Banking Factors for Mobile Application Events in OneSpan Risk Analytics for Corporate Banking

Checks if the operating system (OS) version is new for the bank.

Checks if the device model code no longer matches the registered code.

Checks if the device state is the same as for the previous event received for the device.

Checks if Wi-Fi is enabled on the device (as received in the CDDC event).

Checks if mobile data is enabled on the device (3G/4G).

Checks if the device ID used in the previous event was the same for the current session.

Checks if the OS is no longer encrypted. This means that previously, an event has been received where the operating system had been encrypted.

Checks if it is the first event sent over the GSM network for this corporation (i.e. relationship_ref).

Depends on the availability for the mobile device.

Number of bank corporations (i.e. relationship_ref) linked to this device.

Checks if geolocation is enabled for the device.

Checks if the device supports a SIM card.

Checks the number of events received from this device using this SIM card ID.

Distance in km from the previous mobile event for the same corporate user. The distance is calculated based on the latitude and longitude.¹

Checks if the country used in the previous event (NME or TXN) is the same for the same corporate user.

Time (in seconds) elapsed since the last session was closed (time since the event in the previous session).

Number of requests submitted in the current session.

NME/TXN between 9 a.m.and 12 a.m.

NME/TXN between 3 p.m. and 6 p.m.

NME/TXN between 9 p.m. and 12 p.m.

NME/TXN between the 1^st and the 10^th day of the month.

Checks if the application UID is new for this corporation (i.e. relationship_ref).

.

Checks if the version of the application is new (i.e. not known to the bank).

Checks the number of days since the release date.

Checks if the application is PIN-protected (as received in the CDDC event).

Checks if PIN protection is the same as for the previous event for the same corporate user and application UID.

Checks if the application is fingerprint-protected (as received in the CDDC event).

Checks how often the fingerprint protection has changed in the last week.

Checks if face protection is the same as for the previous event for the same corporate user and application UID.

Checks if the face of the end user has been enrolled.

Checks the face recognition verification score computed during the authentication. The value must be between –1 and 1, >=0 means authenticated.

Checks the quality of the captured samples during face verification. The value must be between 0 and 1.

Checks if the behavior protection is the same as for the previous event for the same corporate user and application UID.

Checks if the authentication server is trained to be able to authenticate the user’s behavior.

This factor is deprecated. OneSpan recommends using directly the input field BEHAVIOR_TRAINED which provides the same information.

Checks the confidence of the user behavior verification score computed during the authentication. The value ranges from 0 to 1.

This factor is deprecated. OneSpan recommends using directly the input field BEHAVIOR_CONFIDENCE which provides the same information.

Checks if the application is using a secure element (hardware) to store secret keys.

Checks if the application is App Shielding-protected.

Checks the number of different connected Wi-Fi BSSID during the last period as defined (short, medium, long).

Default values:

• short time: one week

• medium time: one month

• long time: three months

Checks if the host application was repackaged.

Only for App Shielding applications running under iOS.

Checks the number of events with an attached debugger received from the device during the last period as defined (short, medium, long).

Default values:

• short time: One week

• medium time: One month

• long time: Three months

Only for App Shielding applications running under iOS.

Checks the number of events with a detected screenshot received from the device during the last period as defined (short, medium, long).

Default values:

• short time: One week

• medium time: One month

• long time: Three months

Only for App Shielding applications running under iOS.

Checks the number of events with a detected library injection received from the device during the last period as defined (short, medium, long).

Default values:

• short time: One week

• medium time: One month

• long time: Three months

Only for App Shielding applications running under iOS.

Checks the average rooting probability for the last period as defined (short, medium, long).

Default values:

• short time: One week

• medium time: One month

• long time: Three months

Only for App Shielding applications running on Android.

Checks the number of events with an untrusted keyboard received from the device during the last period as defined (short, medium, long).

Default values:

• short time: One week

• medium time: One month

• long time: Three months

Only for App Shielding applications running on Android.

Checks the number of events with an untrusted screen reader received from the device during the last period as defined (short, medium, long).

Default values:

• short time: One week

• medium time: One month

• long time: Three months

Only for App Shielding applications running on Android.

Checks the number of events with a detected hooking framework received from the device during the last period as defined (short, medium, long).

Default values:

• short time: One week

• medium time: One month

• long time: Three months

Only for App Shielding applications running on Android.

Status on a customer authentication that possibly occurs for the current event.

Possible values:

• 0: No Authentication

• 1: Simple Authentication Failed

• 2: Simple Authentication Success

• 3: Strong Authentication Failed

• 4: Strong Authentication Success

Number of days since the last successful SCA for the current corporation (i.e. relationship_ref). Number of days since 1/1/1970 00:00:00 if the corporation has never performed a strong authentication.

Number of days since the last successful SCA applied to XS2A consent for the current corporation (i.e. relationship_ref) and the current TPP (i.e. tpp_ref). Number of days since 1/1/1970 00:00:00 if the corporation has never performed a strong authentication to give XS2A consent to this TPP.

Number of days since the beneficiary became trusted for the current corporation (i.e. relationship_ref.

0 if the beneficiary is not or no longer trusted.

Number of days since the last successful SCA for the current corporate user (i.e. user_ref).

Number of days since 1/1/1970 00:00:00, if the corporate user has never performed a strong authentication.

Number of days since the last successful SCA applied to XS2A consent for the current corporate user (i.e. user_ref) and the current TPP (i.e. tpp_ref). Number of days since 1/1/1970 00:00:00, if the corporate user has never performed a strong authentication to give XS2A consent to this TPP.

Number of days since the beneficiary became trusted for the corporate user (i.e. user_ref).

0 if the beneficiary is not or no longer trusted.

Number of days since last event for that contract (i.e. contract_ref).

Number of events successfully submitted by all corporate users (i.e. user_ref) for that contract (i.e. contract_ref) during the last period (default value: three months).

Number of days since the last successful SCA for the current corporate user (i.e. user_ref) with that contract (i.e. contract_ref).

Checks if the GIS country of the event is the same as the country used for the previous web or mobile event in the session.

Number of failed login attempts by this corporate user (i.e. user_ref) during the last period as defined (short, medium, long).

Default values:

• short time: One day

• medium time: One week

• long time: One month

Average number of weekly successful logins of the current corporate user over the last period (default value: six months).

Checks if the number of logins of the current corporate user during the current week is higher than the average number of weekly logins (NumLoginCurrentWeek > AverageWeeklyLogin?).

Number of successful updates to contacts (create new or change existing fields) during the last week.

Checks if this beneficiary's IBAN is known to the bank.

Number of failed attempts to create new beneficiaries for this corporate user (i.e. user_ref) during the last period (default value: six months).

Number of different accounts performing transactions to this beneficiary over the last week. It also checks if these are included in the whitelist.

Number of outgoing transfer attempts for this account over the last period as defined (short, medium, long).

Default values:

• short time: One week

• medium time: One month

• long time: Three months

Transfer sums of successful outgoing transfers for this account over the last period as defined (short, medium, long).

Default values:

• short time: One week

• medium time: One month

• long time: Three months

Number of successful outgoing transfers to the same beneficiary in the last period (default value: three months).

Number of failed outgoing transfers for this account over the last period as defined (short, medium, long).

Default values:

• short time: One week

• medium time: One month

• long time: Three months

Number of transactions the corporate user (i.e. user_ref) was able to successfully submit for that contract (i.e. contract_ref) during the last period (default value: three months).

Total amount of transactions the corporate user (i.e. user_ref) was able to successfully submit for that contract (i.e. contract_ref) during the last period (default value: three months).