Banking Factors for Web Application Events in OneSpan Risk Analytics for Corporate Banking

Checks if the IP address (IP) of the event is a new IP for all bank customers and corporate users of the bank.

Checks if the IP city of the event is a new IP city for all bank customers and corporate users of the bank.

Number of corporate users of all corporations of the bank linked to this IP address within the last monitoring period (default value: three months).

Checks if the ISP of the current session is a new ISP for this corporate user.

Checks if the IP country of the current session is a new IP country for this corporate user.

Number of distinct IP addresses used by the corporate user during the last monitoring period (default value: three months).

Number of distinct IP countries used by the corporate user (default value: three months).

Checks if the IP address of the event is the same as the IP used in the previous session.

Checks if the IP country of the event is the same as the IP country used in the previous session.

Checks if the IP address of the event is the same as the IP used in the previous event of the current session.

Checks if the IP country of the event is the same as the IP country used in the previous event of the current session.

Checks if the IP uses a corporate proxy.

Checks if the used device is the same as the first one used in the current session.

Checks if the device used in the session is a new device for this corporate user.

Number of different devices used by this corporate user during the last period.

Checks if the user agent is new for this corporate user.

Average number of sessions opened within a week by the corporate user during the last period (default value: six months).

Time (in seconds) elapsed since the last event of the previous corporate user session.

Number of requests submitted in the current session.

NME/TXN between 9 a.m. and 12 a.m.

NME/TXN between 3 p.m. and 6 p.m.

NME/TXN between 9 p.m. and 12 p.m.

NME/TXN between the 1^st and the 10^th day of the month.

NME/TXN after the 20^th day of the month.

Checks if this is a new cookie for all bank customers and corporate users of the bank.

Number of sessions using the IP address for this corporation (i.e. relationship_ref). The number of sessions excludes the current one.

Number of sessions using the device for this corporation (i.e. relationship_ref). The number of sessions excludes the current one.

Number of days since the corporation first used the IP address (i.e. relationship_ref).

Number of days since the first event sent by the corporation (i.e. relationship_ref) from the city is identified by IP_CITY.

Number of days since the corporation (i.e. relationship_ref) first used this device.

Number of days since the corporation (i.e. relationship_ref) first used this beneficiary bank country.

Number of a distinct corporation (i.e. relationship_ref) using the same device.

Number of days since the corporation (i.e. relationship_ref) first used this user agent.

Number of days since the corporation (i.e. relationship_ref) first used this referrer.

Date of the last successful Strong Customer Authentication (SCA) for the current corporation (i.e. relationship_ref).

1/1/1970 00:00:00 if the corporation has never performed a strong authentication.

Date of the last successful SCA applied to access the account (XS2A) consent for the current corporation (i.e. relationship_ref) and the current TPP (i.e. tpp_ref).

1/1/1970 00:00:00 if the corporation has never performed a strong authentication to give XS2A consent to this TPP.

Indicates if the beneficiary of the current event or transaction is trusted for the current corporation (i.e. relationship_ref.

Possible values:

• 0: the beneficiary is not trusted

• 1: the beneficiary is trusted

Date of the last successful Strong Customer Authentication (SCA) for the current corporate user (i.e. user_ref).

1/1/1970 00:00:00 if the corporate user has never performed a strong authentication.

Date of the last successful SCA applied to access the account (XS2A) consent for the current corporate user (i.e. user_ref) and the current TPP (i.e. tpp_ref).

1/1/1970 00:00:00 if the corporate user has never performed a strong authentication to give XS2A consent to this TPP.

Indicates if the beneficiary of the current event or transaction is trusted for this corporate user (i.e. user_ref).

Possible values:

• 0: the beneficiary is not trusted

• 1: the beneficiary is trusted

Number of failed transactions in the last period as defined (short, medium, long) for this corporate user (i.e. user_ref).

Default values:

• short time: one day

• medium time: one week

• long time: one month

Number of days an ISP has been known by that contract (i.e. contract_ref).

Number of days a device has been known by that contract (i.e. contract_ref). The device refers to FINGERPRINT_HASH.

Number of days a cookie has been known by that contract (i.e. contract_ref).

Number of days since that contract (i.e. contract_ref) has first appeared.

Number of failed login attempts by this corporate user (i.e. user_ref) during the last period as defined (short, medium, long).

Default values:

• short time: One day

• medium time: One week

• long time: One month

Average number of weekly successful logins of the current corporate user over the last period (default value: six months).

Checks if the number of logins of the current corporate user during the current week is higher than the average number of weekly logins.

Checks if the beneficiary's IBAN (if one) used during the session is known to this corporate user.

Checks if the beneficiary's country (if one) used during the session is known to this corporate user.

Number of successful address changes for this corporate user (i.e. user_ref) during the last week (NME_TYPE).

Number of successful updates to contacts (create new or change existing fields) during the last week.

Checks if this beneficiary's IBAN is known to the bank.

Number of failed attempts to create new beneficiaries for this corporate user (i.e. user_ref) during the last period (default value: six months).

Number of different accounts performing transactions to this beneficiary over the last week. This factor also checks if these accounts are included in the whitelist.

Number of outgoing transfer attempts for this account over the last period as defined (short, medium, long).

Default values:

• short time: One week

• medium time: One month

• long time: Three months

Number of successful outgoing transfers for this account over the last period as defined (short, medium, long).

Default values:

• short time: One week

• medium time: One month

• long time: Three months

Number of failed outgoing transfers for this account over the last period as defined (short, medium, long).

Default values:

• short time: One week

• medium time: One month

• long time: Three months

Number of successful outgoing transfers to the same beneficiary in the last period (default value: three months).

Standard deviations between the corporation (i.e. relationship_ref) amount mean (for the last month) and the current transaction amount.

Corporation (i.e. relationship_ref) transaction amount mean for the last month.

Number of transactions the corporate user (i.e. user_ref) was able to successfully submit for that contract (i.e. contract_ref) during the last period (default value: three months).

Total amount of transactions the corporate user (i.e. user_ref) was able to successfully submit for that contract (i.e. contract_ref) during the last period (default value: three months).