论文标题
调查3-D Secure的欺诈检测模型
Investigation of 3-D Secure's Model for Fraud Detection
论文作者
论文摘要
背景。 3-D Secure 2.0（3DS 2.0）是身份联合协议，验证了网络上信用卡交易的付款启动程序。目的。我们旨在量化3DS 2.0在其欺诈检测决策过程中使用的因素的影响。方法。我们使用两个网站进行信用卡交易，系统地操纵名义IVS \ textsf {Machine \ _data}，\ textsf {valitsf {valie}，\ textsf {regionsf {regions}和\ textsf {weblity}。我们测量了用户是否为\ textsf {挑战}，具有身份验证，交易是否为\ textsf {dected}，以及该卡是否为标称DVS。结果。 \ textsf {weblots}和\ textsf {card}在很大程度上没有对任何结果显示出重大影响，但\ textsf {Machine \ _data}，\ textsf {valitsf {value}和\ textsf {regionsf {region}做到了。 \ textsf {Machine \ _data}，\ textsf {regions}或\ textsf {value}的更改的可能性是通过密码身份验证挑战的5-7倍。但是，即使在另一个因素发生变化的外国地区，受到挑战的总体可能性也只达到60美元\％$。当在卡的家乡地区，很少会拒绝交易（$ <5 \％$控制，$ 40 \％$ $，一个因素更改）。但是，在卡中的一个区域中，系统更有可能下降交易（约合$ 60 \％$），并且\ textsf {Machine \ _data}或\ textsf {value}的任何更改都将导致近乎确定的交易。 \ textsf {region}是被阻止卡的唯一重要预测指标（$ \ mathsf {or} = 3 $）。结论。我们发现，通过密码身份验证，拒绝交易和阻止卡的决定的决定受不同的权重管辖。 3DS 2.0最有可能降低交易，尤其是在外国地区。即使更改了\ textsf {Machine \ _data}或\ textsf {value}，也不太可能使用密码身份验证来挑战用户。
Background. 3-D Secure 2.0 (3DS 2.0) is an identity federation protocol authenticating the payment initiator for credit card transactions on the Web. Aim. We aim to quantify the impact of factors used by 3DS 2.0 in its fraud-detection decision making process. Method. We ran credit card transactions with two Web sites systematically manipulating the nominal IVs \textsf{machine\_data}, \textsf{value}, \textsf{region}, and \textsf{website}. We measured whether the user was \textsf{challenged} with an authentication, whether the transaction was \textsf{declined}, and whether the card was \textsf{blocked} as nominal DVs. Results. While \textsf{website} and \textsf{card} largely did not show a significant impact on any outcome, \textsf{machine\_data}, \textsf{value} and \textsf{region} did. A change in \textsf{machine\_data}, \textsf{region} or \textsf{value} made it 5-7 times as likely to be challenged with password authentication. However, even in a foreign region with another factor being changed, the overall likelihood of being challenged only reached $60\%$. When in the card's home region, a transaction will be rarely declined ($< 5\%$ in control, $40\%$ with one factor changed). However, in a region foreign to the card the system will more likely decline transactions anyway (about $60\%$) and any change in \textsf{machine\_data} or \textsf{value} will lead to a near-certain declined transaction. The \textsf{region} was the only significant predictor for a card being blocked ($\mathsf{OR}=3$). Conclusions. We found that the decisions to challenge the user with a password authentication, to decline a transaction and to block a card are governed by different weightings. 3DS 2.0 is most likely to decline transactions, especially in a foreign region. It is less likely to challenge users with password authentication, even if \textsf{machine\_data} or \textsf{value} are changed.
