Wolfpaw's Fraud Screening and Detection Module - Miva Merchant - v10.301
Installation and Configuration
Note:
The system extension and component/item versions of this module work with Miva v10.x only.
Description
New Features in Version 10.301 - For Miva 10.x and higher
How the Module Works
System Extension or Component Module - Which to Choose
Installation - System Extension Module Version
Installation - Component/Item Module Version
Module Configuration
Upgrading from Prior Versions
Tips and tricks
Description
Wolfpaw
has partnered with MaxMind, makers of the GeoIP® location
database, to bring the minFraud fraud screening and detection
system to Miva Merchant. For less than one-half cent per
query the minFraud system provides a risk score indicating
the probability that a order is fraudulent. The risk score is then used by the Wolfpaw Fraud Screening and Detection Module to accept or decline a potential order before sending the customer's information to the payment gateway for approval. Alternatively the merchant can use the notification emails to cancel orders after invoicing. This helps protect the merchant from chargebacks, excessive payment gateway fees, and reputation issues resulting from hackers testing card numbers, stolen cards, and various other forms of fraud.
The
risk score is based on a number of factors including:
geographical distance between the person placing the order and the
customer billing address; high
risk IP address analysis; location of customer's telephone
number; free and high-risk e-mail analysis; open proxy
detection; shipping remailer detection, and, according to MaxMind approximately 30 other risk factors.
More information on the minFraud system and risk scoring
Signup for a minFraud account
Buy Wolfpaw's Fraud Screening and Detection Module Now
New features in Version 10.301 - For Miva 10.x and higher
IP whitelisting - top asked-for feature. Take manual orders without triggering the module, damaging your IP's reputation or wasting MaxMind queries. Allows you to list IP addresses and networks to be whitelisted. Orders from whitelisted IPs will not trigger a fraud check.
IPv6 Compatibility - whitelist IPv6 addresses and networks. Works with and analyzes transactions from IPv6 customers.
New minFraud Service Levels - designed to support minFrauds new risk score, insights and factors service levels. Each provides the same quality risk score but differ in the level of supporting detail. Depending on the level you select in the module's admin panel the merchant email will provide much of that detail. Additional details are available in your account at MaxMind.
Extracts customer IP from http headers - Allows the module to obtain the customer's IP address and check for fraud even when the website is behind a proxy, content delivery network (CDN), load balancer, or translation server (e.g. Global Nimbus).
Uses Miva's global mailing configuration - module's merchant notifications are sent using the global mailing configuration in your domain settings.
Country blocking - uses the settings in your MaxMind account to allow or deny orders from any number of countries.
How
the Module Works
The system extension version of the module is integrated into Miva Merchant at the start of the OSEL (payment/shipping method selection) page. This insures all potential orders are checked - even orders using COD,
Simple Credit Card Validation and offsite credit card
entry gateways such as PayPal and Amazon. Fraudulent orders can then be declined prior to credit card authorization.
This can reduce your gateway fees, improve your merchant
decline ratio, refund ratio and chargebacks and possibly
qualifying you for lower credit card fees. This also works to help stop hackers testing credit cards.
The module collects data about the potenatial order - customer billing and shipping addresses, phone numbers, email addresses and most importantly the IP address being used - forwards it to MaxMind and instantly gets a response with a fraud score and information about the IP address and the order. That information includes the actual location of the person placing the order, the geographical distance between the IP address and the customers billing address, whether he/she is hiding behind anonymous proxy, whether he/she is using a free email account, whether the phone number matches the billing location, whether the shipping address matches the address of known remailers. The IP address is compared against a continually updated database of suspicious IPs. The fraud score that is returned represents MaxMind's determination of the probability that the order is fraudulent.
An email with the above information can be sent to you for all orders or only orders over a certain fraud score threshold. Likewise, the module can automatically decline orders over a certain fraud score. This is extremely helpful if you're getting bombarded by credit card testers - it just cuts them off - and helps prevent reputation issues with payment gateways and off-site payment systems like PayPal and Amazon.
The module allows you to whitelist IPv4 and IPv6 addresses. The module will not check fraud or generate a MaxMind query for an order from a whitelisted IP. Generally you'll want to whitelist your own IP and the IP's of your branch offices. That will also prevent fraud score issues when you process manual orders (e.g. geographical distance between you and your customer).
If your website is on a server that is behind a load balancer, a translation server, proxy server or content delivery network (CDN) you can select to have the module analyze the HTTP headers to find the customer's actual IP address and use that in the analysis. (Note: If this is turned on http headers are examined in the following order to extract the customer IP - http_client_ip, http_x_forwarded_for, http_x_forwarded, http_x_cluster_client_ip, http_forwarded_for, http_forwarded.)
To
protect against false negatives (loss of legitimate orders)
the module provides extensive logging, decline and email
notification thresholds and custom screens allowing merchants
to notify customers to check their billing and shipping
address entries and/or call to place their orders manually.
To
prevent module processing or minFraud server connection
errors from halting the checkout process the module can be configured
to email the merchant and accept all orders in the event
of an error (this is the default). Also, to prevent an
overly large log file from halting Miva Merchant the module
rotates the antifraud log file after it has reached 50MB's.
Until
you become familiar with the module we recommend that
you leave logging turned on, email notification threshold
set to '0%', and the decline threshold set to 100%. This
will insure that all legitimate orders are accepted and
you can manually review suspect orders before you ship.
Afterwards you can raise the email notification threshold
and lower the decline threshold to numbers you are comfortable
with.
System Extension or Component Module - Which to Choose
We provided you with two versions of the module: the system extension version and the component version. The system version is easy to install and is designed to do the fraud checking right after the customers shipping and billing addresses have been entered. That's typically the OSEL (or OUSL) page where the customer makes his shipping method selection. However, in cases where your pages have been redesigned and or renamed or you're using a one-page checkout the OSEL page may not exist. In that case the component version of the module needs to be used. This version installs as an 'item' and, with one line of code, can be placed on any page. Pick a page where the customer's billing and shipping addresses are known and place the 'item' at the top of the page. That's where the module will fire and conduct it's fraud analysis.
Installation - System Extension Module Version
1.
Download the module from the provided link and unzip on your
local PC. The name of the file is 'wp_antifraudv10301_module.mvc'. Note the location of the module file on your
local PC.
2.
Open your Miva admin and select Settings from the main menu.
3. Select Domain Settings.
4. Select Modules.
5. Click on Add Module.
6. Click on Upload.
7. Click on Choose File.
8. Find the module file wp_antifraudv10301_module.mvc click it and then click Open.
9. Now click Upload to upload the module to your store.
10. And Add to add the module in Miva Merchant.
11. Click on Update and a message appears indicating that the module has been updated.
12. Click on Settings and then Modules.
13. Scroll through your installed modules and find WP Fraud Screening and Detection and click on Install. This will install the module and display the configuration screen.
14. The configuration screen appears. See Configuration below to continue.
Installation - Component/Item Version
1.
Download the module from apps.miva.com and unzip on your local PC. The name of the file is 'wp_antifraudv10301_component.mvc'. Note the location of the module file on your local PC.
2. Open your Miva admin and select Settings from the main menu.
3. Click on Domain Settings.
4. Click on Modules and then Add Module to add a module.
4. Click on Upload.
5. Click on Choose File.
6. Find the module file wp_antifraudv10301_component.mvc. Click it to highlight the file and then click Open.
7. The Upload File window reappears. Click Upload and then Add to upload and install the module.
8. A message appears indicating that the module has been installed. Now click Information and insure the Active box is checked. Then select Settings and Modules.
9. Scroll through your installed modules and find WP Fraud Screening and Detection then click on Install. This will install the module and display the configuration screen. Instructions for configuring the component module are provided below. You can come back to the module's configuration screen by finding it in payment settings.
9. Now we'll install the component's item in the OSEL page. Click on User Interface on the left menu.
10. Select Templates, then Pages and then OSEL Checkout: Shipping/Payment Selection.
11. The code for the OSEL page appears. Add the following line to the top of the template code. If necessary, create an empty line by putting your cursor at the start of line 1 and pressing RETURN on your keyboard. Here's the code to enter:
<mvt:item name="wp_antifraud" param="fraud_check" />
Then click on Update and then Items at the top.
12. Scroll down the list of items and find wp_antifraud. The switch to On. It should turn green.
13. That completes the component module item installation. The module is now activated and assigned to the OSEL page. You can return to the main admin screen and complete the module configuration described below.
Module Configuration
Configuration is the same for the system extension and component/item versions of the module. To get to the configuration screen return to the admin home screen and click on Settings. Then select Payment Settings. The various payment modules are shown across the top of the screen. Click on WP Fraud Screening and Detection. If there are many payment modules you may need to click on the three dots ( ...) in order to find the module.
The module configuration settings are shown in the above image. A description
of each setting follows.
Module License: Check this box if you agree with the End User License Agreement. You must agree to use this module.
Enable Fraud Checking: Checking this box turns fraud checking on - otherwise it is off.
WP Antifraud Module Registration Code You should have received the registration code when you purchased the license. Enter it here.
MaxMind minFraud Account ID You need a minFraud account with MaxMind. Enter your Account ID here. You can signup with MaxMind at our affiliate signup page here
MaxMind License Key: In your MaxMind account portal navigate to the Account Manu and then 'Manage License Keys'. The click on Generate a new license key. The enter the license key here.
Select Transaction Reporting Depth: Maxmind in addition to the risk score, MaxMind provides three levels of detail - each at a slightly higher cost. See https://www.maxmind.com/en/solutions/fraud-prevention/plans-pricing for more information.
MaxMind Server URL: Maxmind uses https://minfraud.maxmind.com/minfraud/v2.0/. If MaxMind changes the URLs in the future you can make an adjustment here.
Email Notifications - Email From Address: The module is designed to send you merchant notifications by email. Enter the address you would like to have appear in the 'From' line of these emails.
Email Notifications - Email To Address: Enter the address(es) you would like to have merchant notification emails sent to. Separate multiple email addresses with commas.
Cart Behind a Proxy, Load Balancer, CDN: If your website is behind a proxy server, load balancer, content delivery network (CDN), or translation server the IP address of the device communicating with the website may not be that of the customer's browser. Checking this box will cause the module to scan the http request headers for the forwarded IP address of the customer.
The test results shown on the configuration screen will help determine if you need to enable this feature. Shown on the configuration screen is the the IP address of the device communicating with your website and the IP of your browser as extracted from the http headers. If these IP's are different you should enable this feature. Also, if you're using a translation service such as Global Nimbus you'll want this feature enabled.
Whitelisted IPv4 IP's: Enter the IPv4 addresses you want whitelisted. Separate multiple IP addresses with commas. You can enter network octets such as 192.168.12 to whitelist blocks of IP's. Queries will not be sent to MaxMind for orders from whitelisted IPs.
Whitelisted IPv6 IP's: Enter the IPv6 addresses you want whitelisted. Separate multiple IPv6 addresses with commas. You can enter IPv6 subnets with partial IPv6 address as long as they don't include double colons.
On Whitelisted IP - Email Notification: Check this box to be notified if an order is received from a whitelisted IP address.
On Whitelisted IP - Email Subject: The subject line that will be used in
merchant notifications emails for orders from a whitelisted IP addresses.
Enable Fraud Analysis Logging: This should be checked.
The log provides a complete record of the queries sent
to the MaxMind server and the responses sent back. The
log is automatically rotated after it reaches 50MB's -
approximately 50,000 queries.
Log File: Name of the log file. You can leave this as
is.
Risk Threshold for Merchant Notification Emails: You can set this
to 0% and get a fraud analysis email for every order or
minimize the emails by raising the threshold slightly.
You should set this to 0% at the outset so you can develop
an understanding of how the system works and the risk
scores for normal orders.
Click
on the thumbnails below for examples of merchant notification
emails.
Email Subject for Merchant Notification Emails: The subject line that will be used for
fraud analysis emails. The risk score and whether the order
was accepted or declined will also appear on the subject
line of the email.
Risk Threshold for Order Decline: The risk score (probability
the order is fraudulent) at which an order should be declined. You should set this to 100% to start and then lower it as you become experienced. Generally legitimate orders will have a risk threshold of under 0.50%. MaxMind recommends setting the decline threshold at between 3% and 5%. However, every merchant's customer base is different and you'll need to decide what's best for you.
Screen Message on Order Decline: Message that appears
on the screen notifying the customer his order is declined.
You can add html tags. Our default message asks the user
to call a telephone number for asistance. If you use this message be sure to include your correct phone
number.
On Processing Error - Order Disposition: In the event the module encounters
a processing error or cannot reach the MaxMind servers
you can either accept or decline orders. The recommended default is to accept orders.
On Processing Error - Email Notification: Enables merchant notification in the case of a processing error.
On Processing Error - Email Subject: Email subject for merchant notification in the case of a processing error.
Screen Message on Processing Errors: Message that appears
on the screen to the customer if the module encounters a processing
error.
Upgrading from prior versions
Due to changes in Miva's licensing system we recommend any previous versions of Wolfpaw's Fraud Screening and Detection module be deleted before installing this new version. Be sure to make a copy of your configuration data before deleting. Then use that data to configure the new module.
Tips and Tricks
You can block any number of countries from ordering on your website. Go into your MaxMind account and click on 'Country Block List.' All countries are listed. Change the radio button next to a country to 'Block' and the Risk Score for transactions originating from that country will be increased to 100.
Change
the 'email-to' address for notifications to your email
address and put your phone number in the screen decline
and processing error messages.
The
default email notification and decline threshold settings
are very conservative. The risk score for email notifications
is set to 0% - this means you'll get a fraud analysis
email for every order attempt. The risk score for order
decline is set to 100%. This means no orders will be declined
by the module.
After
you get used to the email notifications try raising the
risk score for email notifications to 3%. We find that
most legitimate orders have risk scores under 2%.
If
you want to block fraudulent orders from passing to your
payment gateway then reduce the risk score for order declines
to 30% - 40% to start and make sure the 'decline message' in the module's
configuration says what you want (correct phone number,
etc) - so a legit customer will call you if he accidently
gets blocked. MaxMind recommends using 3% - 5% as the decline threshold but you'll need to decide if that's right for you.
Mathematically
you can calculate the risk score to use. You'll want to
make sure that the average profit gained by accepting
an order is greater than the average cost of accepting
it. Here's a simplified formula to help you with this
calculation. Please note that this is a generalization
and does not apply in every case
If
(profit on the order) * (100 - riskScore) > (fraud
loss) * riskScore, then process the order.
Here
the 'profit on the order' is the money you would make
if the order is legitimate and the 'fraud loss' is how
much you would lose if the order were fraudulent (e.g.
shipping, chargeback fees, cost of goods, etc.).
On
a very simplified basis if you assume no shipping cost
or chargeback fees then if your gross margin is 25% you
would decline any order with a fraud probability higher
then 25%.
