Are there open solutions for fraud detection?

Question

I've been dealing with an inordinate amount of bogus payments, mostly people using PayPal. I am aware of services that provide an API that returns a score, but I'd like to first explore the possibility of using something open source.

Are there any solutions (language matters not) that use freely available geolocation databases (I'm interested only in country level accuracy, and it does not have to be perfect) combined with other freely available sources of information that may help determine a fraud sale? (I.e. checking IP blacklists, etc).

I could probably write something, but its not a wheel that I'm particularly interested in studying, much less re-inventing, unless I must.

Answer 1

You should contact Paypal. Check out this page on their site, https://www.paypal.com/us/cgi-bin/webscr?cmd=xpt/bizui/BusinessSecurity-outside&country=US&locale.x=en_US&pagetype=outside. Since you are using PayPal they should be providing fraud detection for you.

I used to work for an online financial firm and no matter what you will run into some fraud issues. We used Lexus Nexus which is one of the major companies in the area of scoring you mentioned. They are expensive and take a good deal of time to integrate. Even with their help we still had at least 4-5 individuals committing fraud a year. We eventually rolled our own fraud detection software because it was so specific. We found that the people committing fraud knew how to exploit our system and we could hunt for a pattern.

The first thing you need to do is find what pattern you are looking for. Then you might be able to find some "non-fraud" related software and integrate it to look for fraud. Specifically, it sounds like geotracking their IP address could be useful. It is possible that software exists to do this specifically to fraud. I would find it much more possible though that a standard geotracking package with a slight tweak would do exactly what you want.

Answer 2

We've been using MaxMind for years and it does quite a good job at detecting fraudulent transactions at an extremely reasonable price. It's not open source but frankly it's so inexpensive that unless you have an ideological problem with using commercial services, it's a great option.

Answer 3

I recommend http://DataXO.com, which is exactly what you are looking for. This is an open source product. For most businesses an enterprise level fraud management system is very expensive. Most business cannot afford the best solutions in the market - try calling companies like FICO.

The key component of any fraud solution is that it must be progressive i.e. ability to adapt to new challenges posted by fraudsters and support for real-time. IP filtering is only a part of the puzzle, you need something like velocity checks, machine learning etc..