How Does AI Detect and Prevent Payment Fraud?

TL;DR

Artificial intelligence detects fraud by learning the normal behavior of each cardholder, merchant, and device, then identifying suspicious changes in real time. A complete system combines behavioral device identification, cross-channel customer monitoring, merchant-level analysis, and breach detection, allowing organizations to trace related anomalies back to a possible point of compromise while protecting customers behind the scenes.

Transcript

Hi, I'm Tracy Kitten with Information Security Media Group at RSA Conference 2014. I'm here with Dr. Ocklay Ajote of Brightrion to talk about authentication and user experience. Ocklay, you and I have spoken quite a bit in the past about authentication and some of the challenges that the industry faces there, and your company's doing quite a bit in... Read More

Key Insights

• Artificial intelligence is already used in financial and retail security, rather than being merely a science-fiction concept. Brighterion reported working with major financial organizations, MasterCard, and Worldpay while processing more than a billion financial and retail transactions each month.
• Real-time decisioning is central to rapid fraud detection because suspicious card transactions can be evaluated within milliseconds. Instead of waiting 30 or 60 days, an organization can analyze abnormal activity on the same day and investigate a possible compromise much sooner.
• Smart-agent technology treats each card as an individual agent that can contribute behavioral signals. When multiple cards begin acting suspiciously after visiting the same merchant, the system can connect their activity and identify that merchant as a possible point of compromise.
• Data-breach detection depends on monitoring activity involving potentially stolen cards after the compromise occurs. By comparing when suspicious behavior begins across cards and tracing their shared history, Brighterion said its tests could identify this type of incident within two hours.
• Population-wide fraud rules are limited because individuals within the same category can behave very differently. Rules based on demographic clusters or averages may miss meaningful personal deviations, while individualized behavioral models can detect changes specific to each cardholder, merchant, card, or device.
• Unknown fraud schemes can be detected through behavioral change rather than reliance only on known attack signatures. A system that continuously follows the specific activity of people, cards, merchants, and devices can flag anomalies even when experts have not previously written a rule for that scheme.
• Comprehensive fraud prevention requires a 360-degree view across four layers: the device, the customer's cross-channel behavior, the merchant's behavior, and possible data breaches. Monitoring only one channel cannot provide the complete context needed to connect suspicious activity across an organization.
• Privacy can be preserved by analyzing behavior anonymously. Brighterion follows every activity associated with a card without knowing the cardholder's identity, allowing the system to protect the card based on its behavioral history without identifying whether it belongs to a particular person.

Questions & Answers

Q: How does artificial intelligence detect payment fraud?

Artificial intelligence detects payment fraud by learning the normal behavior associated with a specific cardholder, card, merchant, or device and then identifying meaningful changes. It evaluates transactions in real time, compares suspicious activity across related cards, and traces shared histories. If several affected cards visited the same store before behaving abnormally, that store can be identified as a possible point of compromise.

Q: Why is individual behavior better than population-based fraud rules?

Individual behavioral analysis accounts for the fact that every person acts differently. Population-based systems divide people into clusters, such as students or senior citizens, and apply average rules created by experts or historical analysis. Those rules may not fit a particular customer. Following each person's specific behavior makes it possible to detect a change that would otherwise appear ordinary within a broad category.

Q: How can AI identify fraud schemes that have not been seen before?

Artificial intelligence can identify an unfamiliar fraud scheme by looking for deviations from established individual behavior instead of depending exclusively on rules for known attacks. Every cardholder, merchant, device, and card is monitored according to its own activity pattern. When that pattern changes, the system can flag the behavior as suspicious even if experts have never defined a rule for that particular scheme.

Q: How can smart agents reveal a retail data breach?

Smart-agent technology represents individual cards and allows their behavioral signals to be compared. When several cards show suspicious activity, the system examines where those cards were previously used and when their behavior changed. A shared visit to the same retailer can reveal a possible point of compromise. Brighterion stated that tests showed this type of detection could occur within two hours.

Q: What are the four layers of end-to-end fraud prevention?

The four layers are behavioral device identification, cross-channel customer or endpoint behavior, merchant-level behavior, and data-breach detection. The first layer evaluates the phone, tablet, or computer. The second follows customer activity across credit, debit, checks, ACH, and other channels. The third looks for merchant or internal fraud, while the fourth connects suspicious card activity to possible compromises.

Q: Why is real-time decisioning important for fraud prevention?

Real-time decisioning allows suspicious activity to be analyzed within milliseconds and can expose related anomalies on the same day. This reduces reliance on investigations that begin 30 or 60 days later. Rapid comparison of affected cards can show that they passed through the same retailer before behaving differently, giving security teams an earlier opportunity to examine a possible breach or fraud event.

Q: Does AI-based fraud monitoring affect the customer experience?

AI-based fraud monitoring can operate behind the scenes while giving customers better protection. By learning behavioral patterns, a company can recognize suspicious changes and use intelligence from transaction and device data to improve security. The consumer benefits when the organization can protect accounts more effectively and serve customers better, without requiring the customer to perform the underlying analysis personally.

Q: Can AI monitor card behavior without violating privacy?

Card behavior can be monitored anonymously without revealing who owns the card. Brighterion described following every activity associated with a card while having no knowledge of whether it belongs to the interviewer, the executive's daughter, or another person. The model protects the card by analyzing its behavior, allowing fraud detection to continue while separating the analysis from the cardholder's personal identity.

Summary & Key Takeaways

• Artificial intelligence can evaluate financial and retail transactions in real time, with decisions occurring within milliseconds. Brighterion described processing more than a billion transactions per month and using smart agents to represent individual cards, compare suspicious activity, and connect affected cards to a shared store or other potential point of compromise.

• Behavior-based monitoring focuses on each person, card, merchant, and device rather than applying average rules to broad demographic clusters. Because every user behaves differently, the system learns specific activity patterns and flags changes. This approach is intended to identify both established fraud schemes and suspicious behaviors that do not match previously documented attacks.

• End-to-end fraud prevention requires four connected layers: behavioral device identification, cross-channel customer or endpoint analysis, merchant-level monitoring, and data-breach detection. The system can analyze credit, debit, checks, ACH, and other activity while operating behind the scenes. Card behavior can also be monitored anonymously without knowing the cardholder's identity.