An introduction to Connect, Ravelin's graph database for link analysis

What is Connect?

Ravelin’s graph database link analysis tool is called Connect. It uncovers hidden relationships between your users – making it excellent at spotting fraud rings, multi-accounting, ATO, suspicious new accounts and more.

Connect creates a graph of your customers using high-cardinality data points, such as emails, phone numbers, device IDs or payment methods.

It is used for machine learning features, as well as by human analysts: You can block users within a certain network, and you can conduct better manual reviews.

Connect serves a variety of use cases:

• Online payment fraud prevention
• Account takeover (ATO) prevention
• Voucher and promo abuse prevention
• Refund abuse prevention
• Detection of fraudulent insurance claims

Data points shown in Connect

These high-cardinality data points are entirely unique data points, which are unlikely to change. When two customers share an attribute, they will be connected in the network.

Depending on the use case, Connect can display these data points in the network:

Email address, telephone number, payment card ID, device ID, forms of ID, vehicles.

The graph can be enhanced to show additional information about customers including chargebacks or manual reviews. Connect also allows you to add a tag to customers (for example VIPs), and even search for customers with specific tags.

It’s also very easy to add new unique, sharable data points, dependent on your business case – just ask us.

What does a genuine customer look like?

Genuine customer networks have low connectivity of customers, no or very few chargebacks within the network, low network growth, and they are generally stable over time.

Below is a snapshot of a genuine customer network and the numerical data behind it. The network is five years old.

The network is relatively small – there is a connection between two users in a shared card, but there are no other users.

It’s also important to note that both users have several devices they use independently, rather than having few shared devices.

Using Connect to detect fraud, abuse and suspicious activity

Connect can be used to detect a range of fraudulent and negative user activity. Here are some examples.

Online payment fraud

With typical online payment fraud, also known as card-not-present (CNP) fraud, fraudsters create new accounts to appear as new customers and use stolen credit card details to make purchases.

Card details can easily be blocked, so fraudsters often buy hundreds or even thousands of card details.

We commonly see:

• Users adding multiple credit cards to an account to make new orders.
• One device being used to open lots of new accounts in a short space of time.
  

Often fraudsters will have used the same device or email in another account previously, and so when they open a new account it will be linked to their past activity.

Refund abuse

Refund abuse is not technically a form of fraud. However, there are still some serial offenders, and merchants lose a lot of money to it.

Fraudsters or even first parties can request refunds on most of their orders - sometimes up to 80%. In many cases, this means the merchant is losing money through the customer.

Connect allows you to:

• Tag customers abusing your refund policy
• At time of score, check each customers network for the tag (within a set distance)
• Offer different terms and conditions to protect yourself from abuse, or block users in refund abuse networks

A fake account network

Account takeover

A steady stream of data breaches and the widespread tendency for customers to reuse passwords have led to an increase in ATO activity.

You can use Connect to identify ATO networks through searching for:

• Multiple existing accounts being accessed from the same device
• Multiple accounts existing accounts suddenly becoming linked by new details (address, phone number)
  

Connect allows you to see when an account joined a network, so that you can investigate genuine accounts so that they can be recovered for the customer quickly.

Voucher abuse

Merchants often offer vouchers, referral schemes or promotions to attract new customers, especially during expansion. Fraudsters, or even genuine customers, may abuse the voucher system by attempting to use the same voucher multiple times with new accounts.

Using Connect, we can assign each voucher an ID to enable you to:

• Set limits on the number of uses per voucher
• Configure how many vouchers within a set network distance counts as abuse
• Apply different levels of control for different voucher types

Even though this activity is not strictly fraud, it’s important that merchants can stay in control, otherwise the cost of running promotional schemes may end up being wasted on people who are already users, instead of attracting new customers.

Claims abuse

Insurance firms can be vulnerable to claims abuse – for example, car insurers.

Customers either fake crashes or perform "crash for cash" schemes and submit excessive claims. This activity is often repeated with the same actors, vehicles and locations involved.

Connect can help the insurance merchant to act on this by:

• Tagging customers with claims and checking a customer’s network for the tag (within a set distance)
• When a policy is requested, offer different terms and conditions, adapt the pricing, or investigate further before offering a quote

Connect can supercharge your fraud strategy

Uncovering hidden connections between your users, Connect is a powerful tool in your fraud prevention strategy. Use it in several ways:

1. For manual reviews – giving you a complete picture of a shopper or user and their connections to others.
2. For machine learning features – link analysis from Connect is fed into Ravelin's ML models for improved efficacy.
3. During a fraud attack – by allowing you to quickly block every user associated with those identified as fraudsters.
4. Against bot-created networks of bad actors – when fraudsters automate their attacks using scripts or bots, Connect gives you the power to automate your response, even in the middle of the action.
5. To set up fraud rules – you can, for example, block any attempt at signing up for a new account from a certain email, or IP – and more.
   

Book a call with Ravelin to discover how Connect can be a game-changer in your fraud strategy.

Related links

• Guide: How to use graph networks effectively in fraud prevention
• Ravelin Insights: Link analysis & graph databases
• Webinar: Case study of a scripted fraud attack
• Six fraud signals to spot account takeover
• Webinar: How to use network analysis for fraud detection