Banking Factors for Web Application Events in OneSpan Risk Analytics for Digital Banking

Checks if the IP address (IP) of the event is a new IP for all bank customers.

Checks if the IP city of the event is a new IP city for all bank customers.

Number of bank customers linked to this IP address within the last monitoring period (default value: three months).

Checks if the ISP of the current session is a new ISP for this customer.

Checks if the IP country of the current session is a new IP country for this customer.

Number of distinct IP addresses used by the customer.

Number of distinct IP countries used by the customer.

Checks if the IP address of the event is the same as the IP used in the previous session.

Checks if the IP country of the event is the same as the IP country used in the previous session.

Checks if the IP address of the event is the same as the IP used in the previous event of the current session.

Checks if the IP country of the event is the same as the IP country used in the previous event of the current session.

Checks if the IP uses a corporate proxy.

Checks if the used device is the same for the current session as the one used in the previous event.

Checks if the device used in the session is a new device for this customer.

Number of different devices used by this customer during the last period.

Checks if the user agent is new for this customer.

Average number of sessions opened within a week during the last period (default value: six months).

Time (in seconds) elapsed since the last session was closed (measured with the time since NME type in the previous session).

Number of requests submitted in the current session.

NME/TXN between 9 a.m. and 12 a.m.

NME/TXN between 3 p.m. and 6 p.m.

NME/TXN between 9 p.m. and 12 p.m.

NME/TXN between the 1^st and the 10^th day of the month.

NME/TXN after the 20^th day of the month.

Checks if this is a new cookie for all bank customers.

Number of sessions using the IP address for this customer (i.e. relationship_ref). The number of sessions excludes the current one.

Number of sessions using the device for this customer (i.e. relationship_ref). The number of sessions excludes the current one.

Number of days since the customer first used the IP address (i.e. relationship_ref).

Number of days since the first event sent by the customer (i.e. relationship_ref) from the city is identified by IP_CITY.

Number of days since the customer (i.e. relationship_ref) first used this device.

Number of days since the customer (i.e. relationship_ref) first used this beneficiary bank country.

Number of days since any customer of the bank first used this user agent.

Number of days since the customer (i.e. relationship_ref) first used this cookie.

Status on a customer authentication that possibly occurs for the current event.

Possible values:

0: No Authentication.

1: Simple Authentication Failed

2: Simple Authentication Success

3: Strong Authentication Failed

4: Strong Authentication Success

Number of days since the last successful SCA for the current customer. Number of days since 1/1/1970 00:00:00 if the customer has never performed a strong authentication.

Number of days since the last successful SCA applied to XS2A consent for the current customer (i.e. relationship_ref) and the current TPP (i.e. tpp_ref). Number of days since 1/1/1970 00:00:00 if the customer has never performed a strong authentication to give XS2A consent to this TPP.

Number of days since the beneficiary became trusted for the current customer.

0 if the beneficiary is not or no longer trusted.

Checks if the IP country of the event is the same as the country used for the previous web or mobile event in the session.

Number of failed login attempts by this customer during the last period as defined (short, medium, long).

Default values:

• short time: One day

• medium time: One week

• long time: One month

Average number of weekly successful logins of this customer in the last six months.

Checks if the number of logins of the current customer during the current week is higher than the average number of weekly logins.

Checks if the beneficiary account (e.g. IBAN) is on the list of known accounts used by this customer during the last period (default value: one year).

Checks if the beneficiary country is on the list of known beneficiary countries used by this customer during the last period (default value: six months).

Number of successful address changes during the last week (NME_TYPE).

Number of successful updates to contacts (create new or change existing fields) during the last week.

Checks if this beneficiary's IBAN is known to the bank.

Number of different accounts performing transactions to this beneficiary over the last week. This factor also checks if these accounts are included in the whitelist.

Number of outgoing transfer attempts for this account over the last period as defined (short, medium, long).

Default values:

• short time: One week

• medium time: One month

• long time: Three months

Number of successful outgoing transfers for this account over the last period as defined (short, medium, long).

Default values:

• short time: One week

• medium time: One month

• long time: Three months

Number of failed outgoing transfers for this account over the last period as defined (short, medium, long).

Default values:

• short time: One week

• medium time: One month

• long time: Three months

Number of successful outgoing transfers to the same beneficiary in the last period (default value: three months).

Number of outgoing transfers from the customer to this beneficiary.

Standard deviations between the customer (i.e. relationship_ref) amount mean (for the last three months) and the transaction amount mean for the last month.