WL SIPS DOCS

An antifraud rule verifies one of the transaction's criteria. The criterion verified can be the card issuer country, cap collar amounts, card number, IP address, customer ID, etc. Rules are classified into categories: geolocation, velocity, list, basket and miscellaneous.

To be executed, rules must be configured in an antifraud profile. Please refer to the 'Antifraud profile definition' section to know how to define such a profile.

Some rules do not have necessarily a positive or negative nature (for example geolocation rules: you may want to favour some countries or unfavour others) whereas some others do have necessarily a positive nature (whitelists) or a negative nature (blacklists).

By default, the proposed rules are configurable in simple configuration mode, in which a rule is defined as being positive or negative.

Nevertheless, some rules have an advanced configuration mode. In this mode, the same rule can be both positive and negative. The rule will have a positive, negative or neutral influence on the result of the transaction check depending on the rule setting and the transaction context.

The choice to activate the advanced configuration mode is done during the rule configuration in the profile. It is possible to activate this mode only for certain rules and to let the simple configuration mode for the others.

Rule advanced settings allow specifying the criteria that will have a positive or negative influence on the result.

Example with the cap collar amount rule configured as decisive:

Example with the 3-D Secure authentication rule configured as decisive:

In pre-authorisation mode (default mode of the Worldline Sips fraud risk management tool), rules are executed prior to the authorisation request and following the 3-D Secure authentication (if the webshop is 3-D Secure enrolled). If the checking result is negative, the transaction will be declined prior to the authorisation request.

For means of payment with a redirection to a specific page for the related means of payment (Paypal for example), the pre-authorisation checking is trigerred prior to the redirection.

Depending on your needs, you define your pre-authorisation profile(s) by combining:

• GO and/or NOGO rules
• decisive and/or informational rules

A profile is informational when all of its rules are informational.

A profile is decisive when all of its rules are decisive.

A profile is mixed when it includes both informational and decisive rules.

In pre-authentication mode, rules are executed prior to the 3-D Secure authentication. If the checking result is positive, the 3-D Secure authentication is bypassed and Worldline Sips carries on with the authorisation request.

This mode applies only to card transactions with 3-D Secure authentication.

Depending on your needs, you define your pre-authentication profile(s) by combining the GO and/or NOGO rules.

A profile is decisive when all of its rules are decisive.

Only decisive rules can be configured in a Go-No-Go profile for the pre-authentication step. Informative rules in such a profile are useless at this step.

An antifraud profile is a set of rules that you configure after choosing them from the rules made available by the distributor of the ePayment solution. Rules are executed prior to the 3-D Secure authentication and to the authorisation request according to your configuration (to understand the pre-authentication and pre-authorisation modes, please refer to the execution modes and their consequences on acceptance).

There are three types of antifraud profiles:

• the distributor's "offering" profile
• profile templates
• merchant profiles

A distributor's "offering" profile is defined by the distributor and administered by Worldline. It defines the scope of the available rules and of the configurations that may be mandatory. If an webshop has no suitable profile for the means of payment used, then the distributor’s offering profile is used.

Profile templates are defined and administered by the distributor. They are used as templates for creating merchant profiles.

Merchant profiles are defined by you for your webshop and are administered by you and/or the distributor (depending on the distributor's choice). They can be created from profile templates. The terms "webshop profile" may be used in this document. They are equivalent to the merchant profile.

Throughout this document, the notion of "profile" will refer to merchant profiles.

Antifraud profiles are set up through the fraud GUI of your extranet.

In most cases, you define a single antifraud profile that is applied to all transactions regardless of the means of payment used. However, you can also define additional profiles the settings of which suit one or more specific means of payment.

When a transaction must be evaluated, the risk management system first searches the webshop configuration for an antifraud profile specific to the means of payment used.

If no such profile is found, the system looks for the webshop default profile. This profile makes it possible to analyse the transactions that were not processed by the profiles specific to the means of payment.

To create a default profile, simply create a profile without associating any means of payment with it.

Only one profile can be active for a given means of payment. Likewise, only one default profile can be active.

For example, there can be:

• a dedicated profile for CB, VISA and MASTERCARD
• a dedicated profile for AMEX
• a default profile that will check the transactions for which other means of payment are used.

Which means three active profiles at the same time.

You can create as many inactive profiles as required. This allows, for example, to keep profiles in reserve for particular periods of the year (sales, holidays, etc.).

Illustration of the weight of the settings:

In Business Score mode, each active rule of the profile evaluates an aspect of the transaction and can produce a score.

The rule scores are then added up to produce an overall score (please refer to the calculation of the overall score subsection to know how it is calculated). This overall score is then compared to the orange and green thresholds set in the profile so a decision can be made as to the continuation of the transaction.

The overall score is comprised between two limits:

• the min bound, which is the value obtained if all negative rules and no positive rules are triggered (i.e. sum of negative rules' scores)
• the max bound, which is the value obtained if all positive rules and no negative rules are triggered (i.e. sum of positive rules' scores)

Therefore, when you define the profile, you must define the orange and green thresholds between the min and max bounds, which will delimit 3 possible ranges for scores. Each of these ranges is associated with a colour: green, orange and red (please refer to the execution modes (pre-authentication & pre-authorisation) and their consequences on acceptance for further details about colours and their effects on transactions):

• The orange threshold defines the limit between the orange area and red area. The value is included in the orange area.
• The green threshold defines the limit between the orange area and green area. The value is included in the green area.

In the following example, orange threshold -8 is included in the orange area, and green threshold -4 is included in the green area.

If both the orange and green thresholds have the same value, then there is no orange area.

In the following example, the orange threshold and the green one both have the same score of -6. Score -6 is included in the green area.

Example: an antifraud profile contains 3 rules:

• rule 1, negative rule, associated score -3
• rule 2, negative, associated score -2
• rule 3, positive rule, associated core +3

Therefore, you must set the orange and green thresholds between -5 (min bound) and +3 (max bound).

In this case:

• the orange threshold is -2
• the green threshold is +1
• the red area is between score -5 (included) and -3 (included)
• the orange area is between score -2 (included) and 0 (included)
• the green area is between score +1 (included) and +3 (included)

You can bypass certain rules of the profile dynamically in the transaction request. For a list of directives to be used to bypass rules, please refer to the following section: 'Appendix disabling some rules in the profile dynamically'.

You can override some rules of the profiles dynamically in the transaction request.

The methods for overriding rules dynamically are described in the 'Descriptions and implementation of rules' section.

The overall score is the sum of all rules' scores and determines the result of the antifraud checks.

For a given profile containing n individual checks:

• let Rk be the result of the individual check indexed by k in the profile:
  • 0 if not checked
  • 1 if checked
• let Pk be the weight associated with the individual check indexed by k:
  • 0 for neutral
  • 1 for low
  • 2 for medium
  • 3 for high
  • 4 for decisive
• let Tk be the nature of the individual check indexed by k:
  • +1 when positive
  • -1 when negative

The overall score (S) of the transaction verified with this profile will be obtained through the following formula:

The final result of the antifraud checks of the Business Score offering is represented by one of five colours.

Three colours represent the result obtained from the overall score:

• green: the overall score is higher than or equal to the profile's green threshold. The green result means that the transaction poses no risk.
• orange: the overall score is higher than or equal to the profile's orange threshold, and lower than the green threshold. The orange result means that the transaction poses an average risk.
• red: the overall score is lower than the profile's orange threshold. The red result means that the transaction poses a high risk.

Two colours represent a result that was obtained because a decisive rule was triggered:

• white: the condition of a positive rule set as decisive is met; the rule produced a positive result. The white result means that the transaction poses no risk.
• black: the condition of a negative rule set as decisive is met; the rule produced a negative result. The black result means that the transaction poses a high risk.

The result of the execution of the pre-authorisation profile is returned in the fields below:

• scoreColor, rule results represented in the form of a colour
• scoreValue, value of the overall score
• scoreProfile, antifraud profile executed
• preAuthorisationProfileValue, contains the unique identifier of the executed profile version. This information is useful to retrieve the profile in the same configuration as when the checks were performed
• scoreThreshold, thresholds set for this profile
• scoreInfo, breakdown of the executed rules
• preAuthorisationRuleResultList, a list of detailed results of each rule executed before the authorisation

Each object contained in the preAuthorisationRuleResultList field corresponds to a rule result and contains the following values:

• ruleCode, the rule code. For rule codes, please refer to the list of rules.
• ruleType, the rule type. For rule types, please refer to the list of rules.
• ruleWeight, the rule weight defined in the profile:
  • 0: neutral
  • 1: low importance
  • 2: medium importance
  • 3: high importance
  • 4: decisive
• ruleSetting, indicates the configuration type of the rule:
  • D: dynamic in the transaction
  • S: static in the merchant profile
  • I: static and imposed by the distributor offer
  • N: no configuration (when the rule cannot be configured)
• ruleResultIndicator, the execution result of the rule:
  • N: negative result
  • P: positive result
  • O: neutral result
  • U: rule not executed due to an incomplete transaction (e.g. data not filled in)
  • X: rule not applicable to this kind of transaction
  • B: rule not executed because bypassed by the merchant
  • E: rule not executed due to a technical error
  • D: rule not executed due to a dynamic override error
• ruleDetailedInfo, complementary information produced by the executed rule

Please refer to the 'Description and implementation of rules' section for detailed information about each rule.

You are returned these fields in the following interfaces:

• automatic and manual responses from Sips Paypage
• responses from Worldline Sips connectors (Checkout, CashManagement (duplication) and Diagnosis services)
• the Merchant Extranet
• the transactions report except the scoreInfo and preAuthorisationRuleResultList fields.

The result of the execution of the pre-authentication profile is returned in the fields below:

• preAuthenticationColor, rule results represented in the form of a colour
• preAuthenticationValue, value of the overall score
• preAuthenticationThreshold, thresholds set for this profile
• preAuthenticationInfo, breakdown of the executed rules
• preAuthenticationProfile, the name of the antifraud profile executed before the authentication
• preAuthorisationProfileValue, contains the unique identifier of the executed profile version. This information is useful to retrieve the profile in the same configuration as when the checks were performed.
• preAuthenticationRuleResultList, a list of detailed result of each rule executed before the authentication.

Each object contained in the preAuthenticationRuleResultList field corresponds to a rule result and contains the same values as the preAuthorisationRuleResultList field in pre-authorisation mode. For the content, please refer to the pre-authorisation mode.

You are returned these fields in the following interfaces:

• automatic and manual responses from Sips Paypage
• response from the Sips Office connectors (services Checkout, CashManagement (duplication) et diagnosis services)
• the Merchant Extranet
• the transactions report except the preAuthenticationInfo and preAuthenticationRuleResultList fields.

The overall Worldline Sips offering supports many international means of payment such as Visa/Mastercard cards, the Paypal digital wallet, iDeal transfers, Sepa Direct Debits, etc.

The rules do not necessarily apply to all means of payment.

For single message** means of payment, means of payment, defining informational profiles is technically feasible, but the result of the check will have no consequences on the acceptance of the transaction.

To know if an antifraud rule is applicable to a means of payment, please refer to the following section: 'Correspondences between means of payment and antifraud rules'.

____________________

** “Single-message” refers to a means of payment for which the authorisation and capture are performed in a single step e.g. transfers with Ideal, Paybutton, or Paypal in immediate mode. Dual-message refers to a means of payment for which authorisation and capture are performed in two steps.

Antifraud profiles apply to transactions and cash management operations that result in a new transaction being created (duplication).

Thus, standard cash management operations that deal with existing transactions (validation, cancellation, refund, etc.) and credit holder transactions are not subject to antifraud checkings.

For payments in n instalments, only the first instalment is subject to antifraud checkings.

For some rules, data must be sent in the request. The latter will not be executed if the data is missing.

For example, for the customer ID velocity rule, the customer ID must be sent in the request. Otherwise the rule will not be executed.

The rules do not necessarily apply to both modes (pre-authentication et pre-authorisation).

For example the 3-D Secure authentication rule is not available in pre-authentication. Indeed, this rule is based on the 3-D Secure authentication result, but the pre-authentication antifraud profile is applied first. So this rule is of no use prior to authentication.