Trust-First Design

Trust, then verify

Jack Dorsey describes the founding product philosophy at Square as an inversion of the financial industry's default. In his framing, "A lot of the financial industry had a mindset of distrust, constantly looking for opportunities to prove why people shouldn't get into the system. Whereas we took on a mindset of trust and then verify, verify, verify, verify."¹ [11:39] The pattern is to assume good faith at the door and move the scrutiny downstream, to the behavior itself.

Dorsey locates the problem in the tool the industry had inherited. The FICO credit check, he argues, was never designed as a blanket gate for small merchant accounts; it was simply the only available signal for predicting whether someone would be a legitimate vendor. The consequence he describes is exclusion by default: roughly 60 to 70 percent of small business owners who wanted to accept card payments were denied before their first transaction. He does not frame this as malicious but as a blunt instrument that screened out people with thin credit files, such as new businesses, recent immigrants, and entrepreneurs without prior history, who might be entirely trustworthy merchants.¹

The inversion in practice

By Dorsey's account, Square replaced the upfront credit check with transaction-level monitoring. Merchants onboard with no credit check and can accept a first payment within minutes. The system watches at the level of the transaction rather than the merchant, continuing to serve anyone whose activity looks credible. Anomalies, or what he calls "interestingness" in usage patterns, are surfaced for human review, and removal from the system is behavior-based rather than credential-based. He reports the acceptance rate moving from roughly 35 percent to 99 percent under this design. [12:08]

Dorsey is explicit that the sequence ran mindset first, technology second: "The change in mindset led to the technology, not the other way around." Square, in his telling, did not first invent new monitoring capabilities and then decide to be inclusive; it decided to trust people and then built the models needed to make that commercially viable. The ordering is the pattern's whole content: a belief about people precedes the system built to serve them, and the engineering follows the stance rather than setting it.

Why the mindset is load-bearing

The deeper claim Dorsey makes is that the same data infrastructure produces categorically different systems depending on the assumption behind it. If the operating belief is that people are fundamentally good and the task is verification, the system surfaces edge cases. If the belief is that people are fundamentally suspect, the same data is used to find reasons to deny. The instrument is identical; the default assumption determines the output.

This design choice relates to trust as an economic force, the broader observation that trust accumulates slowly through repeated positive interactions and is destroyed instantly by a single doubt. Trust-First Design operates at a different layer: it concerns the institutional default a customer-facing system encodes before any individual trust exists, and it creates the conditions under which transaction-level trust can then accumulate. The two reinforce each other while remaining distinct.

Where the pattern generalizes

Dorsey and the host note that the same inversion, flip the default and build verification underneath, recurs beyond payments. The presumption of innocence in criminal adjudication is structurally the same move applied to judgment. Content moderation splits along the same axis, reactive removal after flagging versus screening everything before publishing, yielding radically different systems from the same premise. Dorsey also observes that parts of the financial industry are now revisiting the default, with open-banking regulation forcing the access expansion Square chose voluntarily.

The pattern carries a stated dependency: it works only when the monitoring layer underneath is strong enough to catch misbehavior after the fact, since the upfront filter has been removed. The wager is that granular, behavior-based verification can absorb the risk that the credential check previously screened out at the door.