The most interesting issue for me, however, is the simplicity and ease of the actual fraud case. In trying to learn about Zynga's risk management capabilities, I came across a short quote of Zynga's CEO, saying that they had to develop everything in-house. Looking at the market (even in PayPal, I have to admit) I understand why: when you get recommendations like " Use SSL and remember you're accountable ", it's hard not to get depressed. But what is that "everything" they developed in house?