Machine-learning fraud detection, which self-updates to adapt to fraud trends, is growing in popularity but hasn't rendered hands-on methods obsolete.
"Merchants are not using one single strategy; all these get reverse-engineered by the fraudster so they must use a multi-layered approach," said Nathalie Reinelt, an analyst at the Aite Group.
While machine-learning seems more scalable for large businesses, some still prefer rules-based fraud systems, which require humans to manually update the software with each type of behavior they want to flag.
"Merchants sometimes want more control," said John Sheard, head of business development at Realex Payments, which provides a rules-based fraud detection system to its clients. "Other merchants want to totally outsource that service, and there are those in the middle that want a combination or third party analysis and a local rule set we're getting mixed responses on what retailers want as far as rules-based or machine-learning software."
Realex also offers biometrics and device fingerprinting systems as well. Device fingerprinting identifies the PC, tablet or smartphone device from previous purchases.
What differentiates rules-based systems are the technologies baked into the rules, Reinelt said. "Machine-learning is more an analytics tool to optimize the rules engine," she said.
Every merchant should mix in some machine-learning fraud techniques with their rules-based system, said Shirley Inscoe, senior analyst at the Aite Group.
"In the e-commerce space cyber criminals are becoming so much more sophisticated and they are so creative and successful so [a rules-based fraud detection system] is not enough to adequately protect a merchant," Inscoe said. "If a company is doing nothing but rules-based fraud prevention that sounds a bit antiquated."
NuData Security, a vendor of online fraud detection systems, uses a layered approach. One of its features is behavioral piercing, which studies the patterns a specific user exhibits when navigating a Web page with a mouse or keyboard.
"The new [fraud] technology is completely transparent and in the background, so the consumer is totally unaware and not impeded in any way," said Inscoe.
Reinelt said the systems that analyze behavior work well for detecting bots.
According to an Aite Group survey of 36 merchants, 62% of merchants said behavioral analytics had a high or very high impact on reducing card fraud. Sixty-two percent of merchants also said point-to-point encryption has a high or very high impact.
Digital content is an especially hot target for fraudsters, Reinelt said. Since consumers expect to receive digital content (such as downloadable songs or apps) immediately after purchasing it, merchants have little time to detect fraud.
Fraudsters are also taking advantage of in-app purchases, re-selling items such as the digital coins used within games, she said.