Skip to main content

Overview of Zuora Fraud Protection

Zuora

Overview of Zuora Fraud Protection

  1. Last updated
  2. Save as PDF

Zuora has partnered with Microsoft Dynamics 365 Fraud Protection to provide an opt-in payment fraud protection service called Zuora Fraud Protection. This service helps protect merchants from payment fraud and reduces chargeback rates through adaptive AI technology.

This feature is in the Early Adopter phase. We are actively soliciting feedback from a small set of early adopters. If you want to join this early adopter program, submit a request at Zuora Global Support.

Introduction

Powered by Microsoft, Zuora Fraud Protection grants you pre-integrated access to the Microsoft Dynamics 365 Fraud Protection portal. In the Microsoft portal, you can train the machine learning model with your data, define rules to determine the validity of the fraud, and prevent any unwanted activities from reaching your payment gateways.

By enabling this fraud protection service in Zuora, you give consent to Zuora to share the data with Microsoft. Zuora continuously submits all rejected transactions to Microsoft on your behalf at no additional cost to consistently increase the accuracy of the machine learning model for your organization.

In Zuora, you can configure whether to screen the following types of data:

  • Transactions initiated through Zuora Hosted Payment Method (HPM) pages
  • Transactions submitted by any operations that create payments through the Zuora UI, APIs, or payment runs

Screening means each individual fraud evaluation that is performed by third-party Microsoft using their Purchase API. Each transaction undergoes a single screening. Before the transaction data is sent to the gateway side, Zuora Fraud Protection is triggered and transaction data is sent to Microsoft for evaluation via their Purchase API. This evaluation process is known as a screening. 

For transactions initiated through HPM, before the transaction request is evaluated by Zuora Fraud Protection, security settings enabled in Zuora for your hosted pages are performed, such as rate limiting checks, token expiration, and Google reCAPTCHA validation. If all prior checks pass, Zuora screens the transaction through the fraud protection service. For more information on the security measures for HPM, see Security measures for Payment Pages 2.0.

If the response received from Zuora Fraud Protection is Reject, Zuora sets the payment processing status to Error, which means the purchase transaction will not be sent for payment processing. If the response received from Zuora Fraud Protection is Review or Approve, Zuora sends the purchase transaction data to the payment gateway for normal processing. Review means an inconclusive result from Zuora Fraud Protection. Approve means the transaction passed the Zuora Fraud Protection review. 

The following image shows how Zuora Fraud Protection works with Microsoft Dynamics 365 Fraud Protection to evaluate transaction data.

ZFP_flow.png

Microsoft Dynamics 365 Fraud Protection provides a suite of innovative and advanced services to protect your business from fraud. Velocity checks identify the patterns of activities during attacks and restrict the frequency of events that can occur. Lists define the collections of values to flag transactions based on certain criteria. The machine learning score generated by AI models is a single assessment score indicating the overall risk of an event. The utilization of velocities, lists, and machine learning scores is the most effective way to fight fraud, especially in subscription and adding payment instrument scenarios. 

Zuora pre-integrates the Device Fingerprinting service with Payment Pages 2.0. With Device Fingerprinting, more attributes such as operating system, screen resolution, language, IP location, and linkage are valuable for the calculation of the machine learning score. You can enhance your fraud protection with additional values in the following scenarios:

  • Detect scenarios where a customer is adding a payment instrument on file, which might be a sign of account takeover or identity theft.
  • Monitor the number of attempted transactions by device or IP, which can indicate suspicious activity and potential card testing.
  • Create lists of known good or bad devices or IPs, which can be used in rules.
  • Identify embargo countries, which can be used in rules to reject or review transactions.
  • Identify bad actors and mitigate fraud for products that have higher fraud rates, by collecting and analyzing device and location attributes.
  • Benefit from the Fraud Protection network, which can help you gain a broader awareness of fraud patterns and trends across merchants.

Without Device Fingerprinting, you will have to rely more on other data points, such as emails or payment instruments, to monitor the frequency of events and create velocities.

In the following table, the effectiveness of Zuora Fraud Protection in different front-end integrations is indicated by the colors: green for the most effective, yellow for less effective, and red for ineffective.

Category Hosted Page Direct POST CORS REST External Hosted Pages (Zuora PAN Vault) External Hosted Pages (External PAN Vault)
Screen new Payment Methods Device Fingerprinting (YES)
Payment Instrument Data (YES)		 Device Fingerprinting (NO)
Payment Instrument Data (YES)		 Device Fingerprinting (NO)
Payment Instrument Data (YES)		 Device Fingerprinting (NO)
Payment Instrument Data (NO)		 Device Fingerprinting (NO)
Payment Instrument Data (NO)
Screen stored Payment Methods Device Fingerprinting (NO)
Payment Instrument Data (YES)		 Device Fingerprinting (NO)
Payment Instrument Data (YES)		 Device Fingerprinting (NO)
Payment Instrument Data (YES)		 Device Fingerprinting (NO)
Payment Instrument Data (YES)		 Device Fingerprinting (NO)
Payment Instrument Data (NO)