Risk-Based Authentication

for
“Frictionless” 3-D Secure

JB Dumerc
2017/5/23
 ThreatMetrix Introduction
• Headquarters: Silicon Valley (San Jose, USA)
• CEO : Reed Taussig
• Employee: Around 200
• Offices: New York, London, Paris, Tokyo,
Hong Kong, Singapore, Sydney
• Customers: More than 5000
(Including through partners)
• Installed base: eCommerce, eBanking, Payment,
Fintech, Social Networking, Telecommunications
• Installations: More than 30,000 web site
and mobile applications
• Transactions volume: More than 2 Billion /month
• Database : 4.5 billion devices / 1.8 billion Personas

Uniquely Helps Differentiate Good Users from Bad Criminals

On web or mobile – At account opening, login or transaction
ThreatMetrix Confidential Information – Do Not Copy or Distribute Without Express Written Permission 2
2
 Business Model = Shared Intelligence

Analyzing more than 80 million daily transactions

across 30,000 web or mobile applications
Across 4.5 billion devices in 200+ countries

Trusted World leading fraud detection

users？
“Frictionless” user experience
Mutually collected and
shared intelligence
Cyber Protection of corporate
criminal？
value and customers
World’s Largest Digital Identity Network

Up to 95% recognition rate / 70% reduction in false-positive rates

200% authorization increase / 90% reduction in fraud
ThreatMetrix Confidential Information – Do Not Copy or Distribute Without Express Written Permission 3
 3 Solutions Portfolio
Intelligence – Decision - Authentication

Digital Identity Dynamic Decision Smart

Intelligence Platform Authentication

User Profiling Global Shared Real Time and

with about 600 Intelligence of Customizable Rule Step-up to
Attributes Anonymous Digital Engine with machine Multi-factor
Identities learning & case Authentication
management
ThreatMetrix Confidential Information – Do Not Copy or Distribute Without Express Written Permission 4
 Smart & Frictionless Authentication
Block Fraudsters without Inconveniencing Good Customers
グローバル化する不正を集合知で迎え撃ちましょう！

eBanking SMS OTP

eCommerce ?

Payment
✓
Persona
? Brokerage Sign-up OK

Behavior
Loans
Login Step-Up
Device Travel Digital Identity
Intelligence
Dynamic Decision
Platform
Smart
Authentication
＆Location Payment NG
Insurance
Malware
Media
SNS
Gaming

ThreatMetrix Confidential Information – Do Not Copy or Distribute Without Express Written Permission 5
 Valuable eco-system partners throughout
the world and across industries

ThreatMetrix Confidential Information – Do Not Copy or Distribute Without Express Written Permission 6
 Constraints with Legacy 3D-Secure

ThreatMetrix Confidential Information – Do Not Copy or Distribute Without Express Written Permission 7
 Typical “High Friction” Authentication Prompt

Cardholders are
inconvenienced by
suddenly being
prompted for
additional
authentication,
leading to high level
of abandonment and
call center support

ThreatMetrix Confidential Information – Do Not Copy or Distribute Without Express Written Permission 8
 Impact of 3-D Secure on Conversion Rate

Positive
(More transactions)
Negative
(Abandonment)

-60% +30%

Source: Adyen and Edgar, Dunn & Company - 2014

ThreatMetrix Confidential Information – Do Not Copy or Distribute Without Express Written Permission 9
 3-D Secure Adoption per Country
Enrollment
Percentage

Source: Ingenico 2014

ThreatMetrix Confidential Information – Do Not Copy or Distribute Without Express Written Permission 10
 Conclusion: Low Usage Rate of 3-D Secure
3DS
authenticated
transactions

ThreatMetrix Confidential Information – Do Not Copy or Distribute Without Express Written Permission 11
 Today’s Cross-Border fraud
cannot be tackled solely at national level
Source: ThreatMetrix Q4, 2016 Cybercrime Report

Borderless Cybercrime complicates fraud and authentication decisions.

ThreatMetrix solves global challenges to defend domestic customers.
ThreatMetrix Confidential Information – Do Not Copy or Distribute Without Express Written Permission 12
 Introducing Risk-Based Authentication

Shared Intelligence and Real Time Decisioning

ThreatMetrix Confidential Information – Do Not Copy or Distribute Without Express Written Permission 13
 Increased Coverage / Reduced Friction
Limited Systematic
Coverage Challenge
Enrolled
Cardholders Legacy ACS ACS server
(No risk based)
User ID

Selective Password

Risk-Based Auth. Challenge

Ready ACS
High Risk Prompt page
Not Enrolled （Less than 5%）
Full Low Risk
coverage （Above 95%）
• Authentication possible for 100% of
Cardholder enrollment Frictionless cardholders, even for cardholders not
in 3-D Secure Authentication enrolled in 3-D Secure program
• Authentication is frictionless for more
than 95% of the transaction in an
invisible manner to the cardholder
ThreatMetrix Confidential Information – Do Not Copy or Distribute Without Express Written Permission 14
 Authenticating Non-enrolled Cardholders

ThreatMetrix Confidential Information – Do Not Copy or Distribute Without Express Written Permission 15
 Selective Authentication Prompt
The cardholder experience has come
under criticism and some merchants
complain that Verified by Visa can have
a negative impact on conversion rates.
Consequently, Verified by Visa is evolving
– and one of the big breakthrough is Risk-
Based Authentication.

ThreatMetrix Confidential Information – Do Not Copy or Distribute Without Express Written Permission 16
 Less Friction => Higher Purchase Conversion

Source: Visa UK
(Frictionless Experience in Verified by Visa)
ThreatMetrix Confidential Information – Do Not Copy or Distribute Without Express Written Permission 17
 Example of Service Improvement

Simulation with statistics from Japan

• Coverage improved from 17.6% to 100%
• Abandonment rate reduced from 8% to 1%

Simulation Before After

Coverage 17.6% 100%
Abandonment 8.0% 1%
Completion 16.2% 99%

X6 Source: Visa UK
(Frictionless Experience in Verified by Visa)

Improvement

ThreatMetrix Confidential Information – Do Not Copy or Distribute Without Express Written Permission 18
 Result on VISAʼs in-house operated ACS (VCAS)
Integrating ThreatMetrix intelligence with
Visa network data provided a more
accurate risk score for cross-border and
global transactions, helping reduce friction
and abandonment

Eliminate friction and Less than 5% of cardholders

improve overall card usage challenged with
while reducing fraud. authentication request
Every event analyzed in the
context of pattern of 70% reduction in
trusted user behavior authentication abandonment

“Our partnership with ThreatMetrix has allowed us to augment our network

level data with device analytics to make better fraud decisions” Visa Inc.

ThreatMetrix Confidential Information – Do Not Copy or Distribute Without Express Written Permission 19
 Migrating with ThreatMetrix
To Risk-Based Authentication
from your legacy 3-D Secure
1) Your current ACS 1.0.2
2) Next Generation ACS 2.0

ThreatMetrix Confidential Information – Do Not Copy or Distribute Without Express Written Permission 20
 Legacy “High Friction” 3-D Secure
(3DS1.0.1 – No Risk-Based Authentication)
Cardholder
EC Site (PSP)
1

Shopping

Payment Page

4 ３
User ID / Authentication
Password Prompt
Issuer ACS

All cardholders User ID

have to suffer Password

the “Friction” of
Authentication! Authentication page

ThreatMetrix Confidential Information – Do Not Copy or Distribute Without Express Written Permission 21
 Introducing “Frictionless”
Risk-Based Authentication (3DS1.0.2)
Cardholder
EC Site (PSP)
４ 1

Shopping
Profiling
Payment Page

Digital Identity Network

５ ３ 8 Authentication
result

Issuer ACS 7 Issuer ACS

６
ACCEPT User ID
CHALLENGE <５％
EC Merchants DENY Authenti Password
and their PSP cation
Prompt
benefit of
Inline Pop-up Page
increase Authentication Page
<TAG>
Business!
ThreatMetrix Confidential Information – Do Not Copy or Distribute Without Express Written Permission 22
 New Generation EMVCo 3-D Secure
(3DS２.0)
Cardholder <TAG> EC Site (PSP)
Profiling ４ 1

Shopping
API Call ３
５
Payment Page
６
Profiling Data
Digital Identity Network
8 Authentication
9 8 Result
(3DS Method)
10
Issuer ACS Issuer ACS
ACCEPT 11 User ID

CHALLENGE
From now on, EC DENY Authenti Password
cation
Merchants and Prompt
their PSP need to Inline Pop-Up Page Authentication Page
take care of
Profiling!
ThreatMetrix Confidential Information – Do Not Copy or Distribute Without Express Written Permission 23
 ACS
ACS Server ThreatMetrix

8a. API Call Risk-based

8c. 8a. Risk Scoring
Authentication
& Response
11a. Challenge Request

Authentication
Step-up
Challenge
15. Determine
Challenge Outcome

ThreatMetrix Confidential Information – Do Not Copy or Distribute Without Express Written Permission 24
 Correlation with
3D-Secure Method

ThreatMetrix Confidential Information – Do Not Copy or Distribute Without Express Written Permission 25
 Two Profile Detection Methods in 3-DS 2.0
2. Optional Profiling from the ACS

Mandatory In-Band profiling:

Merchant MI collects
attributes from browser
(3DS Method)

session and adds them to the

Areq transaction as
Standard Areq fields

Optional Out-Of-Band profiling:

• Issuer ACS publishes 3DS Method URL in DS and merchant must execute HTTP POST
to the 3DS Method URL with Transaction ID
• This is basically the same as Risk-based Authentication in current 3-D Secure 1.0.2
ThreatMetrix Confidential Information – Do Not Copy or Distribute Without Express Written Permission 26
 3DS Method Spec Extract
Term Definition
3DS Method A scripting call provided by the 3DS Integrator that is placed on the
3DS Requestor website. Optionally used to obtain additional browser
information to facilitate risk-based decisioning.

Step 4 Browser and the ACS

The Browser will connect via the 3DS Method to the ACS or an entity designated by the
ACS to gather browser and Device Information. The manner in which the 3DS Method
obtains Device Information and which information is gathered is outside the scope of this
specification, however it is necessary to use the 3DS Server Transaction ID to identify the
Browser/Device Information for a later match at the ACS.
5.8.1 3DS Method Handling
The 3DS Method allows for additional browser information to be gathered by an ACS
prior to receipt of the AReq message to help facilitate the transaction risk assessment.
The use of the 3DS Method by an ACS is optional.
6.1.8 Link h: Browser—ACS (for 3DS Method)
The link between the Browser and the ACS for the 3DS Method is opened from a hidden
iframe loaded by the 3DS Server as part of the check-out page. It is used for the ACS to
load JavaScript which gathers device information to be returned to the ACS. This
includes the 3DS Server Transaction ID which enables the ACS to marry the information to
the correct transaction.
ThreatMetrix Confidential Information – Do Not Copy or Distribute Without Express Written Permission 27
 ThreatMetrix Specified Sequence of Profiling
1.Issuer ACS publishes a 3DS Method URL in the DS along with the card range data.
2.Merchant MI reads the DS data ahead of time and caches the data.
3.If the DS data contains a 3DS Method URL the Merchant MI must present that URL to the
cardholders browser prior to sending the Areq.
4.The 3DS Method URL must point to the ThreatMetrix profiling API as the “designated entity”.
5.The 3DS Method Data shall contain the following data :
a. 3DS Server Transaction ID (same as sent in the AReq message)
b. 3DS Method Notification URL (ThreatMetrix will write to this URL to tell the merchant MI
when profiling is done)
c. Create a JSON object with the 3DS Method data elements and then Base24 encode it.
d. Render a hidden HTML iframe in the Cardholder browser and send a form containing the
JSON Object via HTTP POST to the ACS’s 3DS Method URL (i.e. ThreatMetrix)
6.When 3DS Method profiling is done, the merchant can then complete the AReq & forward
to issuer ACS
7.The ACS will receive the AREQ from the Merchant MI
a. ACS can then make session query to ThreatMetrix with the Transaction ID and other
attributes from Areq
b. ThreatMetrix scores the combined 3DS Method attributes & Areq attributes
c. ThreatMetrix returns the risk score and reason codes
ThreatMetrix Confidential Information – Do Not Copy or Distribute Without Express Written Permission 28
 Two Independent Sets of Risk Attributes
72 Standard Attributes Up to 600 Optional Attributes
• Agent: 3DS Requestor & Server • Behavior: History, Correlation, Anomalies
• Cardholder: Name, addresses, • Personas: Anonymized identities &
phone number, account number Related events / associations
• Context: SDK, evice identifiers • Threat: Malware, Proxy, MitB, TOR
(Browser, user agent, accept • Device / Networks / Location
header, App ID, Device_info), IP
address • Monitoring optional data fields
• Merchant: Merchant ID, which may not be consistent or
Merchant Name, Merchant URL uniform across merchants / agents:
• Account type: Debit / credit • 3DS Requestor Authentication
Information
• Brand: DS ref. number, DS URL
• Cardholder Account Information
• Transaction: Amount, currency, • Merchant Risk Indicator
date • 3DS Requestor Challenge Indicator
• Etc …

ThreatMetrix Confidential Information – Do Not Copy or Distribute Without Express Written Permission 29
 Next Generation Integrated Layered Profiling

4th Layer Behavior Velocities & Correlations & Activity

Frequencies Anomalies Meta Data

3rd Layer Personas ?

Age & Anonymized Associations &
Attributes Identities Related Events

2nd Layer Threats

Proxy, VPN, TOR MitB & Malware Bots & Scripts

1st Layer Devices !

Fingerprinting True Location & Network Device Tampering

Global Shared Intelligence

ThreatMetrix Confidential Information – Do Not Copy or Distribute Without Express Written Permission 30
 What Makes the Digital Identity?
Digital Identity
Understanding Device 2
complex behavior Userna
me
and profile of a
Phone 1
persona and its
relationships between
associated devices,
credentials, threats Phone 2

and other personas…

Device 1
Email

Your
Company

Shared Intelligence
Analyzing more than 80 million daily transactions across 30,000 web or mobile
applications and across 4.5 billion devices in 240 countries
ThreatMetrix Confidential Information – Do Not Copy or Distribute Without Express Written Permission 31
 Our Customers Contribute to The Network to
Create Share Intelligence about Global Digital Identities

Encrypted + Hashed PII The

imag
The
imag
& Data in
The
imag The
imag

Th
e Digital Identity score, The
reasons and attributes out imag The
imag

ThreatMetrix Confidential Information – Do Not Copy or Distribute Without Express Written Permission 32
 Wider Set of Attributes for Higher Risk Assurance
Profiling Scoring
600 Attributes
Standard Data Input +100
Hashed or clear .
.
•Agent .
•Cardholder + 30
Rules PASS
•Context
•Merchant engine + 20
•Account + 10
•Brand >100
rules 0
•Transaction
Additional OOB Data - 10
- 20 REVIEW
•Behavior
•Threat - 30 REJECT
•Persona Real Time and .
.
•Device, Network & Fully Customizable .
Location Rule Engine
- 100

ThreatMetrix Confidential Information – Do Not Copy or Distribute Without Express Written Permission 33
 Example of Rules Weighting
Rule Name Rule Score
DeviceCountriesNotAllowed -50
HiddenProxy -25
3EmailPerDeviceDay -25
SatelliteProxyISP -25
3DevciePerAccountNumberDay -15
3DevciePerEmailDay -15
NoDeviceID -15
AnonymousProxy
FlashImagesCookiesDisabled
-15
-15
All rules are
3CreditCardPerDeviceDay
ComputerGeneratedEMail
-15
-10
customizable
PossibleVPNConnection -10
DeviceNegativeReputation -10
ProxyNegativeReputation
AnonymousProxy
-10
-10 Each score is
3ProxyPerDeviceDay
3EmailPerDeviceWeek
-10
-10 tunable
3AccountNumberPerDeviceWeek -10
3DevciePerAccountNumberWeek -10
DeviceProxyGeoMismatch -10
DeviceAccountGeoMismatch -10
3DevciePerEmailWeek -10
LanguageMismatch -10
SatelliteISP -10
DialupProxy -10
UnusualProxyAttributes -10
3DevicePerCreditCardDay -10
DeviceGlobalBlacklist .. -10
FlashCookiesDisabled
3CreditCardPerDeviceWeek
. -10
-10

ThreatMetrix Confidential Information – Do Not Copy or Distribute Without Express Written Permission 34
 Smart Analytics

Smart Rules
+ Smart Learning

Adaptive per-entity calculated Optimized rule creation,

behaviors and variables weighting & normalization
all real time and dynamics
ThreatMetrix Confidential Information – Do Not Copy or Distribute Without Express Written Permission 35
 Authentication Step-up / Identity Verification
In case of REVIEW, prompt for additional authentication or verification

Integration Hub
PASS

PROFILE REVIEW Third Party

3 Authentication

REJECT

Basic Menu Third Party Partner Menu

IVR OTP (Fixed Line) OTP Mobile OTP Postal Address

IVR OTP (Mobile) eMail OTP SNS

SMS SMS OTP (Mobile / 1 Way) Phone Verification Identity

Push OOB (Smart Phone） Biometrics Data Matching

ThreatMetrix Confidential Information – Do Not Copy or Distribute Without Express Written Permission 36
 Expanding Beyond 3-D Secure

New Account Opening

Portal Login
Payment

New Account Opening

Smart Authentication

Portal Login
PSP Payment

Digital Identity Network

New Account Opening

3DSecure Login

New Account Opening New Account

Portal Login Opening
Portal Login

ThreatMetrix Confidential Information – Do Not Copy or Distribute Without Express Written Permission 37
 Shared Intelligence & Consistency
Wider variety of profiling attributes
• Each attribute (Standard & Optional) is an independent source of inherent risk.
• ThreatMetrix will process the independent inherent risk attributes using: Shared
intelligence, Threat Intelligence, link analysis, behavior analytics, machine learning, etc
AReq consistency checks
• ThreatMetrix will perform cross correlation between AReq attributes and correspondent
attributes contained in Device_info (Mobile App) or 3DS Method URL (Browser).
AReq optional attributes
• ThreatMetrix platform has the flexibility to monitor optional data fields which may not be
consistent or uniform across merchants / agents:
1.3DS Requestor Authentication Information
2.Cardholder Account Information
3.Merchant Risk Indicator
4.3DS Requestor Challenge Indicator
Transaction Profiling Completeness
• The completeness of Device_info depends on the Mobile app SDK implementation.
ThreatMetrix provides the flexibility to include the ThreatMetrix SDK on top of the 3DS SDK
to ensure the quality and completeness of the risk profiling and risk score

ThreatMetrix Confidential Information – Do Not Copy or Distribute Without Express Written Permission 38
 Thank You!

ThreatMetrix.com | sales@threatmetrix.com | partners@threatmetrix.com

1.408.200.5700 (Americas) | +61 2 9411 4499 (Asia Pacific) | +31 (0)20 800 0638 (EMEA)