Risk management

The process of financial fraud prevention can be characterised as follows.

First of all, this process is multilayered. It involves different stakeholders—merchants, providers, payment systems, and issuers, and each of them is responsible for fraud prevention at their level in respect to the payments they handle. It also involves different tools some of which can be commonly used by several parties (for example, 3‑D Secure authentication) while others can be distinctly specific to each party (for example, whitelists and blacklists). Utilising these tools consistently ensures multiple-step filtering of operations and achieving efficiency of the overall performance.

Secondly, this process implies that two-way communication predicated on feedback is expected between all stakeholders. Thus, if a certain operation is established to be fraudulent after it has been processed and finalised, this information is brought to the attention of all parties involved and allows modifying the countermeasures intended to prevent similar operations at different levels.

Thirdly, at each of these levels the process can be presented as an iterative cycle with four steps—setup, monitoring, response, and analysis.

The process of financial fraud prevention is multilayered as it involves different stakeholders—merchants, providers, payment systems, and issuers. Each of them is responsible for fraud prevention both at their level in respect to the payments they handle and together with all parties involved. At each of these levels the process can be presented as an iterative cycle with four steps—setup, monitoring, response, and analysis.

Thus, financial fraud prevention can be presented a system of interlinked actions which repeat cyclically at different levels.

Main steps of this process—setup, monitoring, response, and analysis—are described in the sections that follow with the focus on the aspects that can be useful and relevant for merchants.

Before operations are processed in the ecommpay payment platform, they need to be validated. During the validation process, the parameters of each operation are checked against the predefined rules, and the operation is automatically deemed one of the following:

Before operations are processed in the ecommpay payment platform, they need to be validated. Following the validation check, the operation is automatically deemed one of the following:

• Fraudulent—if any parameter of the operation is blacklisted or the risk of executing this operation (based on all its parameters) is considered high. In this case, the operation is declined, and the ecommpay payment platform sends the web service a final callback with the operation status decline and the error code (the comprehensive list of such error codes and their description is available in the section RCS codes).
• Suspicious—if it is not possible to reach a definitive conclusion regarding the risks associated with the execution of the operation after the predefined algorithms were used, and additional evaluation is required. In this case, the operation is processed while the ecommpay specialists additionally review the operation and decide whether it is trustworthy or fraudulent. Then, if necessary, they report their findings to the merchant's employees for further assessment. Following the review by the specialists, different measures can be taken which includes issuing a refund and updating the blacklist.
• Suspicious—if it is not possible to reach a definitive conclusion regarding the risks associated with the execution of the operation after the predefined algorithms were used. In this case, the operation is processed while the ecommpay specialists additionally review the operation. Then, if necessary, they report their findings to the merchant's employees for further assessment.
• Trustworthy—if any parameter of the operation is whitelisted or the risk of executing this operation (based on all its parameters) is considered low. In this case, the operation is executed.

Risk monitoring does not stop after risks have been initially assessed by the merchant and ecommpay: if ecommpay approved an operation, it does not exclude the possibility this operation is going to be flagged by other parties involved in payment processing. Likewise, the approval of the operation by all parties involved does not exclude the possibility of detecting fraud retrospectively. In such cases, the information about the fraud attempts and cases detected by other parties is reported to ecommpay, and then, by the ecommpay specialists to the merchant's employees. In addition, the merchant can monitor the execution of operations and learn about declined or fraudulent operations using Dashboard or via email (more details below), and in any unusual situation should contact the ecommpay risk management team.

The operation that has passed the validation check in the payment platform can still be flagged as suspicious or fraudulent by other parties. In such cases, the information about the fraud attempts and cases is reported to ecommpay, and then, by the ecommpay specialists to the merchant's employees. In addition, the merchant can monitor the execution of operations and learn about declined or fraudulent operations using Dashboard or via email (more details below).

The merchant's response is based on the assessment of the risks associated with the operation execution and whether the operation is deemed fraudulent after it has been processed and finalised. If the response is efficient, it can significantly impact the success rates of fraud prevention and doing business as a whole.

Cases when the merchant's response is needed include the following:

• The operation is rejected as fraud by ecommpay. In this case, reviewing the reason of rejection (by examining the callback or using Dashboard) is recommended. If necessary, the following response is due:
  • Update the blacklist—if the operation is definitely fraudulent and it is possible to identify a condition for blocking similar operations in the future (for example, a phone number of the customer).
  • Update the whitelist—if it is certain that the operation is trustworthy, albeit characterised by the unusual behaviour of the customer, and it is possible to identify a condition for confirming reliability of similar operations in the future.
  • Contact the ecommpay specialists—if there are any questions regarding the operation processing.
  • Initiate the operation again—if it is applicable to the given user scenario and (following the update of the whitelist or the approval by the ecommpay specialists) it is clear that the rejection of the operation is not going to be repeated.
• The operation is flagged as suspicious by ecommpay. In this case, analysing the reason and the nature of suspicions is recommended. If necessary, contact the customer for clarification as well as the ecommpay specialists—to coordinate the required course of action following which necessary measures should be taken. This may involve issuing refunds and updating whitelists and blacklists.
• The operation has been approved by ecommpay, but is flagged as fraudulent by the other party. In this case, reviewing the reason of rejection (by using Dashboard or by contacting the ecommpay specialists) is recommended. If necessary, the following response is due:
  • Update the blacklist—if the operation is definitely fraudulent and it is possible to identify a condition for blocking similar operations in the future.
  • Initiate the operation again with the updated or expanded list of parameters—if the reason of rejection does not prevent a retry and it is certain that the operation is trustworthy, and it was declined due to incorrect or incomplete data.
• The operation has been processed and finalised, but is deemed fraudulent retrospectively. In this case, revising criteria which were used to flag the operation (by using Dashboard or by contacting ecommpay support specialists) is recommended. If necessary, the blacklist should be updated and the customer affected by fraud should be compensated.

In any unusual case, contact the ecommpay risk management team.

To ensure efficient payment processing—with high levels of conversion rates and fraud prevention, merchants should analyse the overall performance on a regular basis. It includes evaluating the ratio of correct and incorrect payment rejections, identifying additional criteria for whitelists and blacklists, determining whether ecommpay should introduce changes to the procedures of customer authentication and operation validation rules, and so on. All aspects of fraud prevention require constant scrutiny, not in the least because fraud patterns in e-commerce continue to develop as perpetrators attempt to circumvent current countermeasures.

To ensure efficient payment processing, merchants should analyse the overall performance on a regular basis: evaluate the ratio of correct and incorrect payment rejections, identify additional criteria for whitelists and blacklists, make sure operations validation rules of ecommpay are updated, and so on.

To learn more about analysing risk management efficiency, contact your account manager.

The payment platform allows you to monitor information about attempts and cases of fraud detected by ecommpay and payment systems. You can use the tools of the Dashboard interface and the option of receiving automated emails.

You can monitor information about operations flagged as fraudulent by payment systems not only with the use of different Dashboard tools but also by receiving automated emails sent to the email address associated with the Dashboard user account. Emails with notifications are sent out at 14:00 UTC+0 if the platform receives any new information about detected fraud. By default, the option to receive these emails is enabled for all user accounts. You can disable this option on your own by going to the My profile section, or an employee with the Merchant admin role can do it for you in the My team section.

To disable the option to receive automated emails on your own:

1. Open the user profile.

   Click the user name or the user account icon in the top right corner and select My profile in the dropdown menu.

2. Disable the Receive emails about fraudulent transactions option.

   Switch to the editing mode by clicking on the User Profile panel, turn off the toggle switch and save changes by clicking Save on the upper-right side of the User Profile panel.

3. Make sure all changes have been saved.

   The option should be disabled.

When operations are validated, their parameters are checked in the platform against various rules, including whitelists and blacklists. These lists can be common for all merchants or specific to an individual project of the merchant.

• Whitelist is a list of criteria matching any of which indicates that an operation is trustworthy.
• Blacklist is a list of criteria matching any of which flags an operation as fraudulent.

The following considerations are applied when assessing the risks of processing specific operations:

1. If at least one of the operation parameters is blacklisted and the blacklist category is Customer ID, Account number, or E-mail, then the blacklist takes precedence over the whitelist and the operation is flagged as fraudulent.
2. If the condition described above does not apply, but the operation has parameters that are found in the IP and BIN lists (one parameter can be blacklisted, the other can be whitelisted, in either combination), then the whitelist has higher priority and the operation is deemed trustworthy.
3. If the operation is deemed untrustworthy following the AML (Anti-Money Laundering; matching the person included in the sanctions list) and Compliance (matching the country in the prohibited country list) checks, it is declined even if some of the operation parameters are whitelisted.

Dashboard allows you to manage criteria of whitelists and blacklists applicable both to your specific projects and to all of your projects. The Risks section includes the B/W list subsection that allows you to do the following:

The Risks section of Dashboard includes the B/W list subsection that allows you to:

• View the list of criteria, using filters, using search and filtering, if necessary.
• Add new criteria, one by one or in bulk.
• Delete criteria, one by one only.

You can search for criteria of whitelists and blacklists using filters on the upper panel, which includes the possibility to enter multiple values of one category (for example, customer_id) separating them by a comma or a space.

Adding risk assessment criteria to whitelists and blacklists is also possible using payment information tabs. This capability is supported for all operations: there are no restrictions on payment types or payment methods, or whether the operation has to be flagged as fraudulent by a payment system or not.

Capability of managing risk assessment criteria can only be accessed with a separate permissions set which, by default, is granted to user accounts with the Risks and Merchant Admin roles.

Figure: Whitelists and blacklists register

In the payment information tabs, you can add criteria to whitelists and blacklists for individual operations initiated within payments without any restrictions. This is convenient when individual cases of fraud are reviewed, and it allows you to respond quickly. To add criteria:

1. Locate the payment within which the target operation was initiated. The target operation is the one whose parameter values should be whitelisted (blacklisted).

   Use Search (learn more) or filters in the registers in the Payments and Risks sections.

2. Open the payment information tab by clicking the row in the register of the selected section.
3. Add criteria to the whitelist (blacklist) by doing the following:
   1. Click the Add to list button on the right of the Manage operation panel.
   2. Select in the window that opens the type of the list (whitelist or blacklist), categories available for this operation (for the criteria you need to whitelist or blacklist) and identifiers of projects (to which these changes will apply). If necessary, you add a comment: it will be the same for all added criteria.
      Note: In certain cases, the Add to list window may display categories that were not used for performing the target operation. For example, the email category can be shown as available, even if the request to perform the operation in question did not contain such a parameter. If this is the case, then nothing is added to the whitelist or blacklist when you attempt whitelisting or blacklisting a criterion.
   3. Confirm adding criteria to the whitelist (blacklist) by clicking Apply.
      
      
4. Make sure that the criteria have been added to the whitelist (blacklist).

   Check the register with the list of criteria in the B/W List subsection.

1. Locate the payment within which the target operation was initiated in the Payments and Risks sections.
2. Click Add to list on the panel with information about an individual debiting operation performed as part of the purchase.
3. In the window that opens, add the required criteria to the whitelist (blacklist) and confirm the request by clicking .
4. Make sure that the criteria have been added to the whitelist (blacklist) by checking the register with the list of criteria in the B/W List subsection.

In the Risks section, you can add various criteria to whitelists and blacklists using the form in the B/W List subsection. This is convenient when different cases of fraud are reviewed and analysed for determining additional criteria of risk assessment, for example, when the need to update whitelists or blacklists does not stem from processing specific operations. To add criteria:

1. Open the form.

   Go to the B/W List subsection of the Risks section, click the Manage button on the left of the filter panel (if the button does not show, click the () button on the right of the filter panel).

2. Add the criteria.

   Select the list you need (whitelist and blacklist), specify the required criteria in the target fields, and click Apply.

   If any of the fields is filled incorrectly, the corresponding error message is shown. Correct the errors (or do not complete these fields) and click Apply again.

3. Make sure that the criteria have been added.

   A notification that the adding request was sent successfully should be shown. You can also verify that the criteria have been added to the criteria list in the B/W List subsection.

1. Open the form for adding criteria individually by clicking the Manage button in the B/W List subsection.
2. Specify the criteria to be added to the whitelist (blacklist) and click Apply.
3. Make sure that the criteria have been added: a notification that the request was sent successfully should be shown. You can also verify that the criteria have been added to the criteria list in the B/W List subsection.

Figure: Adding criteria to the blacklist

You can delete criteria included in the whitelists and blacklists in the Risks section. Keep in mind that they should be deleted one by one.

1. To go to the Criteria subsection, click the B/W Lists button in the Risks section.
2. Find the record you need using filters if necessary.
3. To delete the record, click the button in the corresponding line.
4. Make sure that the record has been deleted from the list.