Payment Fraud Detection
CNP fraud patterns live in the relationship between entities: which card appeared on which device, how many merchants that card has touched, what the user-IP pair has done in the last 7 days. Riskgrove evaluates all of it in a single scoring call.
Get a demoDetection Signals
CNP fraud velocity is invisible if you only look at one dimension at a time. Riskgrove evaluates six entity-pair velocity dimensions on every scoring request.
How long has this card fingerprint been associated with this device? A card appearing on a device for the first time, at transaction time, in the same second (a 0-second pair age) carries a sharply elevated fraud score.
How many distinct merchants has this card fingerprint touched in the past 24 hours, 3 days, and 7 days? Fraudsters maximize card utilization before it's cancelled. Normal usage concentrates on 2-4 merchants per week.
Aggregate spend from this user account on this IP address across rolling windows. Fraudsters using a shared proxy will accumulate abnormally high aggregate spend from the same IP-user pair across multiple sessions.
How many cards from the same BIN range have appeared on this device? Stolen card batches come from the same issuer; testing them from the same device creates a detectable BIN-device concentration signal.
Transaction amount relative to this account's historical average and maximum. A first transaction that is 8x the account's historical max spend, even for a legitimate-looking user, scores as an outlier worth escalating to REVIEW.
The card's issuing country compared to the transaction IP country. Cross-border transactions aren't inherently fraudulent, but a pattern of mismatches across a device or session cluster elevates the velocity composite.
API Response
The response tells you what to do with the transaction and which signals drove the score. Your authorization logic acts on the recommendation field.
HTTP/1.1 200 OK | /v1/score response
{
"request_id": "rq_8Lm3xN7pQs2",
"score": 0.89,
"recommendation": "review",
"signals": [
{
"name": "card_merchant_distinct_24h",
"value": 31,
"contribution": 0.34
},
{
"name": "card_device_pair_age_seconds",
"value": 0.7,
"contribution": 0.28
},
{
"name": "user_ip_txn_amount_7d",
"value": 12400,
"contribution": 0.18
}
],
"latency_ms": 38
}Start catching CNP fraud
Send us a sample of recent transactions and we'll show you the entity-pair signals that stand out in your data before you go to production.