I've been dealing with an inordinate amount of bogus payments, mostly people using PayPal. I am aware of services that provide an API that returns a score, but I'd like to first explore the possibility of using something open source.

Are there any solutions (language matters not) that use freely available geolocation databases (I'm interested only in country level accuracy, and it does not have to be perfect) combined with other freely available sources of information that may help determine a fraud sale? (I.e. checking IP blacklists, etc).

I could probably write something, but its not a wheel that I'm particularly interested in studying, much less re-inventing, unless I must.

3 Answers 3


You should contact Paypal. Check out this page on their site, https://www.paypal.com/us/cgi-bin/webscr?cmd=xpt/bizui/BusinessSecurity-outside&country=US&locale.x=en_US&pagetype=outside. Since you are using PayPal they should be providing fraud detection for you.

I used to work for an online financial firm and no matter what you will run into some fraud issues. We used Lexus Nexus which is one of the major companies in the area of scoring you mentioned. They are expensive and take a good deal of time to integrate. Even with their help we still had at least 4-5 individuals committing fraud a year. We eventually rolled our own fraud detection software because it was so specific. We found that the people committing fraud knew how to exploit our system and we could hunt for a pattern.

The first thing you need to do is find what pattern you are looking for. Then you might be able to find some "non-fraud" related software and integrate it to look for fraud. Specifically, it sounds like geotracking their IP address could be useful. It is possible that software exists to do this specifically to fraud. I would find it much more possible though that a standard geotracking package with a slight tweak would do exactly what you want.

  • That's my primary interest, examining trends. In my experience, PayPal is ANYTHING but helpful when you are on the wrong end of a dispute (especially for digital goods or services), but I'll give it a try.
    – Tim Post
    Jul 17, 2010 at 18:41

We've been using MaxMind for years and it does quite a good job at detecting fraudulent transactions at an extremely reasonable price. It's not open source but frankly it's so inexpensive that unless you have an ideological problem with using commercial services, it's a great option.

  • Not ideological, in fact I've used them in the past. I'd like something that I can 'tweak' for special cases. For instance, if selling web hosting, you might want to apply a slightly higher score to a transaction that was originally referred by a 'hax0r' forum. I'd like to put all of that special sauce in one place.
    – Tim Post
    Jul 19, 2010 at 6:34

I recommend http://DataXO.com, which is exactly what you are looking for. This is an open source product. For most businesses an enterprise level fraud management system is very expensive. Most business cannot afford the best solutions in the market - try calling companies like FICO.

The key component of any fraud solution is that it must be progressive i.e. ability to adapt to new challenges posted by fraudsters and support for real-time. IP filtering is only a part of the puzzle, you need something like velocity checks, machine learning etc..

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.