When it comes to fraud, most solutions focus on the illegal or deceptive transfer of money. They have this narrow view because they can’t do anything else – they can only capture data from the time a user logs in. But fraud doesn’t start when an account is opened, or money is transferred, or even when the user (real or fake) logs in. It starts way before that, and so do the behaviors that indicate fraud. This creates a huge opportunity in fraud prevention, because when you identify fraud before it happens you change the game: reduced fraud losses, less friction for legitimate customers, increased efficiency, and more time to focus on revenue producers instead of revenue detractors.
From scams to ATO to bot detection, every facet of fraud detection is enhanced with comprehensive understanding of visitor and customer journeys – and to build those journeys you must start capturing data from an unknown state.
Understand the whole journey to detect fraud in real time
Fraud can be detected long before any transaction takes place by building a comprehensive identity profile of every visitor and their interactions with your site or app. Imagine someone visiting a banking website for the first time. A legitimate user will likely browse around slowly, clicking on various menus and options, maybe trying out a mortgage calculator or reading some interesting articles. They may do some account comparisons or look up interest rates. And they’ll likely do this several times going forward – on different days, different devices, and possibly in different locations. A fraudster on the other hand may browse a page or two, but then they’re going to head straight for their target – like opening a new account. This goes for a “real” fraudster as well as a bot. And during all this activity, every interaction, mouse movement, page visit, and pause will provide insight into whether they’re a legitimate user or a fraudster. Add in behavioral biometrics and you’ve got a goldmine of signals to use in real-time fraud prevention.
What about existing customers? It’s the same story but with even more data and the opportunity to compare “me vs. me” by matching behaviors in the current session to the customer’s robust Identity (ID) Graph. When a customer visits your online site or mobile app, their behaviors can be compared with their existing profile in real time, continually assessing the risk to determine if the user is an imposter, or a scam is in progress. While deviations are to be expected from day to day, an individual’s behavioral biometrics will remain consistent overall. So, when a customer suddenly behaves differently, accessing new features or pages, navigating the site with hesitation, or being on the phone while accessing their online banking profile – it’s an instant red flag. This is why capturing data BEFORE login is critical.
Leverage ID Graphs to capture from unknown state
A comprehensive ID Graph looks for behavioral differences throughout the entire visit and journey, not just from login to logoff. For example, a fraudster (or bot) may have long pauses between actions while they’re looking up information or credentials they’ll need to commit the fraud. They may also copy and paste data, hesitate on 2FA, or type too precisely (most humans are going to have a typo here and there). If your fraud detection solution doesn’t start capturing data until login, you’ll never see these indicators and may allow fraud that could have been prevented.
Before the fraud: What to look for
To prevent fraud in real time your ID Graph should be capturing, contextualizing, and analyzing all data as it’s captured to inform your decisioning and intervention strategy. There are many data points that should inform your identity profiles, for both known and unknown visitors: A sophisticated, real-time fraud prevention solution will:
- Record different login times and locations
- Capture behavior: why is Jo applying for multiple loans, checking addresses, copy/pasting, etc.
- Compare behavior over time: One random anomaly in a session may be nothing, but if it there are several deviations, that’s a collection of signals that should alert the system (based on rules you’ve set)
- Detect anomalies in real time
- Employ advanced bot detection
- Track behavior from first action: This goes beyond transactional monitoring – fraud detection can’t wait until sign in or transaction
- Leverage behavioral biometrics to compare “me vs. me” and detect known fraud behavior
- Use sense and trace to identify and track mule accounts
- Compile robust identity profiles for anonymous, known, and authenticated users
And don’t forget about opportunistic fraudsters and scam victims – a transactional fraud monitoring system won’t catch Jeni vs. Jeni. You need a comprehensive ID Graph that incorporates behavioral biometrics to detect legitimate users who are acting fraudulently or under duress, such as a scam victim. For these types of fraud you must compare behavior over time, and track all interactions and behavior from the first action. If you wait until the visitor logs in or initiates a transaction, you’re already behind.
