Fraud impacts every business in a unique way. Custom rules allow you to automatically set a disposition for your minFraud transactions based on knowledge and experience about fraud patterns that affect your business. When you identify a pattern in fraud affecting your business, you can use custom rules to capture all transactions that match this pattern and apply a disposition flag of "accept," "reject," or "manual review" to those transactions. There is also a flag for testing custom rules.
Read more below to learn about:
- disposition (accept, reject, manual review) flags, and how to use them, and
- how to develop custom rules specific to your business needs by
Use dispositions
The disposition flag will be returned along with risk scores and risk data when you submit a transaction to one of the minFraud services. A common use for these flags is:
| Disposition Flag | Common Use |
|---|---|
| accept | Set this flag when a transaction should be automatically approved by your system. You should be confident that these transactions aren't fraudulent. |
| reject | Set this flag when a transaction should be automatically rejected by your system. You should be relatively confident that these transactions are fraudulent. |
| manual review | Set this flag when a transaction should be reviewed by a fraud prevention specialist. Your system could bring these transactions into a queue in your system, or it could email your team to alert them to review the transaction through the account portal. Learn more about reviewing transactions using the account portal. |
| test | Set this flag when you are testing a new custom rule and you don't want to trigger actions in your system that use the other flags. |
Your developer team can use this flag to automate a response based on the disposition. You can read the full API specification for the disposition outputs on our Developers Portal.
This disposition flag will also be recorded in the log of your minFraud transactions accessible through your account portal. Learn more about reviewing transactions using the account portal.
Develop custom rules specific to your business
Once you understand dispositions and how you will integrate them into your existing workflows, you can get started with custom rules by following four steps:
- identify fraud patterns for your business
- design your rules to address the situation
- implement your rules through your account portal
- use and monitor your rules
Step 1: Identify fraud patterns
As you monitor your transactions for fraud, take note of emerging or recurrent patterns.
| Example |
|---|
| Your fraud prevention team notices a surge in chargebacks. On further investigation, you find that all of the problematic transactions come from IP addresses located in Germany, while the billing addresses are all consistently located in the United States. You also notice that you still have a lot of good transactions coming from Germany, and all of the good transaction have an overall risk score less than 20 and an IP risk score less than 5. Some of these good transactions have billing addresses outside of Germany, including the United States. You suspect that a fraudster located in Germany is using stolen credit information, but that you have legitimate customers traveling in Germany and buying your products as well. |
Step 2: Design your rules
Once you have established a pattern in your fraud analysis, design your custom rules to set dispositions on your minFraud transactions accordingly. It’s critical to design rules carefully before implementing them, as we limit customers to 150 active custom rules at a time. Custom rules also interact with one another, and are required to be prioritized in order to resolve potential conflicts.
| Example |
|---|
| You know that you will want to automatically reject some transactions that have their IP address in Germany, and the billing address in the United States, but other transactions are reliably good. You decide that you want one rule that will automatically reject transactions when their IP address is located in Germany and the billing address is located in the United States. You will also need another rule, that overrides the automatic rejection rule, to automatically accept transactions with IP addresses located in Germany when the overall risk score is less than 20 and the IP risk score is less than 5. To be safe, you will have a third rule that marks transactions with their IP address located in Germany as manual review when the overall risk score is between 20 and 30, or when the IP risk score is between 5 and 10, and when the billing address is not in Germany. |
Step 3: Implement your rules
With a clear plan in mind, choose a member of your fraud prevention team to manage your custom rules implementation through your account portal. This person will need to be made a user of your account with product/service permissions. Learn more about user permissions.
Make sure that you have a way to check the dispositions set by these rules in your workflow. You can do this by having your development team integrate the dispositions API into your system, or by assigning members of your fraud prevention team to review transactions through minFraud Interactive. If you plan to integrate dispositions with your own system, you can read the full API specification for dispositions on our Developers Portal. If you plan to use your account portal for manual review, you can learn more about how to filter the log of minFraud transactions in your account portal.
For step-by-step instructions on creating and managing your custom rules, you can start with our article on creating custom rules.
Step 4: Use and maintain your rules
Custom rules are only as stable as your fraud patterns. Some rules may be kept indefinitely, while others may address a temporary problem. Regularly review your rules to ensure that they reflect the fraud patterns that are relevant to your business. You can also use the test disposition to experiment with new custom rules without impacting your normal workflow.
| Example |
|---|
| After a month of automatically rejecting the problematic transactions, you stop receiving transactions with IP addresses located in Germany, billing addresses located in the United States, and higher IP risk scores. Your fraud prevention team believes that the fraudster has been discouraged and moved on. You also notice that a few legitimate transactions have been caught by this rule since then. You decide that you want to recreate the rule that captures transactions with an IP address in Germany, a billing address outside that country, and higher risk scores, but mark these transactions for manual review rather than automatic rejection. You decide that you can keep the rule that automatically accepts these transactions when the risk scores are low enough. |
This page was last updated on .