Indicators

To assess risk, the extension uses a set of built-in predefined indicators designed to detect the most common types of fraud. A detailed report for each indicator is available in the Fraud risk score tab on the order edit page.

Order with Fraud risk score indicators

In the screenshot, the High-Risk Countries indicator at the top of the checklist was added via a fraud detection rule. It has high priority and can even mark the order as Fraud if the specified conditions are met. Other indicators described below.

Built-in fraud indicators

All of these indicators have their own importance (e.g., whether they can be reliably used for fraud detection). Our extension comes with well-balanced default weights for each of them, but you can adjust these values to fit your specific needs.

Here is a short description of each indicator:

• Social network check: although untitled, this check is displayed first, above fraud checklist section. It included links to social media that possibly belong to the customer:

  • Facebook: a personal Facebook profile.
  • Twitter: a Twitter feed.
  • Linkedin: a Linkedin page.
  note

  The extension does not retrieve social media profiles using the customer’s email or contact details. Instead, it attempts to predict possible profile links by combining the customer’s first and last name in various ways. Since many users choose social media usernames based on their real names, these guesses are often accurate.

• Shipping and billing addresses: this check compares shipping and billing addresses, and they need to match in order to pass this check.

• Customer location: this check compares country included in addresses with the country, as defined by IP address, from which order was placed. They need to match to pass this check.

• Order amount: this check measures the average order total by the store, and compares it to the current order's total. If the amount is too small or too large, the check fails.

  note

  This indicator is likely to fail when your store's community is only just forming, or in the case of a sales event. We recommend that you give this check low importance (by default, it is 3).

• Phone number: this check analyzes phone numbers and searches for combinations that can expose them as false - repetitive patterns, the same digits, unusual length, etc.

  note

  This indicator is also likely to fail since phone numbers can be very different. By default, its importance is 1, e. q. very low.

• Customer email: this check analyzes risky patterns in emails. To pass this check, the email should not contain sections of the customer name or blacklisted words, such as example.

  note

  Our extension has a very restricted built-in blacklist, so we recommend having this indicator on a low-profile, and instead create a custom blacklist with a Rule. We have a good example of it to follow.

• Customer history: this check is merely informational. It contains short statistics of customer sales.

  • Quantity of Completed Orders: orders that were fully satisfied.
  • Quantity of Refunded Orders: refund numbers.
  • Quantity of Cancelled Orders: orders that were canceled.
    note

    If the customer has not placed an order yet, there will be the following notification Customer has not placed orders before.

• IP History: it is basically the same check as above, but with IP filter. To pass this check, the customer needs to have most of the orders placed from the same IP.

• Distance: is a geo-based check that measures the distance between the actual customer location (calculated from IP) and the location of the billing and shipping address. To pass this check, they need to match.

• Location: this check is untitled since it acts as an addition to the previous one, and visually highlights the actual customer location.