Banking Factors for Mobile Application Events in OneSpan Risk Analytics for Digital Banking

Checks if the operating system (OS) version is new for the bank.

Checks if the device model code no longer matches the registered code.

Checks if the device state is the same as for the previous event received for the device.

Checks if Wi-Fi is enabled on the device (as received in the CDDC event).

Checks if mobile data is enabled on the device (3G/4G).

Checks if it is the first event received from this device for this customer.

Checks if the OS is encrypted.

Checks if it is the first event sent over the GSM network for the bank.

Depends on the availability for the mobile device.

Checks if the GSM network used in the previous event was the same for the same relationship_ref value.

Number of bank customers linked to this device.

Checks if geolocation is enabled for the device.

Checks if the device supports a SIM card.

Checks the number of events received from this device using this SIM card ID.

Distance in km from the previous mobile event for the same relationship_ref value. The distance is calculated based on the latitude and longitude.¹

Checks if the country used in the previous event (NME or TXN) is the same for the same relationship_ref value.

Checks the number of events received for this customer using this city.

Average number of sessions opened within a week during the last period (default value: six months).

Time (in seconds) elapsed since the last session was closed (time since the event in the previous session).

Number of requests submitted in the current session.

NME/TXN between 9 a.m.and 12 a.m.

NME/TXN between 3 p.m. and 6 p.m.

NME/TXN between 9 p.m. and 12 p.m.

NME/TXN between the 1^st and the 10^th day of the month.

Checks if the application UID is new for this customer..

Checks if the version of the application is new (i.e. not known to the bank).

Checks the number of days since the release date.

Checks if the application is PIN-protected (as received in the CDDC event).

Checks if PIN protection is the same as for the previous event for the same relationship_ref and application UID values.

Checks if the application is fingerprint-protected (as received in the CDDC event).

Checks how often the fingerprint protection has changed in the last week.

Checks if face protection is the same as for the previous event for the same relationship_ref and application UID values.

Checks if the face of the end user has been enrolled.

Checks the face recognition verification score computed during the authentication. The value must be between –1 and 1, >=0 means authenticated.

Checks how often spoofing attacks were detected on the device for the last period as defined (short, medium, long time).

Default values:

• short time: one week

• medium time: one month

• long time: three months

Checks if the application is user-behavior-protected.

Values: BEHAVIOR_PROTECTED=

• 0: disabled

• 1: client only (not applicable – reserved future use)

• 2: client/server

Checks how often user behavior protection has changed in the last week.

Checks the user behavior verification score computed during the authentication. The value ranges from 0 to 1.

This factor is deprecated. OneSpan recommends using directly the input field BEHAVIOR_SCORE which provides the same information.

Checks the type of protection(s) used for OTP generation.

The value is a combination of one or more protection type bitmask values below:

• 1: No Password

• 2: Password

• 4: User Fingerprint

• 8: Face Recognition

• 16: User Behavior

Checks if an event with PIN protection related to the customer has been received during the last period as defined (short, medium, long).

Default values:

• short time: one week

• medium time: one month

• long time: three months

Checks if an event with face recognition protection related to the customer has been received during the last period as defined (short, medium, long).

Default values:

• short time: one week

• medium time: one month

• long time: three months

Checks the number of OTPs generated by the customer with NO PIN protection during the last period as defined (short, medium, long).

Default values:

• short time: one week

• medium time: one month

• long time: three months

Checks the number of OTPs generated by the customer with fingerprint protection during the last period as defined (short, medium, long).

Default values:

• short time: one week

• medium time: one month

• long time: three months

Checks if the application is using a secure element (hardware) to store secret keys.

Checks if the application is App Shielding-protected.

Checks the number of different connected Wi-Fi BSSID during the last period as defined (short, medium, long).

Default values:

• short time: one week

• medium time: one month

• long time: three months

Checks the number of events received for the customer app using this launcher ID (Android only).

Checks if the host application was repackaged.

Only for App Shielding applications running under iOS.

Checks the number of events with an attached debugger received for the customer during the last period as defined (short, medium, long).

Default values:

• short time: One week

• medium time: One month

• long time: Three months

Only for App Shielding applications running under iOS.

Checks if a screenshot of the application has been taken.

Only for App Shielding applications running under iOS.

Checks the number of events with a detected screenshot received from the device during the last period as defined (short, medium, long).

Default values:

• short time: One week

• medium time: One month

• long time: Three months

Only for App Shielding applications running under iOS.

Checks the number of events with a detected library injection received for this customer during the last period as defined (short, medium, long).

Default values:

• short time: One week

• medium time: One month

• long time: Three months

Only for App Shielding applications running under iOS.

Checks the probability that the device has been rooted using heuristics. The value ranges from 0 and 100.

Only for App Shielding applications running on Android.

Checks if the keyboard is untrusted.

Only for App Shielding applications running on Android.

Checks the number of events with an untrusted keyboard received from the device during the last period as defined (short, medium, long).

Default values:

• short time: One week

• medium time: One month

• long time: Three months

Only for App Shielding applications running on Android.

Checks the number of events with an untrusted screen reader received for the customer during the last period as defined (short, medium, long).

Default values:

• short time: One week

• medium time: One month

• long time: Three months

Only for App Shielding applications running on Android.

Checks if one or more hooking frameworks are present in the process.

Only for App Shielding applications running on Android.

Checks the number of events with a detected hooking framework received from the device during the last period as defined (short, medium, long).

Default values:

• short time: One week

• medium time: One month

• long time: Three months

Only for App Shielding applications running on Android.

Checks the number of events with native code hooks present received for the customer during the last period as defined (short, medium, long).

Default values:

• short time: One week

• medium time: One month

• long time: Three months

Only for App Shielding applications running on Android.

Number of sessions using the current GSM network for this customer (i.e. relationship_ref). The number of sessions excludes the current one.

Number of sessions using the beneficiary or creditor for this customer (i.e. relationship_ref). The number of sessions excludes the current one.

Number of days since the first event sent by the customer (i.e. relationship_ref) from the city identified by GIS_CITY.

Number of days since the customer (i.e. relationship_ref) first used this device.

Number of days since the customer (i.e. relationship_ref) first used this beneficiary bank country.

Number of days since any customer of the bank first used the current OS version.

Status on a customer authentication that possibly occurs for the current event.

Possible values:

0: No Authentication.

1: Simple Authentication Failed

2: Simple Authentication Success

3: Strong Authentication Failed

4: Strong Authentication Success

Number of days since the last successful SCA for the current customer. Number of days since 1/1/1970 00:00:00 if the customer has never performed a strong authentication.

Number of days since the last successful SCA applied to XS2A consent for the current customer (i.e. relationship_ref) and the current TPP (i.e. tpp_ref). Number of days since 1/1/1970 00:00:00 if the customer has never performed a strong authentication to give XS2A consent to this TPP.

Number of days since the beneficiary became trusted for the current customer.

0 if the beneficiary is not or no longer trusted.

Checks if the GIS country of the event is the same as the country used for the previous web or mobile event in the session.

Number of failed login attempts by this customer during the last period as defined (short, medium, long).

Default values:

• short time: One day

• medium time: One week

• long time: One month

Average number of weekly successful logins of this customer in the last six months.

Checks if the number of logins of the current customer during the current week is higher than the average number of weekly logins (NumLoginCurrentWeek > AverageWeeklyLogin?).

Checks if the beneficiary account (e.g. IBAN) is on the list of known accounts used by this customer during the last period (default value: one year).

Checks if the beneficiary country is on the list of known beneficiary countries used by this customer during the last period (default value: six months).

Number of successful updates to contacts (create new or change existing fields) during the last week.

Checks if this beneficiary's IBAN is known to the bank.

Number of different accounts performing transactions to this beneficiary over the last week. It also checks if these are included in the whitelist.

Number of outgoing transfer attempts for this account over the last period as defined (short, medium, long).

Default values:

• short time: One week

• medium time: One month

• long time: Three months

Transfer sums of successful outgoing transfers for this account over the last period as defined (short, medium, long).

Default values:

• short time: One week

• medium time: One month

• long time: Three months

Number of successful outgoing transfers to the same beneficiary in the last period (default value: three months).

Number of failed outgoing transfers for this account over the last period as defined (short, medium, long).

Default values:

• short time: One week

• medium time: One month

• long time: Three months

Number of outgoing transfers from the customer to this beneficiary.

Standard deviations between the customer (i.e. relationship_ref) amount mean (for the last three months) and the current transaction amount.