NoFraud - a complete analysis of the antifraud system

[Man]

NoFraud is an e-commerce fraud prevention and checkout solution that protects businesses from fraudsters, eliminates chargeback losses, and provides a smoother, more convenient checkout experience for trusted customers. In this detector, all orders are sent for verification automatically, so we have no way of knowing how many points we have been given. The approximate time for checking orders is up to 24 hours.

In most cases, this solution is implemented in Shopify cms by a plugin via an api key.

Another installation option is also used. This is Java script.

What is Device JavaScript?​

Device JavaScript allows NoFraud to collect information about customer devices. Collecting information about customer devices is critical to NoFraud's accurate screening because it collects device information such as device, operating system, browser, and versions, in addition to the customer's IP address from your site. When NoFraud receives a transaction from your store, our system matches the IP address included in the transaction with the IP address received by Device JavaScript to associate the device information with your transaction.

The HTML device JavaScript tag for your account looks like this:

<script type='text/javascript' src='https://services.nofraud.com/js/19924/customer_code.js'></script>

Therefore, when we analyze our site - conduct it through the f12 console. You will find this script there.

And if plugins, then at worst - builtwich!

Visual representation of the authorization/capture workflow

Filters:

Trust factors in NoFraud:​

• The device is in close proximity to the billing address: This means that the customer's geolocation was close to the address listed in the cardholder's bank database, indicating that the order was placed by the actual cardholder (or close associate/family member).
• Normal device activity observed: The customer's purchasing activity does not match common indicators of fraud (e.g. use of a proxy device, proximity to the billing address, etc.).
• Transaction placed on first payment attempt: A common sign of fraud is when a customer makes multiple payment attempts before the order is finally approved. This trust factor indicates that this order was successfully placed on the first payment attempt.
• Card Verification Value (CVV) match: This means that the CVV code provided by the customer matches the one stored by the cardholder's bank.
• Shipping to cardholder's address: This means that NoFraud has been able to verify that the shipping address belongs to the real cardholder and that the order is not being sent to an unverified address.
• The email address has been active for a significant period of time: Fraudsters typically create new email addresses for the specific purpose of placing a (fraudulent) order. This means that the email address sent with this order has been in existence for a significant period of time.
• Customer has been using this payment method for a long time: This customer has previously used this same payment method for past orders that were not fraudulent.
• Issuing bank matches billing country: (mainly for orders outside the US) this means that the credit card was issued in the same country the order is being shipped to.
• Address Verification System (AVS) Match: The billing address provided by the customer exactly matches the address on file with the cardholder's bank. AVS details HERE!

Risk factors in NoFraud:​

Automatic risk scale

• Dangerous device activity detected: critical characteristics of the device used to place the order raise suspicions (e.g. the customer is hiding information about their device, the device's geolocation is far from the cardholder's address, etc.).
• Unusual device activity detected: some characteristics of the device used to place the order are unusual or unexpected (this could be your behavior in the shop, scrolling, copy-pasting, etc.)
• Card issuing bank does not match billing country: The bank the customer uses is located in a country that does not match the country listed in their billing address.
• Proxy detected: The client is using proxy software to hide information about their device. ( usually if your proxy has open ports)
• IP address geolocation is remote from the billing address: The customer placed an order from a device that is located a long distance from the cardholder's address.
• Address Verification System (AVS) Partial Match: The billing address provided by the customer only partially matches the cardholder's address on file with their issuing bank ( e.g., the postal code matches, but the address does not match).
• Total Address Verification System (AVS) Mismatch: The billing address provided by the customer does not completely match the cardholder's address as stated by their issuing bank.
• Shipping address differs from AVS confirmed address: The shipping address differs from the cardholder's confirmed address.
• Request for expedited shipping: Often scammers will request expedited shipping because a) they are not paying for the item/shipping and have nothing to lose, and b) they believe it will give the seller less time to recognize the scam and reroute the order or prevent it from being shipped.
• Multiple card payment attempts detected in a short period of time: Many scammers attempt to use multiple cards for the same order until one is approved. This indicates that the customer attempted to pay for the order multiple times with different cards before the order was successfully placed.
• Shipping to a Freight Forwarder: Orders shipped to a freight forwarder are generally considered higher risk than orders shipped directly to the customer/cardholder's home address.
• The email address has a little history: Fraudsters often create new email addresses (especially if they do not have access to the actual cardholder's email account) for the specific purpose of placing fraudulent orders. Therefore, a completely new email address is considered a risk factor.

Additional factors:

• IP Geolocation: IP geolocation allows NoFraud to compare the location of a device with the billing or shipping address.
• Proxy Piercing: Proxy piercing determines whether the client is actually where he or she claims to be
• Device fingerprinting: NoFraud tracks whether the device used in a transaction has been associated with fraud in the past.
• Global Blacklists: Monitors global client blacklists.
• Velocity Detection: Monitors transaction velocity to identify risks through related transactions in close succession.
• Identity Tracking: Identity tracking identifies order characteristics and customer behavior to determine risk.
• Social Media Verification: Extracts data from social media databases to verify identity.
• Blacklists: Uses global and merchant-specific blacklists to match transactions.
• Email History and Verification: Analyzes email address for history and verification.
• User Behavior: Tracks how a customer interacts with a website.
• Intelligent Monitoring: Monitors future transactions to retroactively flag past transactions as fraudulent when new data becomes available.

Additional checks and quirks from the company:​

1) Email verification
By default, email confirmation is sent from alert@nofraud.com

But this is all set up by the shop owner. In our case, it is possible to confirm!

2) Text Message (SMS) Verification
Allow NoFraud to contact customers via text message for verification during the verification process by setting Allow text messages for verification to "On" in Settings → Verification. Text message verification is sent to US and Canadian numbers only.

3) Phone Call Verification
Allow NoFraud to contact customers by phone for verification during the verification process by setting “Allow phone calls for verification” to “Enabled” in Settings → Verification.

Confirmation in our case is more difficult, it depends on what number we write when placing the order.

4) Image verification
Sometimes NoFraud may ask the client for confirmation images, trying to confirm a high-risk order.

As part of this process, the following images may be requested:

• Image of government issued ID card
• Image of used credit card (only last 4 digits and full name visible)

Easy rendering, to say the least.

These additional checks increase the time: the status of transactions in the "Review" state within 24 business hours, most often within 4 business hours. Sometimes it takes some time for clients to respond, so the check can take up to 48 business hours.

I'll probably finish here! There's not much more to tell here! Don't throw sticks! Article for Beginners! In the process of writing the article, I used documentation and access to the company's portal where there are transactions.