MaxMind minFraud Score and changing risk scores

Your team switches on minFraud Score using the example thresholds. On Monday, a test order sent to your office address scores well under 5 and passes. By Tuesday, you submit the same order with the same card and shipping address, and it lands in review. Your rules are unchanged. The address is not. During the week, other test orders have been sent there, including some deliberately risky ones. Score has seen that history across the requests and is treating the address differently now. When an order’s result changes while its visible details stay the same, what exactly is the score responding to?

Score response fields

Score returns an overall risk score for the transaction and a separate risk reading for its IP address. Both scores range from 0.01 to 99. A score of 20 indicates a 20% chance that the transaction is fraudulent, according to MaxMind’s response documentation.

Here is the overall score from a live call using only an IP address:

{"risk_score":0.32}

Score costs $0.005 per query, as listed on MaxMind’s pricing page. It does not explain why a score is high or low. Insights adds returned transaction details, and Factors adds reasons for the score.

Network history

minFraud reads activity across its network, which MaxMind says includes more than 7,000 businesses. If it sees a fraudulent transaction at one business, the score can rise when that fraudster later shops at another. The network considers transactions seen over the last year, as described in MaxMind’s explanation of minFraud’s network.

We saw an address change the result. In one call, a Prague shipping address lowered the score. On a later call, the same address raised it, and Factors named the reason: MAX_RECENT_SHIP, with a multiplier of 5.1. Our test calls had used that delivery address repeatedly, including with a Tor exit IP or a card from another country.

A new email address had a smaller effect in another test. It raised the score on its first call, then the increase eased on later calls. Even an identical request could return a different score on its first calls: one live request scored 54.60 on its first call and 15.53 on the calls a few minutes later.

The score reflects a reading at a moment, shaped by the history minFraud has seen.

Inputs and risk scores

The known business email lowered both scores. Adding the card issuer prefix raised the IP risk for the mismatched order, where the country did not match. Adding the shipping address raised both overall scores. The order amount changed neither one.

The email and the shipping address are read against their history, and the card prefix against the country of the IP. Send every field you have so the score can take the available information into account.

Put these checks into a decision flow

Create rules for credit, fraud or collections, then run them on live decisions.

Start free See pricing

Threshold calibration

MaxMind suggests accepting transactions at 5.00 or below, rejecting those at 50.00 or above, and reviewing results between those example bands. Its threshold guidance says the cutoffs need fine-tuning over time.

Calibrate against your own orders and their outcomes. Report chargebacks and false positives through the Report Transactions API. MaxMind says reporting outcomes helps it detect about 10% to 50% more fraud and reduce false positives.

Pay particular attention to the orders that fall between your accept and reject thresholds. That is where your review policy assigns work to a person, so the volume and the outcomes there matter to your operation.

Fraud decision flow

1. Run the checks your own process already uses before making the paid Score call.
2. Send every relevant field you have. The score reads the request in light of the history associated with its inputs.
3. Map the returned score to your own accept, reject or review bands. Your rules make the decision.
4. Decide what a failed call means in your rules. A failed source returns absent values with an error flag, and a 402 response means the account has run out of credit.
5. Choose an unused test address. Use email addresses and shipping addresses that have not appeared in earlier test calls, and do not send real customer details. A test order can affect the next score for the same address.
6. Report the transaction outcome back to MaxMind so it can use that information.

Use cases

Account creation and login

The request can identify account creation or login as its event type. Score supplies an overall risk reading and an IP risk reading for your own decision flow.

Checkout and payments

A purchase can be sent as the event type. Score may be enough when your rules need its two risk readings. If a reviewer needs returned transaction details, such as the email information, Insights adds those fields.

Lending

A credit application can be identified as the event type, and your rules decide what the fraud-risk reading means for the application.

Frequently asked questions

Why did the same order score differently on two days?

The visible request does not include all the network history minFraud reads. Activity associated with an address can change what it contributes to the score.

Should I test minFraud with my own staff’s details?

No. A test order can affect the next score for the same address. Use test details that have not appeared in earlier calls, and keep real customer information out of tests.

Which service do I need?

Score gives the overall risk reading and IP risk. Insights adds transaction details, and Factors adds reasons for the score. Choose based on what your decision flow and reviewers need returned.

What do the API errors mean?

A 429 was rate-limited and not processed. A 402 means the account has run out of credit.

For authentication, store the MaxMind account ID as the username and the license key as the password in one HTTP basic credential. The assistant can configure the data source from MaxMind’s request documentation, and asks for the credential in a separate credential box.

Put these checks into a decision flow

Create rules for credit, fraud or collections, then run them on live decisions.

Start free See pricing