Identifying illegitimate activity.
WHAT THEY MUST BALANCE
Catching fraud Not rejecting legitimate customers
WHY THAT BALANCE IS DIFFICULT
Fraud is rare, so even a small false positive rate rejects many legitimate transactions.
WHAT THAT MEANS
A system rejecting one per cent of legitimate customers may reject more people than fraudsters.
WHAT SIGNALS ARE USED
Transaction characteristics: amount, timing, frequency
Device and connection characteristics Behavioural patterns Historical relationships
Velocity: how quickly things are happening
WHAT VELOCITY CHECKS CATCH
Many attempts in a short period, which is characteristic of automated abuse.
WHAT RULES PROVIDE
Explicit, explainable decisions.
WHAT MODELS PROVIDE
Detection of patterns nobody specified.
WHAT MOST SYSTEMS USE
Both, with rules for known patterns and models for the rest.
WHAT TO ALWAYS PROVIDE
A review path for rejected legitimate customers.
WHY
Otherwise you lose them permanently, and they tell others.
WHAT TO MEASURE
False positive rate, explicitly and continuously.
WHAT ADVERSARIAL MEANS HERE
Fraudsters adapt to your defences.
WHAT THAT REQUIRES
Continuous updating, and not disclosing exactly what triggers rejection.
