MODEL-BASED FRAUD SCORING

MODEL-BASED FRAUD SCORING TECHNICAL OVERVIEW

Model-Based Fraud Scoring is used by merchants to determine the level of risk associated with taking an order in the card-not-present marketplace. Merchants use the score either to reject, review or accept orders, as well as to find out information on what other types of preventive checks they should perform on the order. Key considerations when implementing or buying this functionality include:

• How often are the underlying models updated? This is important as the fraud patterns and data points that are used in a model come from actual good and bad purchases. If a model is a year old merchants are trying to predict fraud off of data elements that were fraud that occurred a year ago, whereas a model updated monthly or on every transaction is looking at more recent patterns.

• How often is the data updated and verified by the vendor?

• What types of fraud prevention techniques does the vendor use (e.g., heuristics, neural nets, shared velocities)?

• What other components does the service provider include as part of their screening service (e.g., delivery address verification, reverse lookups, geolocation, device identification, freight forwarder checks)?

• Do they offer any guarantee on chargebacks or provide any risk sharing?

• Do they offer a pass/fail-only solution or one that provides a true score and range?

• Does the fraud-scoring service support e-commerce and mobile channel? Remember to look at the data elements they use to confirm what the focus of the service is. A service designed to predict e-commerce fraud may omit mobile-specific signals that could be useful

• For merchants that do a lot of volume, this solution can get very expensive. Be sure to negotiate volume discounts.

• What case studies can they give to show how effective the solution was for other merchants, specifically those in the same or similar industry?

• Be leery of any scoring service that guarantees less than .5% fraud without explaining what the effect will be on sales conversion.

• One direct measure of the depth of a fraud-screening service is the number of descriptors it can relate back to help you understand why it scored the way it did. These are codes that tell you more about why it scored they way it did (e.g. can’t verify address, geolocation inconsistency with country, high velocity of use, currently on a negative list). These are also helpful for agents who manually review a scored order.

• Does the service provide tools for the fraud-review team to do manual reviews?

• Can a merchant tune or change the service to meet their unique needs?

• Can the vendor tell you what to expect as far as insult rates (as it relates to certain thresholds)?

HOW DOES IT WORK?

First a merchant must understand that they can either use an external service for model-based fraud scoring or they can build their own fraud scoring engine. In general, you will send an order to a fraud scoring service, which will provide all of the data elements of the order. Typically the merchant will have performed an authorization prior to making this call, so they can provide information such as address verification results and the card security results to the service. These services are typically set up to process orders in a real-time environment, but this does not mean a merchant can’t use them in a batch mode. The service typically takes a matter of seconds to evaluate an order to determine the level of risk associated with it. Once a fraud-scoring service is done, it will provide one of several data points back to the merchant. Make sure to check what the service provider will return, such as a pass or fail result, a numeric score and/or multiple descriptors that influence the score.

So now that you understand what you will see, what is the model-based fraud scoring service doing with their order? When you call a fraud scoring service it runs a series of data integrity checks on the data you provided to look for things that are unusual or are blatantly fraudulent. Examples of this could be nonsensical input such as: Name: IUYIOUYIY, or it could be that “Mickey Mouse” is trying to buy something. The service can then look at the data elements (such as name, address, phone, e-mail) to see if there are any matches to internal fraud lists. It would then check for issues with velocity of use and change. The service may then look at things such as geolocation, address and phone verification, and combine these in a model to see how well this order compares to previous good and bad orders. The service then correlates this into a score or a pass/fail response. This is only an example. Each service is unique, and most vendors will not share the exact methods they use, as this is their “secret sauce.”

HOW DO YOU USE THE RESULTS?

Selecting a fraud-screening service depends on a merchant’s sales channels, mobile browser, mobile app, e-commerce or all of these. If a fraud screening service requires data elements from you, you should do everything you can to submit any and all of these data elements. The more data provided the more accurate a model-based fraud scoring system will be with predictions.

If an order fails authorization merchants don’t need to send it out for fraud scoring. This being said a merchant should perform their authorization check prior to full fraud screening.

These services may or may not provide a case management interface, and they provide no means to establish initial settings. Merchants have to base the original settings off of their own previous history with chargebacks. It typically makes sense to set a decline threshold and review range, with all orders under the bottom end of the review range being auto-accepted. Determing the appropriate thresholds and ranges, however, is merchant-specific.

Merchants can easily get bogged down in the details of the solution. I highly recommend that merchants have a fraud analyst from the vendor of choice or independent source to assist in completing the initial set up, going over best practices of using the fraud screening service. This can save a merchant a lot of time and money in implementing their solution.