PayPal Holdings, Inc. (PYPL) Earnings Call Transcript & Summary

No, that certainly makes sense. Obviously, with the outsized growth that we've seen in digital commerce, fraud comes along with that, with a lot of new challenges to any sort of cybersecurity environment. How would you characterize sort of the state of things now? And how do you see technology being leveraged to address that?

Yes. I'll separate fraud and cybersecurity. There are -- there's a spectrum of things, some of which cybersecurity covers, some of it fraud covers. But fraud, let me talk about in the context of transactions. Transaction sanctity on the platform is one of the most important things for trust. When a customer wants to move or manage their money, we need to do it in a way that they believe is done right and secure, it's private and so on. We put a huge amount of investment. We have a great team that works on our sophisticated fraud systems, high leverage of data. Within 300 milliseconds during a transaction, we have tens of models that actually look at the context around the transaction and evaluate the safety of the transaction. And that happens on every single transaction that occurs on the platform. And that is what allows us to have some of the industry-leading risk loss rates at the company. Now fraud, just like cybersecurity is one of those things where good yesterday is not good enough today. So you had to continuously evolve and continuously innovate. You have to take the understanding of the fraud patterns into consideration. In many cases, you have to clean those from the signals that you're getting, which are not always direct and react that to those, not just through human processes, but through algorithms and the leverage of data and so on, to stay in front of where the fraudsters are and beat them at their game to the best extent that is possible.

No. That's -- yes, it has to be an incredible challenge. When you look at -- just to dig deeper into that within cybersecurity, what are some of the key trends that you're seeing maybe more broadly, whether it's greater cloud adoption? Or we're certainly seeing this rise in ransomware, what -- is someone who's literally doing this every day, what are the things that you're seeing?

I mean, as is very evident from the news, there is something new that you see in the news every single day, and there are some common patterns that emerge from it. But given the size and scale of our company, we see attacks happening every single minute. And that could be anyone from amateur kid, who is bored in his college dorm, all the way up to any kind of activity that happens from organizations that are committed to cybercrime. So I would say the biggest trend that everyone in the industry has had to deal with over the last year is the movement of the workforce home. Suddenly, the surface area of risk went from your offices, your premises and your devices to a whole lot more. And that's a completely different mindset that you have to start to apply now to say, everyone became a road warrior. And how do you actually make sure that your promise to your customer, to your company, are all upheld through the leverage of technology and systems to ensure that we can keep the cybersecurity promise? We can stay in front of those problems. Ransomware is one kind of attack. It's a special kind of malware. Malware is still out there. Phishing, of course, happens all the time. The way to address all of this, it is, one, it is important for cybersecurity to become a lifestyle aspect in the company, everyone in the company, whether your in technology or not needs to become aware of what cybersecurity implications are. Awareness is critical. Education is critical. We have found the right use of in line messages to make people in the company aware of what they're doing or what they should not be doing, extremely important and extremely effective. And on top of that, we've taken a platform approach to cybersecurity as well. The way we do identity management, the way we do cryptography, things of that nature. We don't just allow for all the teams in the company to do it differently, we have specialized team that built that platform. We actually mandate the leverage of that platform across the whole company. And that gives us the best up-to-date differences possible at any time. And like I said, on fraud, in cybersecurity as well, good yesterday is not good enough today. So it's a continuous marathon that you are at.

So security is often intention, at least at some level, with business initiatives. You talked before about Zero Trust policies, that seems like something that could slow down the velocity of customers getting business done of onboarding new users, time to market. How do you manage that at PayPal?

So whether it is from an employee perspective or from a customer perspective, you're right. Security that's not designed properly can actually land up becoming a friction factor and therefore, impedence in both onboarding of people and their productivity on the system. And this is where we had to take a design centric mindset, a customer-centric mindset that's based on design. And you had to understand what you must absolutely do for security. But at the same time, what you cannot compromise in the experience as well. Now in spite of the best attempts, sometimes you will still create some aspect of friction. And in those cases, it's important to lead with the why and create messages, both for customers and employees, where they understand why something is happening. And the fact that it's of value to them, it's for the safety of them. And that education, combined with the design centric approach, combined with the platform approach, I think that's the way that you try to make the best of all needs you have and create experiences that are delightful and yet safe and secure.

Yes. One of the -- you talked about the challenge of a work from home environment from a security standpoint. But I'm actually really kind of curious how you addressed it from a collaboration an efficiency standpoint for your teams that are working together, how do things like scrums work in this kind of an environment?

Yes. In fact, like, as Dan mentioned, 2020 happened to be the year where we had the most engineering productivity and we put out more PR than ever. And if you'd ask me that question, if you give you have the situation in February of last year, and you said, hey, look, for the rest of the year, everybody is going to work from home, what do you think is going to happen with release velocity and product productivity I would have said, oh, my God, that one, I don't know. And number two, I'm concerned. At the same time, what's occurred, though is, again, the investment in the digitization of the enterprise. And keep in mind, we are a digital native company to start with. And therefore, much of the approaches that we have taken to software development, they're all using collaboration tools, whether it is collaborative editing on documentation or the ease of having a video call with somebody else, or for that matter, creating a virtual setup where everyone can participate and contribute just like they did when they were meeting each other in person. All of that has played a critical role. There are new ways of working. And those ways of working are powered by underlying platforms that we have leveraged from our partners and that has allowed people to connect with each other, whether it is in terms of their day-to-day work or in terms of just connecting with other employees, we've created all those [indiscernible]. One thing that I'd like to highlight is the pandemic definitely stretched what leadership meant, and what innovation meant, and what the need for technology was. A key thing that we did last year was we created an augmented reality, extended the IT experience, called the Pavilion. And that Pavilion actually became the place where we did the annual expo for the company where people present all the things they're working on. We actually had the holiday party in the Pavilion, where people could virtually engage and all that kind of stuff. And then on the side, we've done various things through leverage of slack and other tools like Microsoft 365 that allowed people to interact and exchange their day-to-day. So keeping the concept of a community going, concept of engagement going, while at the same time being productive. There's no doubt there's been burnout too because boundaries went away. People no longer had the boundaries they had before, and they struggled with that quite a bit. But that's where leadership connection, empathy and all the way up to like our Head of HR, help design program, where we now -- every 6 weeks, we have a wellness data, the whole company is off for the whole day. So no single person needs to have the guilt of saying, I'm the only one not working, and let me sneak in a little bit of work. The whole company is out. And that creates space for people to take a break, refresh a bit and get ready for the next 6 weeks as well. So Tech has played a very important role, but I would say, empathy and leadership at the most senior levels in the company has played an equal role, too.

Yes. That's going to be incredible for your teams, I can imagine. Within that same sort of mindset, ESG is obviously a huge area of focus, and I know sustainability, in particular, is a very big focus for PayPal. But for a company like PayPal, much of your environmental footprint is linked to your technology infrastructure. Where are you now on carbon neutrality and in that sort of sustainability journey?

Yes. So the first thing I'll say, I'll step back and say our approach to environmental sustainability is one where we've broken up into 3 pillars. One is managing our impact as well and the commitment to continuously improving the environmental management and reporting through clear goals and objectives. That's one portion. The second aspect is mobilizing our people. We have found that our employees deeply care about the environment, and want to volunteer their time and skills to help address sustainability issues, not just on behalf of PayPal, but for the world as a whole. And the third aspect is through driving innovation and pursuing opportunities that drive positive environmental impact through products and services and so on. You're right, the biggest aspect of the energy footprint is all in the technology space. And we actually started to participate in science-based emissions target a couple of years ago. In 2017, our renewable power footprint was at about 48%. By the time we closed out on 2019, it was at 65%. I don't have the 2020 numbers yet, but we have a target for 2023 to be at 100% renewable power across our data centers for PayPal. All this while making sure that we continue to run all other aspects of sustainability with transparency and reporting and the right kind of climate advocacy as well.

Yes. When we -- somewhat related to that, when you look at the goals of diversity and inclusion, engineering and technology organizations are obviously, as many are, always challenged in terms of building diverse teams. How do you think about talent acquisition and development in that lens?

Yes. Look, I think this is an area of a lot of conversation and whether it has moved my peer group and it work in the rest of the industry, or internally as a technology leadership as well. It's a very high priority. You probably know from everything that you've published, in terms of our values, one of the key values is inclusion. And we actually believe that if we are to serve the world that is very diverse, the inside of our company needs to look very similar to the people that we are serving on the outside. And we have seen the role modeling for this start all the way from the top of the company. Dan, himself, has committed to this, and he's clearly done a lot of work. And if you look at our Board composition, it's a very diverse Board that we have. When it comes to technology itself, there are various things. On the one hand, first of all, creating a culture and fabric of inclusion is the most important part of having diversity thrive. And that means awareness, elimination of biases, reflecting amongst ourselves and understanding what is it that we do every single day in terms of onset norms that may be coming in the way and eliminating those. Being intentional about diversity, having targets, hiring for those targets. And then once people are in the ecosystem, allowing them to giving them space, the psychologically safe space, to succeed and thrive, through the right kind of promotion process and all that kind of stuff, pointing them the right opportunities and so on. But it's much broader. The conversation we are having at the industry level is to say, there's a bit of a pipeline problem as well when it comes to engineering and computer science. So working with the organization by core.org, which is trying to take computer science education into middle schools and high schools. And making sure that we are not only making PayPal a great place for diversity to thrive, but also making sure that the problem we have in the tech pipeline itself is something we are addressing for the long-term investment to ensure that there is the right kind of diversity in the pipeline as well. By the way, if you don't know, core.org has made some amazing progress. If you look at AP computer science, the number of female and diverse [indiscernible] now in the AP program is significantly higher than what it was even 4 years from now. So it's a holistic end-to-end, but this is still a learning journey. It is one that none of us can claim any time of such as on. They'll be all together get to a place where we have inclusive cultures, we have a diverse population of employees and at the same time, we are addressing all aspects of diversity in demand in the tech pipeline.

That's incredibly good to hear. When we look at the regulatory side of things and the -- increasingly, the focus on tech and data regulation, how do you think about the need for personal data protection and privacy and balancing that with the innovation goals that you have as a company? As potentially competing issues?

We -- when people ask us about how we think of ourselves as a company, the first thing that we always say is we are a customer champion company. Everything that we do in terms of the relationship with the customer, particularly the long-term relationship we want with the customer, is the epicenter of all that is trust. And that trust actually includes the safety and a peace of mind in terms of the customers knowing that we are using the data that they have deposited with us in the right ways. In most cases, at PayPal, the leverage of data is in the context of the user, in the context of the transaction. There is no place where we share that data with any other party without the consent of the customer itself. That said, I think it is great, actually, to see the regulatory climate coming to impose the right kind of programs and mandates to protect the consumer as a whole around the world. And we consider ourselves a partner in that process. The -- it's a myth for someone to think that you cannot do privacy and innovate at the same time and build great products, you can. There are many techniques from a technology perspective, including the right application of cryptography and so on, where that can be done without the leverage of personally identifiable information. So this is something that is a core thing for us in terms of technology and data management priority. The regulations we have seen so far are still version 1 of the regulations that we have seen. We actually expect a lot more across the industry to come in this space. And the fact that we've built a regtech platform that helps us with compliance, actually allows us to take all those mandates and make sure that, one, we comply with all of them, but go well beyond those compliance mandates to ensure that we are doing right by the customer during every transaction we have with them.

No, it's really great to hear. Sri, thanks so much for taking the time to join us. This has been incredibly enlightening, and definitely look forward to doing it again into the future, hopefully, in person.

Heath, it's been a great conversation. Thank you for the opportunity.

Thank you.