7 Fraud prevention

The 1cs online payment system supports many methods of automated fraud prevention, because the risk of non-payment is four times higher for Internet orders than for traditional mail order business. Therefore, merchants are well advised to check orders carefully, especially for new customers. The 1cs online payment system can largely automate this check. The use of fraud prevention is an optional feature that must be ordered separately.

You can use fraud prevention to block card, account or device data, view blocked card, account or device data, approve credit card ranges and view approved credit card ranges. As an additional security measure, you can have payment rules (velocity checks) set up.

Velocity checks are checks of parameters that are automatically queried before each transaction is created. For example, you can set up that a maximum of two payments are allowed with the same credit card in a set time. In the application, you can then use the SecurePay negative list to search for temporary blocking entries of the payment rules (velocity checks) and delete them.

With the positive list SecurePay you can free card, account or device data from the payment rules (velocity checks). These card, account or device data can then be used to create transactions without any restrictions.

Deleting list entries

You cannot delete list entries. To delete list entries, contact First Cash Solution Support. You can unblock card, account, or device data by switching the status of the list entry to inactive.

7.1 Display blocked card, account or device data (negative list)

The 1cs online payment system can block certain credit card numbers and account details for you, so that you can protect yourself from orders with fraudulent accounts and cards. You must manually manage the negative list used for this purpose.

Experience shows that fraudsters use the same card and account details over and over again. In addition, there are customers who repeatedly pay by direct debit even though their account is not covered. Both cases not only cause a lot of effort and costs for return debits, often these problems lead to a complete loss of sales. You can avoid this by blocking the critical account link.

Credit cards offer greater protection than direct debits, because the 1cs online payment system checks the card limit and the banks’ blocking list for each credit card authorization. However, if you have had a bad experience with certain customers and cards, you can block these credit cards directly in your 1cs Online Payment System checkout. This protects you from repeated trouble with notoriously difficult customers.

The Fraud Prevention→ Negative List tab lets you search and filter blocked card, account, or device data. You can set filters on the time period and blocking characteristics. You can also block specific card, account, or device data in the application so that you can protect yourself from orders with fraudulent card, account, or device data. You have the option to open the detailed view of the list entry for all blocked card, account or device data to get all information about the blocking characteristics.

 

Period selection area: Specify with the from and to combo boxes.

Select the “Locking characteristics” selection area:  Locking characteristics describe the type of locking. You can set three different locking characteristics: Locking Type, Specific Details, and Status.

Select lock type:

You can use different selection areas to decide which criteria you want to filter by. The selection areas Locking characteristics and Specific details are described additionally below.

Locking type	Description
Map	Blocked credit cards
Account data	Blocked account data
Device ID	Locked Device IDs of a device

Select specific details

Explanations of the specific details can be found in the “Specific details” table below.

  Input field next to the “No specific detail” combo box

In the input field next to the “no specific detail” combo box, you can limit the search to a character string. The string entered depends on the specific detail selected in the “no specific detail” combo box.

Specific detail	Description
Card number	The card number is the number on the bank card that allows a unique assignment
IBAN	An IBAN is a standardised international bank account number and is used to identify a bank account. The IBAN is comprised of the bank code, the previous account number, the country code (DE for Germany) and the two-digit validation code
Account number @ bank code	The account number is a country-specific number and is used to identify a bank account. The bank code is a reference number used in Germany and Austria, which allows unique identification of the credit institute.
Device-ID	The device ID is the ID of the device in Computop Paygate, which allows a unique assignment of the end device

Select status:

Status	Description
Locking active	The lock is active
Lock inactive	The lock is inactive

Open detailed view of a list entry

In the search results, you can call up the detailed view for each list entry. In the detailed view, you are given further information about the blocking characteristics. You can also deactivate the blocking in the detailed view of the list entry.

To call up the detailed view of a list entry, select the values in the selection areas and click on the Search & Filter button.
Then click on the value in the Listed value column for the view of the desired list entry.

Switch blocking of card, account or device data active/inactive

To unlock card, account or device data, open the detailed view of a locked list entry and click the Change details button. Now select Locking active or Locking inactive and confirm your entry.

Export search results

Finally, you can also click the Upload CSV button in the filter dialog. You then have the option of uploading a local file with a comma-separated list containing the desired blocking data in the Select file field, which you then transfer to the Dealer Cockpit by clicking the Upload CSV button again.

7.2 Block card, account or device data (negative list)

Options to block card, account or device data

The Merchant Cockpit transaction list offers several options for blocking accounts and cards.
– You can create a new list entry via the Fraud Prevention → Negative List tab using the New List Entry button.
– You can upload a CSV file containing multiple card, account, or device details
– You can add card, account or device data to the negative list in the detailed view of a transaction using the Lock button.

To add a new list entry to the negative list, open the Fraud prevention -> Negative list tab. Then click the New list entry button.

Locking type	Description
Map	Block credit card number; you can optionally: – a complete credit card number – a so-called pseudo card number (16 digits, starting with “0”) – or the beginning of a credit card number (the first 6 to 9 digits) to the negative list.
IBAN	Lock IBAN
Device ID	Lock device ID of a device

“Listed value” input field

The entered character string depends on the previously selected blocking characteristic in the “Blocking type” combo box.

Then enter the card number, IBAN or Device ID in the Listed value input field and click Add button. If you want to unblock the card again, you must make the list entry inactive.

Lock multiple card, account, or device data using a CSV file

The Upload CSV button allows you to lock multiple card, account, or device data using a CSV file. To do this, collect transaction data such as credit card number, account number or IP address in a CSV file that you can upload in the application. For a detailed explanation of the CSV file structure, see the Compiling a CSV file for import chapter.

When you upload a CSV file in the application, the application creates the blocks stored in the CSV file in the form of list entries. To block multiple card, account or device data using a CSV file, click the Upload CSV button located in the Fraud Prevention -> Negative List tab. The application will check the CSV file. If the CSV file is invalid, a message in red will appear with the cause of the error. If the CSV file is valid, the blocks are created in the form of list entries in the negative list.

Example CSV file for negative list
Here is an example of how a special credit card number, two credit card ranges and a pseudo card number can be placed on the negative list using a CSV file.

blacklist.csv

CC,4111111111111111
CC,411111 CC,422222222
CC,0123456789012345
EDD,DE1212345678123456789

Calling up the detailed view of a transaction
Using the tabs View transactions → Transactions, View transactions → Transaction details and the Global search, you can call up the detailed view of a transaction via the search results by clicking on the merchant transaction number. In the detailed view, you can get more information about customer and transaction data. In addition, you can add further actions to the transaction in the detailed view, such as bookings or credit notes. If a transaction was carried out with a credit card, you can block the credit card in the detail view. If you want to unblock the credit card, you have to remove the credit card in the fraud prevention (negative list).

Locking card, account, or device data using the details view of a transaction.
To lock card, account or device data using the detail view, open the detail view of a transaction and click the Lock button next to the card number, in the Card data section.

7.3 Search and manage approved credit card BIN areas (positive list)

The positive list is not a direct equivalent to the negative list, but functions as a global positive list based on BIN information. The BIN (Bank Identification Number) comprises the first 6 digits of a credit card number. The BIN uniquely identifies the card type as well as the country and the issuing bank (issuer) of a credit card. The structure of the BIN is defined in the ISO 7812 standard.

To search for already released BIN details, execute the Fraud prevention command in the main menu of the Merchant Cockpit and then click on the Positive list tab. In the Filter area, use the From and To combo boxes to set the time period of the query. In the Transaction Characteristics area, you can enter a specific BIN to search for. Click on the Search & Filter button to perform the query.

Note: Select the query period as large as possible, because you are searching for the date of creation of a positive entry. Otherwise, if its creation is longer ago, you will not find the entry, even if it is still valid.

To add further positive entries, click on the New list entry button. In the following dialog you can define an entire BIN range in two input fields, which then appears as a positive entry after clicking on Add entry.

Select “Period” selection area
If you click in the input fields of the date, a calendar opens, in which you can select a date. If you click in the input fields of the time, you can define a time for the search.

Selecting the “Transaction characteristics” selection area
The transaction characteristic allows you to narrow down the search to a specific BIN. You cannot search credit card BIN ranges. BINs can be entered as follows: 100020.

Creating an approved credit card area in the positive list
To add a new list entry to the positive list, click the New list entry button.  Then enter the necessary data and confirm the entry with the Add entry button.

  Input field BIN Range

You must narrow down the credit card BIN range using the “From” and “To” input fields. Credit card BIN range can be entered as follows: 100000 – 100010.

Allow multiple credit card ranges using a CSV file.
The Upload CSV button allows you to allow multiple credit card ranges using a CSV file. To do this, collect the credit card areas in a CSV file that you can upload in the application. For a detailed explanation of the CSV file structure, please refer to the chapter Compiling CSV file for import.

Export search results
To export the search results, select the values in the selection area and click the Search & Filter button. The search results will be made available for download as an Excel spreadsheet by clicking the Export button.

7.4 Show card, account or device data blocked by payment rules (Velocity checks) (Negative list SecurePay).

In contrast to the negative list that you maintain manually, the SecurePay negative list is only a temporary block list that is automatically generated by the 1cs online payment system and implements certain specifications from your merchant configuration in it. For example, as an additional security measure, you may have agreed that a maximum of two payments per day are allowed with the same card. These are so-called “velocity checks”. When such a limit is reached, the card or IP address feature in question is automatically added to this list and also automatically removed again.

  Create payment rules

Velocity checks can only be created and viewed by First Cash Solution Support. Contact First Cash Solution Support to change, create or remove velocity checks.

With the tab “Fraud prevention -> Negative list SecurePay” you cannot make any new entries manually, but only search for blocked entries and delete them manually. In this way, for example, a support employee of the merchant can unblock a temporarily blocked card in case of a request, in order to enable a further payment with it after all.

To search for temporary blocking entries, execute the Fraud Prevention command in the main menu of the Merchant Cockpit and then click on the Negative List SecurePay tab. First, use the From and To combo boxes to set the period in question, for example, the current day. In the Blocking Characteristics combo box, specify the criteria you want to search for. For example, you know the account/card number, a blocked IP address, or some other parameter that specifies a reference number or merchant transaction number. Enter the desired search term in the input field to the right of it and click the Search & Find button. Now click on the relevant value to switch the blocking to inactive in the detail view.

Auswahlbereich Zeitraum auswählen
Wenn Sie in die Eingabefelder des Datums klicken, öffnet sich ein Kalender, in dem Sie ein Datum auswählen können. Wenn Sie in die Eingabefelder der Uhrzeit klicken, können Sie eine Uhrzeit für die Suche festlegen.

Spezifische Details auswählen
Die spezifischen Details werden in der nachfolgenden Tabelle angezeigt.

  Input field next to the “no specific detail” combo box

In the input field next to the “no specific detail” combo box, you can limit the search to a character string. The string entered depends on the specific detail selected from the “no specific detail” combo box.

Specific detail	Description
Account details/Card number	The account number is a national number used to identify a bank account. The card number is the number on the bank card that enables unique assignment.
IP address	The IP address is a standardized string of characters that can be used to uniquely identify each terminal device on the Internet.
Parameter	The payment rule (Velocity check), which was violated
IP and account data/(pseudo) card number	The IP of the device, account or card number or the customer.
Device ID	The Device ID is the ID of the device in the application, which enables a unique assignment of the end device

Open detailed view of a list entry SecurePay.
In the detailed view, you will be given more information about the blocking characteristics. In the detailed view of the list entry, you can also unblock the entry or remove the payment rules (velocity checks) from the card, account or device data contained in the entry.
To call up the detailed view of a list entry, select the time period and the blocking characteristics and click on the Search and filter button.You can then call up the detailed view for each list entry by clicking on the value in the Listed value column.

Export search results
To export the search results, select the values in the selection area and click the Search & Filter button. The search results will be made available for you to download as an Excel spreadsheet by clicking the Export button.

7.5 Show card, account, or device data exempt from payment rules (Velocity checks) (Positive list SecurePay).

The entries stored as positive list SecurePay do not concern the direct release or blocking, but control the behavior of the checks performed by the 1cs online payment system, the so-called velocity checks. Entries recorded here ensure that the automated security checks are excluded for these cards or IP addresses. Thus, transactions for these cards and IP addresses always remain permissible. For example, you can store the IP addresses of individual large corporate customers here so that the restriction on orders permitted at short intervals does not apply there.

To check and edit the positive list for SecurePay, execute the Fraud prevention command in the main menu of the Merchant Cockpit and click on the SecurePay positive list tab. For the search, you can again first narrow down the period in question using the two combo boxes from and to. In the combo box of the transaction characteristics, select the Account/Card Number or IP Address setting. Enter the search term in the field to the right of it and execute the search by clicking on the Search & Find button.

Select period selection area
If you click into the input fields of the date, a calendar opens, in which you can select a date. If you click in the input fields of the time, you can set a time for the search.

Select specific details
The specific details are displayed in the table below.

  Input field next to the “no specific detail” combo box

In the input field next to the “no specific detail” combo box, you can limit the search to a character string. The string entered depends on the specific detail selected from the “no specific detail” combo box.

Specific detail	Description
Account/Card Number	The account number is a national number used to identify a bank account. The card number is the number on the bank card that enables unique assignment.
IP adress	The IP address is a standardized character string that can be used to uniquely identify any terminal device on the Internet.
Device ID	The device ID is the ID of the device in the application, which enables a unique assignment of the end device.

Add a new list entry to the SecurePay positive list.
To unlock certain values yourself, click on the New List Entry button. In the following dialog, in the Lock type combo box, first decide whether the release should be for an account/card number or an IP address. As Listed value you then enter the respective number below. Click on the Add entry button to enter the release in the list.

Lock type

Locking type	Description
Card	Block credit card number
IBAN	Lock IBAN
Device-ID	Lock device ID of a device

Exempt multiple card, account or device data from payment rules using a CSV file. Adding multiple entries can alternatively be done by uploading a comma separated list file by clicking the Upload CSV button. The Upload CSV button allows you to exempt multiple card, account or device data from the payment rules using a CSV file. To do this, collect data such as credit card number, account number or device ID in a CSV file that you can upload in the application. For a detailed explanation of the structure of the CSV file, see the chapter Compiling a CSV file for import.

Open detailed view of a list item
To open the detailed view of a list entry, select the values in the selection area and click the “Search & Filter” button. In the “Listed value” column, you can now click on the desired list entry.
The blocking characteristics show you the creation date and the permitted credit card range of the list entry.

Export search results
To export the search results, select the values in the selection area and click the Search & Filter button. The search results will be made available for you to download as an Excel spreadsheet by clicking the Export button.


Parameter assignment

Name in Merchant Cockpit	Related OPS-Parameter
Merchant	MerchantID
Payment-ID	PayID
Merchant reference number	TransID
Reference number	RefNr
Pseudo card number, also PCN/ substitute card number	PCNr

7.6 Assemble CSV file for import

CSV stands for the expression Comma Separated Values. A CSV file is a text file with values separated by commas. The easiest way to create a CSV file is to use a spreadsheet application such as Microsoft Excel. In the application, you can use a CSV file to lock multiple card, account, or device data, exempt them from payment rules, or allow multiple credit card ranges. To do this, collect data such as credit card number, account number, or device ID in a CSV file that you can upload in the application.

CSV file you can upload in the application on the following tabs:

• “Fraud Prevention” → “Negative list”
• “Fraud Prevention” → “Positive list”
• “Fraud Prevention” → “Posiive list SecurePay”

In the example below you can see how to build a CSV file so that the application can process it..

Strucutre:
EDD,IBANCC,CardNumber
DID,DeviceID
– without HEAD and Foot

Ex.:
EDD,DE11770500000123456789
CC,4444333322221111
CC,4111111111111111
DID,123456ABC

When you click the Upload CSV button, the following box will open. Click Browse, select your desired file and upload it.