| ID | Category | Type | Highlight | Text |
|------|------|------|------|------|
| 6b6cf9fe | geo | good | acct_ad_ctry, bill_ad_ctry | The address listed on the customer's account matches the card billing address |
| a81740c4 | geo | bad | acct_ad_ctry, bill_ad_ctry | The address listed on the customer's account mismatches the card billing address. |
| cee10e3c | geo | good | acct_ad_ctry, bill_ad_ctry, acct_ad_city, bill_ad_city | Low risk of hiding address: The address listed on the customer account and the card billing address are located in the same city. |
| fc7438ad | geo | good | acct_ad_ctry, bill_ad_ctry | Low risk of hiding address: The address listed on the customer account mismatches the card billing address but they are both located in the same country. |
| d9426d1d | geo | good | acct_ad_line1, bill_ad_line1 | Low risk of hiding address: The first line of the customer account address matches the first line of the card billing address. |
| 45d08d99 | user | bad | airticket_days_to_departure | The airline ticket was booked 3 or fewer days before departure. |
| b0124bd0 | transaction | neutral | airticket_electronic_ticket | The airline ticket was purchased electronically. |
| 3f0b9eae | user | good | cust_first_name, cust_last_name, ship_ad_first_name, ship_ad_last_name | The customer name matches the billing and shipping address name. |
| f7aa8f82 | user | good | cust_email, cust_first_name, cust_last_name | The customer and cardholder name match the email username. |
| 0cd68f17 | geo | good | bill_ad_ctry | Based on past trends, the billing address country does not belong to a known high-risk region. |
| 6cefe5e6 | geo | bad | bill_ad_city | The billing address is in a big city (population > 500,000), where fraud rates tend to be higher. |
| ee277a4c | geo | good | bill_ad_city | The billing address is in a small city (population <10,000), where fraud rates tend to be lower. |
| 7d2341b5 | geo | good | bill_ad_ctry, bill_ad_city, ship_ad_ctry, ship_ad_city | The billing address fully matches the shipping address. |
| b37d9dd1 | geo | bad | bill_ad_ctry, ship_ad_ctry | The card billing address mismatches the shipping address. |
| ef6b0426 | geo | good | bill_ad_ctry, bill_ad_city, ship_ad_ctry, ship_ad_city | The billing address city mismatches the shipping address city but they are located in the same administrative area. |
| 0a8af752 | geo | good | bill_ad_ctry, bill_ad_city, ship_ad_ctry, ship_ad_city | The billing address city and the shipping address city are in close proximity. |
| c75ba04d | geo | bad | bill_ad_ctry, bill_ad_city, ship_ad_ctry, ship_ad_city | < The billing address city and the shipping address city are significantly far apart. |
| d6c9b553 | user | good | cust_first_name, cust_last_name, ship_ad_first_name, ship_ad_last_name | The customer full name on the billing address matches the full name on the shipping address. |
| e59f14e3 | user | good | cust_last_name, ship_ad_last_name, bill_ad_last_name | The last name on the billing address matches the last name on the shipping address but the first names mismatch. |
| ee5aa0f2 | user | bad | bill_ad_line1, ship_ad_line1 | The billing and shipping addresses are written in all caps, which deviates from typical user behaviour. |
| 4177604e | user | bad | bill_ad_line1, ship_ad_line1 | The billing and shipping addresses are written in all lowercase letters, which deviates from typical user behaviour. |
| 66d7bd96 | geo | good | bill_ad_ctry, bill_ad_city, ship_ad_ctry, ship_ad_city | Low risk of hiding address: The card billing address partially matches the shipping address. |
| 7e54e88e | geo | good | ship_ad_ctry, bill_ad_ctry | The shipping address country and the billing address country neighbor each other and they have similar GDP size per capita. |
| 26c1bb40 | geo | bad | ship_ad_ctry, bill_ad_ctry | The shipping address country has a significantly lower GDP than the billing address country even though they neighbor each other. |
| e897de56 | user | good | cust_first_name, cust_last_name, ship_ad_first_name, ship_ad_last_name, bill_ad_ctry, bill_ad_city, ship_ad_ctry, ship_ad_city | Likely family name story: The billing address and the shipping address belong to the same country and the last name of the billing address matches the last name on the shipping address. |
| 8d0996be | user | good | cust_first_name, cust_last_name, ship_ad_first_name, ship_ad_last_name, bill_ad_ctry, bill_ad_city, ship_ad_ctry, ship_ad_city | Likely family name story: The billing address and the shipping address belong to the same country and the last name of the billing address matches the last name on the shipping address. |
| ee3b72eb | geo | bad | ship_ad_ctry, bill_ad_ctry | The shipping address country has a significantly lower GDP than billing address country even though they belong to the same geographic region. |
| 99897bf9 | geo | good | bill_ad_city, bill_ad_zip | The zip code provided by the user matches the billing address city. |
| 583d1b2d | geo | bad | bill_ad_city, bill_ad_zip | The zip code provided by the user does not match the billing address city. |
| 3673031f | funding_source | good | bill_ad_ctry, bin_ctry | The billing address country matches the BIN country. |
| b7d58705 | funding_source | bad | bill_ad_ctry, bin_ctry | The billing address country does not match the BIN country. |
| f14b2d98 | funding_source | bad | bill_ad_ctry, bin_ctry | The billing address country and the BIN country have a significatly large GDP per capita difference. |
| e0d69af9 | funding_source | bad | bill_ad_ctry, bin_ctry | The billing address country neighbors the BIN country, however, they have a significantly large GDP per capita difference. |
| 93ac6c23 | funding_source | bad | bill_ad_ctry, bin_ctry | The billing address country and the BIN country are located in the same region, however, they have a significantly large GDP per capita difference. |
| d0fd7ae9 | funding_source | bad | bill_ad_ctry, bin_ctry | < The billing address country mismatches BIN country and the billing address country belongs to a known high-risk region connected to fraud trends. |
| 2d3f0a62 | geo | bad | bin_ctry | The customer is using a proxy internet connection to create an artificial match between the IP address and the BIN country. |
| 33ab5258 | geo | bad | bin_ctry | The customer appears to be located in a country that has a significantly lower GDP even though it neighbors the country in which the card was issued. |
| 6c9b83d4 | funding_source | bad | cc_num | A premium card was used for the transaction, which is more desirable to fraudsters. |
| 21b1c415 | funding_source | good | cc_num | A prepaid card was used for the transaction, which is considered a highly safe card category. |
| 1809b256 | funding_source | good | cc_num | A virtual credit card used for the transaction, which is considered a highly safe card category. |
| 96dd64fd | funding_source | good | ship_ad_ctry, bin_ctry | The shipping address country matches the BIN country. |
| 0b86f9fc | funding_source | bad | ship_ad_ctry, bin_ctry | The shipping address country does not match the BIN country. |
| fb412e9f | funding_source | bad | ship_ad_ctry, bin_ctry | The shipping address country has a significantly lower GDP per capita compared to the BIN country. |
| 428f3fe9 | user | bad | bill_ad_line1, bill_ad_line2 | The customer provided billing address that appears bogus. |
| 43641cf6 | user | bad | bill_ad_line1, ship_ad_line1, bill_ad_line2, ship_ad_line2 | The customer provided addresses that appear bogus. |
| fd72d5a3 | user | bad | ship_ad_line1, ship_ad_line2 | The customer provided shipping address that appears bogus. |
| fb377da0 | user | bad | cust_email | Email username appears to be bogus. |
| d0cc1768 | user | neutral | cust_email, cust_first_name, cust_last_name | Email username isn't indicative, which is common for Chinese email addresses. |
| 905b1f6f | user | bad | cust_email, cust_first_name, cust_last_name | Email username appears to be bogus. |
| 05fc50fe | user | bad | cust_first_name | The customer's first name appears to be bogus. |
| 6936e95a | user | bad | cust_first_name, cust_last_name | The customer's name appears to be bogus. |
| 6e08f1b5 | user | bad | cust_last_name | The customer's last name appears to be bogus. |
| a85b8341 | user | bad | phone | Phone appears to be bogus. |
| 23411282 | funding_source | bad | cc_exp_dt | The credit card expiry date is near. |
| 05c254c5 | funding_source | good | cc_num | Credit Card country doesn't appear to be attractive for fraudsters. |
| bad41d8c | user | bad | cust_first_name, cust_last_name, ship_ad_first_name, ship_ad_last_name, bill_ad_first_name, bill_ad_last_name | The customer name matches the billing address name, but mismatches the shipping address name. |
| c8382f11 | user | bad | cust_first_name, cust_last_name, ship_ad_first_name, ship_ad_last_name, bill_ad_first_name, bill_ad_last_name | The customer name matches the shipping address name, but mismatches the billing address name. |
| e5b3be7b | user | bad | bill_ad_first_name, bill_ad_last_name, cust_first_name, cust_last_name | Billing name doesn't match customer's name. |
| d316c96c | user | good | cust_first_name, cust_last_name, cc_first_name, cc_last_name | Customer's name matches cardholder full or last name. |
| a994c6e1 | user | bad | cust_first_name, cust_last_name, cc_first_name, cc_last_name | Customer's name is different than the cardholder name. |
| b733c4d0 | user | good | cust_email, cust_first_name, cust_last_name, ship_ad_first_name, ship_ad_last_name | The customer and shipping address name match the email username. |
| 88a69ba9 | user | bad | ship_ad_first_name, ship_ad_last_name, cust_first_name, cust_last_name | Shipping name doesn't match customer's name. |
| ed939c06 | user | bad | cust_email, cust_first_name, cust_last_name, ship_ad_first_name, ship_ad_last_name | Neither customer name nor shipping address name matches the email username. |
| 89872dff | geo | good | cust_email, bill_ad_ctry | The email's top-level domain contains a country code that matches the country of the card billing address. |
| 20011848 | geo | bad | cust_email, bill_ad_ctry | The email's top-level domain contains a country code that mismatches the country of the card billing address. |
| 18c33fb5 | user | good | cust_email, cust_first_name, cust_last_name | Customer's email is using a domain which resembles the customer's name. |
| 560c0015 | geo | good | cust_email, ship_ad_ctry | The email's top-level domain contains a country code that matches the country of the shipping address. |
| 7fcd7922 | geo | bad | cust_email, ship_ad_ctry | The email's top-level domain contains a country code that mismatches the country of the shipping address. |
| be029ed4 | user | good | cust_email | Email address is somewhat controlled (business email). |
| 5e92d4f7 | user | good | cust_email | Email address is somewhat controlled (University email). |
| bbf780bf | user | good | cust_email | Email address is controlled (goverment/military). |
| b66f1fd4 | user | good | cust_email | Email address is somewhat controlled (ISP provided email). |
| 9711ad88 | user | neutral | cust_email | Email address is of a free email provider. |
| a8c600e4 | user | bad | cust_email | Based on past fraud trends, the email domain has been identified as high-risk. |
| 16a43a02 | user | neutral | cust_email | The email address comes from a non-common email provider. |
| 65c2a504 | user | bad | cust_email | Email address is "disposable" (It's super easy to open an account with this domain). |
| 1f8715da | geo | good | cust_email, bin_ctry | The email's top-level domain contains a country code that matches the country in which the card was issued. |
| bda53b6d | geo | bad | cust_email, bin_ctry | The email's top-level domain contains a country code that mismatches the country in which the card was issued. |
| fcfc097c | user | bad | cust_email | Email username contains digits, which might indicate serial opening of email accounts. |
| a554993a | user | neutral | cust_email, cust_first_name, cust_last_name | Email username contains digits, which is common for chinese email accounts. |
| f3472afd | user | bad | cust_email, cust_first_name, cust_last_name | Customer's email username contains a name that mismatches the customer's. |
| d7a116ca | user | good | cust_email, cust_first_name, cust_last_name | The customer's email username matches the buyer's name. |
| 8f3efa77 | user | bad | cust_email, cust_first_name, cust_last_name | Customer's email doesn't match buyer's name. |
| 4b2cf8e9 | user | good | cust_email, ship_ad_first_name, ship_ad_last_name | The customer's email username matches the shipping address name. |
| 56c46c84 | user | bad | cust_email, ship_ad_first_name, ship_ad_last_name | The customer's email username doesn't match the shipping address name. |
| 3e2b0ba4 | transaction | bad | ip | The transaction amount ({{trans_eur_amt}} EUR) is high compared to the IP country's GDP per capita. |
| 3645f596 | transaction | good | ip | The IP geo location is tagged as accurate, which could indicate a DSL connection. |
| ea393e87 | transaction | neutral | ip | The IP geo location is tagged as inaccurate, perhaps due to the usage of a mobile IP. |
| 65171929 | geo | good | bill_ad_ctry | The IP address and the billing address are located in the same city. |
| 9d396953 | geo | good | bill_ad_ctry | The IP address and the billing address are located in the same country and in close proximity (within a 50 km radius). |
| e5d79894 | geo | good | bill_ad_ctry | The IP address and the billing address are in close proximity (same or similar zip codes). |
| 4aaf6684 | geo | good | ship_ad_ctry, bill_ad_ctry | The IP address, the billing address, and the shipping address are in relatively close proximity within the same country, less than 250 km apart. |
| e4278a6a | geo | bad | ship_ad_ctry, bill_ad_ctry | The IP address, the billing address, and the shipping address are in the same country, but not in close proximity. There is an average distance of more than 1000 km between them. |
| 2df07b79 | geo | good | bill_ad_ctry | The IP address, the billing address, and the shipping address are located in the same city. |
| e222accb | geo | good | ship_ad_ctry, bill_ad_ctry | The IP address location, the billing address, and the shipping address are in close proximity, sharing the same or similar zip codes. |
| 9d0f3744 | geo | bad | ship_ad_ctry, bill_ad_ctry | The IP address, the billing address, and the shipping address are located in different countries. |
| 3efabbaa | geo | bad | ship_ad_ctry, bill_ad_ctry | The IP address, the billing address, and the shipping address are located in different countries, with an average distance of more than 2000 km between them. |
| 899ade1c | geo | bad | ship_ad_ctry, bin_ctry | The shipping address country has a significantly lower GDP per capita compared to the IP and BIN country. |
| 52488fad | transaction | bad | ip | There's a time difference between the IP hour and the browser hour, which could indicate proxy usage. |
| d5ce9721 | transaction | good | ip | There's no time difference between the IP hour and the browser hour, which indicates lower probability of using a proxy. |
| 40695357 | user | good | ip | This IP address appears to be controlled (corporate/business IP). |
| cadcdf1c | user | good | ip | This IP address appears to be a university IP, which is somewhat controlled. |
| fb1ccd41 | user | good | ip | This IP address appears to be controlled (goverment/military IP). |
| 8ad3d8dc | user | bad | ip | This IP address was detected to be a proxy. |
| f3429009 | user | good | ip | The IP address appears to be travel related (hotel, airport, or similar). This could be a good signal in the right context. |
| cbfaef30 | geo | good | cust_email | The email's top-level domain contains a country code that matches the country of the ip address. |
| 9bc9b4ae | geo | bad | cust_email | The email's top-level domain contains a country code that mismatches the country of the ip address. |
| 9ca30efb | transaction | bad | ip | The IP geo location comes from a country in which we've encountered a lot of fraud recently. |
| d6521162 | transaction | bad | ip | The IP hour of the purchase is at night. This might indicate a usage of a proxy IP. |
| 3b1a0d57 | transaction | technical | ip | The IP address is missing. It is difficult to detect fraud without this datapoint. |
| 6f137a60 | geo | good | ship_ad_ctry | The IP address and the shipping address are located in the same city. |
| ff993b87 | geo | bad | ship_ad_ctry | The IP address and the shipping address are located in the same country but not in close proximity. |
| 5c02ad56 | geo | good | ship_ad_ctry | The IP address and the shipping address are located in neighboring countries with similar GDPs per capita. |
| 22a7fca0 | geo | good | ship_ad_ctry | The IP address and the shipping address are located in neighboring countries with similar GDPs per capita. |
| 477670af | geo | good | ship_ad_ctry | The IP address and the shipping address are in close proximity (same or similar zip codes). |
| 7bf40dc9 | transaction | bad | is_3ds_approved | The card did not pass the 3-D Secure authentication. |
| 64fd555d | transaction | neutral | is_3ds_approved | The card partially passed 3-D Secure authentication. |
| 05fea1a3 | transaction | good | is_3ds_approved | The card fully passed 3-D Secure authentication. |
| 5f586394 | seller | technical | slr_ind, slr_ind_cat, slr_ind_mcc, seller_id, sub_seller | Merchant's industry wasn't provided. This can reduce the Engine's accuracy. |
| 42c88b13 | seller | neutral | slr_ind, slr_ind_cat, seller_id, sub_seller | User is purchasing digital goods. |
| 70925e88 | user | technical | cust_email, cust_scndry_email, cust_first_name, cust_last_name, phone | Customer details (email, name, phone) are missing. It is difficult to detect fraud without these details. |
| 7fb64382 | user | technical | cust_email, cust_scndry_email | Customer's email is missing. It's difficult to detect fraud without the email address used for the purchase. |
| c092ddaf | user | technical | cust_email, cust_scndry_email, cust_first_name, cust_last_name | Customer details (email, name) are missing. It is difficult to detect fraud without these details. |
| eadd1eec | user | technical | cust_email, cust_scndry_email, phone | Customer details (email, phone) are missing. It is difficult to detect fraud without these details. |
| 4ec32864 | user | technical | cust_first_name, cust_last_name | Customer's name is missing. It's difficult to detect fraud without the name of the buyer. |
| 3a32d49e | funding_source | technical | cc_num, cc_num_frg_token, cc_num_hash | No funding source (credit card or bank) was provided for this transaction. This reduces our engine's performance. |
| 2f236b5a | funding_source | technical | cc_first_name, cc_last_name, cc_cardholder | The card holder name was not provided. This reduces our ability to verify legitimate credit card usage. |
| 4d56bcd9 | user | technical | phone | Customer's phone is missing. It's difficult to detect fraud without the customer's phone number. |
| b05efb6b | user | bad | cust_first_name, cust_last_name, bill_ad_line1, ship_ad_line1 | The writing format of the customer name is different from the writing format of one of the addresses. |
| 1deb96c0 | geo | good | phone, bin_ctry | The phone number provided by the customer comes from the same country as the card. |
| 922bea02 | geo | bad | phone, bin_ctry | The phone number provided by the customer comes from a different country than the card. |
| 2b2dab80 | geo | good | phone | The phone number provided by the customer comes from the same country as the ip address. |
| 583c5314 | geo | bad | phone | The phone number provided by the customer comes from a different country than the ip address. |
| bc9d0adb | geo | good | phone, bill_ad_ctry, ship_ad_ctry, bin_ctry | The phone number matches all other country information available in the transaction (billing and shipping address, BIN country, ip address country). |
| 61d18b63 | geo | good | phone, bin_ctry | The phone number matches the ip address and the BIN country. |
| a7c62a75 | geo | good | phone, bin_ctry, bill_ad_ctry | The phone number matches the ip address country, the billing address country and the BIN country. |
| a5ada3d3 | geo | bad | phone, bill_ad_ctry, ship_ad_ctry, bin_ctry | The phone number mismatches all other country information available in the transaction (billing and shipping address, BIN country, ip address country). |
| 2c94ffca | geo | good | phone, ship_ad_ctry | The phone number provided by the customer comes from the same country as the shipping address. |
| c07773aa | geo | bad | phone, ship_ad_ctry | The phone number provided by the customer comes from a different country than the shipping address. |
| 93dc0963 | user | bad | phone | Phone number provided appears to be invalid. |
| 2d700358 | seller | technical | slr_crncy, slr_ctry | Merchant's country and default currency were not provided. This can reduce the Engine's accuracy. |
| 16143a57 | geo | good | ship_ad_ctry | Based on past trends, the shipping address country does not belong to a known high-risk region. |
| 11f4c44e | geo | bad | ship_ad_ctry | The shipping address country belongs to a known high-risk region connected to fraud trends. |
| 7d01e21d | geo | bad | ship_ad_city | The shipping address is in a big city (population > 500,000) where fraud rates tend to be higher. |
| 73490066 | geo | good | ship_ad_city | The shipping address is in a small city (population < 10,000), where fraud rates tend to be lower. |
| 4407ecc6 | geo | good | ship_ad_city | The zip code provided by the user matches the shipping address city. |
| c579970c | geo | good | ship_ad_city | The zip code provided by the user does not match the shipping address city. |
| 95e8ac25 | transaction | neutral |  | The customer's last login to their account was less than 30 days ago. |
| 2834bf3b | transaction | neutral |  | The customer's last login to their account was less than 1 day ago. |
| f47d927b | transaction | good |  | The last login to the account was over 90 days ago. This indicates that the user is an old not very active customer. |
| e5068e1e | transaction | neutral |  | The customer's last login to their account was over 30 days ago. |
| 0c5ccfd3 | transaction | bad | trans_amt | The transaction amount is very high. |
| 139b7f0e | transaction | good | trans_amt | The transaction amount is low for this seller. |
| 68fec9be | transaction | bad | trans_amt | The transaction amount is high for this seller. |
| 1e726fd4 | transaction | bad | trans_amt | The transaction amount is high for this seller. |
| 842205f2 | transaction | bad | trans_amt | The transaction amount is high for this seller. |
| 3ad3a298 | transaction | bad | trans_amt | The transaction amount is slightly high for this seller. |
| 001300aa | transaction | bad | trans_amt | The transaction amount is high for this seller. |
| e1fcb1c0 | transaction | bad | trans_amt | The transaction amount is high for this seller. |
| 12c8c6f5 | transaction | bad | trans_amt | The transaction amount is high for this seller. |
| f19900f3 | transaction | neutral | bill_ad_last_name, bill_ad_first_name, ship_ad_first_name, ship_ad_last_name, cust_first_name, cust_last_name, cust_email | The transaction is likely to be a test transaction. |
|------|------|------|------|------|