Practical fraud detection - Essentials

Hi, name is Duncan Malcolm. I convene First Six Last Four to help us understand more about fraud threats and the things that we can do to reduce our risk in the face of highly motivated adversaries. In this series we are going to look at the main ways to detect and identify potential fraudsters as well as critically how to know if we're under a specific fraud attack. The main way to detect fraudulent customers is pattern analysis. You're looking for things that look unusual versus your non-fraudulent regular customers. You might be asking how do I know what looks different? There are few key steps: Define what normal looks like; Monitor for anything abnormal; Collect more data to spot more abnormal stuff; Simple single transaction example Lets assume we are looking only at the basic data provided from a PSP. For a US physical good reseller that usually sells locally. Now for this comparison it's really easy for us to say that we should not capture funds from the unusual customer. There's too much risk with the higher value and the lack of liability shift. We could mitigate that risk with some additional checks...but given all the discrepancies I'm not sure it would ever get to something you'd be comfortable with. Now it's still possible for a transaction that looks normal to be fraud. But if you collect enough data you should almost always be able to spot the difference. Legally profiling your customer A lot of countries have legislation to protect to protect consumer data. However, the majority of this legislation, including DPA, GDPR etc. have exceptions for financial crime prevention. While IANL and you should check in the jurisdiction you operate in. For most countries if the purpose is to expressly prevent financial crimes including fraud, then as a merchant you are allowed to do a lot more with data then if the purpose is marketing. In most cases, pretty much anything you like. This is great for preventing fraud and financial crime as it opens up an almost limitless pool of data about consumers. Fraud feature categories These are high level groups of things that you can legally check in most countries before taking an online payment. Assuming that you're collecting it for the sole purpose of financial crime prevention. Here are main things or 'features' we can look at to detect fraud: {card used} Information about the transaction such as issue country; {links} We've linked the customer to a transaction that has received a chargeback; {device} The customer's device is different in some way to our regular users; {phone} Something about the customers phone number is unusual {ip} The customer's IP address is unusual; {email} There's something unusual about the email address; {social} We can't find a social presence for a user we might expect one for; {trust network} A 3rd party service has told us that the customer is more (or less) risky than others; {behaviour} the customer is behaving differently to your other customers in buying habits or site behaviour; I'll go into each of these categories in depth but as you can see even at a high level there's a significant range we could use to detect fraud. Simple fraud spike example A key thing to track as mentioned in the post about fraud strategy, is to monitor for unusual spikes. Often it's not possible to immediately know what features make up a fraudster but you should be able to spot trends and take action on them before it's too late. Here we can see that we have a sudden spike across a whole range of different features. While not all fraud attacks will look this overt, it's the kind of things and way you should be monitoring for. -- In subsequent articles I'll cover each of the above topics in a lot more detail. In the meantime, how do you currently monitor for spikes?

Practical fraud detection – Essentials

This post is for subscribers only

Leave a comment Cancel reply