it their responsibility to make sure that they continue to increase their efforts to make sure bad actors aren't out there anymore?

Stephanie:

I mean, I know they're probably doing a lot. A lot of people like to hate on the publishing platforms and they want them to always do more and more and more. Is it maybe on them or maybe not on them anymore to continue to try and track those bad actors, who like you said are kind of popping up here and then they shut down and then open up a new account and do one off things and then shut down again. How should we think about leaning on the platforms like that?

Matt:

Well, I say to folks, the value chain in that industry is actually quite wide. And so from the bad actor who's putting their hands on the keyboards to the consumer, there's a whole bunch of players in the middle. I think it's on everybody to really have defenses in place and to make sure that they're protecting...

Matt:

So if you're at the front end, if you own the demand side platform that the bad actor's using, you need to have your own checks and balances to make sure that you're not bringing in malicious buyers. But all through that value chain, the onus is on everybody. But at the end of the day what I say is, the only person that can be responsible to that end user, is the publisher.

Matt:

Pick your publisher, if you are Fox News or you're the New York Post or you're the Washington Post, you're the one that has that ultimate relationship with Jenny or Johnny consumer who is surfing your site and consuming content. So you're the last line of defense. You're the one that created the site. You're the one that drove the traffic. You're the one that is using ads to monetize your traffic. It's really on you I think, ultimately.

Matt:

Now the publishers, all those folks that I named and there's millions of them, they all want to look upstream and they should. And they should hold everybody accountable upstream. But I think they're the ones that are really the that last line of defense.

Matt:

Because if you go to one of these sites and you have a crappy experience, you don't really care that it came through an ad. Like the woman at Harvard Crimson last week, she didn't know the origins of why it happened. And here's the other crazy thing, she knew that when she went to the Crimson, she was delivered a crappy experience.

Matt:

Now, the crazy part. First time we've ever done it, we actually did a private webinar with the end user because we wanted to explain to her here's exactly what's happening. She told us this story, she said, "Listen, I use ad block." And obviously, the risk to publishers are, if you don't create great experiences, your users are going to start using ad block.

Matt:

What she said was, in the desire to get real news and in the desire to really understand what's going on in the world and in the desire to actually make sure that real news publishers are actually getting compensated, she turned her ad block off and this is what happened.

Matt:

So shame on the Crimson for not delivering a great experience, because guess what? Now that user's like, "I'm not turning ad block off the next time I come to your site. You're not going to get paid for the traffic that I'm going to generate." So again, it really goes back to the publishers, the onus is on them.

Stephanie:

And thankfully, I think there is like new technologies popping up that maybe we'll be able to enable them or even just thinking about implementing. I mean, I've seen some advertisers looking into blockchain and having that as being kind of like a more source of truth to be able to know a one-to-one relationship and knowing who's behind... You don't know exactly who's behind what, but if you have it in a way where they sign up and they can't just start creating a million different accounts because they've got their one single one that they can go off of, it seems like there's a lot of ways that it can improve over the next couple of years that maybe hasn't been so easy the past decade or so.

Matt:

I agree. Obviously, there's industry bodies all trying to figure this out together. There's companies like us who are innovating and coming up with new and unique techniques to block these sorts of nefarious actors. I do think the biggest and most important thing is to recognize that the bad actors aren't just sitting still waiting for somebody to solve this problem. They're innovating honestly, a more rapid rate than many of the industry leaders that you would expect that have hundreds or thousands of people trying to solve this problem. Bad actors unfortunately, are innovating at quite a rapid pace.

Matt:

So the problem I think is going to evolve and change. We've seen it evolve to not just being ads but obviously, compromised Chrome extensions that just seems to be a great vector. And so I think you're going to see the problem move around and especially, if there's a lot of money in it. If there's ways for these guys to make money, you're going to see them salivate with... You're going to put up this defense and they're going to figure out this way to get around it.

Matt:

And there's so many different browser types. There's so many different machines. There's security flaws. There's zero-day. There's so many ways for these guys to actually buy and target, to only focus on iOS 13 and below and blah, blah, blah to reach their audience.

Stephanie:

So tricky. Hopefully, it'll get solved over the next decade. Cool. Well, with a couple minutes left, let's move over to the lightning round. The lightning round is brought to you by Salesforce Commerce Cloud. This is where I'm going to ask you a question and you have a minute or less to answer. Are you ready, Matt?

Matt:

I am ready.

Stephanie:

All right. First the harder one, what one thing will have the biggest impact on e-commerce in the next year?

Matt:

Listen, I think it's been the gold rush for e-commerce merchants over the last year. In many cases I talk to merchants, they're like, "It was raining money last year." Sales were up five X, 10 X, who knows. I think the next year is going to be that year where folks actually look to efficiency, and they look to figure out where there are holes in the boat that they haven't had to look before.

Matt:

And I think that plays to our product because I think in many cases when it's raining money, you almost turn a blind eye to some of these sorts of things. But I think now folks are like, "Listen, if I can be more efficient. If I can take control of my revenue and my margins, I'm going to do that."

Matt:

So I think that's probably, this is the year of people now are catching their breath and they've figured out their distribution and they've figured out their fulfillment and their warehousing and all that sort of stuff and the panic that they had to do to keep up with the pandemic growth. Now, I think it's a deep breath of like, "Okay. Now, let's look at the math."

Stephanie:

Yeah. I agree, that's a good one. What one thing do you not understand today that you wish you did?

Matt:

What one thing do I not understand. I think the affiliate landscape is complex. I think there are a lot of legacy ways in which people have calculated incrementality and I'm not sure if they're all believable. And I hear a lot of feedback from merchants where it's kind of like they just brush it under the rug and they're like, "I know I'm probably paying for stuff that I didn't really get, but let's just let it go." I think every percentage point matters. That ecosystem, because I hear there's good guys and there's bad guys and I'd love to really dig deeper on that. And I think that's a big opportunity for us as a company.

Stephanie:

That's a good one. What's the nicest thing anyone's ever done for you?

Matt:

Wow. The nicest thing that anyone's ever done for me.

Stephanie:

I like to go deep.

Matt:

Yeah. That's a deep question. I think I've been fortunate throughout my whole career in that, I have been given opportunities that I probably wasn't ready for. And by the way, I had never been a CEO before I was at this company. And so, who knew that I'd be able to do it.

Matt:

But I think it actually starts way back to when I first graduated and I was seeking my first job. And I had a mentor that took a risk on me and gave me my shot. And I worked my butt off and hopefully that translated and he and she felt great about what I was doing. So I think the nicest thing, I've just been given opportunities that I don't think I deserved and hopefully I earned that respect and trust over time.

Stephanie:

That's a good answer. If you were to have a podcast, what would it be about and who would your first guest be?

Matt:

Wow. This lightning round is hard.

Stephanie:

Good. Needs to be.

Matt:

If I were to have a podcast. I love gadgets. I'm one of those guys that buys the infomercial type stuff. I bought one of those Rotisserie Showtime girls 20 years ago, I still use it.

Stephanie:

Worth it.

Matt:

Maybe it could be interviewing people who've built made for TV products and really understanding the backstories behind how they came up with the idea and how successful they were and God knows how much money we all made them.

Stephanie:

That's good. We had Kevin Harrington on the show, he was the original OG shark in Shark Tank. He basically made the infomercial. And it was very interesting hearing his perspective of how it started, where it's at now and Shark Tank.

Matt:

I'm fascinated by that ecosystem, it's super cool. And by the way, I always do buy one of those stupid things for my wife for Christmas and she hates me for doing it because she's like, "You're just burning money."

Stephanie:

I had fun buying it and watching the infomercial today.

Matt:

Believe it or not, one of my coworkers gave me a Squatty Potty for Christmas.

Stephanie:

I actually feel like those have good value though, the science is there. It's just a weird thing to buy your wife, if you got that for her. Someone gave it to you, got it.

Matt:

I was given it, by one of my coworkers, "By the way it works."

Stephanie:

And their marketing, I think that's the Harmon Brothers who did their marketing with the whole unicorn and they did the Poo-Pourri thing.

Matt:

Oh yeah, it's super cool. I love those kind of gadgets.

Stephanie:

That's a good one. I would listen to that show. All right. And then the last one, what's up next on your Netflix queue?

Matt:

Well, on my Netflix queue, I think I've got three episodes left on the Queen's Gambit.

Stephanie:

Love that show. That was a good one.

Matt:

I'm a documentary guy. I actually will tell you that I've been kind of hooked on HBO Max for a little bit. And I just finished the Tiger Woods documentary last night, which was fascinating. Nothing that you hadn't been told before. This guy through adversity has come back multiple times; knee surgeries, winning on a broken leg. So I'm into those sorts of stories. One of my guilty pleasures is The Bachelor, so it's on my DVR. I'm playing catch up on that.

Stephanie:

That's great.

Matt:

I love reality TV and that sort of stuff.

Stephanie:

I like where your head's at, me too. Well, Matt, this has been a very fun interview. Where can people find out more about you and clean.io?

Matt:

So you can find me at matt@clean.io. So if you want to send me an email, obviously happy to help you guys in any of your challenges and would love to hear your challenges if they're similar or if they're different than ones that we're solving for. Hit me on LinkedIn, so you can find me there. And our company website is clean.io.

Stephanie:

Awesome. Thanks so much for joining us.

Matt:

Thanks Stephanie. Thanks for having me.