User Guide

Fraud Management Filters Summary
Advanced Fraud Management Filters
44 June 23, 2009 Fraud Management Filters
A billing/shipping address mismatch may indicate that the customer is shipping to an address
different from the one the bill is sent to. A mismatch could be due to a fraudster using a stolen
identity to complete a purchase; however, there are also legitimate reasons why a customer’s
shipping and billing address might not match. For example, your customer might be buying a
gift for someone who lives at a different address or they might want to have a purchase
delivered to their workplace. The billing/shipping address mismatch filter applies to Direct
Credit Card and Virtual Terminal payments.
High Risk Lists Filters
You can filter transactions based on lists of risk criteria.
Zip Code Filter
This filter screens for payments with billing addresses that include a zip code with historically
high rates of fraud. Zip codes are checked against a “Risk List” maintained by PayPal for US
addresses. High-risk zip codes are determined through careful analysis of millions of e-
commerce transactions. Because fraud tends to happen more often in densely populated areas
like major cities, zip codes on the risk list are often for major cities. A matching zip code does
not necessarily indicate a fraudulent purchase; however, it may indicate that you should pay
special attention to the transaction. This filter applies to Direct Credit Card and Virtual
Terminal payments.
Suspected Freight Forwarder Filter
This filter screens for payments whose shipping address is a known freight forwarder.
Addresses are checked against a “Risk List” maintained by PayPal, which only applies to US
shipping addresses. Freight forwarding services receive packages on behalf of a customer and
forward them to another destination. There are legitimate uses for freight forwarding services;
however, fraudsters can use a freight forwarder to mask their true locations. This filter applies
to Direct Credit Card and Virtual Terminal payments.
Email Address Domain Filter
This filter screens for payments from email addresses with historically high instances of fraud.
Email domains are checked against a “Risk List” maintained by PayPal. Fraudsters often use
specific free email services because they don’t require traceable billing information; however,
free email services are also popular among legitimate customers. This filter applies to Direct
Credit Card and Virtual Terminal payments.
Bank Identification Number Filter
This filter screens for payments from credit cards with Bank Identification Numbers (BIN)
that have historically been associated with a relatively higher rate of fraudulent transactions.
BINs, which identify the bank that issues the card, are checked against a “Risk List”
maintained by PayPal. Some BINs carry a higher risk of fraud because the card issuer uses less
stringent authentication policies before issuing cards. Cards from issuers with a large number
of cards in circulation may also represent higher risk because more cards are available to fall
into the hands of fraudsters. The bank identification number filter applies to Direct Credit Card
and Virtual Terminal payments.