ACADEMYExplore Antifrog ↗Payments, banking and risk. Look up a term, understand the distinction, get back to your work.
No matching term. Try “gateway”, “chargeback” or “open banking”.
Attempts to establish whether payment card details work, sometimes by testing many candidates or concentrating on an issuer range. A burst warrants investigation, but customer retries and integration problems remain alternative explanations.
BIN attacks and card enumeration describe related testing patterns; concentration by issuer range alone does not prove fraudulent intent.OWASP · OAT-001 Carding
A count or rate over a defined time window and entity: for example, attempts per device in twelve minutes. The entity and window are part of the definition.
Ask: compared with which baseline and population?OWASP / Automated threats
A cardholder contests a payment through their bank. Reasons differ; a dispute is not automatically a confirmed fraud event.
Ask: what is claimed, what evidence exists, and when is the response due?Visa / Dispute resolution
A cohort groups transactions with a shared reference point, such as purchase week. Maturation describes the time allowed for later outcomes to arrive.
Ask: are these cohorts being compared at the same age?Visa / Dispute resolution
Accounts, devices or payment references connected by observed attributes. Link analysis examines these relationships and their timing to generate investigative leads without assuming that every connection represents shared ownership or coordinated activity.
A shared address or device can reflect legitimate circumstances; stronger conclusions need contextual evidence rather than a universal number of links.OWASP / OAT-019 Account Creation
An additional verification step for a sensitive action or elevated risk. Use an established trusted route and a recovery path.
Ask: is the verification channel itself part of the suspicious change?OWASP / Authentication Cheat Sheet
A legitimate event flagged as suspicious. Its cost can include review time, delay or rejection. Measure it on a defined, labelled population.
Ask: are we measuring all legitimate events, or only the alert queue?Google / Classification metrics
Precision: confirmed positives divided by all flagged events. Recall: flagged positives divided by all actual positives. Neither metric alone describes the cost of a decision.
Ask: what happens to the cases we miss and the customers we interrupt?Google / Classification metrics
The technical connection that securely carries payment requests and responses between the merchant and payment infrastructure.
A gateway is a role, not necessarily a separate company or the acquirer.Read the explanation
The service handling transaction messages and processing for payment participants.
A processor and an acquirer can be packaged by one provider, but the roles differ.Read the explanation
The institution on the merchant-acceptance side of a card payment relationship.
Do not confuse it with the bank that issued the customer’s card.Read the explanation
The institution that issued the customer’s card and typically makes the authorisation decision.
An issuer decline and a merchant’s own risk rejection are different events.Read the explanation
The approval or decline stage of a payment request; approval can reserve available funds or credit.
Approval does not mean the merchant has received a payout.Read the explanation
Submission of an authorised card payment for financial completion.
Capture and merchant payout are different stages.Read the explanation
The fulfilment of financial obligations between payment participants after transaction processing and clearing.
Do not assume settlement and payout share a timestamp.Read the explanation
A reversal through the card dispute process after a payment is challenged through the issuer.
A chargeback is not the same workflow as a merchant-initiated refund, and not every dispute alleges fraud.Read the explanation
Permissioned access to defined account-information or payment-initiation services under the applicable framework.
Account access is not public, and permission to read data does not itself authorise a payment.Read the explanation
A service initiating a bank payment at the customer’s request under the relevant permission and rules.
An accepted instruction may not yet be a completed transfer.Read the explanation
The number identifying a payment card account within the card system. It appears in many payment messages and helps route processing, while also being a sensitive element of cardholder data.
A card number identifies an account relationship; it does not prove that the person submitting it is the legitimate cardholder.PCI Security Standards Council · Glossary
A short security value associated with a payment card, commonly requested during online purchases. Different card brands use different names, and a matching result supplies only one piece of payment evidence.
Possession of the code does not establish consent to a purchase or replace authentication and other contextual checks.PCI Security Standards Council · Glossary
Information associated with a payment card account, centred on its primary account number. Understanding which fields a system receives, stores or transmits helps teams locate sensitive data across the payment journey.
Sensitive authentication data is a separate category; treating every payment field as interchangeable obscures important differences in handling.PCI Security Standards Council · Glossary
A business or organisation accepting payment for goods or services. In card payments, the merchant participates through an acquiring relationship, although platforms and service providers can make that commercial arrangement less visible.
The shop a customer recognises and the legal entity appearing on a payment statement may need separate investigation.PCI Security Standards Council · Glossary
A substitute value used instead of a primary account number in a defined payment context. Tokenisation reduces exposure of the underlying number while preserving a way to process authorised payment activity.
A token is not simply an encrypted card number, and its usefulness depends on the controls governing where it works.EMVCo · Payment Tokenisation
An EMV payment token usable within the payment network ecosystem, subject to controls such as device or merchant restrictions. Its lifecycle can be managed separately from the underlying card account number.
A provider's internal vault token and a network payment token can both hide card numbers but operate at different layers.EMVCo · Payment Tokenisation
The participant requesting a payment token from a token service provider for a particular use. Examples include wallet or merchant applications that need a substitute credential for subsequent payment transactions.
The requestor uses the token for its service; the token service provider manages token issuance and the underlying mapping.EMVCo · Payment Tokenisation
A messaging framework supporting cardholder authentication during remote commerce. Transaction and contextual information can help the issuer assess the person attempting the purchase and decide whether additional interaction is appropriate.
Authentication assesses the payer; authorisation separately decides whether the payment itself is approved by the relevant issuer.EMVCo · 3-D Secure
A 3-D Secure journey in which authentication completes without an additional customer challenge. The authentication decision uses available transaction and contextual information rather than requiring another visible interaction during checkout.
No visible challenge does not mean no authentication occurred, and a frictionless result does not guarantee payment approval.EMVCo · 3-D Secure
An additional customer interaction requested during authentication, such as confirming through a banking application. It gives the issuer another opportunity to assess control of the relevant account or authentication method.
A challenge can interrupt checkout; its completion is still distinct from the issuer approving the subsequent payment authorisation.EMVCo · 3-D Secure
A movement of money from a business or service to a recipient, such as a seller or customer. The delivery rail, recipient eligibility and completion status determine how that payout should be interpreted.
A payout instruction being accepted is not sufficient evidence that the recipient can already spend the delivered funds.Visa · Visa Direct documentation
A payment initiated from the sending side to deliver value to a recipient. In a card based funds transfer, an original credit transaction is one mechanism for pushing funds to an eligible account.
Push describes the direction of initiation; it does not by itself explain funding, recipient availability or possible recovery routes.Visa · Visa Direct documentation
A card transaction used to obtain funds from an eligible account for a transfer or funding purpose. It can form the funding leg of a service that subsequently sends money to another recipient.
Funding and delivery are separate legs; success in the first leg does not prove that the second leg completed.Visa · Visa Direct documentation
A fee exchanged between financial institutions within a card payment arrangement, commonly flowing from the acquiring side to the issuing side. Its amount can vary with transaction and card characteristics.
Interchange is one component of acceptance economics, not necessarily the total fee the merchant sees on an invoice.Visa · Rates, fees and rules
The charge a merchant pays its acquiring provider for accepting card payments. Commercial pricing can combine underlying costs and provider services, making the billed amount different from the published interchange component.
Compare the complete pricing agreement and actual statement; a single advertised rate may not describe every transaction cost.Visa · Rates, fees and rules
The conversion of value from one currency into another using an exchange rate. Payment reporting needs to retain the relevant currency, rate and timing to explain differences between purchase and account amounts.
An exchange rate alone is incomplete context: fees, conversion timing and the direction of quotation can change the result.Visa · Exchange rate calculator
An additional pricing margin or percentage associated with currency conversion relative to a stated reference rate. It helps explain why a customer's final converted amount can differ from a simple market calculation.
A markup and a separately charged bank fee are different price components, even when both increase the final cost.Visa · Exchange rate calculator
The currency in which a purchase amount is expressed for payment processing. It may differ from the card account currency, creating a conversion step between the purchase record and the customer's statement.
Always compare amounts together with their currency; identical numbers in different currencies do not represent the same economic value.Visa · Exchange rate calculator
The exchange, checking and organisation of payment instructions before final settlement, potentially including calculation of obligations between participants. It establishes what parties owe without necessarily completing the transfer of settlement assets.
Clearing works out obligations; settlement discharges them. A cleared transaction should not automatically be described as finally settled.BIS CPMI · Glossary
The offsetting of multiple obligations to calculate a smaller net amount payable or receivable. Payment systems can use netting to reduce the funds needed to settle exchanges among participating institutions.
Netting changes the settlement obligation, not the need to preserve individual transaction records for investigation and reconciliation work.BIS CPMI · Glossary
The risk that a party cannot meet an obligation when it falls due, even if it could meet that obligation later. Timing mismatches can create operational pressure without proving permanent insolvency.
Having sufficient assets overall is different from having the right settlement funds available at the exact time needed.BIS CPMI · Glossary
The possibility that an exchange will not complete as expected, including failure to receive value after giving value. Teams consider the timing and conditions under which obligations become final and irrevocable.
A fast customer interface does not remove settlement exposure; inspect the actual arrangement and when each party gives up value.BIS CPMI · Glossary
A settlement approach in which individual transfers are processed separately and in real time rather than offset into a net batch. T2 uses this approach for euro payments in central bank money.
Real time and gross describe settlement mechanics; they do not imply that every customer transfer uses that infrastructure directly.European Central Bank · T2
Money that is a liability of a central bank, including balances used by eligible institutions for settlement. Its role differs from a customer's deposit claim against their commercial bank.
The balance a consumer sees in a banking app is generally not the same settlement asset held by participating banks.European Central Bank · T2
An electronic payment network arrangement used for credit and debit transfers, especially in the United States. Payroll and bill collection are familiar examples, with processing governed by the relevant network and service rules.
ACH is a payment network category; it is not a synonym for every bank transfer or every instant payment.Federal Reserve Financial Services · FedACH
Processing multiple payment instructions together as a group rather than treating each instruction as an immediately completed individual transfer. File acceptance, item processing and settlement can occur at different moments.
A successfully received file can still contain individual items requiring attention; monitor item outcomes as well as batch status.Federal Reserve Financial Services · FedACH
An area supporting harmonised euro payment schemes across participating countries. It provides a common framework for transfers while allowing payment service providers and technical infrastructures to perform different roles in delivery.
SEPA is not a single bank or processor, and geographical participation is not identical to membership of the euro area.European Payments Council · SEPA Credit Transfer
A payment scheme for euro credit transfers between accounts through participating payment service providers. Common rules support payments within and between participating countries without making every provider's product experience identical.
SCT and SCT Inst are distinct schemes; a euro transfer should not be assumed instant merely because it is within SEPA.European Payments Council · SEPA Credit Transfer
An organisation providing payment services to users, potentially including execution of transfers or account related services. The term describes a service role, whose exact responsibilities depend on the arrangement being discussed.
Identify the actual service and contractual party; the broad label does not tell you who holds funds or operates infrastructure.European Payments Council · SEPA Credit Transfer
A scheme designed for rapid euro credit transfers with funds made available to the recipient within seconds. Its continuous availability distinguishes the intended experience from traditional operating day dependent transfer journeys.
Instant delivery does not mean every attempted instruction succeeds; check the final status and the receiving account's availability.European Payments Council · SCT Inst
A check comparing recipient account details and the supplied payee name through participating payment service providers. The result helps the payer assess whether the intended recipient aligns with the account information entered.
A matching name does not establish that the underlying purchase or investment is legitimate; it answers a narrower identity question.European Payments Council · Verification of Payee
The intended recipient of a payment. Recipient identification can combine an account identifier with a name or other relevant identifier, which may be checked before the payer proceeds with the transfer.
The person requesting payment and the named account recipient can differ; understanding that relationship matters more than accepting a label.European Payments Council · Verification of Payee
A standardised account identifier with a country specific structure and check digits. It helps payment systems identify an account consistently, while formatting checks can detect some transcription errors before processing.
A valid format does not prove that an account exists, belongs to the named person or is safe to pay.Swift · IBAN
An identifier used to recognise an institution or business party in financial messaging. It supports consistent identification across systems and is different from the identifier of an individual customer's bank account.
A BIC identifies a party, while an IBAN identifies an account; neither alone explains the commercial purpose of a transfer.Swift · Business Identifier Code
A service using permitted access to account information to present or analyse financial data for a user. It can support budgeting, account aggregation or other experiences built around the user's banking information.
Access to account information is different from permission to initiate a payment; examine the permissions for the actual service.Open Banking Limited · What is open banking?
A provider offering services based on access to account information with the user's permission. It sits between the account holder's chosen experience and the institutions holding the underlying account data.
The provider presenting an account overview need not be the bank holding the deposit or the operator moving money.Open Banking Limited · What is open banking?
The user's permission for a service to access specified financial information or perform an agreed activity. Useful consent journeys make the intended purpose and access boundaries understandable within the relevant service arrangement.
A broad agreement with a brand should not be assumed to explain every permission granted to a specific connected application.Open Banking Limited · What is open banking?
A credential representing an authorisation granted to a client for access to protected resources. Its permitted use depends on attributes such as scope and lifetime within the authorisation system issuing it.
An access token is an authorisation credential; it should not be confused with a payment token or a card number.IETF · OAuth 2.0, RFC 6749
A representation of the access requested or granted within an OAuth authorisation flow. Scopes allow a service to distinguish permissions, such as reading a resource, instead of granting unrestricted access.
Scope names are service specific; read their meaning rather than assuming similarly named permissions behave identically across providers.IETF · OAuth 2.0, RFC 6749
A credential used by an authorised client to obtain new access tokens under the authorisation server's rules. It supports continued access without requiring the user to repeat the complete interaction each time.
A refresh token is sent to the authorisation server, not used as the ordinary credential for calling protected business resources.IETF · OAuth 2.0, RFC 6749
A property where repeating the same operation has the same intended effect as performing it once. In payment integrations, deliberate duplicate handling helps distinguish a retry from a genuinely new business instruction.
HTTP method semantics alone do not provide a complete payment deduplication design; inspect the provider's operation and identifier contract.IETF · HTTP Semantics, RFC 9110
A code describing the outcome of an HTTP request at the protocol level. Applications interpret it alongside the response body and resource state to understand what happened to a business operation.
A successful HTTP response can acknowledge receipt without proving a payment settled; transport success and business completion are different facts.IETF · HTTP Semantics, RFC 9110
Another attempt to send an operation after failure or uncertainty about the first attempt. Safe handling depends on whether repeating the operation can create additional effects and how previous outcomes are identified.
A timeout means the caller lacks a timely answer; it does not prove that the receiving system did nothing.IETF · HTTP Semantics, RFC 9110
A defined interface through which software interacts with another system. Payment integrations use operations, parameters and responses to request actions or retrieve information while following the service's documented contract.
An API describes interaction, not a guarantee about settlement timing, data freshness or the service's commercial responsibilities to users.OpenAPI Initiative · Specification
An outbound request from a service to a configured receiving endpoint, often used to notify another system about an event. It supports asynchronous updates without requiring the recipient to initiate every check.
Treat a notification as an input to verify and process; arrival alone does not establish that every downstream action succeeded.OpenAPI Initiative · Specification
A description of the structure and constraints expected for data, such as required fields and value types. Schemas help different systems exchange information consistently and detect malformed messages before business processing.
A structurally valid message can still contain an incorrect amount or unsupported business instruction; schema validation is only one layer.OpenAPI Initiative · Specification
A record of an occurrence in a system, accompanied by context that helps consumers understand and process it. Payment systems can use events to communicate changes without coupling every component directly.
An event describes something that occurred; a command asks for something to happen, so their processing semantics should remain distinct.CNCF CloudEvents · Specification
An identifier distinguishing an event within its source context. Consumers can use the combination of source and identifier to recognise repeat delivery rather than incorrectly treating the same occurrence as new.
A payment identifier may connect several different events; using it alone for deduplication can discard legitimate later lifecycle updates.CNCF CloudEvents · Specification
The context identifying where an event originated. Alongside the event identifier and type, it helps consumers interpret an occurrence and keep similarly numbered events from different origins separate in processing.
The transport endpoint delivering an event and the logical source of that event are related concepts but need not be identical.CNCF CloudEvents · Specification
A person entrusted with a prominent public function, with related categories addressed in financial crime frameworks. The designation provides context for assessing exposure rather than evidence that a person committed misconduct.
A PEP classification is not a finding of criminality; keep the classification, supporting identity evidence and individual assessment separate.FATF · Glossary
The work of establishing and understanding a customer relationship, including identity, beneficial ownership and its purpose. It supplies context for evaluating activity throughout the relationship rather than only at initial onboarding.
A document check answers part of the identity question; it does not by itself explain ownership, purpose or subsequent activity.FATF · Glossary
A national body receiving and analysing financial disclosures and disseminating financial intelligence. Its role connects information from reporting entities with the authorities responsible for investigating potential financial crime.
An internal fraud investigation team and a national financial intelligence unit have different roles, access and institutional responsibilities.FATF · Glossary
An arrangement in which one bank provides services to another bank, supporting activities such as international payments. Understanding both institutions' roles helps explain why a transfer can involve more than the sender and recipient banks.
An intermediary bank in the route is not necessarily the beneficiary's bank; trace the institutions and services involved.FATF · Glossary
The natural person who ultimately owns or controls an entity or arrangement, even when formal ownership passes through other entities. Looking through structures helps identify who ultimately benefits or exercises control.
The name on a company register can be an intermediate owner; formal ownership records and ultimate control require separate interpretation.FATF · Beneficial ownership
The sequence of people and entities linking a business to those owning or controlling it. Mapping this chain can reveal intermediate companies and relationships that a single company record does not explain.
A chain of shareholdings does not always capture all control mechanisms; consider the difference between economic ownership and actual influence.FATF · Beneficial ownership
The policies, processes and institutional measures intended to identify and address attempts to move or disguise proceeds of crime. It covers a broader financial crime perspective than detecting unauthorised purchases alone.
A transaction can be authorised by its account holder and still raise money laundering concerns; authorisation does not resolve purpose.FATF · Recommendations
An approach that adjusts assessment and controls to the nature and level of identified risk. It requires understanding context and reviewing evidence rather than applying identical effort to every relationship or activity.
Proportionate does not mean arbitrary; document why the chosen level of attention follows from the relevant evidence and context.FATF · Recommendations
Authentication combining evidence from more than one factor category, such as something known and something possessed. It aims to reduce dependence on a single credential that could be stolen or compromised.
Two passwords are not two different factor categories; count independent types of evidence rather than the number of screens.OWASP · Multifactor Authentication
A category of evidence used to establish control or identity during authentication, commonly knowledge, possession or inherence. The design of the factor affects both resistance to attack and recovery when access is lost.
An additional question may still rely on the same factor; assess whether it adds independent evidence against the relevant threat.OWASP · Multifactor Authentication
A password or code intended for limited use, often bound to a short period or particular authentication attempt. Its security depends on how it is generated, delivered and checked in the journey.
A short expiry does not make a code immune to phishing; an attacker may relay it during the valid window.OWASP · Multifactor Authentication
The proportion of evaluated examples classified correctly, combining correct positives and correct negatives. It is easy to communicate but can conceal weak detection when one class vastly outnumbers the other.
A model calling every transaction legitimate can appear accurate in a low fraud population while detecting no fraud at all.Google · Classification metrics
An example belonging to the positive class that the system labels negative. In a fraud detection evaluation, this can represent fraud the control failed to flag under the chosen labelling rules.
A missing alert becomes a confirmed false negative only when the outcome label supports it; unresolved cases remain uncertain.Google · Classification metrics
An example correctly assigned to the negative class under an evaluation's ground truth. In a fraud model, it typically means a legitimate transaction was not flagged as fraud by that classification rule.
Not every unflagged payment is a known true negative; reliable evaluation needs sufficiently mature outcomes and clear labelling rules.Google · Classification metrics
The share of actual negatives incorrectly classified as positives. In a fraud evaluation, it measures how often legitimate examples are flagged, using all known legitimate examples as the denominator.
This is not the share of alerts that are wrong; that calculation uses a different denominator and answers another question.Google · Classification metrics
A cutoff used to turn a score into a class or action. Changing it alters which examples are flagged and changes the balance between detected positives and unnecessary interventions.
A threshold is a policy choice informed by evidence and costs; the same score need not imply the same action everywhere.Google · Thresholds and confusion matrix
A table comparing predicted classes with known outcome classes. For a binary problem it separates true positives, false positives, true negatives and false negatives, exposing errors hidden by a single headline metric.
Build the table from the same cohort and observation window; mixing populations makes the resulting comparisons difficult to interpret.Google · Thresholds and confusion matrix
An example correctly identified as belonging to the positive class. In fraud evaluation, a flagged transaction counts as a true positive only when the outcome definition also classifies it as fraud.
An analyst's initial suspicion is not automatically the final outcome label; preserve the distinction between prediction and established evidence.Google · Thresholds and confusion matrix
The recorded outcome a model is trained or evaluated against, such as confirmed fraud or legitimate activity. Its meaning depends on the evidence, observation period and decisions used to create it.
A disputed payment is not automatically fraud; poorly defined labels can teach or reward a model for the wrong task.Google · Machine learning glossary
A reference used to judge a current result, such as a comparable historical period, expected behaviour or a simpler model. Its population, timing and purpose determine whether the comparison is meaningful.
Operational baselines describe expected activity; model baselines benchmark predictions. State which comparison is being used before interpreting an apparent improvement.Google · Machine learning glossary
The use of information during model development or evaluation that would not legitimately be available at decision time. It can make reported performance look impressive while failing to transfer to real operations.
A field added after investigation may reveal the outcome; check when every feature becomes available before trusting validation results.Google · Machine learning glossary
Money held as a deposit with a commercial bank, representing a claim against that institution. Most everyday digital payments move or update these claims rather than physically moving notes between customers.
A deposit balance and physical cash are different forms of money; a payment interface can hide the institutional relationships underneath.Bank of England · What is money?
A function of money that provides a shared measure for expressing prices, balances and obligations. It allows people and businesses to compare values without quoting every item in terms of other goods.
The unit used to quote a price need not be the asset used for final settlement; distinguish denomination from delivery.Bank of England · What is money?
A change in which payment participant bears financial responsibility for qualifying disputes under a card scheme's rules. Authentication can contribute to eligibility, but the applicable transaction conditions and exclusions still matter.
A successful authentication does not guarantee protection from every dispute; distinguish fraud liability from delivery, processing and other claims.Visa · Visa Secure for Merchants
A permitted exception to applying strong customer authentication within an applicable regulatory framework. Its use depends on the payment circumstances, provider responsibilities and relevant conditions rather than simply a merchant's preference.
An exemption and a transaction outside the framework's scope are different concepts; neither should be assumed from an unchallenged checkout alone.FCA · Strong Customer Authentication
An SCA exemption associated with a payment service provider's assessment that a remote payment poses low risk, subject to applicable conditions. The assessment and eligibility belong within the relevant provider's regulated framework.
A merchant's low risk score is not sufficient by itself; provider eligibility and the governing conditions remain separate questions.European Banking Authority · TRA exemption clarification
A response value indicating why a payment request was not approved, as expressed by the relevant system. Its interpretation depends on the network, provider mapping and stage of the payment journey.
A decline code is not a fraud verdict; inspect the provider's documented mapping before deciding whether a retry is appropriate.Visa Developer · Request and response codes
Misuse of a merchant's refund process to obtain value through a false or misleading claim. It can involve retaining goods while receiving reimbursement, with the relevant evidence often sitting in returns and support records.
High refund activity alone does not prove abuse; product defects, delivery failures and legitimate customer rights can explain concentrated claims.US Department of Justice · Refund fraud case
A dispute or fraud claim involving a transaction the customer actually participated in or authorised. Investigation considers the relationship and transaction evidence rather than assuming that every fraud coded dispute involves a stolen credential.
A forgotten purchase and deliberate deception are different explanations; evidence of prior activity does not establish intent by itself.Visa · Evolution of Compelling Evidence — Merchant FAQs
A scheme or provider identifier describing the stated basis of a payment dispute. It helps organise the applicable response process and relevant evidence, which can differ between fraud, processing and consumer complaints.
The code records the dispute's grounds, not a completed investigation; the same apparent complaint can require different handling across schemes.Mastercard · Chargeback Guide, Merchant Edition
A formal challenge to a chargeback through the applicable card dispute process, supported by evidence from the merchant side. The response is assessed under the relevant reason, stage and procedural conditions.
Submitting evidence is not the same as winning the dispute; retain the final outcome separately from the response submission status.Mastercard · Chargeback Guide, Merchant Edition
Evidence used under applicable card scheme rules to support a response to certain disputes. Visa's framework can use qualifying historical transaction relationships, but eligibility depends on the programme's defined evidence requirements.
A persuasive narrative is not automatically qualifying evidence; check the applicable rule version instead of treating every past purchase as sufficient.Visa · Evolution of Compelling Evidence — Merchant FAQs
A metric within Visa's acquirer monitoring programme combining specified fraud and dispute reporting against eligible transaction volume. Its exact counting rules, exclusions and applicability belong to the relevant programme version.
This is not a generic chargeback percentage; use the programme's defined numerator, denominator and reporting window before comparing merchants.Visa · VAMP public fact sheet, 2025 edition
A measure relating a count of chargebacks to a defined transaction count. The cohort, reporting period and scheme formula determine what the result means, so the denominator is part of the definition.
Ratios using current sales and prior period sales answer different questions; compare like formulas rather than assuming every percentage is interchangeable.Mastercard · Chargeback Guide, Merchant Edition
A Visa service supporting automated resolution of eligible disputes through configured decision rules before further escalation. It changes the handling path and economics of a case rather than determining whether the original purchase was fraudulent.
An automatically resolved case still has a financial outcome; distinguish the cost of resolution from the cost of contesting a dispute.Visa · Pre-Dispute Services
A notification about a potentially disputed transaction delivered before the full chargeback process develops. It can create an opportunity to investigate or resolve the issue under the relevant service's workflow.
Receiving an alert is not evidence that action occurred; record the response and outcome rather than only counting incoming notifications.Visa · Transaction dispute management
Use of a promotional offer in a way that breaches its applicable conditions, sometimes involving coordinated accounts or third party identities. Assessment requires the actual offer rules and evidence about the relationship between participants.
Using an offer profitably is not automatically abuse; distinguish an unattractive commercial outcome from a documented breach or deceptive behaviour.UK Gambling Commission · Bonus and promotional offers
Operating several accounts under common control in a service where that relationship matters. Automated account creation can enable the pattern, but common devices or connections alone do not establish who controls the accounts.
Multiple accounts are not inherently fraudulent; evaluate service rules, ownership and behaviour while preserving legitimate household or business explanations.OWASP · OAT-019 Account Creation
An identity created by combining fabricated information with other identity elements, potentially including genuine personal data. It can develop an apparently credible history despite not representing the person the service believes it has identified.
Passing individual checks does not establish that the combined identity is genuine; evaluate consistency and history without treating limited history as proof.Federal Reserve Board · Synthetic identity payments fraud
An account used to receive or move proceeds on behalf of criminals. The account holder's awareness and participation can vary, so the observed money movement does not by itself establish their knowledge or intent.
Payments passing through an account can justify investigation, but legitimate intermediaries also exist; establish context before assigning a criminal role.FBI · Money Mules
The conversion or movement of fraudulently obtained value into a form the actor can use or control. It describes a stage in an abuse pattern, not the mere existence of a withdrawal.
An ordinary withdrawal is not suspicious by definition; connect the value's origin, account activity and destination before interpreting the movement.OWASP · OAT-012 Cashing Out
Manipulation of an affiliate programme to obtain commissions without the legitimate referral activity the payment represents. False attribution, fabricated activity or coordinated accounts can create misleading acquisition results for the business.
Poor retention does not establish commission fraud; separate low quality traffic from evidence that attribution or qualifying actions were manipulated.US Department of Justice · Affiliate commission fraud case
A reference derived from observable browser or device characteristics to help recognise activity across sessions. It supplies contextual evidence, but changes, shared devices and collisions limit what it can establish about a person.
A shared fingerprint is not a verified shared identity; combine it with independent context and understand the implementation's uncertainty.OWASP · Authentication Cheat Sheet
Automated attempts to authenticate using credential pairs obtained elsewhere, exploiting password reuse across services. Monitoring considers both unsuccessful attempts and the activity following successful logins within the observed attack pattern.
A successful login shows that credentials worked, not that the legitimate account holder initiated it; examine subsequent sensitive actions.OWASP · OAT-008 Credential Stuffing
A change in the data encountered by a model or in the relationship between its inputs and outcomes. These changes can weaken a previously useful decision rule even when the software remains unchanged.
A schema failure and statistical drift require different diagnosis; investigate data integrity as well as changing customer or fraud behaviour.Google · Machine learning glossary
A group acting in coordination to carry out fraud, potentially using several accounts, identities or intermediaries. The term describes an evidenced operational relationship rather than simply a visually connected cluster of records.
Connections are investigative leads; shared infrastructure and similar behaviour require context before a team concludes that coordinated fraud exists.US Department of Justice · Disrupting networks transferring fraud proceeds
A pattern in which an identity or account builds apparent credibility before exploiting available credit or trust and leaving obligations unpaid. The sequence of relationship building and subsequent loss distinguishes it from a single unusual purchase.
A sudden increase in borrowing is not enough; distinguish deliberate exploitation from changed circumstances and ordinary repayment difficulty.Federal Reserve Board · Synthetic identity payments fraud
A scheme in which a fraudulent seller accepts a buyer's order, then obtains fulfilment from a legitimate merchant using stolen payment details. The buyer can receive genuine goods while the merchant faces a disputed payment.
Different payer and recipient names are common in legitimate gifting; investigate the relationships rather than treating that mismatch as conclusive.Lee County Sheriff · Triangulation fraud alert
Enter a labelled sample. Synthetic defaults; no data is sent. Zero denominators are undefined.