You probably know that your debit and credit cards have someone watching over them for indications of fraud and/or theft, and we’ve written here before about making sure you tell the bank in advance of a trip so that they don’t mistakenly block your card. I’ve personally seen this system work well, and also not so well. But until this week, I never heard some of the intricacies of how fraud detection works.

MetaFilter is a group weblog which has gained a reputation over more than ten years for being consistently interesting, thoughtful, concise and free of junk. They maintain this partially through a nominal registration fee, which keeps out the riff-raff amazingly well. A sub-site called Ask MetaFilter exists primarily for members to seek advice and knowledge from each other. Someone on “Ask MeFi” recently asked:

Just got a call from my bank, Chase, for credit card fraud. Got it all taken care of, card canceled, new one on the way…no worries. I’m just wondering, what tipped them off?

Among the several answers was a lengthy comment from someone who used to work in fraud detection (could this person be making it all up? I suppose, but why would they?). Here are some interesting passages, which piece together the whole process:

• We used software [...] that basically tied a bunch of different databases together
• We started in a queue and looked at risk factors, such as:
  • Testing charges. These are usually online charges through known online vendors that a scammer can use to test a card number as valid. So [if we see] Amazon MP3 followed by Newegg … [you're] probably going to get called
  • Gas is something you can buy almost anywhere without being on camera or talking face-to-face with a clerk. A crook will steal a card, test it at a pump, and then go on a spending spree. So gas followed by Best Buy…. [you're] probably going to get called
  • Out of Country charges. This is an indication that a card has been compromised by a foreign entity (Russia and Turky were two concerns at the time) and fake plastic has been made and is being used until it’s found. Cards leave a data trail of where they’re used, so [if yours is] almost always used in X suddenly used miles away in Y… [you're] probably going to get called
  • Let’s say that a person always uses their card for fast food, gas, and sometimes clothes shopping. All of a sudden we have $2,000 dollars coming through from electronics. Probably going to get called.
  • If something starts off as low risk, but keeps coming back again and again it’s going to get moved up in the queues until someone finally looks at it.

The former fraud detection worker summarizes it this way:

When you use that card, you’re being watched. Sometimes by a person, but most often by computers that analyze and store every purchase you make. Even if you don’t know it, you have a data trail, and that data trail has a signature to it. When something breaks that signature, and is surrounded by other suspicious details, it either get automatically handled by a computer, and will eventually be handled by a human. The testing charge was suspicious, but maybe by itself wouldn’t have mattered. Followed by tools (easy to fence, so a pretty common flag charge) it’s no question. Especially if it looked at your account and couldn’t find strong previous history with either. So your account gets sent to a high priority queue, and some underpaid dude on the eastern seaboard looks at it, tags it as fraud, and calls you to confirm, maybe helping him make an extra 200 bones at the end of the month.

{ 10 comments }