You swipe your card at the grocery store. Four things leave the register: the time, the amount, the merchant and how long you have held the account. The bank’s computer checks them against what it knows about you and, in a split second, decides whether the person at the counter is really you. If the answer looks like no, the reader declines.
No clerk at the bank is watching. Jungwoo Ryoo, an associate professor of information sciences and technology at Penn State’s Altoona campus, laid out how the system works in an explainer first published by The Conversation in 2015.
Why issuers care
The money at stake is large. According to the Federal Reserve Payments Study, Americans made 26.2 billion credit card purchases in 2012, and unauthorized transactions that year cost an estimated $6.1 billion. Under the Fair Credit Billing Act, a cardholder’s liability for unauthorized charges tops out at $50. The card companies absorb the rest.
From phone calls to pattern-matching
Simple checks exist. A thief using a card in an unfamiliar place may be asked for the zip code tied to it. But fraudsters get around that easily, Ryoo wrote, since finding a victim’s zip code can take one Google search.
Older systems flagged suspicious cases and handed them to human investigators, who sometimes phoned the cardholder to ask whether a charge was real. The volume of transactions has since grown too large for that. Issuers now lean on machine learning.
The model is first trained on the normal spending of a great many cardholders. One person fills the tank once a week and shops for groceries every two weeks. The algorithm learns that rhythm. After training, each new transaction is scored in real time with a probability that it is fraud, 97% for example. If the issuer sets the cutoff at 95%, a score of 97% can reject the card at the register on the spot.
The score draws on many inputs, among them how trustworthy the vendor is, the time and place of the purchase, and the buyer’s IP address for online orders. More data points make the call more accurate.
Take the restaurant a customer visits every Saturday morning. A charge there raises no flag. A charge at a gas station two time zones away at 3:00 a.m. does. So does a card that is suddenly used for cash advances twice in one day when the history shows none.
Where people still come in
A quick human review sometimes sits between the score and the decline. If a card is rejected several times, a person may call the cardholder before cancelling it for good. Ryoo argued that heavy human involvement slows the reaction time and can get in the way.
The weak point is the false alarm: a legitimate purchase at an unexpected location trips the system. Ryoo wrote that too many alerts are as bad as none. More data reduces these false positives, which is why issuers feed the models mountains of it. PayPal, he noted, was handling more than 1.1 petabytes of data for 169 million customer accounts at any given moment, and that load pushes companies toward cloud computing, which is not limited by a company’s own hardware.
Ryoo called fraud detection an arms race and said the defenders were gaining ground. Phones that store card details and pay wirelessly had opened new weaknesses, he added, though fraud detection of the day was largely indifferent to how a payment was made.
