Fraud Protection

May all the odds be ever in your favor.
Use Fraud Protection Magento extension
and stop fraudsters on the spot.

It does not matter for cybercriminals how big your business is. Without proper security, store owners put themselves at risk for payment fraud.

The study says that 41% of online retailers got suffered from fraudsters. So it’s time to protect your store with our MaxMind Fraud Protection for Magento.

MaxMind minFraud request types: Score, Insight and Factors

MaxMind minFraud has recently introduced a brand-new version of API which intends to replace Standard и Premium requests and allows identifying suspicious transactions more meticulously. Each minFraud service is built on the risk assessment parameters provided by minFraud Score. Choose the proper service for your business as per your requirements and goals.

The request type can be selected when registering on the MaxMind website. More details on the services can be found here.

Installation

Installation from scratch

• Backup all the files of your store before installation (recommended)
• Disable compilation (Systems > Tools > Compilation > 'Disable' button) and flush store cache (System > Cache Management > 'Flush Magento Cache' button)
• Download the extension package from your account and extract the downloaded archive.
• Copy the content of the extracted folder to your store's root directory (overwrite the files)
• Flush store cache
• Log out from the backend and login again (important)
• Run compilation process if necessary (Systems > Tools > Compilation > 'Run Compilation Process' button).
• Go to the extension settings (System > Configuration > PotatoCommerce Extension > Fraud Check (MaxMind)), enable and configure the extension
• Flush store cache again
• See the configuration guide below

Update the extension from 1.x to 2.x versions

• Backup all the files of your store before installation (recommended)
• Disable compilation (Systems > Tools > Compilation > 'Disable' button) and flush store cache (System > Cache Management > 'Flush Magento Cache' button)
• Download 2.0 version of the extension from your account
• Copy the content of the extracted folder to your store's root directory (overwrite existing files)
• Flush store cache
• Log out from the backend and login again (important)
• Run compilation process if necessary (Systems > Tools > Compilation > 'Run Compilation Process' button).
• Go to the extension settings (System > Configuration > PotatoCommerce Extension > Fraud Check (MaxMind)), enable and configure the extension
• Generate a new license key in the MaxMind account https://www.maxmind.com/en/my_license_key and fill it in the extension settings
• See the configuration guide below

All the previous orders you have got will have fraud check information except IP Risk Score.

NB: if you use the previous version of API, please contact MaxMind support (support@maxmind.com) to connect you to the new API.

Configuration

• Register at https://www.maxmind.com/en/request-minfraud-service-trial
• Fill in the Licence Key and User ID from https://www.maxmind.com/en/my_license_key
• Specify the Score Threshold value (the Maxmind service analyzes the sent data and returns the riskScore)
• Choose ‘Overflow Threshold Action’ This actions will be performed if the riskScore is greater than the threshold.
• Set up IP Address Exceptions if necessary
• Select Request Type
• Save the configuration.

FAQ

After installing the Fraud Check extension my store gives error or a blank page.

Go to Magento Backend, Flush Store Cache (System > Cache Management> 'Flush Magento Cache' button), Logout and Login again.

What’s new in MaxMind PHP API v1.4?

Now the MaxMind service provides 3 types of requests: Score($0.005), Insights($0.015) and Factors($0.030). More information regarding each one can be found here.
The improved minFraud service uses REST principles. Also all requests are made by a POST of a structured JSON document to the web service. And both successful and error responses return a JSON document with an appropriate HTTP error code with details about the error in most cases. Authentication is done over an SSL connection. Follow the link for more details: https://dev.maxmind.com/minfraud/whats-new-in-minfraud-score-and-minfraud-insights/#General_Changes

I specified Factors request type, but now I receive “You do not have permission to use this service interface“ error.

To use Factors request type, please send a request to MaxMind support.

What is the workflow of the extension from the technical point of view? Will it work with my Payment system?

From the technical point of view, when an order is placed in Magento, 4 steps are accomplished:
1. When a new order is saved in Magento, method 'place' of class 'Mage_Sales_Model_Order_Payment' is carried out.
2. One of the payment actions, such as 'authorize', 'authorize + capture' or just 'order' (for offline orders) may be performed (it depends on your payment method)
3. The 'checkout_submit_all_after' event is triggered.
4. Once checkout_submit_all_after is triggered, MaxMind returns the riskScore. If the riskScore > Threshold, and the Hold Order action is configured in the settings, the order status will get changed to "On Hold". It happens right after the order in Magento is created. When the order is held, it can not be charged.
Then it all depends on Payment Method flow.
- If payment is processed when method 'place' of class 'Mage_Sales_Model_Order_Payment' is carried out, the Fraud Check extension is going to work correctly out of the box. Once the order status is changed to On Hold, the system considers the order as fraudulent. If your client think otherwise, they can contact your support to change the order status.
- If payment provider performs a redirect to the payment website, it will work the same way as above.
- If payment is created after checkout process (asynchronously), such a situation may take place:
The order may get the On Hold status, but your client won’t know that and will create a payment. The payment system sends a signal to controller in Magento. If this controller and payment method can work with On Hold status, then there will be no problems. However, if it doesn’t work with orders which have On Hold statuses, the payment will be created without an invoice (due to asynchrony).
That’s why there is a necessity to do tests with your payment methods before going live.