BEHAVIORAL MONITORING

BEHAVIORAL MONITORING TECHNIQUE OVERVIEW

Behavioral Monitoring helps detect and prevent fraud by recognizing anomalous and risky behavioral patterns of users on a website. All web traffic and activity is monitored and typical or normal behavior is defined. Users displaying high risk behavioral patterns, or those not consistent with what is considered good or normal for that site, are flagged.

Key considerations when implementing or buying this functionality include:

• At what points are user behaviors tracked? Behavior should be tracked pre-login, post-login, during site navigation/product browsing and through every stage of the order and purchase process.

• Will the service recognize negative behavior on a large scale, such as with DDoS attacks?

• Does the service only look for anomalous behavior or can it also look for/profile specific behaviors associated with fraud or high risk?

• How often does the service update user behavior records and what is considered ‘normal’ behavior for a particular business or site?

• Does the service only analyze normal behavior based on the entire pool of good users, or can it also profile normal behavior down to the individual user level?

HOW DOES IT WORK?

By monitoring web traffic, how users navigate through a website and other behavioral characteristics high risk and fraudulent activity can be detected and stopped. The system may flag orders or users that displayed behavior different from what is normal or expected, it may identify specific behavioral patterns that are associated with high risk, or the service may do both.

By tracking the behavior of good users the system analyzes what behaviors are normal and identifies user behavior that is anomalous or outside of this norm. The system may also look for particular behavioral patterns that are associated with fraud or high risk activity. For example, a typical customer may go to a merchant’s home page, click on a product category like Electronics, click on a sub-category like Tablets, and then browse through the items they may want to purchase. Whereas the typical behavior of a fraudster may be to go directly to the page where they can buy an iPad, and Behavioral Monitoring will recognize and flag this transaction as displaying high risk behavior.

Behavioral Monitoring services designed for online banking and financial institutions go a step further. They will also track the behavior of individual users, and when these users login to access services their current behavior is analyzed against their typical behavior based on past logins and activity. This is important in recognizing account takeover as a compromised account may begin displaying behavior that is very different than the typical behavior of the true account holder. When 

Behavioral Monitoring services can analyze and compare behavior on the individual user level, as opposed to comparing one user’s behavior to what is considered normal site behavior based on the entire user base, it is able to detect account takeover and prevent or contain losses.

HOW DO YOU USE THE RESULTS?

When anomalous or high risk behavior is detected the business will receive notification. In the event of a DDoS attack or negative behavior site-wide or on a large scale the provider will send a notification so the business can respond immediately. When it comes to flagging individual users or orders for risky behavior there are a few different ways merchants can use these results.

Depending on the software or service used, the results from Behavioral Monitoring may be incorporated with building and executing rules. When the service recognizes unusual or high risk behavior from a user or group of users it may offer the ability for the merchant to build rules around these users to prevent or contain losses. The merchant may put automatic breakers in place, for example when a user or transaction is flagged for odd or risky behavior this can trigger certain rules or affect the orders overall weighted risk score. In more advanced applications a Behavioral Monitoring provider may offer an interface where the Fraud Manager can view the behavior of flagged users in real-time while creating and applying new rules to these specific groups of users.

A merchant may also set automated rules or outcomes based on Behavioral Monitoring signals. For example, a merchant may choose to manually review any order where the user’s behavior was considered atypical, or they may decline all orders where the service recognized the user as displaying known high risk behavior.