User's Guide

Fraud Protection Services User’s Guide 87
Fraud Filter Reference
High-risk Address Filters
A
addresses. IP (Internet protocol) addresses are unique identifiers for computers that can often
be mapped to a specific city or area code.
The specified action is taken whenever the IP address, shipping address, and billing address do
not fall within a 100 mile radius. If you provide only one physical address (billing or shipping
address), then the filter triggers when the distance between the IP address and the address that
you provided is greater than 100 miles.
NOTE: Gift purchases shipped far from the billing address will trigger the filter.
Every effort has been made to ensure that IP address mapping is accurate and
up-to-date. Given the nature of the Internet’s architecture, however, some Internet
Service Providers use data centers far from the customers being serviced. In addition, as
described in the IP Address Risk List Match filter, IP addresses can change
dynamically. For these reasons, treat this filter as an indicator of suspicious activity, not
as a definitive result.
How does the filter protect me?
Comparing the geographical location associated with the IP address to the submitted shipping
and billing information can be an effective method for identifying identity spoofing.
Fraudsters often pretend to live in a location, but live and shop from another.
All three elements should match one realistic customer profile. For example, a customer with a
billing address in New York would typically shop from a computer in New York, and request
delivery to a New York address. While there may be some minor inconsistencies in the overall
profile, it should generally fit together. Remember, however, that gift purchases sent to another
part of the country will not fit this profile.
NOTE: You should be especially wary when a customer has an international IP address but
uses U.S. billing and shipping information.
IP Address Velocity Filter
What does the filter do?
The IP Address Velocity filter triggers when five or more transactions within three days (72
hours) originate from any individual IP address.
IMPORTANT:The specified action is performed on only the transaction that triggered the
filter and not on the previous four transactions. You must manually review and
act upon those transactions. Generate a Transaction Details report and click
the IP Address Velocity link to view the transactions.
IP addresses do not always identify a unique computer or user. For example,
an Internet Service Provider (ISP) may use a limited number of IP addresses
for all of its users. To protect against triggering the filter in this case, set up an
IP Address Velocity Ignore List (described in the online help).
What is Velocity?
In the risk management industry, an event’s velocity is a measure of its frequency of
occurrence during a defined time period. Unusually high velocity is can be associated with a