Expert Ed Tittel explores the purpose of Web fraud detection systems and services, which are designed to reduce the risks inherent in electronic payments and e-commerce.
Each U.S. consumer has, on average, at least one credit card and two bank cards that are used to make in-person and online purchases, pay bills and send money to others. Collectively, U.S. consumers make billions of noncash transactions every year, which are prime targets of cybercriminals looking to walk away with as much of that money as they can.
Although the rate of cybercrime and attempted fraud increases each year, the portion of lost e-commerce revenue by North American merchants is just under 1%, according to the 2014 CyberSource Online Fraud Report, and that number has remained fairly static since 2010. Experts point to the efficient management of Web fraud as the key reason. Even so, payment fraud is a great concern to consumers, and merchants and financial institutions take the hit for most of the money lost as a result of fraud in the form of refunds and chargebacks.
What is Web fraud detection?
Organizations that accept payment cards over the Web -- also referred to as "card not present (CNP)" transactions -- or organizations that back those payments, will deploy Web fraud detection software or services to detect and help prevent fraud.
Web fraud detection systems typically focus on new account origination, account takeover and payment fraud. With account takeover and new account origination fraud detection, organizations attempt to root out unauthorized or fraudulent users posing as legitimate users. Payment fraud detection involves determining whether purchases are being or have been made with stolen payment cards. Some vendors also offer fraud intelligence services, authentication, malware detection (such as man-in-the-browser infections on computers and mobile devices) and secure clients, as well as managed services in which the vendor is primarily responsible for monitoring and taking action on instances of fraud.
Web fraud detection system vendors generally provide either an on-premises software product or platform, or cloud-based software as a service (SaaS) that scans financial transactions made via the Web or by using mobile devices.
How does a Web fraud detection system work?
Web fraud detection software (or cloud-based service) runs background processes that scan transactions and score them based on the possibility of fraud. Many different data points are considered to determine the score, such as user behavior, device ID, other device characteristics, geolocation, order links and so on. The data is then compared against "normal" attributes. If the transaction is deemed valid, it's allowed and processed. If the transaction falls outside of an accepted range, an alert is issued and the transaction may be automatically suspended or denied.
Web fraud detection systems and services ... greatly reduce a merchant's or financial institution's risk and provide a high level of protection to consumers.
To detect fraud, vendors typically use a predictive behavioral scoring model, in which an account holder's behavior is the predominant criteria, or a rule-based system that uses pattern recognition. Some products or services use both types of scoring models.
Even with automated systems available, organizations still need to manually analyze certain transactions, such as those that an automated tool flags as fraudulent.
Who needs Web fraud detection services?
Organizations of all sizes (SMBs to enterprises) that deal with any volume of CNP transactions, that are too burdensome or time-intensive to review manually, should have some type of fraud detection in place. Types of customers include banking and financial services institutions, e-commerce merchants, human resources and payroll services, and social networking sites -- just to name a few. Plus, Web fraud detection services help organizations meet Payment Card Industry Data Security Standard requirements.
How is Web fraud detection sold?
SaaS offerings are the most straight-forward approach to Web fraud detection. A customer simply signs up for a service and agrees to pay a monthly fee based on the number of anticipated transactions or a similar metric. The customer can scale the fraud detection service up or down as its needs change.
On-premises software requires an upfront cost for the software, and any hardware and infrastructure upgrades required to support the software. Companies that lack a full-time security support team (which are most often small to midsize) may need to pay the vendor for initial setup just to get the software up and running properly, and may need minimal staff training.
Managing and supporting Web fraud detection
Web fraud detection management and support varies depending on how it's implemented.
SaaS-based Web fraud detection is hosted by a service provider; customers access the service through a configuration interface to customize settings and perform typical administrative tasks.
On-premises Web fraud detection systems require more administrative effort for installation and maintenance of the server on which the software runs, the software itself, and the customer's network infrastructure.
Moving on
Web fraud detection systems and services can't detect every instance of fraud, but they greatly reduce a merchant's or financial institution's risk and provide a high level of protection to consumers.
Next Steps
In the next part of this Buying Decisions series, learn four enterprise use cases for Web fraud detection systems.
Here's how to detect fraudulent certificates that look real.
How merchants can stop card-not-present scams and keep customers happy.
