DM Users Guide

Title Page
CyberSource Decision Manager

User Guide
January 2018
CyberSource Corporation HQ | P.O. Box 8999 | San Francisco, CA 94128-8999 | Phone: 800-530-9095
CyberSource Contact Information
For general information about our company, products, and services, go to
http://www.cybersource.com.
For sales questions about any CyberSource Service, email sales@cybersource.com or

call 650-432-7350 or 888-330-2300 (toll free in the United States).
For support information about any CyberSource Service, visit the Support Center at
http://www.cybersource.com/support.
Copyright
© 2018 CyberSource Corporation. All rights reserved. CyberSource Corporation ("CyberSource") furnishes this
document and the software described in this document under the applicable agreement between the reader of
this document ("You") and CyberSource ("Agreement"). You may use this document and/or software only in
accordance with the terms of the Agreement. Except as expressly set forth in the Agreement, the information
contained in this document is subject to change without notice and therefore should not be interpreted in any way
as a guarantee or warranty by CyberSource. CyberSource assumes no responsibility or liability for any errors
that may appear in this document. The copyrighted software that accompanies this document is licensed to You
for use only in strict accordance with the Agreement. You should read the Agreement carefully before using the
software. Except as permitted by the Agreement, You may not reproduce any part of this document, store this
document in a retrieval system, or transmit this document, in any form or by any means, electronic, mechanical,
recording, or otherwise, without the prior written consent of CyberSource.
Restricted Rights Legends

For Government or defense agencies. Use, duplication, or disclosure by the Government or defense agencies
is subject to restrictions as set forth the Rights in Technical Data and Computer Software clause at DFARS
252.227-7013 and in similar clauses in the FAR and NASA FAR Supplement.
For civilian agencies. Use, reproduction, or disclosure is subject to restrictions set forth in subparagraphs (a)
through (d) of the Commercial Computer Software Restricted Rights clause at 52.227-19 and the limitations set
forth in CyberSource Corporation's standard commercial agreement for this software. Unpublished rights
reserved under the copyright laws of the United States.
Trademarks
Authorize.Net, eCheck.Net, and The Power of Payment are registered trademarks of CyberSource Corporation.
CyberSource, CyberSource Payment Manager, CyberSource Risk Manager, CyberSource Decision Manager,
and CyberSource Connect are trademarks and/or service marks of CyberSource Corporation.
All other brands and product names are trademarks or registered trademarks of their respective owners.
2
CONTENTS
Contents
Recent Revisions to This Document 12
About This Guide 13

Audience 13
Purpose 13
Scope 13
Conventions 14
Note, Important, and Warning Statements 14
Text and Command Conventions 14
Related Documentation 15
Customer Support 15
Chapter 1 Introduction 16
Decision Manager 17
List Manager 18
Case Management 19
Chapter 2 Administration 21
Decision Manager Administrator 21
Assigning Permissions and Roles 21
Permissions 21
Roles 22
Choosing Global Decision Manager Settings 23
Services 23
Payment Processing 23
Hedges 23
Velocity and Managed Customer Lists Processing 25
Local Currency 26
Order Status Notification 27
Reply Flags 29
Decision Manager User Guide | January 2018 3

Contents
Searching the Auditing Logs 30

Search Options 31
Search Results 35
Examples 37
Using the Managed Risk Service 39
Customer Lists Administrator 40
Choosing Early or Late Processing 40
Choosing Predefined Rules Settings 41
Creating Custom Rules 41
Choosing Settings for Temporary Entries in the Positive List 42
Preparing a Notification Message 44
Creating Test Transactions 44
Adjusting Your Settings 45
Case Management Administration 45
Setting Up Review Queues 45
Defining a Queue 46
Modifying a Queue Definition 48
Specifying a Hold Queue 48
Configuration Scenarios for Queues that Support SLAs 50
Assigning Reviewer Options 56
Permissions and Roles 56
Maximum Number of Orders 61
Address Mapping Options 62
Review Queues 62
Choosing Temporary Positive List Fields 63
Enabling Third-Party Services 65
192.com 66
Accurint 66
Credilink 68
Emailage 70
Perseuss 71
TARGUSinfo 72
Whitepages Pro 73
Evaluating Your Case Management Process 74
Reviewer Statistics 75
Reviewers 76
Results 76
Example 77
Queue Statistics 78
Queues 78
Results 78
Example 79

Contents
Chapter 3 Order Profiles 80

Creating and Editing a Profile 80
Defining a Profile 81
Selecting a Case Management Queue 82
Setting the Fraud Score Options 82
Risk Model 83
Fraud Score Thresholds 84
Setting Business Rules 85
Rule Options 85
Rule Priority 86
Predefined Rules 87
Custom Rules 92
Editing an Order Profile 92
Copying a Profile 92
Deleting a Profile 92
Selecting Profiles 93
Creating Profile Selectors 93
Selecting a Profile Activity Mode 95
Active Selectors 96
Passive Selectors 97
Replay Selectors 98
Rule Sequence 98
Evaluating the Performance of Your Profiles 98
Chapter 4 Custom Rules and Custom Lists 100

Creating Rules 100
Components 101
Order Elements 101
Comparison Operators 102
Comparison Values 103
Creating a Rule 104
Creating Custom Lists 108
Custom Lists 109
Merchant Region 112
Creating Custom Fields 113
Copying, Editing, Deleting Rules 115
Managing Rules and Categories 116
Categories 117
Core Rules 118

Contents
Chapter 5 Positive, Negative, and Review Lists 119

Overview of Available Tools 120
Adding Data 120
Adding Order Data During Order Review 122
Adding Customers to the Positive List 124
Adding Customers to the Negative List 129
Adding Customers to the Review List 131
Adding Order Data to Customer Lists 132
Positive Records 133
Negative and Review Records 137
Deleting Data 140
Using Clear Mark as Suspect 140
Removing Order Data from History 140
Deleting Data from Customer Lists 141
Uploading Data 142
Editing and Preparing to Upload Customer Lists 142
CSV Format 144
XML Format 147
Preparing Chargeback Data Files 150
File Content 151
File Format 153
Uploading Customer Lists and Chargeback Data Files 157
Verifying the Results 158
Chargeback Files 158
Automated Input 158
CyberSource API 160
Searching and Reviewing Customer Lists 160
Search Criteria 160
Date Range 160
Field Options 161
Results 162
Negative List 163
Review List 165
Positive List 165
Deleting Records 166
Downloading Customer Lists 166
CSV Format 166
Column Headings 167
Origin of Data 168
Sample Report 169
XML Format 170
Origin of Data 170
Sample Report 172

Contents
Chapter 6 Velocity 173

Global Velocity 173
Test Intervals 174
Selecting Time Intervals 175
Merchant Velocity 175
Rules Summary 176
Creating Velocity Rules 178
Velocity Definition 179
Time Interval 180
Threshold 181
Morphing 182
Deleting Velocity Rules 183
Sample Velocity Rules 184
Minimum Number of Orders or Products 186
Minimum Order Subtotal with Item Value Threshold 187
Minimum Order Subtotal and Cumulative Order Value 188
Restricted Number of High-End Purchases 188
Combined Minimum Amount and Numbers of Orders or Items 189
Multiple Tracking Elements and Morphing Element 191
Custom Data 192
Chapter 7 Case Management 193

Searching for Orders 193
Take Next Case Option 194
Quick Search Links 194
Search Parameters 195
Multiple Criteria Tab 195
Field and Value Tab 199
Profile/Rule Result Tab 199
Reviewing the Search Results 202
Search Parameters 202
Queue Table 203
Results Table 204
Managing Orders in the Case Management Search Results Window 212
Available Order Review Actions 212
Downloading Results 215
Search Results 215
Action Results 216

Contents
Visualizing Case Search Results 217

Case Search Visualization Icons 218
Navigating the Case Search Visualization Window 219
Exploring Relationships Between Orders 220
Viewing Case Details in the Case Search Visualization Window 220
Marking Orders as Suspect in the Case Search Visualization Window 221
Rejecting Orders in the Case Search Visualization Window 222
Reviewing Orders 223
Order Information 223
IP Address 224
Account Details 227
Customer ID 229
Billing and Shipping Information 229
Available Actions 229
Similar Searches 230
Visualizing the Results of Similar Searches 230
Case Information 232
Possible Actions 232
Order Status 232
Hold Option 233
Case Properties 233
Advanced Fraud Screen (AFS) Information 235
Rule Evaluation 237
Address Verification 239
Card Verification Number 240
Order Data Quality 241
Customer Data Validation 242
Payer Authentication 242
Order Monetary Quality 243
Velocity 243
Other Tests 243
Notes 244
Adding a Note 244
Offer Details 245
Travel Information 246
Third-Party Services 247
192.com 247
Accurint 248
Credilink 248
Emailage 248
Perseuss 248
TARGUSinfo 249
Whitepages Pro 249
Export Compliance Service 249
Mark as Suspect History 251

Contents
Additional Information 252

Completing the Review Process 252
Accepting or Rejecting Orders in the Case Management Search Results Window 253
Accepting or Rejecting Orders in the Case Management Details Window 255
Reviewing Digital Goods Transactions 256
Appendix A Custom Rules Elements and Examples 258

Comparison Operators 258
Order Elements 260
Customer Fields 260
Export Fields 262
Fraud Score Fields 262
Order Fields 263
Payment Fields 265
Fingerprint Fields 266
Travel Fields 267
Velocity Morphing Count 267
Third-Party Credilink Fields 267
Third-Party Emailage Fields 268
Third-Party Perseuss Fields 270
Third-Party Whitepages Pro Fields 271
Custom Fields 277
Sample Custom Rules 278
Item and Amount Elements 278
Date and Time 279
Time and Time Zone Conversion 279
Day and Time of Payment 280
Screening Your Customer Lists 282
Positive List 282
Negative List 283
Review List 284
Matching the Customer’s Billing Address to the Order’s IP Address 284
Reviewing Inconsistent Decoded IP and Billing Addresses 285
Rejecting Risky or Unknown IP Routing Methods 285
Reviewing or Rejecting Orders Originating Outside of U.S. or Canada 285
Accepting Orders from Specific IP Address 286
Custom Fields and Custom Lists 286
Custom Field 286
Custom List 287
AVS Codes 287
Export Data 289
Restricted Countries and Lists 289
Restricted Individuals and Organizations 289

Contents
Velocity Rules 290

Postal Codes (Regular Expressions) 290
Single Postal Codes with Simple Conditions 291
Multiple Postal Codes with Multiple Conditions 291
Multiple Postal Codes with Complex Conditions 291
Postal Codes +4 with Complex Conditions 292
API Fields 293
Appendix B Third-Party Services 297

192.com 297
Summaries 297
Report Summary 297
KYC Summary 297
Input Details 298
Details 299
Credit Reference 299
Deceased 300
Directors 300
Electoral Roll 300
Fraud 301
Telephone 302
Examples 303
Accurint 304
Credilink 306
Emailage 308
Perseuss 309
TARGUSinfo 310
Possible Results 310
Match Results 310
Based on the Phone 311
Based on the Address 311
Additional Data 312
Possible Types of Results 312
Whitepages Pro 314
Appendix C Countries Included in the European Union Risk Model 316

Contents
Appendix D Information and Reply Codes 318

Address Verification Codes 318
Card Verification Numbers 320
Risk Factor Codes 320
Information Codes 321
Address Information Codes 321
Internet Information Codes 322
Customer Lists Information Codes 322
Phone Information Codes 324
Global Velocity Information Codes 325
Suspicious Data Information Codes 326
Excessive Identity Changes 327
Index 328

REVISIONS
Recent Revisions to This
Document
Release Changes
January 2018  Added information about the CyberSource APIs to the CyberSource web site. See the
CyberSource API Versions page.
 Added the AU NZ risk model. See "Risk Model," page 83.
 Added additional customer list information codes. See "Information Codes," page 321.
October 2017 Added the multiple morphing element for velocity. See "Merchant Velocity," page 175.
September 2017 Added information about enhanced velocity features. See "Merchant Velocity," page 175.
August 2017  Reorganized chapter 5 and moved "Adding Order Data During Order Review" section from
chapter 7. See Chapter 5, Positive, Negative, and Review Lists.
 Revised deleting data sections from chapter 5 and chapter 7 to include new Clear Mark as
Suspect feature. See "Deleting Data," page 140.
 Added new Emailage and Whitepages Pro fields. See "Third-Party Emailage Fields,"
page 268 and "Third-Party Whitepages Pro Fields," page 271.
 Updated examples for Emailage and Whitepages Pro results. See "Emailage," page 308 and
"Whitepages Pro," page 314.
July 2017 Added the UK risk model. See "Risk Model," page 83.
June 2017  Added information about Decision Manager normalizing the customer IP address. See
"Creating Profile Selectors," page 93, "Creating Rules," page 100, and "Creating Custom
Lists," page 108.
 Added information about new Clear Mark as Suspect feature. See "Overview of Available
Tools," page 120, and Chapter 7, "Case Management," on page 193.

ABOUT GUIDE
About This Guide
Audience
This guide is written for system administrators, case management administrators, case or
order reviewers, and anyone who uses Decision Manager in the CyberSource Business
Center.
Using or configuring Decision Manager requires familiarity with case management

processes and a general knowledge of fraud management as it relates to your business.
Purpose
This guide describes how to configure your Decision Manager account in the Business
Center and how to use Decision Manager for case-management tasks.
Scope
This guide describes how to use the Decision Manager application in the CyberSource
Business Center. It does not describe how to integrate Decision Manager services with
your order management system. For that information, see "Related Documentation,"
page 15.

About This Guide
Conventions
Note, Important, and Warning Statements
A Note contains helpful suggestions or references to material not contained in

the document.
Note
An Important statement contains information essential to successfully

complete a task or learn a concept.
Important
A Warning contains information or instructions, which, if not heeded, can result

in a security risk, irreversible loss of data, or significant cost in time or revenue
Warning or both.
Text and Command Conventions

Convention Usage
bold  Field and service names in text. For example:
Include the ics_applications field.
 Items that you are instructed to act upon; for example:
Click Save.
italic  Filenames and pathnames. For example:
Add the filter definition and mapping to your web.xml file.
 Placeholder variables for which you supply particular values.
Screen text  XML elements.
 Code examples and samples.
 Text that you enter in an API environment; for example:
Set the davService_run field to true.

About This Guide
Related Documentation
 Decision Manager Using the Simple Order API Developer Guide describes how to
integrate Decision Manager with your order management system. (PDF | HTML)
 Decision Manager Using the SCMP API Developer Guide describes how to integrate
Decision Manager with your order management system. (PDF | HTML)
The SCMP API is a legacy name-value pair API that is supported for
merchants who have already implemented it. If you are new to
Important CyberSource and want to connect to services, use the Simple Order API.
 Decision Manager Planning Guide describes fraud and fraud-fighting tools that
Decision Manager provides. It also discusses best practices for creating order profiles,
using order velocity, and managing your Decision Manager account. (PDF | HTML)
 Decision Manager Reporting Guide describes the reports that are generated when
you use Decision Manager services. (PDF | HTML)
 The CyberSource API Versions page provides information about the CyberSource API
versions.
Refer to the Support Center for complete CyberSource technical documentation:
http://www.cybersource.com/support_center/support_documentation
Customer Support
For support information about any CyberSource service, visit the Support Center:
http://www.cybersource.com/support

CHAPTER
Introduction
1
Decision Manager is a hosted fraud management tool that enables you to identify viable
orders quickly and reduce the need for manual intervention in your order review process.
This guide describes the following features in the Business Center:
 "Decision Manager" contains profiles and rules that are used to evaluate your orders.
 "List Manager" provides a central location from which to update and search your
positive and negative lists of customers.
 "Case Management" provides a central location from which to examine in detail each
order that is not automatically accepted or rejected.

Chapter 1 Introduction
Decision Manager
To start using Decision Manager, you must create order profiles and add custom rules that
are specific to your business. To ensure that orders are evaluated by the most appropriate
profile, you must create profile selector rules.
The following figure shows the components of Decision Manager.
Figure 1 Decision Manager Components

List Manager
Administrators and reviewers use List Manager in the following ways:
 Administrators set up options and permissions for reviewers, manually add

information to customer lists, modify the type of information that is added to lists, and
search and update the lists manually by adding or deleting entries.
 Reviewers, while reviewing orders, use the links provided in the details window to add
order data to or remove it from the lists.
The following figure shows the settings available to administrators and reviewers.
Figure 2 List Manager Settings

Case Management
Administrators and reviewers use Case Management in the following ways:
 Administrators set up the options and permissions for reviewers.
 Reviewers review orders and mark order data.
Figure 3 Case Management Components

Notice to European Union Merchants

The European Union's Privacy and Electronic Communications Directive (the “Directive”) restricts
the deposit and storage of cookies on the devices of customers of online merchants operating in
the European Union.
The device feature of CyberSource Decision Manager is one of more than two hundred global
fraud detectors and tests. This feature enables the deposit and storage on the customer's
computer of a cookie that profiles the specific attributes of the computer used in transactions. This
cookie is used to mitigate fraud.
While we cannot provide legal advice to our merchants, we can provide the following information.
The restrictions under the Directive require, among other things, that you
 provide “clear and comprehensive information” to visitors of your Web site about the storage
of cookies on their computer
 obtain the consent of visitors before depositing and storing cookies on their computer unless
certain exceptions apply.
Your compliance with applicable privacy laws depends on how you use the cookies, on what
information you disclose to customers, and on what consent you obtain from customers. Because
CyberSource has no direct connection to your customers, you are responsible for ensuring that
cookies are used properly to perform the requested CyberSource services. CyberSource believes
that the safest course of action is for you to clearly and conspicuously disclose the use of cookies
to your customers and to obtain their consent before placing cookies on their devices. If you
operate in Europe and use the device fingerprint, you should consult your legal counsel and other
advisors to find out how to comply with the requirements of the Directive and whether an exception
might be available for you. CyberSource cannot take any position on the storage of cookies on the
devices of customers for purposes other than to provide CyberSource services. When used
without the device fingerprint, Decision Manager does not store cookies.

CHAPTER
Administration
2
Decision Manager Administrator

As administrator, you are responsible for configuring Decision Manager.
Assigning Permissions and Roles

An important step in preparing Decision Manager for your business is to assign to your
users the various permissions that they need in order to perform tasks.
Permissions
You are responsible for assigning the permissions for all users of Decision Manager
according to their positions in the organization. When you add or remove a permission,
the change becomes effective the next time that the user logs in to the Business Center.
Configuration and Order Review Management

As administrator, you have all Decision Manager configuration and order review
management permissions as shown in Table 1.
Table 1 Decision Manager Configuration and Order Review

Management Permissions
Permission Description
Configuration Management View, create, modify, and delete all Decision Manager settings.
List Management All functions associated with positive, negative, and review lists.
List View Search and view positive, negative, and review lists, but not modify or delete
them.
Profile Management View, create, modify, and delete order profiles, custom rules, and profile selector
rules.
Profile View View profile rules, but not modify or delete them.

Chapter 2 Administration
Table 1 Decision Manager Configuration and Order Review

Management Permissions (Continued)
Queue Settings Management View, create, modify, and delete queues. Required in order to set reviewing time
limits for orders in a queue.
Queue Settings View View queue definitions but not modify or delete them.
Velocity Management View, create, modify, and delete velocity rules.
Velocity View View velocity rules but not change them.
Reporting
Table 2 Decision Manager Reporting Permissions
Permission Reports Description

Performance Statistics  Reviewer Statistics View and modify date range settings, view reports.
Review  Queue Statistics
 Profile Statistics
Replay Request Management Includes all Replay Request View permissions plus
can select a new date range and submit a new report
request job.
Replay Request View  Replay View the Replay option under the Decision Manager
Reporting node and can view the last report that was
run. Cannot configure a date range or submit a new
report request job.
Report Download  System Performance Download programmable reports but cannot log in to
Reports the Business Center. Required in order for
administrators to download reports.
 Monthly Trend
Report Settings Management Reports Modify report settings and subscriptions.
Report Settings View  Case Managment View report settings and subscriptions but cannot
Reports modify them.
Report View  Conversion Reports Search and view reports but cannot modify or view
report settings.
 List Manager Search
Results
Roles
To fulfill your team’s requirements, you can combine permissions into roles. Roles enable
you to customize and simplify user management:
 You assign a role to users instead of individual permissions.
 You update the permissions assigned to a role to support new tasks. Then the
permissions for all employees that are assigned the role are immediately updated.

For example, to enable an employee to create or modify all components of a profile,

create a role with these permissions:
 Profile Management
 Queue Settings Management
 Velocity Management
Choosing Global Decision Manager Settings

To find global Decision Manager settings, choose Configuration > Settings.
Services
CyberSource recommends that you use Decision Manager with each service that you use.
Check the boxes for the services that you want to process in the same request as
Decision Manager:
 Authorization
 Direct Debit
 Advanced Fraud Screen
 PayPal
 PayEase China Processing
 Electronic Check Debit
Payment Processing
Use this area of the window to configure whether reviewers can automatically process the
payment of orders that they approve. If you enable this option, make sure to grant the
appropriate payment permissions to reviewers. Otherwise, the payment option does not
appear in the case details window. For more information about payment permissions, see
Table 6, page 59.
Hedges
Hedges enable you to assign additional risk to order conditions, such as orders with
different billing and shipping addresses that may indicate the order is a gift.
Each hedge condition corresponds to an API field and to a specific Decision Manager
setting. The precedence for hedge settings are as follows:
 Hedges set with the API fields take precedence over the Business Center settings.
Therefore, if you want to use the Business Center settings, do not use the API fields.
 If you do not use the API fields or the Business Center settings, the default value
(Normal) is used to evaluate your orders.

Modify one hedge setting at a time so that you can observe the effect on your orders. You
may need to choose different hedge settings for each of your products. Among the
available values, the most restrictive value for each hedge in the order is used when
calculating the final score:
 Low: Lower-than-average concern about the hedge condition.
 Normal: Average concern about the hedge condition.
 High: High concern about the hedge condition.
 Off: The content of orders does not affect the score.
Table 3 Hedge Settings
Setting Description
Gift Category Whether to assign risk to the order if the billing and shipping addresses
specify different cities, states, or countries. Choose one of these options:
 Yes: Orders are assigned only slight additional risk if billing and
shipping addresses are different.
 No (default): Orders are assigned higher additional risk if billing and
shipping addresses are different.
 Off: Differences between billing and shipping addresses do not affect
the score.
Host IP address: orders placed with an email address from an anonymous
Web-based email provider or IP address are typically riskier than orders
placed with an email address from a business or an Internet service
provider (ISP). Decision Manager calculates the risk of the customer’s
email domain on a scale from 0 to 5. For example, if the customer’s email
address is jdoe@example.com, the risk of the domain
example.com is calculated.
Nonsense Text content: weight on each order of the multiple tests performed to
identify nonsensical input.
Obscenities Text content: weight on each order of the multiple tests performed to
identify obscenities in the text content of the order.
Phone Phone number: weight on each order of the multiple tests performed with
phone numbers.
Time Time of day: weight on each order of the multiple tests performed.
Knowing the customer’s local time of day helps to predict risk because
orders placed during normal business hours are typically less risky than
those placed late at night or early in the morning. Advanced Fraud Screen
calculates the customer’s local time by using the time of the transaction
and the customer’s billing address.
Velocity Number of orders purchased by a customer in a certain time interval

Velocity and Managed Customer Lists Processing

You must decide whether to process the tests for velocity and managed customer lists
before or after processing the payment.
 Authorizations are not processed if Decision Manager rejects an order that contains
an authorization request. However, the profile rules are still evaluated and accept
supersedes reject. As a result, orders can be accepted without processing the
Important
authorization.
 If Decision Manager services are called before processing the payment, your
account might be billed for a Decision Manager transaction even if payment
authorization is declined and the transaction does not successfully complete.
Velocity
Use velocity tests to track the number of orders or specific products that customers
attempt to purchase from your Web site.
When you enable early velocity, the order velocity is increased even if the
payment transaction fails. Product velocity is not affected.
Important
Before or after processing the customer's payment, you can perform many tests on each
order to verify that the order is legitimate and to review or reject orders that you suspect
are fraudulent. The setting that you choose here applies to the rules that you create. All
services and features are processed in a specific order as shown below in the first column:
1st Profile selector rules
2nd Early velocity check

3rd Payment services
4th Decision Manager: order profiles, rules, and Advanced Fraud Screen or score service
5th Late velocity check
You must decide whether to process the velocity tests before or after the payment and
order screening tests.
 Before the Payment and Advanced Fraud Screen Services: Velocity tests are
performed first:
 If no element in the order is suspicious, the order passes the velocity tests, and
the payment and Advanced Fraud Screen services proceed normally. The order is
accepted, reviewed, or rejected depending on other factors and rules, but the
velocity tests have no impact on the final decision.

 If elements in the order are suspicious, the order fails the velocity tests. The
payment service is not processed. However, the Advanced Fraud Screen service
does proceed, and you receive the appropriate codes. You can later review or
reject the order depending on the velocity and Advanced Fraud Screen rules that
you set.
With this setting, you can eliminate immediately all orders highly suspect of fraud.
 After the Payment and Advanced Fraud Screen Services: With this setting, you
process orders as usual and use the velocity records only as a final check:
 If the services are successful, the order is accepted, reviewed, or rejected

depending on the velocity and other rules in the profile.
 If the services are unsuccessful, the velocity tests are not performed. You can
later review or reject the order depending on the velocity and Advanced Fraud
Screen rules that you set.
Managed Customer Lists

For complete information about setting up your customer lists, see "Customer Lists
Administrator," page 40.
Local Currency
This setting, which may differ from your processing currency, is used to display the
transaction amounts in your reports, in the Performance Statistics, and in the Offer Details
section of the case details window.
Figure 4 Local Currency Settings
If the processing and local currencies are different, the processing currency is converted
to the local currency before being displayed in reports.
You can change your local currency at any time. The new setting applies only to future
orders. For example, the amounts in the Performance Statistics reports apply only to the
orders placed or resolved after the change.
The amounts in converted currency that appear in the Business Center are
approximate because conversion rates fluctuate during the reporting periods.
Note

Order Status Notification
To implement this feature, your software development team must provide a

URL where notifications can be sent.
Important
Order status notifications can be enabled on the Developer tab of the Settings window.
When you enable this feature, the Case Management Order Status report in URL-
encoded XML format is sent to the notification URL each time a reviewer adds a note or
makes a final decision. Notifications can also be sent each time an order profile
automatically rejects an order. For a description of the Case Management Order Status
report, see the Decision Manager Reporting Guide (PDF | HTML).
A report is sent each time an action is taken so one order can generate multiple reports.
Figure 5 Order Status Notification Window
A notification is sent only once. If it is not successfully delivered, no second attempt is

made. Notifications can be sent by using an HTTP or HTTPS POST. HTTPS POST is the
most secure, but requires that you use an SSL certificate issued by a trusted authority.
You cannot specify alternate port numbers in the URL. Although CyberSource has
obtained most public certificates issued by trusted authorities, a certificate may be
missing. If the public certificate that you need is missing, you cannot receive notifications.
If you use a secure URL and cannot receive notifications, contact your CyberSource
support representative.

To enable order status notifications:
Step 1 In Decision Manager, click Settings, and then select the Developer Settings tab.
Step 2 In the Order Status Notification pane, select Send notifications when order status is
updated or a decision is made.
Step 3 Select one of the following options:
 Notify for Reviewer Decisions

A notification is sent each time that a reviewer adds a note or makes a final decision.
 Notify for Reviewer Decisions and Profile Reject Decisions

A notification is sent each time that a reviewer adds a note or makes a final decision,
and each time that an order is automatically rejected by an order profile.
Step 4 Enter the Notification URL you want to receive the Case Management Order Status
report. If you change the notification URL, make sure to change your entry in this field.
Step 5 Click Test URL to ensure that the notification works. A result message appears
immediately.
Step 6 Click Update to save your changes.
Step 7 In your web site, modify your firewall to allow messages through that come from
cybs-gw.ic3.com.
If you validate the report against a DTD in your system, make sure to download
the most current DTD of the Case Management Order Status report from the
Important Business Center and to update your code accordingly.
To ensure that all converted orders have been correctly processed, CyberSource
recommends that you download the Conversion Detail report. This report contains the
results of converted orders for each reviewer, giving you an overview of all orders that
were not immediately accepted. For more information, see the Decision Manager
Reporting Guide (PDF | HTML).

Reply Flags
This section applies only to the legacy SCMP API. If you use the Simple Order
API, it returns the actual value.
Important
With the assistance of your development team, you need to select the reply flag that is
returned when Decision Manager determines that an order should be reviewed or
rejected. If possible, choose reply flags that generally represent the majority of your orders
to review or reject. For example, you may choose to use these flags as follows:
Figure 6 Reply Flags Settings
DCALL Transaction declined. You may want to call the customer to try to
resolve the issue. This flag is appropriate for the orders that you want
to review.
DNOAUTH Transaction declined because of invalid authorization. This flag is
appropriate for the orders that you want to reject.
DREVIEW and DREJECT Default reply flags for Decision Manager.
SOK Usual flag for accepted orders. You might use this flag if you want to
continue processing the requested services, such as capture, when
orders are marked for review or rejected. Decision Manager still
places these orders in the correct review or reject queue.

Searching the Auditing Logs

By searching the Decision Manager logs, you can find the information available about the
changes, such as additions, modifications, conversions, copies, and deletions, made by
your users to any of the features that affect the outcome of your transactions. Changes to
permissions, Performance Statistics, Custom Fields, and Case Management are not
logged.
Log records are stored for six months. This option is located at the bottom of the Account
Management menu:
Figure 7 Audit Search Option

Search Options
Use these options to find the elements that were modified.
Figure 8 Audit Log Search Settings
Date Range
Select a date and time interval.
Custom ranges are possible only for a maximum of 31 days within the
previous six months.
Note
 If you select a preset time interval, the search results include transactions requested
from midnight on the start date to 11:59 p.m. on the end date.
 If you select a custom range, a date and time menu appears.
Figure 9 Custom Date Range Settings
To select your date and time, use either the drop-down menus, or click the calendar
icon in the center of the Start and End lines.
Figure 10 Calendar Date Settings

After you submit your range, it appears as follows in the search window:
Figure 11 Date Setting Display
Search Criteria
The default category is Risk. All other criteria are optional.
 Subcategory: Specific Decision Manager feature.
Figure 12 Decision Manager Subcategory Feature Settings
Subcategory Search Options

Profiles Changes, additions, and deletions made to profiles.
Note The setting of a rule in a profile appears in this section, but the
changes in conditions inside the rule appear in the Custom rules
subcategory.
Custom rules Changes, additions, and deletions made to custom rules and copies
made of predefined rules.
Active profile selector Changes, additions, and deletions made to active and passive profile
Passive profile selector selector rules.
Replay Profile Selector Changes, additions, and deletions made to Replay profile selector
rules.
Event Profiles Changes, additions, and deletions made to Event profiles.
Event Custom Rules Changes, additions, and deletions made to Event custom rules.

Subcategory Search Options

Event Profile Selector Changes, additions, and deletions made to Event profile selector
rules.
Event Velocity Changes, additions, and deletions made to event velocity rules and
settings.
Custom lists Changes, additions, and deletions made to custom lists. However, list
items that are added or deleted are not logged.
Queues Changes, settings, and deletions made to queues.
Velocity Changes, additions, and deletions made to product, order, and global
velocity rules and settings.
Custom Fields Changes, additions, and deletions made to custom fields.
Settings Changes made to all Decision Manager settings.
Third party Changes, additions, and deletions made to third-party configuration
settings.
Reviewer settings Changes, additions, and deletions made to reviewer settings.
Reviewer Roles Changes, additions, and deletions made to reviewer roles.
DMH group activation Changes in activation of merchants in a group of merchants.
DMH group management Addition and removal of merchants in a group of merchants.
List Management Changes, additions, conversions, and deletions made to the positive,
negative, and review list.
Replay Changes, additions, and deletions made to Replay settings.
 User Name: Name of the user who made the changes.

Keyword
 Keyword: Name of the Decision Manager component, such as custom list, profile, or
queue, or List Manager record that was modified. For example, if you have a custom
rule named Overnight Shipping, you can use the name of the rule as a keyword. In
addition to the name of the component, you can use the keywords in the table below.
The keyword search is not case sensitive.
Section Action Keyword

Third-party  Name of the third-party service
configuration
 CyberSource License agreement
Case details  Marking a transaction or  Request ID
removing from history
 Requesting and viewing a  Name of third-party service
third-party service
Custom lists Changes in countries  Merchant Region

Section Action Keyword

List Manager Deletion of records:
 positive list  Record name
 negative and review lists  Value of the element: For a specific
payment account, address, or other
element, use the account suffix, the
street address, or the value of the
element.
Conversion between  Value of the element: For a specific
negative and review lists payment account, address, or other
element, use the account suffix, the
street address, or the value of the
element.
Addition of records:
 positive list  Record name
 negative and review lists  Marking reason
Exporting search results Export
(XML or CSV)
File upload Name of the file with the extension
Profiles  All available actions
 Change in status  Default Active Profile
 Default Passive Profile
Profile Selectors Changes in status and order  Active Profile Selector
 Passive Profile Selector
 Order of Passive Profile Selector
Rules
 Order of Active Profile Selector
Rules
Reviewer settings  <user's name>
Queue definitions
Velocity  Global Velocity
 Info code
Settings Editing any feature in the  SETTINGS (all caps)
window
 Test Notification URL

Search Results
The results can contain up to 2000 entries that correspond to your search parameters,
which are listed on the line above the table:
Figure 13 Search Results Display
The columns contain this information:
Column Content
Description Summary of the change followed by details about the previous and current
(modified) states
Date Date and time of the changes
Subcategory Decision Manager feature
Merchant ID CyberSource merchant ID
Organization Business unit or group of the user who made the change; can be the same as
the CyberSource merchant ID or account ID, or CYBS if an internal user made
the change.
User Name Name of the user who made the change
Keyword Modified component
You can temporarily customize the layout of the table and narrow your search results. To
return the columns to their original width, location, and sorting order, click Restore
Columns on the far right. These changes are not saved by Decision Manager.
Customizing the Layout

You can manipulate the columns to best suit your reviewing needs.
 Location: drag a column heading left or right to the desired location in the table.
 Width: When you click the edge between two columns, a double arrow appears. Move
the edge right or left to widen or shorten. If you make a column narrower than its
content, the entire contents of the column appear when you hover the cursor over the
field.

Sorting order of the content

When you click the heading of a column, a small triangle appears in the top right corner of
the heading. The triangle indicates whether the sorting order is ascending or descending.
You can sort only one column at a time; when you sort a second column, the sorting order
of the first column disappears. In this example, the data is sorted in descending order.
When sorted in ascending order, the content is sorted as follows:

 The oldest date is at the bottom.
 Text is sorted alphabetically, starting with numbers followed by uppercase and
lowercase.
Narrowing the Search Results

Use the row of fields below the column headings to find specific text. Although the
description column can contain many lines, you can find text located on any of the lines.
The fields are not case sensitive.
Example Finding Rule Changes Involving Card Verification Numbers (CVN)
To find all the changes made to the rules that contain the card verification rule (CVN) not
submitted, enter CVN or cvn. All changes that do not contain these letters are removed
from the table:

As you continue entering characters, the rows in the table is further reduced until only
those containing CVN not submitted remain:
Examples
These examples illustrate results that are possible.
Modified rule in a profile

This example shows two changes made to a profile that are logged in separate
subcategories:
 The change in profile setting of a custom rule is logged in the Profiles subcategory.
 The change in a condition in the rule is logged in the Custom Rules subcategory.

Modified default profiles

This example shows in steps that the user named test_user modified the default active
and default passive profiles.
Original setting: The profile was set as default active and passive:
Change: The user selected the Example profile as default active and the Test profile as
default passive profiles:

Auditing logs: show that test_user has set different default active and default passive
profiles:
Converted List Manager records

This example shows two conversions between the review and negative lists. In both
cases, an email address that was present in one of the lists was moved to the other list.
The search keyword would be the email address.
Using the Managed Risk Service

CyberSource’s Managed Services Order Review service enables you to use the expertise
of trained reviewers who have special tools to provide the most thorough review possible.
After you have discussed with the reviewing team your business practices and
requirements specific to your industry, the reviewing team thoroughly examines each
order marked for review. Reviewers may also examine rejected orders.
To obtain more information about the order, reviewers can use third-party resources, such
as network registries for IP addresses and payment card company databases. Reviewers
keep track of their progress by adding notes to the order details. If they have resolved the
issues, they accept the order on your behalf. If they cannot resolve the issues
satisfactorily, they reject the order.
When you enroll in the service, you agree to relinquish control of your order review to the
Managed Services team and to not accept or reject orders that the team is responsible for
managing on your behalf. If you continue to accept or reject orders, records of these
orders only change in your database but not in CyberSource’s database.

Customer Lists Administrator

The section shows how to prepare your system to use the information in the lists to allow
or prevent customers to place orders. To prepare your system, you need to complete
these tasks.
If Decision Manager services are called during early processing, your account
might be billed for a Decision Manager transaction even if payment
Important authorization is declined and the transaction does not successfully complete.
Choosing Early or Late Processing

With Decision Manager, you can check both customer lists before or after processing the
customer's payment. Therefore, before choosing a setting, make sure that you understand
the implications for the work flow of your business. This section applies to card
authorization, PayPal Express Checkout, and PayEase China Processing.
Figure 14 Managed Customer Lists Settings
All services and features are processed in this order:
1st Profile selector rules

2nd Early customer lists check
3rd Payment services
4th Decision Manager: order profiles, rules, and Advanced Fraud Screen or score service
5th Late customer lists check
Each section below describes whether to check your positive and negative lists either
before or after authorizing the customer's payment with card authorization or PayPal Do
Payment service.
 Before payment processing and the score service: The cases below describe how
orders are processed:
 When customer information is not in your customer lists, the payment and the
score service are processed normally, and you accept, review, or reject the order
depending on the results. If appropriate, you can later add customer information to
your lists.

 When customer information is in your positive list, you accept and process the
order.
 When customer information is in your negative list, the payment is not processed.
However, the score service does proceed, and you receive the appropriate codes.
You can reject the order and update your customer lists with the information from
the orders.
 When customer information is in both lists, you review the order to ensure that all
information is correct and that no error occurred before making a final decision.
You update one or both lists. The positive list result takes precedence over the
negative list result.
 After payment processing and the score service: With this option, you process your
orders as usual and use the customer lists test only as a final check so that you can
update the lists when appropriate.
Choosing Predefined Rules Settings

When you choose to check orders against your customer lists before processing the
payment, both predefined rules are activated as shown below. You need to set these rules
to determine how orders are processed when the rules are true. You can set both rules to
either ignore or review. For example, you can set the negative list rule to automatically
reject orders and the positive list rule to automatically accept orders.
Figure 15 Example Rule Settings
Creating Custom Rules

To screen your orders for specific data, you can create custom rules with the score factor
and information codes that you receive in the reply for negative and/or positive list
matches. You can use these fields when you want to find specific fraud score information.
Fraud score factors Codes returned for positive (E) or negative (F) list matches regardless
of the specific customer data in the positive or negative list.
Fraud score customer list Codes returned for transactions that are on the positive lists (POS-
information PERM or POS-TEMP), the negative list (NEG–), on both lists (CON-
POSNEG), or on the review list (REV-).
For examples, see "Screening Your Customer Lists," page 282.

Choosing Settings for Temporary Entries in the

Positive List
To activate the link Mark as Temporarily Trusted in the Case Details window,
you must click Update even if you do not change the default settings.
Note
After your basic settings are ready, you can start using List Manager. This figure shows the
default settings.
Figure 16 Default Positive List Settings
temp
You can add to your positive list temporary information about specific customers. These
customers’ orders were initially rejected because of a high score, for example, but after
reviewing the orders, you decide that they are acceptable. Therefore, you want to allow
these customers to re-place their orders for a specific duration, from 1 to 30 days.
When you add these customers’ information to the positive list, the records are dropped
automatically from the positive list when either of these events occurs:
 After the customer places the order again.
 After the time allowed to place the order has elapsed whether or not the customer has
placed the order again.
To add customer information to your positive list, select an option and a duration. The
default duration for temporary entries on the positive list is three days. You can change
your criteria at any time.

Figure 17 Temporary Positive List Field Option Settings
A billing or shipping address comprises the street address, city, state or province, country,
and postal code. In all cases, the billing address is usually associated with residential
customers, and the email address is usually associated with the shipping location. All
options are available with and without payment information, which is available if a
payment service request was included in the order. Only the account suffix is shown
decrypted. The options are as follows:
Email address and billing Average customer who shops from the home computer and has the
address order shipped to the home address.
Email address and shipping Customer who shops from home, work, or while travelling and has
address the item shipped to an address other than the home address, such
as the work address. The item may also be a gift.
Email domain and billing Organization, such as a company or college campus, which can
address contain two types of users:
 Corporate users who use the company card and have items
shipped not necessarily to the building where they work.
 Students and others who use a personal card and have a billing
address outside the campus.
Because of the added complexity, this case is more subject to fraud

than the previous ones. You need to recognize the email domain as
an important factor in determining whether the order is legitimate or
fraudulent. In this case, you may want to use other rules, especially
custom or profile selector rules to screen these orders completely
and accurately.
Email address, phone Customer who shops often from home or work with the same
number, billing address, and account number and always uses the same shipping address and
shipping address phone number. Orders that match this case are the most secure.
This option is the most complex, the least common, and the most
difficult to match.

Email address and device Customer who uses the same email address but may be using a
fingerprint new computer or device that they have not previously used when
shopping.
Email address Usually associated with the shipping location.
Device fingerprint and Customer who may be using a new computer or device and the
phone number same phone number.
shipping address same shipping address.
Device fingerprint Available if you are using the Device Fingerprint service. To detect
and prevent repeated fraud, you can use this ID (unique computer
ID) to link transactions made from that computer.
CPF/CNPJ CPF or CNPJ identification number for an individual or a business,
used by the Brazilian revenue agency, Receita Federal.
Later, while reviewing your orders, you can use the link Mark as Temporarily Trusted to
extract data from the transactions and add the customer’s identity to your positive list for
the duration that you set.
Preparing a Notification Message

When you add a customer to your positive list for a limited number of days, you need to
rapidly inform the customer of the special conditions. Prepare a message and a process
by which this message would be sent to your customers as soon as they are placed
temporarily on the positive list.
Creating Test Transactions

Prepare a sample list of test customers that you can use to keep track of the type of
transactions that you typically run. Make sure that the data is valid for the transaction type
that you create: valid data for transactions that you add to the positive list and fraudulent
data for those that you add to the negative list.
Process test transactions as follows:

Step 1 Process enough test payment transactions so that you can add 1–2 transactions to each
case:
Location Feature List Type
Case details Mark as Temporarily Trusted Positive list
Case details and List Manager Mark as Trusted Positive list
Case details and List Manager Mark as Suspect Negative list
Case details and List Manager Mark for Review Review list
Step 2 Be sure to note the request ID so that you can follow these transactions in the case details
window and in the List Manager search.

Step 3 After you add temporary records to your positive list, be sure to reprocess or drop some of
these transactions to simulate a customer placing an order a second time.
When you do so, you can verify later in your search or download that the temporary
records are dropped from the positive list as they normally would.
Adjusting Your Settings

Periodically, you must modify your settings to account for changes in customer purchasing
habits:
 User permissions: Make sure to review the permissions that you assign to users so
that all permissions are well covered by experienced users.
 Business rules: Verify that your core and custom rules satisfy your business
requirements for screening orders that may contain positive or negative data.
 Temporary list entry settings: Verify that the customer information that is added to your
temporary positive list and the expiration date are appropriate for your business.
 Type of data to add to the lists: As your customers and their purchases change with
time, you may need to change the type and quantity of customer data that you add to
the positive, negative, and review lists.
Case Management Administration

As administrator, you are responsible for implementing your case management process
and evaluating its effectiveness.
Setting Up Review Queues

Queues are used to organize orders that are marked for review into categories. For
example, you can create queues to:
 Specifically review issues related to address verification, order amounts, and order or
product velocity
 Distribute orders to specific reviewers
 Distribute orders to specific service-level agreements (SLAs)
Decision Manager provides eight default queues that you can use as is, modify, or delete.
In addition, you can define up to 50 custom queues.
A queue becomes active as soon as you create it and remains active until you delete it.
You cannot delete a queue if it contains orders.

You can use the Queue Reports and the Performance Statistics to monitor the number of
orders in each queue and the length of time that an order spends in a queue. For more
information, see "Evaluating Your Case Management Process," page 74.
Defining a Queue
To define a queue:
Step 1 From the Business Center home page, click Decision Manager > Queue Definitions.
Step 2 In the Queue Definitions window, click Add Queue:
Step 3 In the Queue Editor, enter a unique name for and a description of the queue (up to 255
characters), including notes for reviewers if appropriate.
Step 4 To configure a time limit for the queue or to configure the queue to support an SLA, check
the cases in this queue box and choose one of the following actions from the drop-down
menu. The specified action occurs after the time limit expires:
Table 4 Possible Queue Actions
Action Description
Reject Rejects orders and removes them from the queue.
Accept Accepts orders and removes them from the queue.
Expire Tags orders as missing the specified queue time limit, but leaves
orders in the queue.

Table 4 Possible Queue Actions (Continued)
Action Description
Accept and Settle/Debit Accepts orders, settles them, and removes them from the queue.
Move Moves orders to the specified queue.
For examples of queue configurations that support SLAs, see "Configuration Scenarios for
Queues that Support SLAs," page 50.
Step 5 If you choose the Move action in Step 4, select a queue from the cases in this queue to
drop-down list. Orders are moved to this queue within the time limit that is specified in
Steps 6 - 9.
Step 6 Specify a time limit.

When you specify a time interval with the only between option, the first time that you
specify for the interval must be earlier than the second. For example, if you specify only
between 11:00 AM and 10:00 AM, you cannot save the queue because 11:00 AM is later
than 10:00 AM.
Step 7 If the queue is used continually, choose Weekly and check the day or days that the action
and time limit should apply to orders in this queue.
Step 8 If the queue is used until a specific date, such as the date that a sale or special offer ends,
choose By Date, and select a date. The action and time limit specified in Steps 4 and 5
apply to this queue until the specified date.
Step 9 If you are using travel departure time and you want to override the queue policy time limit,
check Automatically expire when within and specify the number of hour(s) and
minutes. The queue policy action (reject/accept/expire/accept and settle) is performed on
orders before departure within the amount of time you specify.
Step 10 Choose a policy that adjusts how the SLA applies to orders that are moved into this
queue.
 The time zone used is determined by the merchant time zone that is specified in the
report configuration.
Note  If you use Level II or Level III information, your interchange rates may be
downgraded if you choose to accept and settle orders automatically. Be sure that
your reviewers are aware of the consequences and that orders are reviewed very
carefully.
Step 11 Click Save.

Modifying a Queue Definition
To modify a queue definition:
Step 1 From the Decision Manager home page, click Decision Manager > Queue Definitions.
Step 2 In the Queue Definitions window, click the name of the queue.
Step 3 In the Queue Editor window, make your changes.
Step 4 Click Apply.
Specifying a Hold Queue
To specify a hold queue:
You can specify one queue as a hold queue. Reviewers can move orders to the hold
queue by clicking a Hold button in the Case Management Details window. This button
enables reviewers to move orders to the hold queue with a single click, which streamlines
the order review process. When you move an order to the hold queue, the move policy
configured for that queue takes effect immediately.
Order reviewers must have the Move Orders permission and the Order
Conversion permission to use a hold queue. For information about granting
Note permissions and roles to reviewers, see "Assigning Reviewer Options,"
page 56.
Step 1 From the Decision Manager home page, click Decision Manager > Queue Definitions.

Step 2 In the Queue Definitions window, scroll down to the Hold Queue drop-down list and select
a queue as the hold queue:
For information about using the hold queue in the Case Management Details window, see
"Hold Option," page 233.

Configuration Scenarios for Queues that Support SLAs
Pending Customer Contact Queue Example

Acme Chocolates' order review team has an internal policy that customers must respond
within 3 days if they are contacted to clarify their order information. If a customer does not
respond within 72 hours, the order is rejected.
To configure the Pending Customer Contact queue:
Step 1 From the Business Center home page, choose Decision Manager > Queue Definitions.
Step 2 In the Queue Definitions window, click Add Queue in the lower right corner of the window.
Step 3 Enter a name and description for the queue.
Step 4 Check the cases in this queue box, and choose Reject from the drop-down menu.
Step 5 Choose After, and enter 72 hours.
Step 6 Verify that Weekly is selected and that all days of the week are checked.
Step 7 Choose a policy to apply to orders moved in from other queues.

Step 8 Click Save.

The Pending Customer Contact queue configuration is shown in the following figure:
Notice that only between 12:00 AM and 11:59 PM is set. This setting is the default
setting and means that the 72 hour time limit for this queue is in effect 24 hours per day.

Seasonal Sales Queues Example

All Acme Chocolates orders must be shipped by a specific date to arrive in time for the
end-of-year holidays. Typically, they categorize orders by shipping method and create
queues for each shipping method. They create a “Ground—Ship by December 18" queue,
a “3-day Express—Ship by December 21" queue, and an “Overnight—Ship by December
23" queue. Orders in all of these seasonal sales queues are rejected automatically on the
queue cut-off date. Customers whose orders cannot be shipped in time for the holiday are
contacted to determine if they would like to upgrade their shipping method.
To configure the Ground—Ship by December 18 queue:
Step 1 From the Business Center home page, choose Decision Manager > Queue Definitions.
Step 4 Check the cases in this queue box, and choose Expire from the drop-down menu.
Step 5 Choose At, and set the drop-down lists to 7:00 PM.
Step 6 In the but omit cases received within text box, leave the hour(s) text box empty and set
the minutes drop-down list to 30.
Step 7 Choose By Date, and set the date to Dec 18 2013.

Step 9 Click Save.
The Ground—Ship by December 18 queue configuration is shown in the following figure:
All orders that come in after 7:00 p.m. on December 18 are automatically expired. Based
on their experience and the contract that they have with their shipping provider, Acme
Chocolates knows that they can ship all orders by 7:00 p.m. and still guarantee on-time
delivery. The customers who place their orders after the cut-off time can be contacted to
upgrade their shipping method or cancel the order.
The Expire action is selected instead of Reject because Acme Chocolates wants to
contact the customers so they can upgrade their shipping method or cancel. If Reject is
selected, the orders are removed from the queue. When Expire is selected, the orders
remain in the queue.
Orders received 30 minutes before the 7:00 p.m. cut-off time are not expired, which gives
the order review team time to review them and accept or reject the order for shipping.
The “3-day Express—Ship by December 21" queue and the “Overnight—Ship by

December 23" queue are configured the same way, except the By Date setting is different.

First Class Tickets Queue Example

Autour Escapes is a boutique luxury cruise line specializing in Mediterranean cruises.
Their case management department categorizes all ticket orders by class so that they can
distribute higher-cost tickets to more experienced reviewers. Each day they clear out their
order queue at midnight. If an order is for a trip that departs within 24 hours of the midnight
cut-off, they set a queue policy override option.
To configure the First Class Tickets queue:
Step 1 From the Business Center home page, click Decision Manager > Queue Definitions.
Step 4 Check the cases in this queue box, and choose Expire from the drop-down menu.
Step 5 Choose At, and set the time drop-down list to 12:00 AM.
Step 6 Verify that Weekly is selected and that all days of the week are checked.
Step 7 Check the Automatically reject when within policy override, enter 24 hour(s), and select
00 from the minutes drop-down list.

Step 9 Click Save.
The First Class Tickets queue configuration is shown in the following figure:
All first-class ticket orders expire each night at midnight. However, if an order is for a flight
that leaves at 2:00 p.m. and the order has not been accepted or rejected, it is
automatically expired at 2:15 p.m.

Assigning Reviewer Options

An important step in preparing Decision Manager for your business is to assign
permissions and reviewer options to your users so that they can perform the tasks
associated with their job roles.
Permissions and Roles

As administrator, you have all the permissions. You are responsible for assigning the
permissions and roles to all users according to their position in the organization.
Permissions
When you add or remove a permission, the change becomes effective the next time that
the user logs in the Business Center.
Figure 18 Permissions Settings

Table 5 Reviewer Permissions
Case Reassignment Enables the user to assign orders owned by this user to other reviewers.
Order Conversion Enables the user to take the next available case, to review orders that are in a
queue, move orders to the hold queue, and to reset the reviewing time limit for
specific orders, but the user cannot request third-party services. The user can
accept or reject orders in the case management and transaction details
windows. This permission is required for the user's name to appear in these
locations:
 Case Management Search: The permission applies to the link Orders owned
by me and to the Order Ownership menu.
 Reviewer Settings: With this menu, you can set specific limits to the number
of orders that the user can own and the queues that the user can access.
When you assign this permission to a new reviewer, you must click Update in
the Reviewer Settings window even if you do not change any of the default
settings.
By itself, this permission does not enable the user to convert rejected orders,
but it is required to use the Rejected Order Conversion permission. If you want
the user to settle the order while accepting it, you must give to the user the
Payment Capture/Settlement/Debit permission. The user cannot accept or
reject orders that belong to other reviewers without having permission to steal
these orders.
Move Orders Enables the user to move orders owned by this user between queues or to
move orders to the hold queue.
Ownership Release Enables the user to un-assign orders owned by this user. When an order is
released, it is assigned to another reviewer or is returned to the pool of orders
that are not assigned. The user can release ownership in the search results
window and in the details window in the Case Properties menu. This permission
requires the Unrestricted Order Review permission.
Ownership Stealing Enables the user to appropriate orders assigned to other reviewers. The user
can steal ownership in the search results window (Take Ownership button and
Steal Ownership option) and in the details window in the Case Properties menu.
requires the Unrestricted Order Review permission requires the Unrestricted
Order Review permission.
Performance Statistics Review Enables the user to view reviewer performance statistics and to click the links to
view lists of transactions.
Priority Change Enables the user to change the priority of orders owned by the user in the
search results and case details windows.
Queue Search Enables the user to search all queues and to view orders that were initially
marked for review or rejected by the profile. The user can view all transactions
in all queues that are assigned to all users. However, this permission alone does
not enable the user to perform any actions, except adding notes to the orders
found. This permission is required for all other Case Management permissions,
except Reviewer Settings.
Queue Settings Management Enables the user to view, create, modify, and delete queues. This permission is
required to set a reviewing time limit for orders in a queue.

Table 5 Reviewer Permissions (Continued)
Queue Settings View Can only view the queue definitions.
Rejected Order Conversion Enables the user to review and accept orders that were initially rejected by the
profile. The user can perform this action in the case management and
transaction details window with the Transaction View permission. This
permission requires the Order Conversion permission.
Reviewer Settings Enables the user to access the Reviewer Settings window to set the maximum
number of transactions that reviewers can own and the queues that reviewers
can access. This permission does not enable the user to review or convert
orders.
When you sign up for Enhanced Case Management, your existing reviewers are
automatically signed up. However, when you assign this permission to a new
reviewer, you must click Update in that window even if you do not change any of
the default settings.
Third-Party Configuration Enables the user to enter the merchant information necessary to request third-
party services.
Third-Party Requests Enables the user to request third-party services by clicking the links in the
details window if the user has the Unrestricted Order Management permission.
This permission is not required to view the data that has already been requested
by another reviewer.
Time Limit Disabling Enables the user to remove and restore the time limit for specific orders that are
marked for review. This permission applies only to the orders owned by the
reviewer in the case details window; it does not apply to the time limit set for
queues.
Time Limit Reset Enables the user to reset to the current date and time the start of the reviewing
time allowed. This permission applies only to the orders owned by the reviewer
in the case details window; it does not apply to the time limit set for queues.
Transaction Marking Enable users to mark transactions that you want to add to one the lists or that
Permissions you want to hide from future searches:
 Mark as Suspect: can tag transactions as potentially or confirmed fraudulent
and add order data to the negative list.
 Clear Mark as Suspect: can clear an order that was marked as suspect by
accident or later confirmed to be legitimate, and remove the order data from
the negative list. This option is available only for orders that were marked as
suspect.
 Mark as Trusted: can add good order data to the positive list.
 Mark as Temporarily Trusted: can add order data to the positive list for a
limited time.
 Mark for Review: can add order data to the review list.
 Remove from History: can hide order data from score and from the negative
list.

Table 5 Reviewer Permissions (Continued)
Unrestricted Order Enables the user to work on any case, including those that the user does not
Management own. This permission applies only to these other permissions:
 Case Re-Assignment
 Move Orders
 Ownership Release
 Priority Change
 Third-Party Requests
 Time Limit Disabling
 Time Limit Reset
However, having a permission that applies only to the orders owned by the
reviewer, such as Time Limit Reset, removes the limitation. In this case, the user
is allowed to reset the time limit of any order.
Unrestricted Order Review Enables the user to review any order that is not assigned by using the Take
Ownership button in the results window. With this review permission, the
reviewer can add notes and perform all the actions necessary to convert orders
but cannot request third-party services. To successfully take ownership of
orders, the reviewer also needs these permissions:
 To convert orders, the reviewer needs the Order Conversion and/or Rejected
Order Conversion permissions.
 Without having the Order Stealing permission, the reviewer cannot steal an
order from another reviewer with the Take Ownership button.
 In the case details window, the reviewer can take ownership of an order by
clicking the Own button, by checking the box in the Case Properties, and
when adding a note.
When you sign up for this service, your existing reviewers are automatically
given this permission. To restrict your existing reviewers to taking ownership of
only the highest priority orders, remove this permission.
payment
In addition, some of your users may require these payment permissions:

Table 6 Payment Permissions for Reviewers
Payment Authorization Can successfully process card authorizations.
Payment Capture/Settlement/ Can successfully process credit card capture, electronic check debit, and direct
Debit debit.

Roles
You can take advantage of the built-in Case Management Administrator and Case
Management Reviewer roles. Each contains the basic permissions required to fulfill the
roles. You can edit these roles as needed and create roles specific to your business.
To fulfill all the requirements of your reviewing team, you can also combine several
permissions into roles. For example, reviewers may need other permissions, such as
Queue Settings Management, Transaction View and Payment Capture/Settlement/Debit.
Roles enable you to customize and simplify user management as follows:
 You assign a role to users instead of permissions.
 You need to update only the role that contains the tasks that you want to update. The
permissions of all employees assigned the role are immediately updated.
Example Fictitious Account with One Merchant ID and Multiple Users
This fictitious account has one merchant ID with several users. The case management
permissions are grouped in four roles:
 Search: queue search

 Review & conversion: order conversion, rejected order conversion, and unrestricted
order review
 Reviewer self-administration: ownership release and ownership stealing
 Administration: case administration and reviewer settings
Table 7 Example Reviewer Roles
Role Responsibilities and Permissions

Administrator All
Junior Reviewer The junior reviewer reviews specific orders assigned by the
administrator or that are in a queue assigned to this reviewer.
 Queue Search and Transaction View
 Order Conversion and Rejected Order Conversion
Staff Reviewer The staff reviewer is responsible for most orders marked for
review. This user can review any order, take ownership of
orders that are not assigned, and if appropriate, settle the
order while accepting it.
 Order Conversion and Unrestricted Order Review
 Third-Party Service Requests
 Payment Capture/Settlement/Debit

Table 7 Example Reviewer Roles (Continued)
Role Responsibilities and Permissions

Senior reviewer The senior reviewer can review, convert, and settle any
order, can self manage, but cannot perform administrative
tasks
 Order Conversion, Rejected Order Conversion, and
Unrestricted Order Review
 Ownership Release and Ownership Stealing
 Third-Party Service Requests
 Time Limit Disabling
 Payment Capture/Settlement/Debit
Reviewers are assigned a role that corresponds to their responsibilities. Several reviewers
can be assigned the same role depending on the size and the needs of the business.
Maximum Number of Orders

For each new reviewer who has the permission to accept or reject orders (Order
Conversion and Rejected Order Conversion permissions), you need to specify the number
of orders that the reviewer can own and the queues that the reviewer can access.
Figure 19 Reviewer Settings

To set the maximum number of transactions that the reviewer can own at any time, check
the box and enter a number. After reaching the limit, the reviewer can select new orders
only after releasing ownership of or accepting or rejecting at least one order, except in this
case: if the order does not belong to another reviewer, the reviewer can select and accept
it immediately because the ownership and the conversion happen simultaneously.
Figure 20 Maximum Number of Orders Allowed Settings
This limit does not apply in the search results window in these cases:
 Administrators can override the number of orders assigned to a reviewer by using the
Assign action.
 Reviewers can accept or reject orders that belong to other reviewers by using the
Accept Selected and Reject Selected actions.
The Take Ownership and Ownership Stealing permissions are required when appropriate.
Address Mapping Options

In this section, you can enable each reviewer to use one of the online mapping options,
which allow your reviewers to view the actual location of the customer's billing or shipping
address on a map. When you select an option, a globe appears in the case details window
for your reviewer.
Review Queues
You need to select the queue(s) that the reviewer can search. For example, reviewers can
convert orders after searching All Queues and selecting an order in any queue.
Figure 21 Review Queue Settings

To restrict reviewers to specific queues, check Select Queues. Select the queue or queues
(Shift-select) that you want each reviewer to access and move the queue(s) to the
Assigned Queues column.
Choosing Temporary Positive List Fields

You must select and save an option to activate the Mark as Temporarily Trusted link in the
case details window.
You can add information about specific customers that you want to allow to re-present
orders that were initially rejected because of a high score. You have reviewed these
orders and know them to be acceptable. To add customer information to your temporary
positive list, select a set of fields and a duration. The data from the fields is extracted from
the transactions and added to your positive list for the duration date when you click Mark
as Temporarily Trusted in the transaction or case details window. These temporary
records are dropped automatically from the positive list when either of these events
occurs:
 After the customer places any order that matches the positive criteria
placed the order again
To add customer information to your temporary positive list:
Step 1 Select the field option that you want.

 A billing or shipping address comprises the street address, city, state or province,
country, and postal code. The billing address is usually associated with residential
customers.
 The payment information refers to the payment method: credit card or debit (direct
debit or electronic check).
Most options are available with or without payment information.
Table 8 Field Options for Adding Items to the Positive List
Option Description
Email address and billing Customer who shops from home and has the order shipped
address to the home address.

Table 8 Field Options for Adding Items to the Positive List (Continued)
Option Description
Email address and shipping Customer who shops from home, work, or while travelling
address and has the item shipped to an address other than the
home address, such as the work address. The item may
also be a gift.
Email domain and billing Organization, such as a company or college campus. In this
address case, it contains two types of users:
 Corporate users who use the company card and may
have items shipped to a location other than the building
where they work, but still within the company.
 Students and others who use a personal card and have a
billing address (most likely their home address) outside
the campus.
Because of the added complexity, this case is more subject
to fraud than the previous ones. You need to recognize the
email domain as an important factor in determining whether
the order is legitimate or fraudulent. In this case, you may
want to use other rules, especially custom or profile selector
rules to screen these orders completely and accurately.
Email address, phone Customer who shops often from home or work with the
number, billing address, and same card and always uses the same shipping address and
shipping address phone number. Orders that match this case are the most
secure. This option is the most complex, least common, and
most difficult to match.
Email address and device Customer who uses the same email address but may be
fingerprint using a new computer or device that they have not
previously used when shopping.
Device fingerprint and phone Customer who may be using a new computer or device and
number the same phone number.
Device fingerprint and Customer who may be using a new computer or device and
shipping address the same shipping address.
Device fingerprint Available if you are using the Device Fingerprint service. To
detect and prevent repeated fraud, you can use this ID
(unique computer ID) to link transactions made from that
computer.
CPF/CNPJ CPF or CNPJ identification number for an individual or a
business, used by the Brazilian revenue agency, Receita
Federal.

Step 2 Select the expiration date for your entries in the positive list, from 1 to 30 days.
The default is 30 days.
Step 3 To save your changes, click Update.
Enabling Third-Party Services

You can enable additional services that can help your reviewers validate customer
information. 192.com, Accurint, Credilink, Emailage, Perseuss, TARGUSinfo, and
Whitepages are external sources of data that enable you to correlate the customer's
name, address, phone number, and other data present in the order.
To enable case reviewers to request data from these external services in the case details
window, you must give permission to your reviewers to query these services or add the
permission to a role.
When you create a rule for a third-party service with real-time results, you may want to
create a new profile to run this rule. All rules within a profile run against incoming
transactions. Creating a new profile allows you to specify that your rule only runs for
necessary transactions.
When entering your credentials, make sure that the information is correct. If
you enter incorrect information, your changes are saved, but you receive an
Important error message when you try to use the service.
To configure third-party services in the Business Center, click Decision Manager, and
then click Third-Party Configuration under Case Management in the left navigation
panel.
Third-party services are not guaranteed to work and they can be removed or
changed at any time. For information on pricing for third-party services, contact
Important your Customer Support representative.

192.com
This service uses order data to provide detailed information about persons and
businesses in the U.K., Germany, Sweden, the U.S., and Canada. You can find complete
information about names, addresses, and many different types of public records.
Figure 22 192.com in the Third-Party Service Configuration Window
To use your existing 192.com account, select 192.com in the Third-Party Service
Configuration window and enter your 192.com user name and password.
Make sure that your development team includes the date of birth field in the API
request if you want 192.com to compare the customer’s date of birth obtained
Note from public records with the customer’s stated date of birth in the order.
If you do not have an account with 192.com, contact your CyberSource
representative.
Accurint
This service applies only to U.S. addresses. Accurint provides information about the
location of persons, their addresses, and phone numbers. If you want your reviewers to be
able to view this section in the case details window, select Accurint in the Third-Party
Service Configuration window, and enter your Accurint user name and password.
Authenticating with Your Existing Accurint Credentials
To authenticate using your existing Accurint credentials:
Step 1 Click Authenticate with your credentials.

Step 2 Enter your Accurint user name and password.
Step 3 At the bottom of the window, click Update.
Accurint bills you for each call.

Figure 23 Accurint Authentication with Accurint Credentials
The information obtained from Lexis Nexis may contain nonpublic personal
information and it is not provided by “consumer reporting agencies,” as that
Important term is defined in the Fair Credit Reporting Act (15 U.S.C. § 1681, et seq.)
(“FCRA”) and the information does not constitute “consumer reports,” as that
term is defined in the FCRA. Accordingly, the data provided by Lexis Nexis
may not be used in whole or in part as a factor in determining eligibility for
credit, insurance, employment or another purpose in connection with which a
consumer report may be used under the FCRA. Further, (A) Customer certifies
that it will not use any of the information it receives from Lexis Nexis to
determine, in whole or in part an individual's eligibility for any of the following
products, services or transactions: (1) credit or insurance to be used primarily
for personal, family or household purposes; (2) employment purposes; (3) a
license or other benefit granted by a government agency; or (4) any other
product, service or transaction in connection with which a consumer report
may be used under the FCRA or any similar state statute, including without
limitation apartment rental, check-cashing, or the opening of a deposit or
transaction account; (B) by way of clarification, Customer may use information
received through the Services for the following purposes: (1) to verify or
authenticate an individual's identity; (2) to prevent or detect fraud or other
unlawful activity; (3) to locate an individual; and (C) Customer shall not use any
of the information it receives through the Services to take any “adverse action,”
as that term is defined in the FCRA.
The information provided by Lexis Nexis may contain “nonpublic personal
information” that is subject to the Gramm-Leach Bliley Act (“GLBA”) (15
U.S.C. § 6801, et seq.). Customer must have a permissible use in order to
obtain the GLBA data. The only permissible use that is allowed under the
terms of your agreement with CyberSource is that the Lexis Nexis data will be
used for the purpose of selling products and services to End-Users.
Customer acknowledges and agrees that it may be required to certify its
permissible use of GLBA data at the time it requests information in
connection with requests to Lexis Nexis. In addition, Customer agrees it will
recertify, in writing, its permissible use of the GLBA data upon request by
CyberSource.

Credilink
This service provides access to public information that is maintained by the Brazilian
revenue agency, Receita Federal. If you want your reviewers to be able to view this
section in the case details window, select Credilink in the Third-Party Service
Configuration window, and choose one of the following options for authenticating to the
service.
Credilink uses the Cadastro de Pessoas Fiscicas (CPF) identification number

for individuals and the Cadastro Nacional da Pessoa Juridica (CNPJ) for
Note businesses to return information maintained by the Receita Federal. Make sure
that your development team includes the personal ID field in the API request for
the CPF and the CNPJ identification numbers.
For more information, see the billTo_personalID field in the Decision
Manager Using the Simple Order API Developer Guide (PDF | HTML) or the
personal_id field in the Decision Manager Using the SCMP API Developer
Guide (PDF | HTML)
Authenticating with Your CyberSource Credentials

The option to authenticate using your CyberSource credentials is available only in the
Business Center production environment. It is not available in the test environment.
To authenticate using your CyberSource credentials:
Step 1 Click Authenticate with CyberSource credentials.

CyberSource adds a fee for each call. For more information, contact your CyberSource
representative.
Figure 24 Credilink Authentication with CyberSource Credentials

Authenticating with Your Existing Credilink Credentials

Contact your Credilink representative to make sure that you are correctly configured to
use your existing Credilink credentials in the Business Center.
To authenticate using your existing Credilink credentials:

Step 2 Enter your Credilink user name and password.
Step 3 Enter your Credilink Sigla user code in the Credilink Code text box.
Credilink bills you for each call.
Figure 25 Credilink Authentication with Credilink Credentials
Enabling Real-Time Credilink Results
To enable real-time Credilink results:
Step 1 Check the box to enable real-time Credilink results in custom rules.
Step 2 At the bottom of the window click Update.

The Credilink order elements are available when you create a rule as described in
"Creating a Rule," page 104. For descriptions of the Credilink order elements, see "Third-
Party Credilink Fields," page 267.
Figure 26 Enabling Real-Time Credilink Results

Emailage
Emailage provides identity intelligence and information based on a customer’s email
address. Emailage information is available to use in the Rule Editor or during manual
review.

representative.
Figure 27 Emailage Authentication with CyberSource Credentials
Authenticating with Your Existing Emailage Credentials

Contact CyberSource support for available configuration options.
Enabling Real-Time Emailage Results
To enable real-time Emailage results:
Step 1 Check the box to enable real-time Emailage results in custom rules.

The Emailage order elements are available when you create a rule as described in
"Creating a Rule," page 104. For descriptions of the Emailage order elements, see "Third-
Party Emailage Fields," page 268.

Figure 28 Enabling Real-Time Emailage Results
Perseuss
This service applies to travel merchants who are processing passenger-related
information. Merchants can reference the Perseuss service with passenger information,
and it provides risk scores based on matches in the Perseuss system. Within Decision
Manager, the Perseuss service can be used manually or in real-time.
Authenticating with Your Existing Perseuss Credentials

Contact your Perseuss representative to make sure that you are correctly configured to
use your existing Perseuss credentials in the Business Center.
To authenticate using your existing Perseuss credentials:

Step 2 Enter your Perseuss user name and password.
Perseuss bills you for each call.
Figure 29 Perseuss Authentication with Perseuss Credentials

Enabling Real-Time Perseuss Results
To enable real-time Perseuss results:
Step 1 Check the box to enable real-time Perseuss results in custom rules.
The Perseuss order elements are available when you create a rule as described in
"Creating a Rule," page 104. For descriptions of the Perseuss order elements, see "Third-
Party Perseuss Fields," page 270.
Figure 30 Enabling Real-Time Perseuss Results
TARGUSinfo
This service applies only to U.S. addresses. TARGUSinfo provides real-time name,
address, and phone number verification. You can use the service on your own or through
the case details window. If you want your reviewers to be able to view this section in the
case details window, select TARGUSinfo in the Third-Party Service Configuration window,
and choose one of the following options for authenticating to the service.

representative.
Figure 31 TARGUSinfo Authentication with CyberSource Credentials

Authenticating with Your Existing TARGUSinfo Credentials
To authenticate using your existing TARGUSinfo credentials:

Step 2 Enter your TARGUSinfo user name, password, and service identification number into the
appropriate text boxes.
TARGUSinfo bills you for each call.
Figure 32 TARGUSinfo Authentication with TARGUSinfo Credentials
Whitepages Pro
Whitepages Pro leverages customer identity information including name, email address,
phone (billing and shipping), address (billing and shipping), and IP address to help
validate the identity of the customer, and the legitimacy of their order. The Whitepages Pro
Identity Check results are available in Decision Manager for use in rules and/or manual
review.

representative.
Figure 33 Whitepages Pro Authentication with CyberSource Credentials

Authenticating with Your Existing Whitepages Pro Credentials

Contact CyberSource support for available configuration options.
Enabling Real-Time Whitepages Pro Results
To enable real-time Whitepages Pro results:
Step 1 Check the box to enable real-time Whitepages Pro results in custom rules.
The Whitepages Pro order elements are available when you create a rule as described in
"Creating a Rule," page 104. For descriptions of the Whitepages Pro order elements, see
"Third-Party Whitepages Pro Fields," page 271.
Figure 34 Enabling Real-Time Whitepages Pro Results
Evaluating Your Case Management Process

The Performance Statistics option, located under Reporting, enables you to view the
Reviewer Statistics, Queue Statistics, and Profile Statistics reports, which provide
information about the performance of your case management reviewers, queues, and
profiles. To access these reports, you must have the Performance Statistics Review
permission.
Figure 35 Performance Statistics Window
The reports in the Performance Statistics window present information about orders placed
or resolved during the selected time range. Searches and links to the case management
search results window are based on the conversion date.

For the Reviewer Statistics report and the Queue Statistics report, the Date drop-down list
contains available search intervals (today, yesterday, week to date, last week, month to
date, last month) and the option to set a custom range. Weekly searches start on the day
specified under Report Subscriptions in the Account Management section of the Business
Center left navigation panel. Custom ranges are valid only for a maximum of 31 days
within the previous six months.
Figure 36 Reviewer Statistics Tab
Your search criteria are displayed above the results table as shown in Figure 37. The
Refresh option on the right enables you to resubmit your search interval.
Figure 37 Search Criteria Displayed Above Results Table
Numbers in the Total Resolved, Owner, and Marked as Suspect columns of the results
table are links to a case search results window that contains only these orders. If more
than 2000 orders are returned in the search results, the numbers are not links.
Reviewer Statistics
This report presents information for orders placed or resolved during the selected time
range. For each reviewer, the report shows the number of orders that were resolved or in
review, and the reviewer’s average review time. Only reviewers who owned or resolved at
least one order placed during the date range selected appear in the report.

Figure 38 Reviewer Statistics Report
Reviewers
In the results table, reviewers are identified as follows:
 Individual reviewers are shown in the format merchant ID: user name.
 For orders that are automatically accepted or rejected by the system after the
reviewing time limit passes, the reviewer is shown as CYBS:sla.
 For orders that are resolved by an internal or managed risk reviewer, the reviewer is
shown in the format CYBS:<user name>.
Results
Columns contain the following information:
 Total Resolved: Number of orders accepted or rejected by reviewers and those
resolved automatically by the system during the selected time interval.
 Owner: Number of orders accepted and rejected by the reviewer who was assigned
or took ownership of the orders. Percentage amounts indicate the percentage of total
orders accepted or rejected. These columns are empty if the orders owned by the
reviewer were resolved automatically by the system.
 Time Limit: Number of orders owned by the reviewer that were resolved
automatically by the system after the reviewing time limit of the queue passed.
 <Specified Currency> Total: Value in the local currency of the orders that were
resolved. The default is the currency selected in the Settings window under
Configuration in the left navigation panel. If you change your local currency during the
time range selected, the total amounts include only the orders placed after the local
currency was changed. If transactions are in multiple currencies other than the local
currency, the converted amounts are approximate because conversion rates fluctuate
during reporting periods. The column title displays the three-letter ISO code for the
specified currency.
 Marked as Suspect: Number of orders owned by the reviewer that resulted in
chargebacks or were marked suspect.

 Currently Owned: Number of orders currently owned by the reviewer at the end of
the reporting system. This column does not apply to orders that were resolved
automatically by the system.
 Average: Average time required by a reviewer to resolve an order based on the date
when ownership of the order was initially assigned to the reviewer. Reviewers who are
assigned a large number of orders may appear to have a longer reviewing time than
reviewers who are assigned only a few orders at a time or reviewers who choose only
the case with the next highest priority. For orders that are automatically resolved by
the system, the time is 0:00:00. Time is displayed in the format
hours:minutes:seconds.
 Pickup: Time interval between when the order was placed in the queue and when
initial ownership occurred. Orders that are not owned by a reviewer are not
considered in the calculation.
 Review: Time interval between initial ownership and order resolution.
Example
Figure 39 shows a report with two reviewers and the system (CYBS:sla):
 The performance of the reviewers differs significantly in the number of resolved orders
and in average pickup time (highlighted in red). The administrator needs to
understand the reasons, such as the type of orders in the assigned queues or the
amount of time spent reviewing orders, so that assignments of orders to review can be
modified if necessary.
 Most of the orders were resolved automatically by the system (highlighted in black).
The columns that are not relevant (Owner and Currently Owned) are empty. In this
example, the administrator might decide to modify the assignments so that more
orders are resolved by reviewers instead of by the system.

Figure 39 Reviewer Statistics Report Example: 2 Reviewers and the System
Queue Statistics
This report presents information for orders resolved during the selected time range. For
each queue, this report presents the number of resolved orders and the average
processing time for each order.
Figure 40 Queue Statistics Report
Queues
All active queues are listed even if they are empty. Queues are listed in random order.
Results
Columns contain the following information:
 Total Resolved: Number of orders resolved by reviewers, including the system,
during the specified time period.
 Owner: Number of orders accepted or rejected by the reviewer who owned the orders
and the percentage of the total resolved orders.
 Time limit: Number of orders resolved automatically by the system after the specified
reviewing time has passed.
 <Specified Currency> Total: Value in the local currency of the resolved orders. The
default is the currency selected in the Settings window under Configuration in the left

navigation panel. If you change your local currency during the time range selected, the
total amounts include only the orders placed after the local currency was changed. If
transactions are in multiple currencies other than the local currency, the converted
amounts are approximate because conversion rates fluctuate during reporting
periods. The column title displays the three-letter ISO code for the specified currency.
 Marked as Suspect: Number of orders that resulted in chargebacks or were marked
suspect.
 Average Time: Time is displayed in the format hours:minutes:seconds.
 Pickup: Time interval between when the order was placed in the queue and when
initial ownership occurred.
 Review: Time interval between initial ownership and order resolution.
 Still in Queue: Number of unresolved orders in the queue at the end of the reporting
period (owned or unowned).
Example
This figure shows a report with two queues. Orders remain in the Example queue for much
longer than in the other queue before being owned by a reviewer. The administrator might
need to examine how orders are routed to the queue, the content of the queue, and
reviewer assignments to determine the reason for the delay.
Figure 41 Queue Statistics Report Example: 2 Queues

CHAPTER
Order Profiles
3
An order profile is a group of business rules tuned for a particular type of order, such as
high value, specific product, or seasonal, that is used to evaluate an order. As a result of
the evaluation, the order is accepted, reviewed, or rejected.
You can create and modify as many order profiles as you need by selecting predefined
rules or by creating custom rules. You can create basic profiles for every day use or for
special occasions. For example, you may create a special profile for the end-of-year
holiday season, which you put into production only during that time.
You must have created at least two queues (review and reject) before you can
create an order profile.
Important
Creating and Editing a Profile

You can use the built-in profile named Example to start evaluating orders immediately in
passive mode. This profile contains basic settings that you can use to screen orders until
you understand the type of fraud that applies to your business.
When creating a profile, you have two options:

 Add Profile With Core Rules: each is set to accept, review, reject, or monitor.
 Add Empty Profile: none of the core rules are in use.
In both cases, custom rules that you have created are listed in the categories that you
selected. After you have made your changes, click Save if you are creating a profile or
Apply if you are modifying a profile.

Chapter 3 Order Profiles
Defining a Profile
Give your profiles a descriptive name. The name appears in the list of order profiles with
the description. Both should enable you to view the purpose of each profile.
You can set a priority level for each profile according to your business rules or the types of
orders that are screened by the profile. Priority levels range from 1 (high) to 5 (low). Your
selection takes effect as soon as you save the profile.
The default priority level is 3. Orders are assigned priority according to the level set for the
profile:
 When no priority is set for the triggered rules
 When no rules are triggered even if a priority level is set for them.
Figure 42 Profile Editor Window

Selecting a Case Management Queue

For each profile, you need to select how to process your orders that are marked for review
or rejected. You may choose to use the queues differently in different profiles. For
example, if you created a queue called High Value, you can send the high value orders
that you want to review to the review state and the high value orders that you want to
reject to the reject state.
The figure shows that orders that you want to review are sent to the review queue and
those that you want to reject are sent to the reject queue.
Figure 43 Queue Selection Window Example
For more information on defining case management queues, see "Setting Up Review
Queues," page 45.
Setting the Fraud Score Options

These options set the model and threshold used for all orders evaluated by the profile.
Figure 44 Fraud Score Window

Risk Model
The risk model is used to generate the fraud score for the transaction.
To make sure the appropriate risk model is used for your orders, CyberSource
recommends that you select the Best risk model, unless you are only selling
Important products that fall into the vertical risk model category (travel or digital). If you
are only selling travel or digital products, you should use the appropriate
vertical model. If you receive transactions that originate from mobile
applications or mobile browsers, use the appropriate mobile risk model.
You can choose from these options:

 Default model:
 Best risk model: risk model that takes into account all of the transaction details to
choose the best risk model for the transaction. This option is the default when you
create a profile.
 Country-specific models for transactions with physical merchandise:
 U.S. model: default risk model for transactions in the U.S.
 Canada model: default risk model for transactions in Canada.
 UK model: default risk model for transactions in the UK.
 China model: default risk model for transactions in China.
 AU NZ model: default risk model for transactions in Australia and New Zealand.
 Region-specific models for transactions with physical merchandise:
 APAC model: default risk model for transactions in the Asia-Pacific region.
 CEMEA model: default risk model for transactions in Central and Eastern
Europe, the Middle East, and Africa.
 East Asia model: default risk model for transactions in Hong Kong, Taiwan,
Macao, Singapore, Vietnam, and Korea.
 E.U. model: default risk model for transactions in the countries listed in "Countries
Included in the European Union Risk Model," page 316.
 LATAM model: default risk model for transactions in Mexico, Central America,
and South America.
 Vertical models:
 Travel model: default risk model for travel transactions with no geographic
restrictions.
 Digital model: default risk model for any transactions that require no
merchandise delivery and are without geographic restrictions. For example, use
this model if you deliver digital goods, services, or subscriptions.
 Mobile models:
 Global mobile model: default risk model for mobile transactions that involve
physical merchandise in all regions.

 APAC mobile model: default risk model for mobile transactions that involve
physical merchandise in the Asia-Pacific region.
 Travel mobile model: default risk model for mobile travel transactions with no
geographic restrictions.
 Digital mobile model: default risk model for mobile transactions that require no
merchandise delivery and are without geographic restrictions. For example, use
this model if you receive transactions for digital goods, services, or subscriptions
that originate from mobile applications or mobile browsers.
The choice that you make here is used for all orders evaluated by the profile. For
assistance in choosing the most appropriate custom models, contact Customer Support.
If the default active and default passive profiles have different models, the
model in the default active profile overrides that in the default passive profile.
Note
Fraud Score Thresholds

The tests estimate the level of risk associated with each order, providing a fraud prediction
score based on many categories, such as inconsistencies in customer information, fraud
list, and invalid values. Use these thresholds to determine when to review or reject orders.
You can use the default settings or modify the thresholds according to the requirements of
your business. In the default profile (Example), the score thresholds are enabled as
follows:
 0 to 39: orders generating these fraud scores are ignored.
 40 to 70: orders generating these fraud scores cause the order to be reviewed.
 71 and higher: orders generating these fraud scores cause the order to be rejected.
Figure 45 Fraud Score Thresholds Window
When you move the slider handles, the range is automatically displayed above the three
sections. If you move both sliders to the right (99), the fraud score does not affect the
outcome of your orders because orders that score from 0 to 98 are ignored. When you
change the threshold values, the Ignore and Reject ranges are adjusted automatically.
If the score thresholds are enabled in the profile, your settings can trigger either or both of
these rules when the score for an order is higher than your limit to review or reject: Order
is above your AFS threshold for review and Order is above your AFS threshold for reject.
For example, if your review limit is 70, orders that score 75 are rejected and trigger both
rules. These rules are listed in the case details and in the Profile Rule Performance report.

Setting Business Rules

In each profile, you can use any number of predefined rules, and you can add up to 100
custom rules. The rules are divided into categories of related rules. This figure shows all
categories closed. To expand all categories at once, click the open folder icon on the far
right:
To expand or close each category, click the title of the category. The numbers in
parentheses, such as (4 of 4 applied), indicates the number of rules in use in the profile.
Figure 46 Profile Rules Window
In the figure above, View All Rules is visible. To toggle between the rules in use and
those available for use, click View All Rules or View Applied Rules at the bottom of the
window:
Rule Options
For each rule, select the appropriate checkbox for profile impact on the order. You can
choose only one option for each rule:
 Monitor: the rule is used to evaluate the order, but the result has no impact on order
acceptance or rejection. Use this setting for rules that you want to test before putting
in production.
 Accept: the order is automatically accepted. Use this rule for specific cases only, for
example when your customers added temporarily on the positive list re-place an
order.
 Review: the order is placed in a review queue.

 Reject: the order is automatically rejected.
Do not set a rule to reject an order unless you have data to demonstrate
that the particular parameter has been used fraudulently. Otherwise, the
Important number of false-positive fraudulent results increase significantly. Use
Accept only when the rule screens orders for positive attributes, such as a
customer on the positive list. For all other orders, because you are
searching for errors or potential fraud, use Monitor or Review.
Rule Priority
You can set a priority level for each rule. Priority levels range from 1 (highest) to 5 (lowest).
Your selections take effect as soon as you update the profile. By default, no priority is set
for any rule. If you save a profile in which no priority is assigned to a rule, orders are
assigned the profile’s priority. When you set a priority level to a rule, orders are assigned
priority as follows:
 Orders are assigned priority according to the triggered rule that has the highest
priority level.
 The priority level of any triggered rule supersedes that of the profile (1) whether the
rule' priority is higher or lower than that of the profile and (2) regardless of the impact
of the rule (accept, monitor, review, or reject) on the profile.
Example This figure shows the first two sets of rules.
Because the profile priority is the default (3), the order would be assigned
priority as follows:
 Address verification rules: If the second or fourth rule is triggered

(priority = 1), the order is given the highest rule priority (1). If the first
rule is triggered (priority = 4), the order is given priority 4. If the first two
rules are triggered, the order is marked for review (first rule), and the
priority is 1 (second rule even if set to Monitor). If no rule is triggered,
the order is given the priority of the profile (3).
 New category rule: Because no priority is set, this rule does not affect
the order’s priority if it is triggered.

Predefined Rules
All predefined rules are initially set to Monitor, except for these:
Default Setting Predefined Rule

Review Suspiciously high number of account numbers
Billing and/or shipping address not verifiable
Geolocation inconsistencies in order
Letter combinations not found in English
Reject Customer on the negative list
Accept Customer on the positive list
Although you cannot modify the conditions in predefined rules, you can change the
category where the rule is located, its setting as a core rule, and its role in the profile. For
example, in the figure below, the predefined rule is located in the Address Verification
category, the rule is set as core rule, and its role is to monitor only. All other fields are
disabled.
Figure 47 Rule Definition Window

Example A merchant wants to enforce these rules:
 Only orders from the U.S. are accepted.

 When processing card authorizations, the Address Verification Service
(AVS) is used to accept orders only if the complete address matches. If
the match is not complete, the orders are reviewed.
 High-value orders are reviewed. Those with different billing and
shipping addresses are always reviewed.
 When the review queue contains very many orders, low-value orders
are shipped before they are reviewed.
 The Mark as Suspect feature is used, and chargebacks are analyzed
regularly. The chargeback rate is between 0.2% and 0.3%.
The merchant sets the predefined rules as shown in this table.
Business Model Corresponding Predefined Business Rules Setting

Always require full AVS Card authorization service only.
Match
Address Verification category:
 No AVS match Review
 AVS service not available Review
Card Verification Number category:
 CVN not supported by cardholder's bank Review
Order from the U.S. only Address Verification category:
 Account issued outside of billing country Review
Order Data Quality category:
 Order outside the US Review
 Order outside of merchant’s region Review
To check orders that (1) originated outside the U.S. but
mimic orders from within the U.S. and (2) have non-U.S.
billing or shipping addresses
Same billing and Order Data Quality category:
shipping address
 Shipping address different from billing address Review
Maximum order $250 Order Monetary Quality category: 250 USD
 Maximum amount Review
US Dollar
 Currency
Monitor velocity and Other Tests category with early processing enabled:
continue to build the
 Customer on the negative list Reject
negative list
 Customer on the positive list Accept

This figure shows the corresponding sections of the Profile Editor.
Figure 48 Profile Editor Rule Window Example
After using this profile for one week in passive mode, you are ready to review reports that
show the results of the rule settings. The Rule Performance report shows that the Address
Verification rules were triggered 25% of the time, different billing and shipping address
rules were triggered 25% of the time, and orders were greater than $250 30% of the time.
Your chargeback pattern shows the following results:
Figure 49 Chargeback Pattern Results

This table shows that the fraud rate for orders of $500 is four times that of orders of $250,
which is four times that of orders of $120. You conclude that you need to reduce the fraud
rate for orders in the $500 range because they have a fraud rate above the accepted 1%
threshold.
The following sections describe some of the main points concerning predefined rules.
Payment Type
When creating a profile to screen orders with a payment type other than card
authorization, follow these recommendations:
 Do not add these rules to the profile:
 Address and card verification rules, except for the rule Card issued in country
other than country in customer's billing address.
 Payer Authentication
 Create custom and profile selector rules to use additional address or order data
information.
Order Amount
To use these rules, you need to select an option and enter a value:
 Accepted currency
 Maximum amount
 Minimum amount
Review your business requirements before entering the amounts.
Figure 50 Order Amount Rules

Velocity
These rules enable you to use the frequency of purchases to screen your orders. To use
the velocity that applies only to your business, you need to create custom rules.
Figure 51 Velocity Rules
 Similarities of this order to other recent orders (Global Velocity): This rule evaluates
orders as a whole. You can also set the tests in the Settings window of Decision
Manager. For more information, see "Global Velocity," page 173.
Early Processing
 Merchant-specific order velocity and Merchant-specific product velocity: These rules,

which apply specifically to your business, are triggered by order velocity and product
velocity rules. You can use these rules either before (early processing) or after you
process the payment and the Decision Manager tests. These rules function in the
early processing mode only in your active profile. After you enable early processing in
the Settings window, these rules are shown with a sun icon as in the figure above.
Other Tests
Use these rules to screen credit card and other supported payment types. After you
enable early processing in the Settings window, these rules are shown with a sun icon as
in the figure below.
Figure 52 Other Tests Rules
 Customer on the negative list and Customer on the positive list: These rules are
triggered when the customer is on your negative or your positive list. You can use
these rules either before (early processing) or after you process the payment and the
Decision Manager tests.
 Order outside merchant's region: This rule is triggered when orders do not come from
the countries that you have selected in the custom list of countries.

Uncategorized
This section lists other core or custom rules that you can use the rules to evaluate orders.
You might use this section, for example, to test rules before adding them to categories.
Custom Rules
You can add up to 100 custom rules in each profile, and for each merchant ID, you can
create up to 600 custom rules that can be used in any profile. You can set each custom
business rule to Monitor, Accept, Review, or Reject. Rules that are set to Monitor evaluate
orders, but the evaluation is not considered in the final results.
Editing an Order Profile

You can edit an existing order profile by changing the settings and by adding or removing
custom rules. You can edit order profiles at any time. Changes to an active profile take
effect immediately.
Whenever you change a rule, the reports from that day can show both rule
results.
Important
Copying a Profile
cloning
To save time when creating additional profiles, you can copy and modify as needed an
existing profile. This option is available to all users who have the permission to edit
profiles. To make a copy, save the order profile with a different name and description,
change at least the name, edit the copy, evaluate it, and replace the current default active
profile with the modified profile. You can copy any profile, including the Example profile.
Deleting a Profile
You can delete any profile, but you should not delete active profiles. To delete a profile,
click Delete at the top. Deleted profiles no longer appear in the list of profiles.

Selecting Profiles
After having created a profile, you need to choose how to use it by creating a rule to select
the profile and by selecting a default profile.
Figure 53 Profile Selectors Window
Creating Profile Selectors

Profile selectors are rules that you can use to select the profile that evaluates each order.
You can create up to 50 active and 50 passive selector rules. Each order is pre-screened
against each selector rule according to their placement in the table.
In Figure 53, rules 1 through 4 appear. Each order with a value higher than $350 triggers
the first selector rule. This selector rule routes all orders to the profile named test core.
A profile is selected according to data in the request (not the reply), such as product
category, order amount, or shipping information. When creating selector rules, you can
use custom fields and lists. You may want to create a rule to select a specific payment
type or a high monetary amount profile. Selector rules may have more than one condition,
such as order exceeds 15 items and invoice amount exceeds $500.
If you use the customer IP address in a profile selector rule, the address requires special
formatting. Decision Manager normalizes the customer IP address in the API request as
follows:
 For Internet Protocol version 4 (IPv4): by removing leading zeros in any of the octets.
 For Internet Protocol version 6 (IPv6): by including all eight groups of hexadecimal
digits, by removing leading zeros in any of the groups, and by converting all letters to
lowercase.

If you create a profile selector rule using the customer IP address, make sure that you
enter it in the Custom Value field as described above.
If you request a specific profile through the API (not recommended) after you
set up an active profile selector and a passive profile selector, the profile
Important selectors are ignored. Instead, the order is evaluated by the profile named in
the API request.
To create a profile selector rule:
Step 1 Under Decision Manager, click Profiles.
Step 2 Click the tab for the type of selector that you want. Figure 54 shows Passive Selectors.
Figure 54 Passive Selector Tab
Step 3 Click Add Selector Rule.

Step 4 Name and describe a rule called High order amount.
Step 5 Select the profile that you want to screen with this rule.
Step 6 Create your condition (high order amount) as follows:
Order Element Fraud score customer list information

Comparison Operator contains
Comparison Value Custom list of information codes for the review list
Figure 55 “High order amount” Rule Definition

Step 7 Because you have only one condition, you can ignore the relationship.
Figure 56 Rule Conditions Window
Step 8 Click Save.

Your rule appears at the bottom of the list. You can now change its position in the order
evaluation sequence.
Step 9 Drag the rule to the evaluation position that you want by using the handle.
Figure 57 Dragging a Rule into the Evaluation Position
Not all Fraud Score order element fields are currently available for profile
selection. Fields that are generated from model processing are only available
Note for use in profile rules after the system selects a profile for transactions.
Selecting a Profile Activity Mode

You can use a profile in active, passive, or replay mode:
 Active selectors evaluate every order and affect the outcome (accept, review, or
reject) of the order.
 Passive selectors do not affect the outcome of the order. Orders evaluated by an
active profile selector can also be evaluated by a passive profile selector.
 Replay selectors provide immediate feedback on the impact of order profiles and rules
on past transactions.

Active Selectors
Rules are active as soon as they are created and remain active until they are deleted. The
profile selector rules choose the profile according to the first rule that is triggered.
CyberSource recommends that you set a default active profile when you use a profile
selector so that orders that are not triggered by the profile selectors are also evaluated.
Different profiles can be active, but only the profile triggered by the selector rule (or the
default active profile if none is chosen) evaluates the order. This figure shows the active
profile (top). It is prefixed by A- because it was selected as the default active profile
(bottom) in the Active Selectors section.
Figure 58 Default Active Profile

Passive Selectors
To determine the effectiveness of new rules, set one or more order profiles to the passive
mode. To use the default profile, click Passive Selectors and select the Example profile
as shown below:
Figure 59 Setting Example Profile to Passive Mode
This figure shows the passive profile (top). It is prefixed by P- because it was selected as
the default passive profile (bottom) in the Passive Selectors section.
Figure 60 Passive Profile
Because you can use the same rule in each of the profile selectors, each order can be
evaluated by the default active profile and the default passive profile.

Replay Selectors
When you use passive profiles with ongoing transactions, you must wait for specific types
of transactions to come in that address the issues you are testing. In contrast to testing
changes to passive profiles with ongoing transactions, replay selectors enable you to
receive immediate feedback on the impact of configuration changes.
If you tune an order profile to get better screening results and create a replay profile
selector rule, you can immediately replay the transactions to determine whether your
profile tuning produces the desired results.
Rule Sequence
After creating selector rules, you need to decide the order in which you want Decision
Manager to use them to choose a profile. Under each tab, to arrange the profile selector
rules in a different order, drag the handle on the left edge to move the rule up or down. The
order number of the selector rule is updated as soon as you release the handle.
When... Decision Manager selects this profile:

One or more selector rules are triggered. First profile listed in the Profile Selector table
No rule in the Profile Selectors is triggered. Default active profile
or
Decision Manager cannot find the profile specified
in the request or in the Profile Selector.
Decision Manager cannot find a default profile. Default passive profile
In this case, the order is not evaluated by Decision
Manager.
Evaluating the Performance of Your Profiles

The Profile Statistics report, located under Reporting > Performance Statistics,
summarizes the initial evaluation results of your profiles. This report does not present case
management results. If you are the administrator of a group of merchants, you can view
reports for the group or for a single merchant. If you are a member of a group of
merchants, you can view only the reports for your orders that were evaluated by the
group’s profiles.
The preset time intervals (Today, Yesterday, This Week, This Month, Last Month) are
based on the date you run the report. Each row of the report provides the number of
orders that were accepted, rejected, or marked for review by all profiles. Percentage
amounts indicate the percentage of the total number of orders that were accepted,
rejected, or marked for review within the time interval specified by the column heading.

Example Using Performance Statistics
Performance Statistics shows that the number of accepted orders for the current month
(971) matches the number of orders with the current status Accepted by Profile in the
Case Management search results.
To view the detailed results of each profile, see the Profile Rule Performance Report,
which is available in the Business Center left navigation panel at Decision Manager >
Reporting > Reports. For more information, see the Decision Manager Reporting Guide
(PDF | HTML).

CHAPTER
Custom Rules and Custom
Lists
4
Custom rules and custom lists are not intended to and must not be used to
capture personally identifying information. Accordingly, merchants are
Warning prohibited from capturing, obtaining, and/or transmitting any personally
identifying information in or via custom rules or custom lists. Personally
identifying information includes, but is not limited to, address, credit card
number, social security number, driver's license number, state-issued
identification number, passport number, and card verification numbers (CVV,
CVC2, CVV2, CID, CVN). In the event CyberSource discovers that a merchant
is capturing and/or transmitting personally identifying information via custom
rules or custom lists, whether or not intentionally, CyberSource immediately
suspends the merchant account, which results in a rejection of any and all
transaction requests submitted by the merchant after the point of suspension.
Creating Rules
Case
Custom rules are those that you create to meet your business requirements. For each
merchant ID, you can create up to 600 custom rules. Rules are not case sensitive, except
for merchant velocity rules that contain custom fields and product velocity rules that
contain product SKUs.
Ensure that any rules being employed are not in violation of payment network
rules or those rules specified by your acquirer.
Important Before creating a custom rule, make sure that your development team has
added the fields to the API request that correspond to the order elements, and
that you plan to use in your custom rules. If you use a service other than the
CyberSource authorization service, you need to provide the data from your
authorization service in your request to CyberSource. If the order information is
not available, your custom rules do not work, and you do not receive an error
message. For a conversion list of order elements and API fields, see "API
Fields," page 293.

Chapter 4 Custom Rules and Custom Lists
Components
The conditions in custom rules are made up of an order element, a condition operator, and
a comparison value.
Order Elements
Order elements are request fields, reply fields, and other order data, such as authorization
amount. Some elements contain only a single value whereas others can contain multiple
values. For example, an order can contain only one billing address but many fraud score
information codes. The Rule Editor has more than 100 predefined elements. You can also
create rules with custom fields, which are listed at the bottom of the order elements. For
the list of order elements, see "Custom Rules Elements and Examples," page 258.
To provide a broad screening ability, you can combine order elements, such as the same
order element with different options. For example, you can use the fraud score phone
information element to search for these options:
 Phone number inconsistent with billing state
 High risk area code
 Toll-free phone number
 Invalid area code
 Invalid phone number
Order Elements with Unique Characteristics

 Rules created with the Amount (Offer) element are triggered whether or not your API
request contains an offer line. To avoid this issue, CyberSource recommends that you
always include an offer line in your API request.
 Order elements with (Single Offer) or (Single) appended to their name can be used to
create rules that tag multiple order elements only within the same offer line or line item
of an order. For example, to tag transactions that involve over 5 pairs of fitness-
tracking sunglasses, use the Product Name (Single Offer) order field and the Quantity
(Single Offer) payment field in your rule.
normalization
 Rules created with address elements (on the left in the figure below) evaluate the
address as it is entered by your customer.
Decision Manager normalizes the address by correcting some of the problems and by
formatting it consistently. For example, instead of street, the common abbreviation st
is used. The normalized address is used to compare the address to your customer
lists and to return the appropriate information codes in the case details window. To
ensure that your rules evaluate orders in which the address elements are normalized,
CyberSource recommends that you create rules by using the fraud score address
information codes (on the right in the figure) instead of the addresses provided by your
customers.

 If you create a custom rule using the customer IP address, the IP address requires
special formatting. Decision Manager normalizes the customer IP address in the API
request as follows:
 For Internet Protocol version 4 (IPv4): by removing leading zeros in any of the
octets.
 For Internet Protocol version 6 (IPv6): by including all eight groups of hexadecimal
digits, by removing leading zeros in any of the groups, and by converting all letters
to lowercase.
- Before: 123A:45cd:0067:89::EF
- After: 123a:45cd:67:89:0:0:0:ef
If you create a custom rule using the customer IP address, make sure that you enter it
in the Custom Value field as described above.
Comparison Operators
Comparison operators enable you to compare an element to one or more values or to
determine whether a condition is present. For detailed descriptions and examples, see
"Comparison Operators," page 258.
Equal, Contains, Starts, and Ends

Use with elements and comparison values that can contain multiple values (or lists), such
as the fraud score information codes. Depending on the operator that you choose, you
can match any order element value to any comparison value as follows: <value 1> or
<value 2>... or <value n>.

Equal and contains function differently: equal matches a complete order

element whereas contains matches part of an order element. Therefore, when
Note you convert a rule that uses contains to one that uses equal, the rule is not
triggered when matching a single comparison value, such as email domain, to
part of an order element, such as email address.
Greater and Less

Use with a single value as order element and comparison value.
Present
Use to obtain a yes or no answer about the presence of a specific value in the order data.
Regular Expressions
Use with elements that can contain multiple values.
The comparison operators named member of are being discontinued.

Although this operator is still visible in the menu, use equal to instead when
Important creating or modifying rules.
Comparison Values
Some of the values are predetermined. In other cases, you need to enter the value(s) that
you want to find, such as an amount or a list of custom fields. When appropriate for the
order element that you are using, you can select multiple comparison values by using Ctrl-
click, for example: several possible card verification values, custom lists, and custom
fields. When using custom values, separate lists of values with a comma, except with the
greater and less than operators. For information on using REG EXP operators, see
"Postal Codes (Regular Expressions)," page 290.

Creating a Rule
To create a rule:
This sample rule is triggered by orders that contain more than five items and an order
amount greater than $375.
Step 1 Under Decision Manager, click Custom Rules > Add Rule at the bottom of the window.
Figure 61 Rule Editor Window
Step 2 Name and describe a rule called High item count and order amount.

Step 3 If you know where you want to place this rule, select a category.
Figure 62 Rule Category Detail
You can also choose the category later in the Custom Rules list window.
Step 4 If you want this rule to be added automatically to profiles created with core rules, check
the box, and select how you want the rule to be used in the profile.
Initially set new rules to Monitor so that you can evaluate and refine how the rule functions
before placing it into production.
Figure 63 Core Rule Setting Detail
You can choose only one option for each rule:

 Monitor indicates the rule is used to evaluate the order, but the result has no impact
on order acceptance or rejection. Use this setting for rules that you want to test before
putting in production.
 Accept indicates the order is automatically accepted. Use this rule for specific cases
only, for example when your customers added temporarily on the positive list re-place
an order.
 Review indicates the order is placed in a review queue.
 Reject indicates the order is automatically rejected.

Step 5 Create your first condition (many items) as follows:

a In the Payment Fields section of the Order Elements, select Quantity (Offer).
b Select this comparison operator: is greater than
c In the Custom Value field, enter 5.
d Click OK.
Figure 64 Add Condition Window
Step 6 Create your second condition (high order amount) as follows:

a In the Payment Fields section of the Order Elements, select Amount (Offer).
b Select this comparison operator: is greater than
c In the Custom Value field, enter 375.
d Click OK.
Figure 65 Rule Conditions Example
For rules that contain two or more conditions, you need to decide how the conditions
should interact. This setting is located above the names of the conditions:
 If you want the rule to be triggered only when all the conditions are triggered, select all
conditions are true.
 If you want the rule to be triggered when any one of the conditions is triggered, select
at least one condition is true.
Step 7 In this case, leave the default all conditions below are true.
Figure 66 Default Rule Condition Setting

Step 8 Optionally, to add this rule immediately to your existing profiles, click Edit Rule
Configuration in Profiles.
This option enables you to set at once in all profiles how you want to use the rule (Monitor,
Accept, Review, or Reject) and how you want to set the rule priority. In cases where you
set a custom rule as core rule, the profiles created with core rules will show the rule as you
set it. In profiles created without core rules, the rule setting may be different. You can also
add the rule to your profiles later.
Step 9 For each profile listed, check how you want to use the rule (accept, review, reject, or
monitor) and a priority if you wish.
Figure 67 Rule Configuration in Profiles Settings
Step 10 To close the window, click Update.
Step 11 To close the Rule Editor and return to the list of custom rules, click Save.
If two users are modifying a rule at the same time, the changes saved last are
kept.
Note
Step 12 To view your rule, in the navigation pane, click Custom Rules.
Your rule appears in the category where you place it. You can modify the rule at any time.
Figure 68 Rule Displayed in Category

Creating Custom Lists

Custom lists enable you to streamline your business and product information by
combining several items into lists. Initially, this menu contains only the list of countries, as
shown below. To view and edit the content of a list, click anywhere on a name or
description of the list or on the pencil:
Figure 69 Custom Lists Windows
The lists that you create are added above the list of countries.

Custom Lists
You can define up to 200 custom lists, which you can use in custom rules and as product
groups in velocity rules. Each list can contain up to 8000 elements of up to 50 characters
each. The same element can be used in several lists. As soon as you save a list, you can
use it in custom and velocity rules.
The elements of custom lists are not case sensitive. However, the elements of
the lists that you plan to use as product groups in velocity rules are case
Important sensitive.
You can change the name, description, and content of your the lists at any time. Rules that
contain the modified custom lists are updated automatically. All custom lists use the string
data type, which includes letters and numbers. Even if the lists contains other characters
or type of information, such as a date, the list is screened as if it contains only letters and
numbers. Make sure that each element is unique within a list.
You can assign each product to a group or list so that when orders are evaluated by the
product group, all the SKUs that you included in the product group are evaluated. To
screen orders for the velocity of single items, you can also use a product velocity rule. For
more information on product velocity rules, see "Merchant Velocity," page 175.
SKU codes are case sensitive. For example, AA, aA, Aa, and aa are four different sample
SKU codes. You can use actual SKU codes or use a wild card character to match a
pattern, such as a SKU starting with abc.
This table shows how to search for different patterns in your product SKUs. To indicate a
wild card, use an asterisk (*).
Pattern to Syntax Decision Manager searches Decision Manager does not search
match
Starts with 12345* All SKUs that start with 12345. Start with 123, 1234, or other parts of this
12345 sequence.
Start with the characters in a different order.
Ends with *67890 All SKUs that end with 67890. End with 678, 7890, or other parts of this
67890 sequence.
End with the characters in a different order.
Matches 123 123 Only SKU 123 is matched. Any sequence that contains only some of
exactly these characters or the characters in a
different order, such as 12, 345, or 321.
Contains 345 *345* Only SKUs that contain 345, such as Any sequence that contains only some of
12345AB, 23456, or 345. The SKU can these characters or the characters in a
also start or end with 345. different order, such as 45, 534, or 243A5.
Is a member of ABC When you enter one SKU on each line Any sequence that contains only some of
the list ABC, DEF without using asterisks, Decision these characters or the characters in a
DEF, GHI GHI Manager searches for all these SKUs. different order, ABCD, CB, or DEG.

A travel merchant can compare the type of plane ticket (economy, business, or first class)
to the velocity of the customer’s email address with these elements:
 The merchant creates a custom list for each type of ticket. Each custom
list contains only one value: economy, business, or first class.
 The merchant creates a product velocity rule for each custom list with
email address as tracking element.
 In the merchant product SKU API field, the merchant uses the value
corresponding to the type of plane ticket: economy, business, or first
class.
When Decision Manager screens orders, the value of the merchant product
SKU triggers the product velocity rule. A specific information code is returned
in the API reply and appears in the case details.
Decision Manager normalizes the customer IP address in the API request as follows:
 For Internet Protocol version 4 (IPv4): by removing leading zeros in any of the octets.
 For Internet Protocol version 6 (IPv6): by including all eight groups of hexadecimal
digits, by removing leading zeros in any of the groups, and by converting all letters to
lowercase.
 Before: 123A:45cd:0067:89::EF
 After: 123a:45cd:67:89:0:0:0:ef
If you create a custom list using the customer IP address, make sure that you format each
item as described above.

Figure 70 Custom List Editor
To create a list:
Step 1 To create a list, click Add Custom List.
Step 2 Choose a unique name of up to 30 characters.
Step 3 Enter a description of up to 255 characters.
Step 4 Enter one item on each line.

For example, a list of risky postal codes might contain these items:
11111
33333
66666
Step 5 When done, click Save.

The list appears in alphabetical order in the Custom Lists summary window.
You can edit your lists as needed. When deleting an item from the list, click Apply. The
item is deleted without a warning message. You can delete any custom list unless it is in
use in a custom or velocity rule. If you attempt to delete such a list, a warning message
appears. To delete a custom list, click Delete Custom List.

Merchant Region
You need to choose the countries from which you want to accept orders. When you do so,
you can use the predefined rule Order outside merchant's region, and you can create
custom rules that use your countries as comparison values when you use billing country or
shipping country as order elements. You can modify your list of countries at any time. The
figure below shows the window that you use to select the countries.
Figure 71 Merchant Region List Editor
To select countries, click the Merchant Region line in the Custom Lists summary window.
In the Merchant Region List Editor, select countries one by one, or to select multiple
countries at once, use Ctrl-click and Shift-click. When done, click Save. Although you can
view and edit its content, you cannot delete this list.

Creating Custom Fields

You can use custom fields in custom and velocity rules. You can use up to 100 fields. To
do so, assign a name meaningful to your business.
Although you can name custom fields only in the Business Center, you can use them
either in the API or in the Business Center. To use custom fields correctly, you need to
coordinate the names with your development team. The first four merchant defined fields
are the same fields that are used by the Secure Data services. For information on using
the merchant-defined data API fields, see the Decision Manager Using the Simple Order
API Developer Guide (PDF | HTML) or the Decision Manager Using the SCMP API
Developer Guide (PDF | HTML).
This figure shows a few custom fields. The type of data that was selected when they were
created determines the type of information that they can contain.
Figure 72 Custom Fields Window

To create custom fields:
Step 1 Click Add Custom Field.

In this figure, the order element is merchant_defined_data13. When creating a field, you
can select any available name from the menu. You do not need to use the names in the
order in which they appear.
Figure 73 Custom Field Editor
Step 2 Enter a name (up to 30 characters) and description (up to 255 characters).
In the name, do not use the back slash (\) and the single quote (‘).
Step 3 Choose the type of data that the custom field contains:
 String, which includes letters and numbers
 Number, which only includes numbers
 Date, which includes date and time
Step 4 Click Save.
After you have created a custom field, you can change the name and the description but
not the data type. To change the data type, you need to delete the field and create a new
one. When you do so, rules that used the old custom field no longer function correctly
because they are not updated with the new data type. Therefore, when deleting a custom
field, be sure that it is not currently being used or that you recreate a corresponding field
with the same data type.

Copying, Editing, Deleting Rules

To copy or edit a custom rule, click anywhere on the rule’s description line or on the pencil
on the right:
If you create custom rules that use Amount (Offer), which is the Business
Center equivalent of a line item, your custom rule is triggered whether or not
Note you send an offer line in your API request. To avoid this issue, CyberSource
recommends that you always send a line item in your API request. For more
information, see the Decision Manager Using the Simple Order API Developer
Guide (PDF | HTML) or the Decision Manager Using the SCMP API Developer
Guide (PDF | HTML).
To copy, edit, or delete rules:
Step 1 In the Rule Editor, click Copy Rule.
A simplified version of the Rule Editor appears.
Figure 74 Rule Editor Window
Step 2 Change at least the name of the rule, ensuring that the name does not conflict with the
names of your existing rules.
Step 3 Modify the description of the new rule appropriately.

Step 4 Update your existing profiles with the new rule.

You can do so immediately or later. If you update your existing profiles with the new rule
now, the original rule is replaced by the new rule. However, the profiles do not evaluate
orders differently because the conditions in the rule have not changed.
Step 5 When done with your changes, click Save.

The Rule Editor reappears so that you can change the conditions appropriately for your
new rule.
You can delete rules from the Rule Editor or from the rules summary window:
 From the Rule Editor, click Delete at the top of the window.
 From the rules summary window, check the boxes on the right of the rules, and click
Delete at the bottom of the window.
Managing Rules and Categories

The rules list contains all the categories that contain core and custom rules.
Figure 75 Rules List

Categories
Categories are predefined or user-defined sets of rules that you want to group together as
appropriate for your business. You may create new categories and add rules to categories
as desired. The number next to the name of a category indicates the number of rules in
the category.
For example, you might create a category of rules associated with payment types or
specific groups of products. By default, the categories are open. This figure shows open
only the first category. The number next to the name of the category indicates the number
of rules in that category.
To create or edit categories:
Step 1 Click Add Category at the bottom of the window.

or
Click the folder icon on the left side of a category, and click Add Category:
Step 2 Enter a name and click Add.
Your category is added without any rules as indicated by the number 0 next to the name of
the category.
To move the new (or any other) category in the window, click the handle and drag the
category to a new location.

To move a rule from one category to another, click the handle on the left of the rule. The
list of categories appears.
Drag the rule to the category of your choice.
Core Rules
Core rules are those that you want to add automatically when you create a profile with
core rules instead of an empty profile:
In the built-in profile named Example, the core rules are the predefined rules created
automatically by Decision Manager. When you create a profile, you can set any rule as a
core rule, including the predefined rules, and you can change your settings at any time.
To set a rule as a core rule (red) or to remove the setting (gray), click the letter C as shown
in the following figure:
You can also set core rules in the Condition Editor when you create the rules.
Note
The description of rules that are set for early processing is preceded by a sun icon:

CHAPTER
Positive, Negative, and
Review Lists
5
This chapter describes how to create and update your positive, negative, and review lists
with the List Manager feature of Decision Manager. Fraud data is discussed in the
Decision Manager Planning Guide (PDF | HTML).
Addresses are normalized before they are added to a list. In the search results
and in the files that you download all minor errors are corrected and the
Important address information is formatted consistently by using common abbreviations,
for example: st for street. In addition, the address information is changed to
lowercase.
For example:
“44 Fisher Str./Mtn View/California/94053”
is changed to:
“44 fisher St/mountain view/ca/94043”
Addresses are normalized before being compared to other addresses.

Chapter 5 Positive, Negative, and Review Lists
Overview of Available Tools

You can use many tools to add to or retrieve data from the customer lists.
Tool Type of Data Retrieval or Deletion

Business Center
List Manager Positive, negative, and fraudulent data Delayed retrieval and deletion
Mark as Trusted Excellent data –
Mark as Temporarily Trusted Good data –
Mark as Suspect Fraudulent data –
Clear Mark as Suspect Good data –
Mark for Review Uncertain data –
Remove from History Positive, negative, and fraudulent data Delayed retrieval but no deletion
Chargeback Files Fraudulent data No
CyberSource API Services
Risk Update Service Positive, negative, review, and fraudulent data Delayed retrieval and deletion
Score Service Fraudulent data Real-time retrieval but no deletion
Decision Manager Positive, negative, review, and fraudulent data Real-time retrieval but no deletion
Chargeback Marking Fraudulent data No
Adding Data
You can use all data in real time or in a delayed manner. While you process orders, the
score service, either alone or through Decision Manager, uses the data from the database
to send orders that are not immediately accepted to your review or reject queues.
While reviewing or searching for orders, you can mark orders as follows:
 Orders that you mark suspect are considered fraud.

 Orders that are legitimate but that are marked as suspect can be updated by using the
Clear Mark as Suspect link.
 Orders that you mark trusted are added to the positive list temporarily or permanently.
While updating your customer lists with List Manager, you can search for up to 5000
records. However, you can export the complete lists in XML or CSV format even if the lists
contain more than 5000 records.

You can search for orders according to the queue in which the orders were placed. You
can use the links in the case details to add customer information to the database.
 Negative List: You can use the Mark as Suspect link. The request ID of the order being
marked is automatically stored with the list entry.
What can be added Request ID, shipping address, account number, email address,
phone number, IP address, and travel data.
Type of customers Those who caused chargebacks, requested a credit (no goods
received), or with whom you do not wish to conduct further business
for various reasons, such as abusive behavior and high return rates.
Because all the elements that you add here are considered fraud, some customers
and their orders receive a higher score than they deserve. For this reason, you may
want to set up your business to be able to distinguish true fraudulent customers from
simply undesirable ones.
If you confirm that an order that has been marked as suspect is not fraudulent, you
can remove the order data from the negative list by using the Clear Mark as Suspect
link. You can update the marking reason of an order up to five times; for example, to
change the marking reason for a suspected order or to clear an order from being
marked as suspect.
The following scenario describes how you might update the marking reason for an
order:
 You receive an order and accidentally mark it as suspect.

 Use the Clear Mark as Suspect link to remove the order data from the negative
list.
Only the transaction fields that were selected when the order was originally marked as
suspect are removed from the negative list.
If an order is already marked as a fraud chargeback, the marking reason is not

updated. However, any additional transaction fields you select are added to the
negative list.
 Review List: The review list is a temporary location for data that you want to keep
reviewing until you can confirm whether it is good or fraudulent. Because the data is
initially presumed to be suspicious, the fields for the review list are the same as those
of the negative list. Review list data is added to the Customer Lists database. Review
items are deleted after one year.
To flag suspicious orders while you are reviewing orders, use the Mark for Review link
to reach the Transaction Marking Tool. Data that you add to the review list is retained
for one year unless you move it to the negative list or delete it manually.

 Positive List: You can use the Mark as Trusted and Mark as Temporarily Trusted links
to add records to the positive list. The request ID of the order being marked is
automatically stored with the list entry.
What can be added Email, billing, and shipping addresses, email domain, phone number,
and payment information.
Type of customers Those whom you trust for either of these reasons:
 They have purchased from you several times, and their
transactions were always successful (permanent addition to the
positive list).
 You want to allow customers to place an order again after you
reviewed a previously rejected order (temporary addition to the
positive list).
Adding Order Data During Order Review

This section describes how to add order data to the lists by using the Transaction Marking
Tool during the order review process with Case Management.
For orders that have been marked as suspect, the Clear Mark as Suspect option is
available.
When you add customer and order data to a list, List Manager proceeds as follows:
 Addresses are normalized before they are added to a list: minor errors are corrected,
and the address information is formatted consistently in a preferred format using
common abbreviations, for example: st for street.
 The identity of the user who added the record and that of the merchant ID who owns
the record are stored. This information is used by the administrator of the shared lists.
 The request ID of the order being marked is stored with the list record.

Table 9 compares the major characteristics of the lists.

Table 9 List Characteristics
Characteristic Negative List Review List Positive List

Marking action Mark as Suspect link adds Mark for Review adds order Mark as Trusted or Mark as
order data to the negative data to the review list. Temporarily Trusted adds
list and the fraud history. order data permanently or
temporarily to the positive
Clear Mark as Suspect link
list.
removes order data from the
negative list and removes
the marking from the fraud
database.
Custom rules Screen orders for data Screen orders for data Screen orders for data
present in the negative list. present in the review list. present in the positive list.
Reply data  NEG- information codes  REV- information codes  CON-POSNEG and
trigger the negative list do not trigger any POS- information codes
standard rule. standard rule. trigger the positive list
standard rule.
 F factor code  No factor code
 E factor code
 High score  Score not affected
 Low score
Moving data Data can be moved to the Data can be moved to the Data can be removed from
between lists review list. negative list but not to the the positive list.
positive list.
If you move an entry that If you move an entry that
was previously on one of If you move an entry to the was previously on one of
the other lists to the review list, the other lists are the other lists to the positive
negative list, the data is not affected. If you add data list, the data is not removed
removed from those lists. that was previously on one from those lists.
For example, a review entry of the other lists, the data is
is deleted from the review removed from those lists.
list when it is moved to the
negative list.
Deleting data from Clear Mark as Suspect Can be removed from the Can be removed from the
lists removes order data from the review list positive list
negative list.
Remove from History hides
order data by removing it
from the fraud history.

Adding Customers to the Positive List

You can add records to your positive list with these links:
 Mark as Temporarily Trusted: these records are added for 1–30 days, depending on
your settings. Records are dropped automatically from the positive list when either of
these events occurs:
 After the customer places the order again.
 After the time allowed to place the order has elapsed whether or not the customer
has placed the order again.
 Mark as Trusted: these records are added permanently or until you decide to remove
them manually.
The following instructions describe how to mark orders and how to view the results in the
case details and list search results window.
Temporarily Adding Customers to the Positive List

For example, you may find that an order was initially rejected because of a specific setting
in your predefined rules, such as different billing and shipping addresses. After reviewing
the order and contacting the customer, you decide to temporarily add the customer to your
positive list. During this time, the customer can place the same order again. At that time,
the order is accepted.
To temporarily add a customer to the positive list:
Step 1 In the Case Management Details window, click Available Actions > Mark as
Temporarily Trusted.

The marking tool appears:
The customer and order data correspond to the option that was selected by the
administrator in the settings window for the temporary positive list fields. This data is
added to the positive list for the selected number of days indicated.
Regardless of the option that you selected in the Temporary Positive List
Fields settings window, only the data present in the order is added to the
Important positive list. For example, if you selected the [Email Address, Billing
Address] option, both are added if they are available.
Remember that when you add real orders to your temporary positive list,
you must notify your customers immediately to give them sufficient time to
place their order again before the expiration date.
Step 2 In the Marking Notes text box, enter notes about the customer record or the transaction.
These comments are stored in the database for the life of the transaction and appear in
the case details.
Step 3 Click Submit.

Permanently Adding Customers to the Positive List

While reviewing orders, you may decide to permanently add some customers to your
positive list. For this privilege, choose customers who have proven very reliable in the
past. In the future, orders from these customers can be accepted automatically depending
on your global setting and on your business rules.
If you try to add a record that already exists in the positive or the negative list,
you receive a failure message specifying that at least one duplicate record
Important exists. When you attempt to process a transaction with data present in both
lists, you receive the information code CON-POSNEG in the API reply and in
the case details window.
To permanently add a customer to the positive list:
Step 1 In the Case Management Details window of a transaction that you want to add to your
positive list, choose Available Actions > Mark as Trusted.

The customer’s name is already entered in the Record Name field.
Step 2 In the Marking Notes text box, add optional comments about the customer or the order.
the transaction details.
Step 3 In the Transaction Fields pane, choose an option from the Field Options drop-down list.
Only options containing order data are enabled. All others are unavailable. In this
example, the phone number and the device fingerprint are absent. Therefore, the options
that contain these elements are disabled. If the order contains a billing address but not
shipping address, the billing address is used for both.

Billing and shipping addresses comprise the street address, city, state or province,
country, and postal code. All options are available with and without payment information.
Only the account suffix is shown decrypted.
Email address and shipping Customer who shops from home, work, or while travelling and has
address the item shipped to an address other than the home address, such
as the work address. The item may also be a gift.
Email domain and billing Organization, such as a company or college campus, which can

than the previous ones. You need to recognize the email domain as
an important factor in determining whether the order is legitimate or
custom or profile selector rules to screen these orders completely
and accurately.
Email address, phone Customer who shops often from home or work with the same
number, billing address, and account number and always uses the same shipping address and
shipping address phone number. Orders that match this case are the most secure.
This option is the most complex, the least common, and the most
difficult to match.
Email address and device Customer who uses the same email address but may be using a
fingerprint new computer or device that they have not previously used when
shopping.
Email Address Usually associated with the shipping location.
phone number same phone number.
shipping address same shipping address.
Device fingerprint Available if you are using the Device Fingerprint service. To detect
and prevent repeated fraud, you can use this ID (unique computer
ID) to link transactions made from that computer. For more
information on this feature, contact your support representative.


The case details window reappears with a success message at the top.
If you try to add a record that already exists in the positive or the negative list,
you receive a failure message specifying that at least one duplicate record
Important exists. When you attempt to process a transaction with data present in both
the Risk Services section of the case or transaction details window.
To view the data that was added to the positive list, you can search List Manager for
records of the positive list.
Adding Customers to the Negative List

The easiest way to find records that you may want to add to your negative list is to search
for rejected transactions in the Case Search window. Add customers to your negative list if
the customer caused a chargeback or is not a customer with whom you want to conduct
further business.
To add a customer to the negative list:
Step 1 In the Case Management Details window, choose Available Actions > Mark as Suspect.

Step 2 In the Marking Details pane, select a Marking Reason from the drop-down list for adding
the transaction to the negative list.
Fraud chargeback chargeback received with a fraud chargeback code

Non-fraud chargeback chargeback received for other reasons, such as item not
received
Suspected chargeback likely to happen
Creditback refund issued to the customer to avoid a chargeback
Step 3 In the Marking Details pane, in the Marking Notes text box, add comments about the
customer or the transaction.
Step 4 In the Transaction Field pane, check the transaction fields that you want added to the
negative list.
Only the account number is checked by default.

Step 5 In the Travel Information pane, if this is a travel order, select the passenger data to add to
the negative list: ID, phone number, and email address.

If you later confirm that the transaction is legitimate, you can use the Clear Mark as
Suspect link from the Case Management Details window to remove the order data from
the negative list. Only the transaction fields that were selected when the transaction was
originally marked as suspect will be removed from the negative list.
Adding Customers to the Review List

The review list is a temporary location for data that you want to keep reviewing until you
can confirm whether the data is good or fraudulent. Because the data is initially presumed
suspicious, the fields for the review list are the same as those of the negative list.
However, when you add data to the review list, no data is added to the negative list.
To add customers to the review list:
Step 1 In the Case Management Details window, choose Available Actions > Mark for Review.
Step 2 In the Transaction Marking Tool, select a Marking Reason from the drop-down list for
adding the transaction to the review list:
Fraud chargeback chargeback received with a fraud chargeback code

Non-fraud chargeback chargeback received for other reasons, such as item not received
Suspected chargeback likely to happen
Creditback refund issued to the customer to avoid a chargeback
Step 3 In the Marking Notes text box, add comments about the customer or the transaction.
Step 4 In the Transaction Fields pane, check the order elements that you want added to the
review list.
Only the account number is checked by default. Billing or shipping address comprises the
street, city, state or province, postal code, and country. Only the data present in the order
is added to the list.

Step 5 In the Travel Information pane, if this is a travel order, select the passenger data: ID,
phone number, and email address.
After you add an order to the review list with the marking tool, you can no longer add the
data to the review list from the Case Management Details window because the link has
disappeared.
Adding Order Data to Customer Lists

The List Addition menu enables you to add order data directly to your customer lists. For
all lists, you choose the type of data (negative, review, or positive) and the order elements
that you want to add to the database.
Figure 76 List Addition Menu

One major difference exists between the positive list and the negative and review lists:
 With the positive list, each record that you create comprises all the identity elements
of the option that you choose.
 With the negative and review lists, each identity element is added to the list as an
individual record. For example, if you create a list record by entering data in four fields,
you effectively add four records to your list. However, all the address elements are
counted as one identity element.
Data added to the review list is deleted automatically after one year if you
do not move it to the negative list or delete it manually.
Note
As a result, an order is flagged as potentially fraudulent if a single item from the order is
matched to the negative or the review list while all the items of a positive list record must
match the order for it to be considered good.
Positive Records
To add records to your positive list:
Step 1 Choose one of the options.

If you select an option but do not enter a value in one of the required fields, you receive an
error message. A billing or shipping address comprises the street address, city, state or
province, country, and postal code. If you choose an option that requires payment
information, you must enter the payment method: credit card or debit (direct debit or
electronic check).
All options are available with and without payment information, which is available if a
payment service request was included in the order. The card number is encrypted, and
later only the last four digits are shown. After you select an option, the required fields are
highlighted.

Email address and Customer who shops from home, work, or while travelling and has the
shipping address item shipped to an address other than the home address, such as the
work address. The item may also be a gift.
Email domain and billing Organization, such as a company or college campus, which usually

than the previous ones. You need to recognize the email domain as an
important factor in determining whether the order is legitimate or
custom or profile selector rules to screen these orders completely and
accurately.
Email address, phone Customer who shops often from home or work with the same account
number, billing address, number and always uses the same shipping address and phone
and shipping address number. Orders that match this case are the most secure. This option
is the most complex, the least common, and the most difficult to match.
Customer Account ID Optional account ID, tracking number, reward number, or other unique
number that you assign to the customer.
Email address and Customer who uses the same email address but may be using a new
device fingerprint computer or device that they have not previously used when shopping.
Device fingerprint and Customer who may be using a new computer or device and the same
phone number phone number.
Device fingerprint and Customer who may be using a new computer or device and the same
shipping address shipping address.
Device fingerprint Available if you are using the Device Fingerprint service. To detect and
prevent repeated fraud, you can use this ID (unique computer ID) to
link transactions made from that computer.

Step 2 Enter a name for the record, which can be a number, name, or other identifier that you
assign to your customers.
This identifier is used for reference only; it is not used as a matching criterion.
Step 3 Enter notes or reasons for adding the customer or the order to your positive list.
Step 4 Enter the customer's complete email address, such as jdoe@example.com or the
customer's email domain, which is the part of the address after the @ sign, such as
example.com
Step 5 Complete the payment information fields:
 Card: enter the card number without spaces or dashes.

Electronic Checks

 Debit: direct debits and electronic checks. Enter at least the required information. For
direct debits, choose Option 1 or Option 2. The IBAN is preferable, but consult your
business manager to find out your requirements.
Electronic Checks (U.S. only) Direct Debits
Bank Account Number Required Required
Bank Country - Required
Bank Code
Bank SWIFT Code
- Option 1
Branch Code
Bank Check Digit
IBAN - Option 2
Step 6 Complete the billing address, shipping address, and/or phone number, which is most likely
associated with the billing address.
Step 7 Click Add Entry.
If you try to add a record that already exists in the positive list, you receive a
failure message specifying that at least one duplicate record exists. If you try to
Important add a record that already exists in the negative list, you are not notified.
However, when you attempt to process a transaction with data present in both
the case details window.

Step 8 To verify the result of your action, search the positive list for data that you added.
Negative and Review Records

The review list is a temporary location for data that you want to keep reviewing until you
can confirm whether it is good or fraudulent. The fields for the review list are the same as
those of the negative list.
You can mark transactions up to 6 months in the past.
To add records to the negative list or the review list:
Step 1 Choose a reason and add notes to document your reason for marking the transaction.
The marking reasons are as follows:
Fraud chargeback You have received a chargeback with a fraud reason code.
Non-fraud chargeback You have received a chargeback for other reasons, such as “Item not
received.” You may want to add the customer to the negative list to
prevent the same customer from shopping at your store in the future.
Suspected You are not certain of the validity of this customer and are concerned
that a chargeback may occur.
Creditback You issued a refund to the customer to avoid a chargeback. You
consider this customer undesirable and want to prevent the same
customer from shopping at your store in the future.

Step 2 Enter as much information as you have in the List Fields section.
Email address and The email address is generally specific to an individual whereas the
email domain domain can comprise several email addresses. If you believe that several
email addresses that are part of a single domain are undesirable, you
may want to add the entire domain to your negative list.
Complete IP and These options are related in the same manner as the email information.
Network IP The complete IP address generally applies to a single computer whereas
Addresses the network address applies to the entire network to which a computer
belongs. If you believe that several IP addresses that are part of a
network are undesirable, you may want to add the entire network to your
negative list.
Phone Number If billing and shipping information are present in an order, the order may
also have two phone numbers. When deciding whether to add the phone
number to the negative list, consider the rest of the information,
especially the address(es).
Customer Account ID Optional account ID, tracking number, reward number, or other unique
number that you assign to the customer.
CPF/CNPJ CPF (individual) or CNPJ (business) identification number used by the
Brazilian revenue agency, Receita Federal, for Brazilian customers only.
Device Fingerprint Unique ID of the computer used by the customer to place the order.
Smart ID Device identifier generated from attributes collected during profiling.
Step 3 Enter either the card, direct debit, electronic check, or no payment information.
The card number is encrypted, and later only the last four digits are shown.
 Card number and BIN: enter without spaces or dashes.
The card number is specific to an individual while the BIN (first six digits of the card)
represents a series of card. If you believe that several cards that have the same BIN
are undesirable, you may want to add the entire BIN to your negative list. In this case,
you may suspect that individuals are generating fraudulent card numbers. When
added to the negative list, the card number is encrypted: you cannot search for it later.
Therefore, make sure to add at least one other item of customer identity that you can
use when you want to search your negative list.

 Debit: direct debits and electronic checks. Enter at least the required information. For
direct debits, choose Option 1 or Option 2. The IBAN is preferable, but consult your
business manager to find out your requirements.
Electronic Checks (U.S. only) Direct Debits

Bank Account Number Required Required
Bank Country - Required
Bank Code
Bank SWIFT Code
- Option 1
Branch Code
Bank Check Digit
IBAN - Option 2
Step 4 Enter any available address information.

The more specific the information that you add, the more precise the record. The Business
Center adds only one address to each record. Differing billing and shipping addresses
could mean that the order is a gift. If you have a customer's identity with a different billing
and shipping addresses, you may prefer to add both with the API at once instead of the
Business Center.
Step 5 Click Add Entry.
Step 6 To verify the result of your action, search the negative list for data that you added.

Deleting Data
You can remove data from the negative list, ignore specific transaction data in the Fraud
History database, and delete some of the data from the customer lists.
Using Clear Mark as Suspect

While reviewing orders, you can use the Clear Mark as Suspect feature to update orders
that were marked as suspect but which were later shown to be legitimate. Using the Clear
Mark as Suspect feature removes the order data from the negative list.
Removing Order Data from History

You can ignore specific transaction data in the Fraud History database. Although you
cannot delete the data, you can prevent further history checks that you request with the
score service from detecting and using this transaction data when screening orders.
This option is available when the Remove from History option appears on the Available
Actions menu of the Case Management Details window.
Remember that you can use the Clear Mark as Suspect link to remove order
data from the negative list.
Important Before selecting the Remove from History option, make sure that you have
sufficient information from all possible sources to justify your action.
To remove order data from history:
Step 1 In the Case Management Details window, choose Available Actions > Remove from
History.

The marking tool appears. The Transaction Fields section shows the information that is
removed from your future history checks.
Step 2 Review all the information to make sure it is the information you want removed from
history.
Deleting Data from Customer Lists

To delete data, use the API or List Manager:
 API: By using the appropriate action code of the Risk Update service, you can delete
information from the customer lists. For more information on the API fields, see the
Decision Manager Using the Simple Order API Developer Guide (PDF | HTML) or the
Decision Manager Using the SCMP API Developer Guide (PDF | HTML).
 List Manager: After searching your lists, you can delete entries in the search results
window. For more information, see "Deleting Data from Customer Lists," page 141. In
addition, if you download the results of your searches, you can delete entries before
uploading your modified lists.

Uploading Data
This section describes how to prepare your negative and chargeback files before adding
them to the Business Center. Remember that addresses are normalized by List Manager
before being added to a list.
Editing and Preparing to Upload Customer Lists

You can examine the content of your downloaded lists to correct errors and
inconsistencies, and you can add information that you obtained from other sources.
You can upload files with negative list, positive list, review list, or chargeback data in CSV
Format or in XML Format. When preparing your files for uploading, make sure that you
follow these important points:
 CyberSource recommends that when you name your files you date them to keep track
of the updates more easily, for example: negative_list_updates_03-02-
06.csv
 The character encoding is usually included in the XML file, but you have to specify the
encoding for CSV files when you upload them:
 If you are using a Western European language, use the default (Latin-1).
 If you are using Japanese characters, select Shift-JIS.
 In all other cases, select UTF-8 or UTF-16.
 When you upload data to a list, you must format each record according to the options
available in the Business Center. Otherwise, your file does not upload successfully.

 When you add records to the positive list, each record must contain one of these
sets of data in addition to the required record name:
Payment Information, Email Address, and Billing Address

Payment Information, Email Address, and Shipping Address
Payment Information, Email Domain, and Billing Address
Payment Information, Email Address, Phone Number, Billing Address, and Shipping
Address
Payment Information and Email Address
Payment Information
Payment Information and Customer Account ID
Payment Information and Device Fingerprint
Payment Information and Phone Number
Payment Information and Shipping Address
Email Address and Billing Address
Email Address and Shipping Address
Email Domain and Billing Address
Email Address, Phone Number, Billing Address, and Shipping Address
Email Address and Device Fingerprint
Email Address
Device Fingerprint and Phone Number
Device Fingerprint and Shipping Address
Device Fingerprint
CPF/CNPJ
 When you add records to the negative list, each record can contain as many of
these elements as you want. Email addresses and phone numbers are not
specific. You can use these fields for either the customers’ or the passengers’
data.
Email Address
Email Domain
Complete IP Address
Network IP Address
Phone Number (numbers only)
Address
City
State/Province
Postal Code
Country
Payment
Credit card number
CPF/CNPJ
Smart ID
True IP address
Proxy IP address

CSV Format
Although you may have saved the file that you downloaded as .txt, make sure that you
save the file that you upload with the .csv extension.
Positive List
To prepare your file for uploading:
Step 1 Insert the field headings in the correct order:

record_name, customer_email, domain, device_fingerprint_hash, customer_cc_
number, bank_account_number, bank_code, bank_swiftcode, branch_code, bank_
check_digit, bank_iban, bank_country, bill_address1, bill_address2, bill_
city, bill_state, bill_zip, bill_country, customer_phone, ship_to_
address1, ship_to_address2, ship_to_city, ship_to_state, ship_to_zip,
ship_to_country, ship_to_phone, personal_id
These headings are deleted in Step 3. You cannot add a temporary record to your positive
list when you upload a file, but you can do so in the Business Center with the List Addition
menu.
Step 2 Enter your data.

In a spreadsheet, a file with three records might appear as follows:
In this example, the first line contains the email and the billing address, the second line
contains the email domain and the billing address, and the last line contains the email
address and the shipping address.
Step 3 When done, delete the heading row.
To upload your file, see "Uploading Customer Lists and Chargeback Data Files,"
page 157.

Negative List
Files for the negative list are the simplest because each entry contains only a field name
and a field value from Table 10.
Table 10 Negative List Fields Names and Values
Field Name Field Value

address billing and shipping address
customer_phone billing phone number
customer_email email address
domain email domain
customer_ipaddress IP address
customer_ipaddress_class3 network IP address
device_fingerprint_hash device fingerprint
bank_account_number, bank account information

bank_account_number/bank_swiftcode/branch_
code/bank_check_digit/bank_iban/bank_
country
customer_cc_number credit card number
personal_id CPF/CNPJ
device_fingerprint_smart_id smart ID
true_ipaddress true IP address
proxy_ipaddress proxy IP address
 About the address: When you include the address, follow this format:
address1/address2/city/state/postal_code/country
Country is required. If you have no data for one or more of the address sections, you
must still have five forward slashes (/):
address1//city//postal_code/country
When you add an address, it appears in the uploaded results as the billing and the
shipping address. If you want to save only one of the entries, delete one of them from
the uploaded results.
repeated field names
 About repeated field names: You can upload a list that contains only some of the field
names, such as a list of names or email addresses. In this case, each row would
consist of the field name and the corresponding value:
customer_email customer1@example.com
 About IP addresses: IP addresses will match any IP address field.

 About the bank fields: You can upload all fields (first sample) or only the account
number (second sample):
bank_account_number,1234/002/004/3/er/us
bank_account_number,1234
In the file, do not include a heading row, and insert the fields in the correct order:
FieldName followed by FieldValue; for example:

XML Format
Positive list
To construct your XML file, use this DTD:
<!ELEMENT PositiveList (Entry)*>

<!ELEMENT Entry (RecordName, EmailAddress?, EmailDomain?,
DeviceFingerprint?, CreditCardNumber? BankAccountNumber?, BankCode?,
BankSwiftCode?, BranchCode?, BankCheckDigit?, BankIban?, BankCountry?,
BillingAddress1?, BillingAddress2?, BillingCity?, BillingState?,
BillingPostalCode?, BillingCountry?, BillingPhone?, ShippingAddress1?,
ShippingAddress2?, ShippingCity?, ShippingState?, ShippingPostalCode?,
ShippingCountry?, ShippingPhone?)>
<!ELEMENT RecordName (#PCDATA)>
<!ELEMENT EmailAddress (#PCDATA)>
<!ELEMENT EmailDomain (#PCDATA)>
<!ELEMENT DeviceFingerprint (#PCDATA)>
<!ELEMENT CreditCardNumber (#PCDATA)>
<!ELEMENT BankAccountNumber (#PCDATA)>
<!ELEMENT BankCode (#PCDATA)>
<!ELEMENT BankSwiftCode (#PCDATA)>
<!ELEMENT BranchCode (#PCDATA)>
<!ELEMENT BankCheckDigit (#PCDATA)>
<!ELEMENT BankIban (#PCDATA)>
<!ELEMENT BankCountry (#PCDATA)>
<!ELEMENT BillingAddress1 (#PCDATA)>
<!ELEMENT BillingAddress2 (#PCDATA)>
<!ELEMENT BillingCity (#PCDATA)>
<!ELEMENT BillingState (#PCDATA)>
<!ELEMENT BillingPostalCode (#PCDATA)>
<!ELEMENT BillingCountry (#PCDATA)>
<!ELEMENT BillingPhone (#PCDATA)>
<!ELEMENT ShippingAddress1 (#PCDATA)>
<!ELEMENT ShippingAddress2 (#PCDATA)>
<!ELEMENT ShippingCity (#PCDATA)>
<!ELEMENT ShippingState (#PCDATA)>
<!ELEMENT ShippingPostalCode (#PCDATA)>
<!ELEMENT ShippingCountry (#PCDATA)>
<!ELEMENT ShippingPhone (#PCDATA)>

This XML section shows a sample positive list:
<?xml version="1.0" encoding="utf-8"?>

<PositiveList>
<Entry>
<RecordName>John Smith</RecordName>
<EmailAddress>jsmith@example.com</EmailAddress>
<BillingAddress1>123 Elm Ave</BillingAddress1>
<BillingCity>Mountain View</BillingCity>
<BillingState>CA</BillingState>
</Entry>
<Entry>
<RecordName>Sarah Young</RecordName>
<EmailAddress>sarahy@example.com</EmailAddress>
<ShippingAddress1>123 Walnut Ave</ShippingAddress1>
<ShippingCity>Palmdale</ShippingCity>
<ShippingState>GA</ShippingState>
</Entry>
<Entry>
<RecordName>Sarah Young</RecordName>
<PersonalID>123456</PersonalID>
</Entry>
</PositiveList>
Negative List
The field name can be the customer’s name, the billing or shipping address, the billing or
shipping phone number, the email address or email domain, or the IP address or network
IP address. To construct your file, use this DTD:
<!ELEMENT NegativeList (Entry)*>

<!ELEMENT Entry (FieldName, FieldValue)>
<!ELEMENT FieldName (#PCDATA)>
<!ELEMENT FieldValue (#PCDATA)>

This XML section shows a sample negative list:

<NegativeList>
<Entry>
<FieldName>Address</FieldName>
<FieldValue>123 Walnut/Mountain View/CA/U.S.A.</FieldValue>
</Entry>
<Entry>
<FieldName>Phone number</FieldName>
<FieldValue>8005551212</FieldValue>
</Entry>
<Entry>
<FieldName>personal_id</FieldName>
</Entry>
<Entry>
<FieldName>device_fingerprint_smart_id</FieldName>
</Entry>
<Entry>
<FieldName>true_ipaddress</FieldName>
<FieldValue>99.88.77.66</FieldValue>
</Entry>
<Entry>
<FieldName>proxy_ipaddress</FieldName>
</Entry>
</NegativeList>
Review List
The field name can be the customer’s name, the billing or shipping address, the billing or
shipping phone number, the email address or email domain, or the IP address or network
IP address. To construct your file, use this DTD:
<!ELEMENT ReviewList (Entry)*>

<!ELEMENT Entry (FieldName, FieldValue)>
<!ELEMENT FieldName (#PCDATA)>
<!ELEMENT FieldValue (#PCDATA)>

This XML section shows a sample review list:

<ReviewList>
<Entry>
<FieldName>Address</FieldName>
<FieldValue>123 Walnut/Mountain View/CA/U.S.A.</FieldValue>
</Entry>
<Entry>
<FieldName>Phone number</FieldName>
</Entry>
<Entry>
<FieldName>personal_id</FieldName>
</Entry>
<Entry>
<FieldName>device_fingerprint_smart_id</FieldName>
</Entry>
<Entry>
<FieldName>true_ipaddress</FieldName>
</Entry>
<Entry>
<FieldName>proxy_ipaddress</FieldName>
</Entry>
</ReviewList>
Preparing Chargeback Data Files

When you submit a chargeback data file, the Business Center searches the fraud history
database for all transactions related to each of your entries and marks as fraudulent each
entry found. In addition, the card number, email address, and shipping address of the
fraudulent transaction are added to your negative list. If no transaction with your data is
found, the data in your entry is added to the negative list. All elements are considered
fraudulent by association. The transaction amount, currency, and date are used to narrow
the scope of the search.
Example How Entries Are Added to Your Negative List
An entry contains a card number and an email address. The card number is not in the
database, but the email address already is. In this case, the card number is added to the
database.

File Content
Each file can contain up to 3000 records. Fields can be required or optional. In addition to
your merchant ID, you must include at least one required field from the left column:
Table 11 Fields Required For Preparing Chargeback Data Files
Required Fields (marked) Optional Fields (not marked)

Request ID Marking notes
Card number Transaction amount
Card number and email address Transaction currency
Card number and date Transaction date (only with card number or email address)
Email address
Email address and date
Marking reason (not marked)
Marking Reason
This information is required. Use one of these values:
 fraud_chargeback: chargeback received with a chargeback reason code.
 non_fraud_chargeback: chargeback received for other reasons, such as item not
received.
 suspected: chargeback likely to happen.
 creditback: you issued a refund to the customer to avoid a chargeback.
If the marking reason is not valid, suspected is used. If you do not provide a marking
reason, the Business Center uses fraud_chargeback.
Request ID
If you provide the request ID, future database searches can result in exact matches. If you
do not provide the request ID, future search results contain related elements, such as the
same card number, email address, combined card number and email address, and card
number and transaction date. With these elements, the scope of the search can be
narrowed significantly.
Account Number
If the file contains an account number, the number is encrypted immediately by the
Business Center.
In the CSV and XML examples, account numbers are shown encrypted
although they are visible in the chargeback file that you upload.
Note

Transaction Date
To narrow database searches, you can include the date with the card number or the email
address. If you do not include either of these elements, the date is ignored. Only
transactions that occurred since the specified date are searched. The transaction date
must be in this format: YYYY-MM-DD GMT.
Example How Specified Dates Affect Searches
If you specify 2007-07-24, only transactions that occurred since that date are searched
and marked. Fraudulent data that exists in older transactions is not be found. Therefore,
choose your dates carefully and conservatively.
Marking notes
Use this field to add any comment that you wish to about the order or the customer.
Amount and Currency

To narrow the database search, you can include the currency and the amount from these
fields: purchaseTotals_currency and purchaseTotals_grandTotalAmount (Simple
Order API) or currency and grand_total_amount (SCMP API). If either the currency or
the amount is missing from the database or the transaction, the database cannot be
searched. The amount is rounded down to the second decimal. If the request amount is
within 10% or less of the amount stored in the database, the transaction is marked.
Example Matching Between Database Values and Chargeback File Values
The database contains the sample transaction amounts shown in the first column of the
following table. Your chargeback file contains the amount of 100.00. For each database
value, the range covered by 10% is shown in the third column. Therefore, in this example,
your 100.00 amount is matched to 91.00, 101.00, and 110.00.
Database amounts 10% +/–

89.00 8.90 80.10–97.90
90.00 9.00 81.00–99.00
91.00 9.10 81.90–100.10
101.00 10.10 90.90–111.1
110.00 11.00 99.00–121.00
111.00 11.10 99.90–121.10
112.00 11.20 111.80–123.20

File Format
You can upload data in CSV or XML format. Each file must have a unique name. In the
Business Center, each format is handled differently:
 Files in CSV format are not checked. If Decision Manager encounters errors, you
receive an error message only if the merchant ID is incorrect. Incorrect transactions
are not marked.
 Files in XML format are checked after you upload to ensure conformance with the
DTD. If the marked transactions contain errors, you receive an error message
immediately if the merchant ID, format, file size, or data is incorrect.
To ensure that all transactions are checked and marked correctly, CyberSource
recommends that you use the XML format.
CSV Format
When assigning a name to a file, make sure that you use these names only when they
represent the content of your file: csv, paymentechResponse, and vital. For example,
the file MYvitalFile.csv is not processed correctly, but the file MYcsvFile.csv is
processed correctly. When creating text files, follow this template:
merchant_id, request_id, cc_number, email, date, amount, currency,
reason, notes
Heading Row
Even if you do not include all the fields, make sure that you keep the structure with all the
commas. CyberSource recommends that you include a heading row. If you use the
heading row, make sure that you start the row with the pound sign (#). This example
shows three records that the merchant wants to mark and add to the negative list. Each
record is followed by a description of the record:
 First record: the user marks a specific request ID. The entire content of this
transaction is marked as fraud chargeback.
 Second record: the user marks a specific card number, which as marked as non-fraud
chargeback. The user notes that the customer is difficult.
 Third record: the user marks a specific card number and email address. The user
suspects that the order is fraudulent and marks the data accordingly.
#merchant_id,request_id,cc_
number,email,date,amount,currency,reason,notes
sample_merchant, 0237970927350972305,,,,,, fraud_chargeback,
sample_merchant,, xxxxxxxxxxxxxxxx1111,,,, non_fraud_chargeback,
difficult customer
sample_merchant,, xxxxxxxxxxxxxxxx9999, sample@email.com, 2007-07-19,,,
suspected, suspected fraud

You can also prepare your records in a spreadsheet. This figure shows the same example
as above.
If you use a spreadsheet, make sure that the date is formatted correctly. To do
so, format the cell as a custom number (yyyy-mm-dd).
Important
XML Format
When assigning a name to a file, make sure that you use the following names only if they
represent the content of your file: paymentechResponse, vital, and xml. For example,
the file MYcsvFile.xml is not processed correctly, but the file
MYChargebackFile.xml is process correctly.
Even if you do not include all the fields, make sure that you keep the structure. This
example shows three records (<chargeback_request/>) that the merchant wants to
mark and add to the negative list. Each record is followed by a description of the record:
 First record: the user marks a specific card number, which is marked as non-fraud
chargeback. The user further notes that the customer is difficult.
 Second record: the user marks a specific request ID, which as marked as non-fraud
chargeback. The entire content of this transaction is marked as fraud chargeback.
 Third record: the user marks a specific card number and email address. The user
suspects that the order is fraudulent and marks the data accordingly.

<?xml version="1.0" encoding="ISO-8859-1" ?>

<chargeback_marking xmlns:xsi="http://www.w3.org/2001/XMLSchema-
instance" xsi:noNamespaceSchemaLocation="ChargebackMarking.xsd">
<chargeback_requests>
<chargeback_request>
<merchant_id>sample_merchant</merchant_id>
<marking_criteria>
<account_number>xxxxxxxxxxxxxxxx1111</account_number>
</marking_criteria>
<marking_reason>non_fraud_chargeback</marking_reason>
<marking_notes>difficult customer</marking_notes>
</chargeback_request>
<marking_criteria>
<request_id>1807527266850167904181</request_id>
</marking_criteria>
<marking_reason>fraud_chargeback</marking_reason>
<transaction_date>2007-07-01</transaction_date>
<marking_criteria>
<account_email>
<account_number>xxxxxxxxxxxxxxxx9999</account_number>
<email_address>fraudulent_customer@email.com</email_address>
</account_email>
</marking_criteria>
<marking_reason>suspected</marking_reason>
<marking_notes>suspected fraud</marking_notes>
</chargeback_requests>
</chargeback_marking>

When creating XML files, follow this XSD. The XSD is available also in the online help
window where you upload your chargeback data.
<?xml version="1.0" encoding="ISO-8859-1"?>

<xsd:schema xmlns:xsd="http://www.w3.org/2001/XMLSchema">
<xsd:complexType name="account_email_type">
<xsd:sequence>
<xsd:element name="account_number" type="xsd:string"/>
<xsd:element name="email_address" type="xsd:string"/>
</xsd:sequence>
</xsd:complexType>
<xsd:complexType name="marking_criteria_type">
<xsd:choice>
<xsd:element name="request_id" type="xsd:string"/>
<xsd:element name="account_number" type="xsd:string"/>
<xsd:element name="email_address" type="xsd:string"/>
<xsd:element name="account_email" type="account_email_type"/>
</xsd:choice>
</xsd:complexType>
<xsd:complexType name="chargeback_request_type">
<xsd:sequence>
<xsd:element name="merchant_id" type="xsd:string"/>
<xsd:element name="marking_criteria" type="marking_criteria_type"/>
<xsd:element name="transaction_date" type="xsd:date" minOccurs="0"/>
<xsd:element name="transaction_amount" type="xsd:decimal" minOccurs="0"/>
<xsd:element name="currency" type="xsd:string" minOccurs="0"/>
<xsd:element name="marking_reason" type="xsd:string" default="fraud_
chargeback" minOccurs="0"/>
<xsd:element name="marking_notes" type="xsd:string" minOccurs="0"/>
</xsd:sequence>
</xsd:complexType>
<xsd:complexType name="chargeback_requests_type">
<xsd:sequence>
<xsd:element name="chargeback_request" type="chargeback_request_type"
maxOccurs="unbounded"/>
</xsd:sequence>
</xsd:complexType>
<xsd:element name="chargeback_marking">
<xsd:complexType>
<xsd:sequence>
<xsd:element name="chargeback_requests" type="chargeback_requests_type"/>
</xsd:sequence>
</xsd:complexType>
</xsd:element>
</xsd:schema>

Uploading Customer Lists and Chargeback Data

Files
The procedures to upload XML and CSV files are similar.
To upload an XML or CSV file:
Step 1 In the List Manager menu, choose List Addition > Upload File.
Step 2 Choose the type of list to upload.
Step 3 Choose the type of file.
 If you choose CSV, you must also select the character encoding:
 For Western European languages, use the default (ISO 8859-1).
 For Japanese characters, select Shift-JIS.
 For all other cases, select UTF-8.
 If you choose XML, the character encoding is already in the file.
Step 4 To find your file, click Browse.
Step 5 Enter your email address. You will receive a notification when the file has been uploaded.

Step 6 Click Upload File.

List Manager adds your merchant ID to the file. Your files are encrypted before being
processed. All new entries are added to the negative list. If an entry is already in the
negative list, the most serious reason is added to the database.
If an entry is already on the negative list, and you upload it with a review list, it remains on
the negative list. If an entry is already on the review list, and you upload it with a negative
list, it is moved to the negative list.
Verifying the Results

The files that you upload are processed hourly. When your files are ready, you receive a
notification email. You can view the processing status of your uploaded list file in the Batch
Upload Search window.
To verify uploaded files:
Step 1 In the Business Center navigation panel, choose Tools & Settings > Batch Transactions
> Batch Upload Search.
Step 2 Specify a search date range and click Search. Your results appear in the status grid.
Chargeback Files
In the next section, you can read about automatically adding chargeback data to both
databases by using the automatic marking service. If you are enrolled in this service, you
can also upload your own chargeback data files in the Business Center.
Automated Input
You can automatically add data to the databases by using chargeback data files and when
new data matches previously marked data.
Chargeback Data Files

This section applies only to merchants who use Chase Paymentech Solutions, GPN, or
Litle as payment processor. With this service, CyberSource can automatically mark
transactions with the appropriate chargeback reason code. Each marked transaction is
used to create an entry (marked as suspect) in your negative list with the account number,
email address, and/or shipping address. Transactions cannot be un-marked automatically
even if they are re-presented successfully. Instead, you must use the Remove from
History feature to hide the customer from the negative list.

To use this service, proceed as follows:

 Chase Paymentech Solutions: contact your technical representatives at Chase
Paymentech Solutions and at CyberSource:
 Request that Chase Paymentech Solutions forward to CyberSource an electronic
copy of your daily chargeback report.
 Request that CyberSource begin marking your chargebacks.
 GPN and Litle: Request that CyberSource begin marking your chargebacks.
Chargeback information is located in the processor_message field (CSV format) or the

ProcessorMessage element (XML format) of the Payment Events report. If your account
has several merchant IDs, the transactions are listed under the primary merchant's
account.
Automatic Data Addition

Customer data is added automatically to the database when a new transaction contains
data already present in the databases. Only one instance of customer data is stored in the
database regardless of the number of transactions that contain this data. The request ID
of each transaction that contains marked data is also added to the database. You can find
the request IDs in the case details window.
Example Order Data in the Database
The database contains the customer and order data of both orders, including the request
IDs:
 Order A contains an email address and a billing address. Because the order is
suspect, the email and billing addresses are added to the negative list. The request ID
of this order is stored in the negative list with the entry.
 Order B contains the same email address as Order A but a different account number
and a different billing address. Because the email address is the same in both orders,
the data for the second order is automatically added to the negative list. The request
ID of this order is stored in the negative list with the entry.

CyberSource API
You can use the Risk Update service to update your customer lists. In this case, you
choose the type of negative or positive data and the customers that you want to add to the
lists. For more information, see the Decision Manager Using the Simple Order API
Developer Guide (PDF | HTML) or the Decision Manager Using the SCMP API Developer
Guide (PDF | HTML).
Searching and Reviewing Customer Lists

An important part of managing your lists is to search the data that they contain so that you
can update it whenever necessary. Your search results are limited to 5000 records. All
search results are displayed in your time zone.
Search Criteria
You can search for "Negative List," "Review List," and "Positive List" records from the List
Search window.
Figure 77 List Search Window
Date Range
The first criterion that you need to choose is the date or date range when the data was
added to the customer list. The preset ranges enable you to search from the past hour to
the past six months. Although all other Business Center searches are limited to six
months, you can search through all your past customer list records in CyberSource’s
database. To do so, select All. When searching through a date range, the start date is the
oldest date whereas the end date is the most recent date.

Figure 78 Creation Date Selector Detail
Field Options
Narrow the scope of your search as much as possible to shorten the duration of your
search. This table describes all the options available for all types of lists: negative (N),
review (R), and positive (P).
Table 12 Field Options
Options List Description

All fields All All field options for the selected list.
Address N&R Street address, city, state or province, country, and postal code in the order.
Note You can search individually for the city, state or province, postal code, or
country. However, when you specify the street address, you must provide also the
city, postal code, and country. The state or province is optional.
Billing Address P Customer's complete address.
CPF/CNPJ All CPF (individual) or CNPJ (business) identification number used by the Brazilian
revenue agency, Receita Federal, for Brazilian customers only.
Complete IP Address N&R Customer's IP address, such as 111.111.111.111 (four sections).
Customer Account ID All Your company’s identifier for the customer.
Device Fingerprint All Unique ID of the computer used by the customer to place the order.
Email Address All Customer's complete email address, such as jdoe@example.com.
Email Domain All Email domain, such as example.com.
Network IP Address N&R Network IP address, such as 111.111.111 (three sections).

Table 12 Field Options (Continued)

Payment All Select the customer's payment option.
Credit card: Enter the complete number:
 Card Number: (All lists) Complete number used for the transaction
 Card BIN: (Negative list) Bank Identification Number (first six digits of the card
number)
Direct debit: Enter any or all of these elements:

 Electronic checks: only the account number is required because checks
payments are valid only in the U.S.
 Direct debits: The bank account number and the bank country are always
required, but the other fields are optional: enter either the IBAN or the bank code,
bank SWIFT code, branch code, and bank check digit.
 Bank Account Number: Customer’s bank account number
 Bank Country: Country where the bank is located
 Bank Code: Code for the customer’s bank
 Bank SWIFT Code: Bank identifier used in cross-border transactions
 Branch Code: Code for the branch of the customer’s bank
 Bank Check Digit: Code used to validate the customer’s account number
 IBAN: International Bank Account Number: preferable when available, but
consult your business manager to find out your company’s rules.
Phone Number All Phone number associated with the order.
Shipping Address P Customer's complete address.
Smart ID N&R Device identifier generated from attributes collected during profiling.
Results
For all lists, the account number and address results are displayed as follows.
Account Number
If you search for an account number, the results window shows the payment type. Direct
debit include electronic check payments. The account number is never returned in its
entirety because it is encrypted when stored. Depending on the length of the account
number, the account number can appear in one of these patterns:
 16 digits and more: only the last four digits are shown; all others are masked, for
example: 2345.
 10–15 digits: the first two and last two are shown; all others are masked. For example,
a 12-digit account number is shown as follows: 12xxxxxxxxxxxx78.
 1–9 digits: all digits are masked.

Complete Address
The complete address comprises the street address (one or two fields), city, state or
province, postal code, and country. When you search for an address, List Manager always
returns all addresses that contain the element that you want and all addresses that contain
no value for this element.
Example Searching for a Specific Postal Code
If you search for the postal code 94520, List Manager returns all addresses within this
postal code and all addresses that have no postal code regardless of the content of the
other address elements. These addresses without data are returned because you need to
consider the possibility that some of them may be located within the postal code that you
are searching. You might want to further investigate these empty address elements to find
out if they are important to you.
Marking Request ID
The request ID appears in the far right column. The request ID is a link to order that was
marked. If the list entry is older than six months, its details are not available. If multiple
fields from different orders are found on the negative list, the request ID of the first order is
shown.
Negative List
You can search the negative list to view the data that it contains, to move data to the
review list, or to hide data from future searches. Each type of information, such as billing
address, email address, and account suffix, appears on a separate row. In the Entry Type
column, the billing or shipping address is labeled Address.

When an order contains customer data that was previously added to the negative list, the
data from the new order is automatically added to the negative list. In this case, the reason
is preceded by auto_: auto_fraud_chargeback, auto_non_fraud_chargeback,
auto_suspected, and auto_creditback, as shown in the last line of the figure below.
Figure 79 Order Containing Customer Data in Negative List
To move order data from the negative to the review list, select one or more lines. When
you do so, the button named Convert to Review is activated.
Figure 80 Convert to Review Button Activated
After you click Convert to Review, a message confirms that the action was successful.

Review List
You can search the review list to view the data that it contains, to move data to the
negative list, or to delete the data confirmed good after having been marked suspicious.
Searching for review list items returns results similar to the negative list search. Each type
of order data, such as IP address, payment type, and billing address, appears on a
separate row. In the Entry Type column, the billing or shipping address is labeled Address.
To move order data from the review to the negative list, select one or more lines. When
you do so, the button named Convert to Negative is activated.
Figure 81 Convert to Negative Button Activated
Positive List
Searching the positive list is especially important to keep track of temporary records.
These records are dropped automatically from the positive list when either of these events
occurs:
 After the customer places the order again.
placed the order again.
In the following figure, the first record is temporary. The expiration date and time are
indicated in the last highlighted column. The last two records are permanent.
Figure 82 Expiration Date and Time Displayed for Temporary Record

Deleting Records
This section applies to positive and negative list records. To delete records, check one or
more records, and click Delete. After you do so, the results window reappears with a
success message.
Downloading Customer Lists

When you download your lists, you can edit the content as needed and later add the
updated data to the Business Center. You can export your lists either in XML or CSV
format. This section provides summary information about the reports. For complete
information about the elements and fields, see the Decision Manager Reporting Guide
(PDF | HTML).
Although you can view a maximum of only 5000 records in the results window, you can
export your complete positive and negative lists. You can download your lists before or
after searching for the content.
The following figure shows the export features in the List Search window:
Figure 83 Export Features in the List Search Window
CSV Format
To download a list in CSV format:
Step 1 Click Export as CSV.

Step 2 Click Save.
Step 3 Change the file extension from .csv to .txt so that all the data in long numeric strings
appears correctly.
Step 4 Save the file to your computer.
Step 5 Import the text file into a spreadsheet as described in the Decision Manager Reporting
Guide (PDF | HTML).

Optional fields contain information only if you added the corresponding data to the list. In
this figure, the fields that contain no data have been collapsed to view more easily the
fields that contain data.
Column Headings
Report headings
Report Date Range All
or
Report Start Date Jun 01 2009 12:00:00 AM
Report End Date Jun 11 2009 07:24:03 PM
Column headings for the positive list
recordName, listType, creationDate, createdBy, groupID, merchantID, expiration,
customerAccountID, billingPhone, shippingPhone, paymentType, accountSuffix, email,
emailDomain, billingAddress1, billingAddress2, billingCity, billingState,
billingPostalCode, billingCountry, shippingAddress1, shippingAddress2, shippingCity,
shippingState, shippingPostalCode, shippingCountry, creditCardBINCountry, IPCountry,
customerEmailCountry, deviceFingerprint, markingNotes, markingRequestID, cpfCnpj,
lastUsedDate
Column headings for the negative and the review lists
recordName, creationDate, createdBy, groupID, merchantID, customerAccountID,
billingPhone, shippingPhone, paymentType, accountSuffix, creditCardBINNumber, email,
emailDomain, address1, address2, city, state, postalCode, country, IPAddress,
networkIP, creditCardBINCountry, IPCountry, customerEmailCountry, deviceFingerprint,
markingReason, markingNotes, markingRequestID, cpfCnpj, smartId, lastUsedDate

Origin of Data
These fields are derived as follows:
Table 13 Origin of Data
Field List Type Description

recordName Positive list only; Created in the List Addition window or when
always present. using the Transaction Marking Tool.
CreationDate, CreatedBy, All lists; always Automatically inserted by List Manager when
MerchantID, and GroupID present. you create the record or mark an order.
listType and expiration Positive list only; Automatically inserted by List Manager when
always present. you mark orders temporarily trusted in the case
or search details window.
customerAccountID All lists; optional. Entered when marking orders or in the list
addition window. For the positive list, this field
may not contain a value even if the order does.
billingAddress1, All lists; optional. Entered in the list addition windows or when
billingAddress2, marking orders. Billing and shipping fields are
billingCity, billingState, always returned as a complete address. For
billingPostalCode, and example, even if you search for only one
billingCountry element, such as the city, your search results
contain the complete billing and shipping
shippingAddress1,
addresses that contain that city and those that
shippingAddress2,
contain no data for the city.
shippingCity, shippingState,
shippingPostalCode, and Negative list: Address elements not specific to
shippingCountry billing or shipping.
billingPhone and Positive list: Address elements specific to
shippingPhone billing or shipping.
email and emailDomain
IPAddress and networkIP Negative and Entered in the list addition windows or when
Review lists; marking orders.
optional.
paymentType and All lists; optional. The exported data can contain credit card
accountSuffix information but not direct debit information.
List Addition windows: Although you add the
complete account number to the list, only the
last four digits are shown in the Business
Center because the number is encrypted.
Transaction Marking Tool: you can view and
can add only the suffix.
creditCardBINNumber Negative and Entered in the list addition windows.
Review lists;
optional.
IPCountry, All lists; optional. Country decoded from the IP address, card
creditCardBINCountry, and BIN, and email address in the order.
customerEmailCountry

Table 13 Origin of Data (Continued)

markingReason Negative and Automatically inserted when a transaction is
Review lists; always marked suspect.
present.
markingNotes and All lists; optional. Notes are available if the reviewer has entered
markingRequestID comments when marking the order and if the
order was marked with the Transaction Marking
Tool.
deviceFingerprint All lists; optional. Device identifier generated from attributes
collected during profiling. Available if you are
using the Device Fingerprint service.
cpfCnpj All lists; optional. This value is sent by the merchant in the
transaction request.
smartId Negative and Unique ID of the computer used by the
Review lists; customer to place the order. Available if you are
optional. using the Device Fingerprint service.
lastUsedDate All lists; always Inserted by List Manager. Indicates the latest
present. date when the value matches an item on a
negative, positive or review list.
Sample Report
This is a sample negative or review list record. Positive list reports are similar.
Report Start Date Oct 23 2010 04:00:00 PM

Report End Date Oct 23 2010 04:35:59 PM
creationDate, createdBy, groupID, merchantID, customerAccountID, billingPhone,

shippingPhone, paymentType, accountSuffix, creditCardBINNumber, email, emailDomain,
billingAddress1, billingAddress2, billingCity, billingState, billingPostalCode,
billingCountry, shippingAddress1, shippingAddress2, shippingCity, shippingState,
shippingPostalCode, shippingCountry, IPAddress, networkIP, creditCardBINCountry,
IPCountry, customerEmailCountry, markingReason, markingNotes, markingRequestID
Oct 23 2010 04:05:54 PM,, dmtest19, dmtest19,,,,,,,,,,,,,,,,,,,,,,,,,,

574bca09e5964d0cbed932bb35cbf70a, suspected,, 2563250986800000139320

XML Format
Before downloading an XML report, make sure to have the current DTD so that
you can take advantage of the most recent features.
Important
To download a list, click XML and save the file on your computer.
Origin of Data
Either start and end dates or a date range appear in the attributes of the report. Optional
fields appear only when the record contains data. These elements are derived as follows:
Table 14 Origin of Data

RecordName Positive list only; Created in the List Addition window or when
always present. using the Transaction Marking Tool.
CreationDate, CreatedBy, All lists; always Automatically inserted by List Manager when
MerchantID, and GroupID present. you create the record or mark an order.
ListType and Expiration Positive list only; Automatically inserted by List Manager when
always present. you mark orders temporarily trusted in the case
details window.
CustomerAccountID All lists; optional. Entered when marking orders or in the
Negative List Addition window. For the positive
list, this field may not contain a value even if the
order does.
BillingAddress1, All lists; optional. Entered in the list addition windows or when
BillingAddress2, marking orders. Billing and shipping fields are
BillingCity, BillingState, always returned as a complete address. For
BillingPostalCode, and example, even if you search for only one
BillingCountry element, such as the city, your search results
contain the complete billing and shipping
ShippingAddress1,
addresses that contain that city and those that
ShippingAddress2,
contain no data for the city.
ShippingCity, ShippingState,
ShippingPostalCode, and Negative list: Address elements not specific to
ShippingCountry billing or shipping.
BillingPhone, ShippingPhone Positive list: Address elements specific to
billing or shipping.
EmailAddress, and EmailDomain
IPAddress and NetworkIP Negative and Entered in the list addition windows or when
Review lists; marking orders.
optional.

Table 14 Origin of Data (Continued)

PaymentType, AccountSuffix, All lists; optional. The exported data can contain credit card
and AccountNumber information but not direct debit information.
List Addition windows: Although you add the
complete account number to the list, only the
last four digits are shown in the Business
Center because the number is encrypted.
Transaction Marking Tool: you can view and
can add only the suffix.
CreditCardBINNumber Negative and Entered in the list addition windows.
Review lists;
optional.
IPCountry, All lists; optional. Country decoded from the IP address, card
CreditCardBINCountry, and BIN, and email address in the order.
CustomerEmailCountry
MarkingReason Negative and Automatically inserted when a transaction is
Review lists; always marked suspect.
present.
MarkingNotes and All lists; optional. Notes are available if the reviewer has entered
MarkingRequestID comments when marking the order and if the
order was marked with the Transaction Marking
Tool.
deviceFingerprint All lists; optional. Device identifier generated from attributes
collected during profiling. Available if you are
using the Device Fingerprint service.
cpfCnpj All lists; optional. This value is sent by the merchant in the
transaction request.
smartId Negative and Unique ID of the computer used by the
Review lists; customer to place the order. Available if you are
optional. using the Device Fingerprint service.
lastUsedDate All lists; always Inserted by List Manager. Indicates the latest
present. date when the value matches an item on a
negative, positive or review list.

Sample Report
This is a sample negative list report. The reports for the positive and review lists are
similar.
<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE ListManager SYSTEM "https://ebctest.cybersource.com/ebctest/
reports/dtd/list_manager.dtd">
<ListManager xmlns="https://ebctest.cybersource.com/ebctest/reports/
dtd/list_manager.dtd" MerchantID="test" Name="Negative List"
SearchDate="Dec 01 2010 12:26:28 PM" ReportDateRange="All"
Version="1.0">
<NegativeItem>
<CreationDate>Nov 30 2010 08:30:37 PM</CreationDate>
<CreatedBy>test</CreatedBy>
<MerchantID>test</MerchantID>
<BillingPhone>6505551212</BillingPhone>
<MarkingReason>suspected</MarkingReason>
</NegativeItem>
<NegativeItem>
<CreationDate>Nov 30 2010 08:30:37 PM</CreationDate>
<CreatedBy>test</CreatedBy>
<MerchantID>test</MerchantID>
<EmailAddress>test@example.com</EmailAddress>
<MarkingReason>suspected</MarkingReason>
</NegativeItem>
</ListManager>

CHAPTER
Velocity
6
This chapter discusses in detail how to plan and use global and merchant velocity tests to
detect and fight the various types of fraud that may affect your business.
Global velocity represents the buying patterns of many merchants. Therefore, it is not
specific to your business. You can use global velocity for its statistical value to decide how
to handle a specific order in view of the past history of one or more elements in the order:
if an order is risky for another merchant, it may be risky for you. For example, a customer
who has been placing many orders at another merchant's Web site may be risky.
Merchant velocity applies specifically to your business. For example, you can review
orders depending on the type of product (unique or every day), the size of the orders (low
or high amount), the number of items to the same address, or a combination of these
factors.
Velocity results for transactions with test credit cards may produce inconsistent
results.
Note
Global Velocity
Global Velocity is a fraud-protection tool that enables you to monitor suspicious activity in
your business based on volume and monetary thresholds that you determine. By
monitoring your business, you can detect suspicious activity more effectively. These
settings enable you to control certain order parameters that contribute to the score.
Account numbers and email, shipping, and IP addresses can suggest the instances or the
suspicion of fraud in several ways, such as these:
 Many account numbers are used, but all orders are shipped to the same address.
 The same account numbers are used with many merchants until the limits are
reached.
 Many orders contain repeated elements, such as the email address.
 The same IP address is used for several orders, but the other parameters vary.
Because the IP address is used to detect not only global velocity but also the origin of the
order (country and state), the IP address is essential in detecting fraud.

Chapter 6 Velocity
To modify the impact that the global settings have on your orders (none, review,
or reject), adjust the predefined rule Similarities of this order to recent orders in
Note the profile Editor for each of your profiles.
Test Intervals
The actual intervals are determined by statistical studies but appear random so that
fraudulent customers cannot determine the beginning or the end of the intervals.
CyberSource changes the intervals according to the performance of the fraud models in
the ongoing statistical studies.
The following figure shows the available parameters and their default settings. Tracking
intervals are specified as ranges that vary from short (15 minutes) to very long (7 days).
The shipping address comprises the street address, city, state, postal code, and country.
Figure 84 Global Velocity Parameters
In the API reply, you receive an information code for each test. False-positive results may
occur when customers make frequent purchases in a short period of time, such as during
a holiday season. At that time, customers may also request to have their gift purchases
shipped to different addresses.

Chapter 6 Velocity
Selecting Time Intervals

Only merchants can change these settings. Administrators can only view the settings of
their merchants. Each cell represents one test. You may choose as many tests as you
wish.
To select velocity time intervals:
Step 1 Click Decision Manager > Velocity.

Step 2 Click the Global Velocity tab.
Step 3 Check the boxes for the tests that you want to perform, and click Update.
You can change your settings at any time.
Merchant Velocity
This section describes how to create velocity rules that apply specifically to your business
to identify problems associated with purchase frequency, such as generated card
numbers and repeated large orders. A rule is triggered if one parameter in the rule is
triggered. You can create two types of velocity rules:
 Order velocity rules, which are not associated with a type of product.
 Product velocity rules, which are associated with a custom list of products.
In addition to velocity rules, you can use these features:

 You can set to Review these two predefined rules: Merchant-specific order velocity
and Merchant-specific product velocity. After you have processed a few orders and
have evaluated the results, you can modify the settings according to your business
requirements. For more information, see "Predefined Rules," page 87.
 You can create custom rules by using the order element named Merchant-specific
velocity. For more information on custom rules, see "Custom Rules and Custom Lists,"
page 100.
When a rule is triggered, these events occur:

 The reply contains a factor code and an information code that you can use to create
custom rules.
 The appropriate (order or product) merchant-specific velocity predefined rule is
triggered. Orders are processed according to your setting for that rule.

Chapter 6 Velocity
Rules Summary
Your rules are listed in the Velocity window of the Configuration section. You can create up
to 50 order and 20 product velocity rules.
When you create an event rule, a pencil icon appears adjacent to the rules that you
create, which indicates that you can edit those rules. If you are an administrator, you can
change only the rules that you create.
The figure below shows the Order Velocity summary table.
Figure 85 Order Velocity Summary Table
This figure shows the Product Velocity summary table.
Figure 86 Product Velocity Summary Table

Chapter 6 Velocity
The following table summarizes the rule elements. The content of the order and product
velocity windows differs slightly as indicated in the second column.
Table 15 Velocity Rule Elements
Element Rule Description

Velocity Rule Name Both Unique name for the rule. You might want to name the rule for its
components. For example, 15-AC-3 means that the time interval
is 15 minutes, the tracked element is account number, and the
threshold is 3.
Custom List Product Unique list of the product group.
Type Product Product information in the custom list: merchant SKU, product
code, or product name.
Tracking Elements Both Customer parameter that you want to track in your orders.
Time Interval Both Interval selected for this rule in the rule editor.
Threshold Both Minimum number of instances or minimum value that you want to
allow for the combination of product, interval, and parameter
before the rule is triggered.
Info Code Both Unique code assigned by Decision Manager to each rule:
 MVEL-R<number> indicates an order velocity rule.
 MVEL-P<number> indicates a product velocity rule.
The numbering starts at 1 and increases by one with each rule.

Because the numbering spans the order and the product velocity
rules, the numbers that appear may not be sequential.
You can use these codes to track the orders that trigger the rule
and to create custom rules. For more information on using the
information codes to search for orders, see "Case Information,"
page 232.

Chapter 6 Velocity
Creating Velocity Rules

The window that you use to create and modify rules is similar for both types of rules. The
following figure shows the Order Velocity Editor.
Figure 87 Order Velocity Editor
The following instructions, which are divided into the same sections that appear in the rule
editor, apply to order and product velocity rules unless otherwise noted.
To create a velocity rule, choose the appropriate tab and click Add Order Velocity or Add
Product Velocity. To modify a rule, click anywhere on the rule line in the summary table.

Chapter 6 Velocity
Velocity Definition
Provide the appropriate information.
Name
Enter a descriptive name for the rule. You might want to name the rule for its components.
For example, you could indicate the time interval, the tracking element, and the number of
orders: [1 hour] - [account number] - [max. 3 orders].
Event Type
The only option is Payment.
Product Element
If this is a product rule, select a product element and a custom list of products. The
product element options are merchant SKU, product name, and product code. You can
use the same list in many velocity rules.
Tracking Element
Choose up to four elements that you want to track. All of the elements that you choose
must be in the transaction and match in order to trigger the rule. You can choose custom
merchant-defined data fields or from the following:
 Account number
 Billing phone number
 Billing first name
 Billing last name
 Card BIN
 Customer account ID
 Customer IP address
 Customer username
 Customer password
 Device fingerprint
 Email address
 Merchant reference number
 Order value
 Proxy IP address
 Shipping address
 Shipping phone number

Chapter 6 Velocity
 Smart ID
 True IP address
If you are the administrator of a group of merchants, you can also choose Merchant ID as
a tracking element.
When Order Value is the Tracking Element, Decision Manager tracks all orders
of the same value against the specified threshold. Order Value as a Tracking
Note Element takes currency conversion into account if you select to apply this rule
to Orders in all currencies.
 Example of an order velocity rule: where Order Value is the Tracking
Element and the Threshold is set to a minimum Order count of 5. This
velocity rule is triggered each time your order processing system receives
6 orders of a specific value such as 100 Euros or 100 Rupees each.
 Example of a product velocity rule: where Order Value is the Tracking

Element for items whose Merchant SKUs contain 123 and the Threshold
is set to a minimum Item quantity of 5. This velocity rule is triggered each
time your order processing system receives orders for 6 items whose
Merchant SKU contains “123” in orders of a specific value such as 800
Dollars or 800 Rubles.
Decision Manager calculates Order Value as follows:

 If offer lines are present in the request, it uses the subtotal of the offer
lines.
 If offer lines are not present, it uses the grand total amount that is present
in the request.
Apply To
Choose the type of orders that the velocity rule should count: orders under review,
accepted orders, rejected orders, and/or failed authorizations. You must choose at least
one. When an order under review is accepted or rejected, the counts are updated to
reflect it.
If you choose Failed Authorizations, Decision Manager will count velocity only if
Authorization ran and received a decline. If Authorization doesn't run or is approved on a
transaction, it won't be counted against velocity rules.
Time Interval
Choose the time interval that you want to allow between purchases. The time interval can
be as short as a minute or as long as 180 days. Options include a calendar period or
custom period. With the custom period, you can specify a period of time and also exclude
days.

Chapter 6 Velocity
For example, you may wish to create a rule going back 90 days to 180 days.
 In the Track back in the past dialog box, enter 180.

 In the Exclude most recent dialog box, enter 90.
When you modify the time interval for a rule, be aware of the implications: you need to
allow a number of items that is proportional to the interval that you choose if you want to
detect the same relative number of fraudulent attempts.
For example, your initial interval (24 hours) has a threshold of 6 items. If you want to
reduce the interval to 8 hours:
 To keep the same ratio of interval to items (4:1), reduce the threshold to 2 items.
 If the risk of fraud is lower, increase the threshold to 3 items.
 If the risk of fraud is higher, decrease the threshold to 1 item.
Threshold
This setting, which depends on your business practices, combines the time interval and
tracking elements specific to a customer identity.
Counts and Values

You must choose to monitor either the number or the monetary value of orders or items.
The figure below shows the Threshold section of the Order Velocity Editor window.
Figure 88 Velocity Threshold: Counts and Values
By default, the currency that appears in the menus is your local currency. You can change
the currency of velocity rules as needed.
 Order count or item quantity
Minimum number of orders or items that you want to allow. For example, if your
threshold is 4, the fifth order by the same customer triggers the rule indicating possible
risk. The minimum value is 1.
The minimum order value (order velocity) or offer-line subtotal (product velocity) and
currency are optional. If you enter a value, orders that exceed this value are
evaluated. For example, you may accept unlimited small orders from a specific
customer, such as 50 USD, but you want to limit the number of orders greater than
200 USD from the same customer. In this case, enter 200 USD.

Chapter 6 Velocity
 Order value or item value

Minimum monetary amount that you want to allow for each order or product group.
Order value refers to the subtotal for the order. For example, if your threshold is 100
USD, 101 USD is considered risky. The amount is cumulative for all orders that fit the
parameters of the rule. For example, if your threshold is 500 USD, all orders from a
customer are added until the threshold is reached. The order that exceeds the
threshold is considered risky.
Orders and Currencies

Choose whether to use this rule for all orders (Orders in all currencies) or only for those in
the currency that you selected above (default option). Orders in currencies other than the
chosen currency are converted to your chosen currency.
Figure 89 Velocity Threshold: Currency
Morphing
If desired, choose up to five morphing elements from the drop-down list.
For example, to track the number of different email addresses received for transactions
while other tracking elements (account number, shipping address, and customer’s IP
address) remain the same:
 Choose Account number, Shipping address, and Customer’s IP address as the

tracking elements.
 Choose Email address as the morphing element.
You cannot choose an item as a morphing element if you have already

chosen it as a tracking element.
Note
Decision Manager returns a morphing count when the values of the tracking elements are
the same for multiple transactions, but the morphing element value changes. You can use
this value when building custom rules. See "Multiple Tracking Elements and Morphing
Element" for further details.

Chapter 6 Velocity
When done, click Save if you are creating a rule, or click Apply if you are modifying a rule.
Your rule appears in the appropriate tab of the velocity rule list (Order Velocity or Product
Velocity) with the info code assigned by Decision Manager.
Deleting Velocity Rules

You can delete any rule in the summary table and in the rule editor:
 In the summary table, check the boxes for the rules that you want to delete, and click
Delete at the bottom of the table.
 In the rule editor, click the Delete button at the top of the window.
When you delete a velocity rule created with an information code, the
corresponding information code is also deleted. As a result, custom rules
Important created with the code no longer function. Be sure to modify or delete these
custom rules immediately.

Chapter 6 Velocity
Sample Velocity Rules

Your goal is to evaluate the purchasing habits of your customers to prevent excessive
purchases and fraud. To obtain a library of rules that covers the scope of your business,
always consider the parameters as a group, and when creating rules, vary the
parameters.
You can create velocity rules to count all orders matching several tracking elements and
set a minimum number of orders during a specific period of time. When the limit is
exceeded, the velocity rule is triggered.
In this sample rule, the time interval (30 days) and the tracking elements (account number,
email address, and shipping address) remain constant.
Table 16 Rules Creation Example

Rule name Minimum number of orders
Tracking Elements  Account number
 Email address
 Shipping address
Order Subtotal Threshold -
Time Interval 30 days
Threshold Order quantity = 5

Chapter 6 Velocity
The following figure shows the rule creation in the Order Velocity Editor.
Figure 90 Velocity Editor: Rule Example
When done, click Save. This rule is triggered if more than five orders matching the
account number, email address, and shipping address are placed within a 30-day interval.

Chapter 6 Velocity
The following examples show how you can combine the available options to create a
comprehensive set of velocity rules:
Table 17 Examples of Velocity Rules

Generated card numbers used to place "Minimum Number of Orders or Products"
repeated orders
Repeated large orders "Minimum Order Subtotal with Item Value
Threshold"
"Minimum Order Subtotal and Cumulative Order
Value"
Orders with many single items of high value "Restricted Number of High-End Purchases"
Repeated orders with many card numbers "Combined Minimum Amount and Numbers of
used for goods shipped to the same address Orders or Items"
Orders in which one tracking element value "Multiple Tracking Elements and Morphing
changes while the others stay constant. Element"
Orders with custom field or custom list data "Custom Data"
Minimum Number of Orders or Products

You want to count all orders or products triggered and to set a minimum number of orders
or products that you use to decide whether to review or reject certain orders. When the
number is exceeded, the velocity rule is triggered. To count specific products, you use
SKUs. You create order and product velocity rules as follows.
Order Velocity Rule to allow a minimum of 2 orders from the same email address within an
interval of 20 minutes. In the velocity rule editor, enter the information as follows:
Table 18 Order Velocity Rule Example

Rule name Repeated Email Address
Tracking Element Email address
Time Interval 20 minutes
Threshold Order count = 2
When done, click Save. Your rule is added to the bottom of the Order Velocity table in the
Velocity window. With this rule, every time that you receive more than two orders from the
same email address in 0–20 minutes, the new order is counted and marked for review or
rejection.

Chapter 6 Velocity
Product Velocity Rule to allow a minimum of three items from the custom list placed with
the same account number within an interval of 12 hours.
Table 19 Product Velocity Rule Example

Rule name Number of cell phones
Product Information (optional) Merchant SKU, product code or product name
Custom List Cell Phone
Tracking Element Account number
Order Subtotal -
Threshold
Time Interval 12 hours
Threshold Item quantity = 3
When done, click Save. Your rule is added to the bottom of the Product Velocity table in
the Velocity window. With this rule, every time that you receive an order that contains more
than three items placed with the same account number in 0–12 hours, the new order is
counted and marked for review or rejection.
Minimum Order Subtotal with Item Value Threshold

You want to control the number of large orders and the value of the orders shipped to your
customers. You create a product velocity rule to evaluate cell phone orders placed within a
time interval of 0–12 hours that are associated with a specific account number as follows:
 For orders with a subtotal value up to 200 USD, you want to automatically allow these
orders regardless of the number of items or their value.
 For orders with a subtotal value of more than 200 USD, you want to allow the value of
the cell phones to be equal to or less than 100 USD.
The Order Value check box activates the rule: if you check the box and
enter an amount, orders are evaluated if their subtotal is higher than your
Important threshold.
Table 20 Order Velocity Rule with Item Value Threshold

Rule name Order Limit with Item Value
Product Information (optional) Merchant SKU, product code or product name
Custom List Cell Phone
Tracking Element Account number
Order Subtotal Threshold 200 USD
Time Interval 12 hours
Threshold Item value = 100 USD

Chapter 6 Velocity
When done, click Save. All orders above 200 USD are evaluated, and cell phone orders
above 100 USD are counted for the rule if they are placed with the same account number
within 0–12 hours.
You can vary this rule slightly by selecting item quantity instead of item value, such as a
minimum of 2 cell phones orders placed with the same account number within 0–12 hours
for orders above 200 USD.
Minimum Order Subtotal and Cumulative Order Value

You want to control the number of large orders and the value of the orders shipped to your
customer. This example shows how you can use the two threshold options toward slightly
different goals: to evaluate a customer who places five orders of decreasing value: $500,
$400, $300, $250, and $100.
 Order Subtotal Threshold Only: You want to evaluate orders with a subtotal more
than a certain amount of money, for example $200. In this case, the first four orders
are counted, but the last one is ignored regardless of the other settings in the rule.
 Threshold Only: You want to keep track of the total monetary value of orders placed
by your customer. This customer placed five orders totalling $1,550. If you set the
minimum value of your rule at $1,400, the rule is triggered by the last two orders.
 Both Threshold Options: By using the same sample values as above, only the fourth
order (250 USD) is evaluated because it is higher than the combined 200 USD
threshold and the minimum cumulative value of 1400 USD.
Restricted Number of High-End Purchases

You want to limit the number or value of high value orders or exclusive products that are
sent to a specific address. When the number or value is exceeded, the velocity rule is
triggered. Because SKUs are specific, you can easily restrict certain items but not others.
You create order and product velocity rules as follows.
Order Velocity Rule to limit the value of orders with exclusive items shipped to the same
address every four months:
Table 21 Order Velocity Rule that Limits Value of Exclusive Products

Rule name High End Items
Tracking Element Shipping address
Order Subtotal Threshold (optional) If you are concerned that other
expensive items may be shipped to the same
address, enter a value, such as 2000 USD.
Threshold Order value = 3000 USD

Chapter 6 Velocity
With this rule, orders with a value less than 2000 USD are ignored, orders above 2000
USD are counted, and orders above 3000 USD are marked for review.
Product Velocity Rule to allow a minimum of one item for each address within an interval
of 120 days regardless of the value of the order.
Table 22 Product Velocity Rule that Limits Number of Items to Addresses

Rule name Plasma TV
Product Information (optional) Merchant SKU, product code or product
name
Custom List Plasma TV
Tracking Element Shipping Address
Threshold Item Quantity = 1
Combined Minimum Amount and Numbers of Orders or

Items
You want to limit the content and/or value of orders sent to the same address during a
specific period of time. To do so, you can limit the total monetary value of the orders, the
number of orders, and the number or value of specific items in the orders. When a limit is
exceeded, the velocity rule is triggered.
In these sample rules, the time interval (21 days) and the tracking element (shipping
address) remain constant so that you can use the three rules together for minimum
detection capability. As a result, you are able to detect whether the same or several
customer identities are placing the orders.
Table 23 Order Velocity Rule Based on Orders Total Monetary Value

Rule name Minimum order value
Threshold Order value = 100 USD

Chapter 6 Velocity
Orders with a value less than 100 USD are ignored whereas orders equal to or more than
100 USD sent to the same address are counted towards the minimum number allowed
within the 21-day interval.
Table 24 Order Velocity Rule Based on Minimum Number of Orders

Rule name Minimum number of orders
This rule is triggered if more than one order is shipped to the same address within the 21-
day interval.
Example Product Velocity Rule Based on Minimum Number of Specific Items
Rule name Minimum number of items

name
Custom List Digital cameras
Tracking Element Shipping Address
This rule is triggered if more than one digital camera is shipped to the same address within
the 21-day interval.

Chapter 6 Velocity
Multiple Tracking Elements and Morphing Element

In this sample rule, you want to track more than two orders from the same email address
and IP address for 30 days, and note the number of different shipping addresses the
orders contain.
Table 25 Order Velocity Rule Using Morphing Element

Rule name Morphing element - shipping address
Tracking Elements  Email address
 IP address
Time Interval Calendar period - Month to Date
Morphing Element Shipping address
This rule is triggered when you receive two or more orders with the same email and IP
address in 30 days. Once these orders have different shipping addresses, you also
receive the morphing count. Decision Manager returns the morphing count when it counts
two orders with different values. Even if the rule does not trigger, Decision Manager
returns the morphing count once it is greater than one.
For example, Decision Manager receives three transactions that match the selected
elements. The second transaction has a different shipping address than the first
transaction, and the third transaction has yet another shipping address. Decision Manager
returns the morphing count as 3.
To use the morphing count, create a rule with a condition that uses the morphing element.
The Velocity Morphing Count is available in the Rule Editor drop-down menu as shown in
the following figure.
Figure 91 Rule Editor: Using Morphing Count Example

Chapter 6 Velocity
Custom Data
You can create velocity rules with custom data if you have already created custom fields.
These rules are triggered if more than one order containing the specific item or date is
shipped to the same address within the 21-day interval.
Table 26 Order Velocity Rule Based on Specific Order Elements

Rule name Specific element
Tracking Element Custom field, such as a specific item or date
Table 27 Product Velocity Rule Based on Specific Order Elements

Rule name Specific element
name
Custom List Digital cameras
Tracking Element Custom field, such as a specific item or date

CHAPTER
Case Management
7
This chapter describes how to use the Case Management features of Decision Manager
to find and review orders.
Searching for Orders

To ensure that you have assigned to your reviewers all the permissions that they might
need to perform all the possible case management tasks, see "Assigning Reviewer
Options," page 56.
To start the order review process, go to Decision Manager > Case Management > Case
Search. To find the case with the highest priority, use one of several pre-determined
searches, or select a specific combination of parameters to appear in the search results.

Chapter 7 Case Management
Take Next Case Option

This feature requires Order Conversion permission. Click Take Next Case to find the next
case marked for review that has the highest priority and is not assigned to another
reviewer. Pending orders that are not assigned to a reviewer are ordered by (1) priority
according to the triggered rules for which a priority level was set and (2) age in the queue.
When you click this link, you are automatically given ownership of the order
selected.
Note
This option only shows cases marked for review despite the presence of higher priority
rejected cases. For example, if you have a case with priority 2 marked for review and a
case with priority 1 rejected by the profile, the case marked for review appears even
though the rejected case has a higher priority.
Quick Search Links

These links enable you to find the most common groups of orders. You can create and
delete your own search options. Each search option is case sensitive and searches
through the orders of all merchants in all queues for the previous six months. The
following quick searches are included by default:
 Mine and unassigned: All pending orders assigned to you in all the queues and those
that are not assigned to a reviewer in queues assigned to you.
 Orders assigned to others: All pending orders assigned to other reviewers.
 Orders owned by me: All pending orders assigned to you.
 Orders not assigned: All pending orders that are not assigned to a reviewer. If you do
not have permission to take orders that belong to other reviewers, you can use this
link to quickly find the orders available to you.
 Complete list: All orders in all queues regardless of assignment.

Search Parameters
If you specify your own search criteria in the Search Parameters pane, a maximum of
2000 orders is returned in search results. Use the drop-down menus to specify your
search criteria. Start by selecting a tab: Multiple criteria, Field and value, or Profile/rule
result.
Multiple Criteria Tab

This tab provides a way to specify generic search criteria. You can search for orders by
specifying the order status, ownership, queues, priority, or transaction date in this area of
the Search Parameters pane. You can specify values in all fields or just one or two. Each
field is explained in the following sections.
Current Status
This drop-down list contains all types of order statuses regardless of date, ownership,
priority, or queue.
Searches for resolved orders are based on the conversion date; all other
searches are based on the transaction date.
Important
Review All pending orders that are marked for review by an order profile. Use
this option to find only the orders that have a reviewing time limit.
All queued All pending orders in all queues. These orders have not been resolved.
This option combines the orders that were marked for review or rejected
by a profile.

All resolved All orders that have been accepted or rejected by a reviewer and orders
that were automatically resolved by the system after the reviewing time
limit passed. When you select this option, the Queue drop-down list
becomes grayed out because resolved orders are no longer in any of the
queues.
Marked as suspect All orders that were marked suspect and chargebacks. When you select
this option, all other drop-down menus are disabled, except Transaction
Date.
Accepted by profile All orders that were automatically accepted when initially screened by
the profile. All other options, which apply only to orders in review or
rejected, are disabled. Although these orders are resolved, you can still
add notes to them in the search results window.
Accepted by reviewer All orders accepted by a reviewer. When you select this option, the
Queue option becomes grayed out because orders that have been
accepted by a reviewer are no longer in any of the queues.
Accepted by system All orders accepted automatically after the reviewing time limit passed.
Orders that were accepted by a profile are excluded. When you select
this option, the Queue option is grayed out.
Rejected by profile All orders that were rejected when screened by a profile.
Rejected by reviewer All orders that were rejected by a reviewer.
Rejected by system All orders rejected automatically after the reviewing time limit passed.
Orders that were rejected by a profile are excluded.
Merchant (Account Administrators Only)

This option does not appear if your account contains only one merchant. The value
specified for this field directly affects what is available in the Order Ownership drop-down
list.
Order Ownership
This drop-down list enables you to search for orders based on ownership, such as orders
that belong to all reviewers or that are not assigned. The list contains five predefined
options and a list of specific users (reviewers) unique to your account in the Business
Center. The user who is currently logged in is the default owner.

The Order Ownership list pre-defined options include the following:
All orders All pending orders whether or not they are assigned to a
reviewer. This option is the sum of All reviewers and Orders not
assigned.
All reviewers All pending orders assigned to all reviewers, including the Managed Risk
reviewers if you are signed up for this service.
Orders not assigned All pending orders that are not assigned to a reviewer.
Mine and unassigned All pending orders that are assigned to the user who is currently logged
in and all pending orders that are not assigned to a reviewer.
Orders assigned to All pending orders assigned to other reviewers, including the
others Managed Risk reviewers.
Queue
Use the Queue drop-down list to search specific queues or to include all queues in your
search. The list contains two pre-defined options and all of the queues that are owned by
the user who is currently logged in. If you are an administrator, all the queues are listed.
The pre-defined options for the Queue list include the following:
All queues All queues are searched regardless of whether the user specified
for Order Ownership has access to all of them.
All assigned queues If you selected a specific user in the Order Ownership field, only
the queues to which the user is assigned are searched. However,
if you chose All Reviewers or Orders not assigned in the above
menu, the search includes all queues because the reviewers may
not be assigned to the same queues.

Priority Range
Priority levels range from 1 (high) to 5 (low). Whether you select from 1-5 or 5-1, the
search results are identical. To search for only one priority level, select the same number
in both drop-down lists. The priority level of each order appears in the search results
window and the case details window.
Transaction Date/Conversion Date

Depending on your choice in the Current Status menu, either the date of the order or of the
conversion appear:
 Transaction date for all orders that have not been reviewed or were rejected by the
profile: All queued, Review, or Reject.
 Conversion date for all orders that have been resolved: All resolved, Rejected by
reviewer, or Accepted by reviewer.
You can search for orders based on several predefined criteria, or a custom range that you
define. The search results include orders requested between midnight on the start date
and 11:59 p.m. on the end date. If you select a custom range, a special date and time
menu appears:
 To open the calendar, click the calendar icon and select the dates that you want by
dragging your mouse over the days and the controls at the top.
 To close the calendar, click outside of the calendar or the X at the top right of the
calendar.

Field and Value Tab

If you check this option, you can search for the following specific values; however, you
cannot export these search results.
 account number  account suffix (last 4 digits)

 billing phone number  CPF/CNPJ (Brazilian
identification numbers)
 custom fields (1-100 merchant-defined data  customer account ID
fields)
 customer first and last names  customer IP address
 email address  order number
 request ID  shipping phone number
 true IP address
For the request ID, the date menu is disabled because the range is always the last six
months; for all other options, you can specify any date range.
For information about specifying a date range, see the previous section, "Transaction
Date/Conversion Date," page 198.
Profile/Rule Result Tab

Use these search options to search for orders based on the profile or rule evaluation
results. You can export the search results as XML or you can save search criteria as a
Quick Search.

Profile Mode
Use the Profile Mode drop-down list to narrow your search results to either Active or
Passive profiles. Active profiles affect the outcome of orders, causing them to be
accepted, reviewed, or rejected. Passive profiles evaluate every order and are used to
create reports, but they do not affect the outcome of orders.
Profile
You can select to include all profiles in your search by selecting Any, or you can narrow
your search results by selecting a specific profile from the drop-down list.
Rule
The Rule option works like the Profile option. You can include all rules in your search by
selecting Any, or you can narrow your search results by selecting a specific rule from the
drop-down list.
Outcome
Use the Outcome options to search on specific results of the specified profiles and rules.
If Any is selected for Rule, select from the following options:
All transactions All orders that meet the other search criteria are returned in
search results.
Non-Force Accepted Returns orders that triggered no reject or review rules contained
in the specified profiles and were accepted by the specified
profiles.
Force Accepted Returns orders that triggered explicit “accept” rules.
Profile Rejected Returns orders that triggered “reject” rules for the specified profile.
Profile Review Returns orders that were marked for review by rules contained in the
specified profile.
All Accepted Returns all orders that were accepted for settlement, including Non-
Force Accepted orders and Force Accepted orders.
All Rejected Returns all orders that triggered “reject” rules or that were rejected by a
reviewer.
Marked As Suspect Returns all orders that were marked as suspect as a result of the order
review process, or because of a chargeback. These orders are
confirmed or suspected as fraudulent.

If a rule is specified, select from the following options:
Accept Returns orders that were accepted as a result of triggering the

specified rule.
Monitor Returns orders that are being monitored as a result of triggering
the specified rule. The triggered rules is set to Monitor in the
profile.
Reject Returns orders that were rejected as a result of triggering the
specified rule.
Review Returns orders that were marked for review as a result of triggering the
specified rule.
Reviewer/System Returns orders that triggered the specified rule and were accepted for
Accepted settlement as a result of reviewer acceptance or the service-level
agreement (SLA) process.
Reviewer/System Returns orders that triggered the specified rule and were rejected as a
Rejected result of being rejected by a reviewer or the SLA process.
Marked As Suspect Returns orders that triggered the specified rule and were marked as
suspect. These orders are confirmed or suspected as fraudulent.
If you select No Rules Triggered for the Rule field, only Non-Force Accepted and
Marked As Suspect appear in the Outcome drop-down list.
Transaction Date
You can search for orders based on several predefined criteria, or a custom range that you
define. For more information about specifying a custom range, see "Transaction Date/
Conversion Date," page 198.

Reviewing the Search Results

Your search results provides basic information about up to 2000 orders. The information
and options that you can view and use in this window depend on your permissions and on
your search criteria.
If your search criteria returns only one order, the case details window appears instead of
the search results window.
Search Parameters
Your search parameters, including the number of transactions that your search returned,
are listed above the results table so that you can verify immediately that you have what
you need.

Queue Table
The results window provides global information about the order queues.
The table lists the queues to which you have access with the number of orders in each
queue for the past six months according to your search parameters. The numbers do not
refer to the date and time interval of your search. Each queue name is a link to the entire
content of that queue. The two sets of columns provide detailed information about your
search and the contents of the queues:
 Search columns: number of orders in the queues according to your search
parameters. The Search columns appear only if your search criteria include orders
currently in queues.
 Search columns: number of orders in the queues according to your search
parameters.
 System columns: number of orders in all queues for the past six months.
 Review columns: number of orders marked for review by the profile.
 Reject columns: number of orders rejected by the profile.
If your search criteria contain orders that are no longer in a queue, such as orders that
have been resolved, marked as suspect, or accepted, only the System columns appear:
 In the Case Search, you chose one of these Current Status menu options: All
resolved, Marked as suspect, or Accepted (by profile, reviewer, or system).
 In the Performance Statistics search, you clicked one of these links in the tables:
Accepted (by reviewer or time limit [system]), Rejected (by time limit [system]), or
Marked as suspect.

Results Table
To take advantage of these options, make sure that cookies are enabled for your browser.
Customizing the Columns

You can customize the appearance of the table by manipulating the columns to best suit
your reviewing needs. The Business Center retains all your settings. You can change your
settings at any time.
 Width: When you click the edge between two columns, a double arrow appears
(indicate by red arrows below). Move the edge right or left to widen or shorten. In this
figure, the Owner column is wider below whereas the Queue column is narrower.
If you make a column narrower than its content, in this case the Queue column, the
content can be viewed by hovering the cursor over the field (in red).
 Location: Click-hold a column heading. When you do so, a double arrow appears.
Drag the column right or left to the desired location within the table. For example, in
this figure, the Queue column, which is on the right in the top section, is moved to the
left of the Priority column.

 Adding or removing: When you click the Settings link on the far right, a menu appears
with the name of all available columns. Check the columns that you want to view, and
un-check those that you do not need. When done, click Update. You can use the
same menu to restore the default settings.
This table, sorted by type of data, summarizes the order information:
Table 28 Case Search Results Column Settings
Type of Data Column Description

Customer Billing Country Country of the customer.
Customer ID Customer’s account ID, tracking number, or other unique number that you
assigned to the customer.
Email Customer’s email address, including the full domain name.
Name Customer’s first and last name.
Shipping Country Country where the product is shipped.

Table 28 Case Search Results Column Settings (Continued)

Order Content Custom Fields Fields where you stored optional information. The column heading appears
as MDD if you have not defined a name for the merchant-defined data
fields.
IP Address Customer’s IP address.
IP Country Name of the country decoded from the IP address used directly or indirectly
by the customer to send the order.
Merchant ID Your CyberSource merchant ID.
Shipping Method Shipping method for the product.
Order Number Merchant-generated order reference or tracking number (same as
merchant reference number). The Order Number is a link to the details of
the transaction.
Transaction Date Date when the customer placed the order.
Device Unique ID of the computer used by the customer to place the order.
Fingerprint
Smart ID Device identifier generated from attributes collected during profiling.
Payment Amount Amount of the authorization, not the price of each item.
Account Suffix Last four digits of the account number.
BIN Country Two-digit country code associated with the BIN of the payment card used by
the customer.
Currency Currency used for the order.


Order Review Conversion Date Date when the order was accepted or rejected by a reviewer or when the
time limit expired.
Expiration Info Information about orders in queues where a reviewing time limit has been
set.
Note The column does not appear if you searched only for resolved cases
or for orders that were rejected by the profile. If your search criteria
comprised orders to review and rejected orders, time limit information
appears only for orders to review. Otherwise, the cells are empty.
You can view the action that is performed automatically if time runs out. For
example, Accept After: Apr 11 2008 05:57:53 PM means
that the order is accepted after the date and time stated. For orders that
were accepted or rejected, the fields are empty. This column can contain
one of these values:
 Accept or Accept and Settle: Accept After: <date and time>
 Reject: Reject After: <date and time>
 Accept or Accept and Settle but time limit disabled for specific case:
Accept After: Disabled
 Reject but time limit disabled for specific case: Reject After:
Disabled
 Time limit not enabled: No time limit
Marked as Reason for having added the customer data to the negative list:
Suspect
 Creditback: you issued a refund to the customer to avoid a chargeback.
 Fraud chargeback: chargeback received with a fraud chargeback code
 Non-fraud chargeback: chargeback received for other reasons, such as
item not received
 Suspected: chargeback likely to happen
Owner Account and the merchant IDs in the format <account>:<merchant ID>.
For orders that are resolved automatically after the reviewing time allowed
passes, CYBS:sla appears. For orders that are owned by an internal or
managed risk reviewer, the owner is listed as CYBS. CYBS appears in
exported search results.
Priority Priority level in the review process.
Queue Queue where orders marked for review or rejected are placed.
Score Fraud score given to the order
Status Current status for each order, such as Review, Accepted by profile, or
Rejected by reviewer.


Travel Complete Route Concatenation of individual travel legs.
Time to Appears for all merchants regardless of industry or product line. For travel-
Departure related orders, this column contains the length of time until departure, in the
format hours:minutes, if the departure time was submitted with the order.
Because the value is absolute, you do not need to convert it to your time
zone. Time amounts of up to 9999 hours (416.625 days) and 45 minutes
appear. For example, a departure time of six months and 30 minutes
appears as 4032:30. If the departure time passed, the value is Departed.
Because this field is dynamic, the number decreases if you refresh the
window. By clicking the column heading, you can sort orders as follows:
earlier, later, departed, and orders without airline data.
If you want to view this data in your search results, request that your
development team includes the information in the API request.
 Sorting order: When you click the heading of a column, a small triangle appears in the
top right corner of the heading (in red below). The triangle indicates whether the
sorting order is ascending (pointed upward) or descending (pointed downward). You
can sort only one column at a time; when you sort a second column, the sorting order
of the first column disappears. In this example, the data is sorted in ascending order.
The following table describes the sorting order of the columns:
Column Sort Order

Dates Ascending starts with the oldest date at the bottom.
Text Alphabetically; ascending starts with uppercase followed by lowercase.
Custom columns Status: alphabetically.
Expiration Info: ascending starts with Accept After: (date and time) <
Reject After: (date and time) < Accept After: Disabled < Reject After:
Disabled < No time limit.
Time to Departure: ascending starts with Nearest time to departure <
later times to departure < departed < orders without airline data.
Order number Ascending starts with numbers < uppercase letters < lowercase letters at
the bottom.
Number columns Ascending starts with the lowest at the bottom.

Resetting the Layout

After you have customized the results table to your needs, your settings remain, but you
can restore the default values any time. To do so, right-click anywhere in the table, click
Settings, and in the Column Settings dialog box, click Restore Default Settings. You can
also use the Settings link above the table on the right side to launch the Column Settings
dialog box.
Finding Information
Use these common options.
Search results that you have narrowed are not retained if you open a case
in the same browser window. To retain these results, open the case in
Note another tab.
 Narrowing search results: Use the row of fields below the column headings. These
filters enable you to search for specific letters or numbers in the columns. When
screening data in multiple columns, you can screen each column in any order.
 Columns with text: The fields are not case sensitive. You can search for data that
contains specific letters.
Example 1
To find a customer named Aljohn, you can start typing jo... The names that do not
contain these letters are removed from the table; only customers whose name
contains the consecutive letters jo (Aljohn, Jones, Johnson, etc) remain. As you
continue typing, the number of lines in the table is further reduced until only the
customers named Aljohn remain.

Example 2
Assume you are interested in finding all orders placed on October 12 that contain
the test@test.com email address. Your initial search returns 32 orders. Enter oct
12 in the Transaction Date field and enter test in the Email field to
eliminate all orders that do not meet your criteria:
 Columns with numbers: For the Priority, Amount, and Score columns, narrow your
search results as follows:
To find orders with this value… Enter…

Specific value (N) = N
Value greater than N > N
Value lower than N < N
Value greater than or equal to N >= N
Value lower than or equal to N <= N
Value within a range N1..N3
Example 3
To find all orders with priority equal to 3, enter this: = 3

Example 4
A search returned 385 orders. You want to find only the orders with a score less
than 20 and an amount between 10.00 and 20.00.
1. In the first figure, the data are randomly distributed.
2. In the second figure, after entering < 20, only orders with scores below 20
remain in the table.
3. In the third figure, after entering 10 .. 20 in the amount field, only amounts in
that range remain in the table.
As a result, of the 385 orders returned originally by the search, only 7 orders
meet your criteria.
 Accessing case details: Although the order number is a link to the details of the order,
you can reach the order also by using one of these methods:
 Right-click a row anywhere and select one of these options. The first two apply to
a single case whereas the last option apply only if you selected multiple rows:
- Open Case
- Open Case in New Tab
- Open Selected in New Tab(s)
The context-sensitive menu applies to the first order, which is highlighted:
 Select a row and press Enter.
 Double-click a row.
To make the menu disappear, click anywhere outside the menu. You can select as
many cases as you want, but you can open a maximum of 15 cases at once.

Managing Orders in the Case Management Search

Results Window
This section describes the order information available in the Case Management Search
Results table and the actions that you can perform on one or more orders, depending on
your permissions.
Available Order Review Actions

All actions that you can perform to manage orders are located above the table. When
performing an action on several orders, the action may succeed for some orders and fail
for others, depending on the required permissions and the status of the orders. After you
perform an action on several orders, a results window appears with a summary of your
changes and the option to export them to an XML file described on page 216.
Actions that apply to the search results

These options are not specific to any order:
Take Next Case
Find the next oldest case marked for review that is not assigned to another
reviewer. Cases are ordered by (1) priority according to the triggered rules for
which a priority level was set and (2) age in the queue. When you click this
link, you are automatically given ownership of the order selected.
This option returns only cases marked for review even if the priority of
rejected cases is higher. For example, if you have a case with priority 2
marked for review and a case with priority 1 rejected by the profile. Although
the rejected case has a higher priority, the case marked for review appears
when you click Take Next Case. This link is visible only to reviewers who
have the Order Conversion permission.
Select All
Select all the orders returned by your search. If you have narrowed your
search results to a specific set of orders, this button selects only these
orders. All selected orders are highlighted in blue. The process takes a few
seconds if your search returned a large number of orders. You can perform
all available actions on the selected orders, depending on your permissions.
Refresh Re-execute the same search to find out if, since your last search, new
queues have been activated, new orders have been marked for review or
rejected (depending on your initial search criteria), or orders have
automatically accepted or rejected after the reviewing time limit.

Actions that apply to orders

These options apply to the selected orders:
Take Ownership
For administrators and for reviewers who have the Queue Search, Order
Conversion, and Unrestricted Order Review permissions. When taking
ownership of orders, you cannot exceed the limit set for you by your
administrator. When you click the button, a verification message appears.
After you accept your changes, a results window appears with a summary of
your changes.
Accept & Reject Accept or reject all at once the selected orders. To accept rejected orders,
you must have the Order Conversion and the Rejected Order Conversion
permissions. When you click these buttons, a window opens so that you can
select a reason and optionally enter a comment. Depending on your
permissions, you may be able to process card, check, and direct debit
payments for the complete original amount. For more information, see
"Notes," page 244, and "Completing the Review Process," page 252.
Assign Give one or more pending orders to another reviewer. The administrator can
exceed the maximum number of orders that a reviewer can own and can
assign an order to a reviewer who does not have the permission to review
and convert orders.
Move Move orders to any queue listed in the menu.
Important When you move an order to another queue, that order inherits
the new queue's reviewing time limit but keeps its original time until
expiration. If the new limit is shorter, the order could be accepted or rejected
immediately, depending on the queue setting. To avoid this issue, before
moving an order, reset its arrival time in the queue to the current time. When
you move a group of orders from queues that have different time limits, these
orders are affected differently.
Release Take one or more pending orders away from any reviewer, including yourself.
Ownership After you submit your changes, these orders are no longer assigned to a
reviewer.
Change Priority Change the priority of one or more orders.

Reset Time Limit Reset to the current date and time the start of the reviewing time allowed for
the selected orders. Only orders to review can be reset whether or not they
are in a queue without a time limit. You should reset orders before enabling a
time limit for the queue or moving the orders to a queue with a different time
limit.
If you move an order from a queue without a reviewing time limit or to a
queue that has a different (shorter or longer) time limit than the original
queue, the order takes the time limit of the new queue. If you move the order
to a queue that has a short expiration time, time may run out immediately. To
avoid this issue, before moving an order, reset its arrival time in the queue to
the current time.
Example Two hours ago, an order was placed in a queue with a time limit
of 10 hours. The customer contacts you to request express shipping instead
of standard shipping. To review the order quickly, you need to move the order
to the Express Shipping queue, which has a time limit of one hour and is set
to accept orders automatically.
If you move the order now, it is accepted immediately because it has already
been in a queue for two hours. Therefore, you need to reset the date and
time of the order to the current time. If you do so, the reviewer has one hour
to review and resolve the order.
Add Note All actions that you perform are logged in the notes for the order. You can
view these notes in the details window. Add comments to selected orders,
regardless of their status.
Mark as Suspect Add order information to the negative list for selected transactions. By
default, the customer’s email address, shipping address, and credit card
account number are added to the negative list. To change the list of marked
fields, contact your Customer Support representative.
Clear Mark as Remove order information from the negative list for a selected transaction
Suspect when you confirm that it was not fraudulent. Removes all data fields that
were added when the order was marked as suspect.
Visualize To visualize relationships between orders, select the orders that you want to
analyze, and click Visualize. For more information, see "Visualizing Case
Search Results," page 217.

Downloading Results
You can download the results of your search in two reports. Both are described in the
Decision Manager Reporting Guide (PDF | HTML).
Search Results
To download the Case Management Detail report from the Case Search window, choose
Actions > Export all Search Result Data as XML.
The report combines all the case management information with most of the data from the
reply. You can use this option to customize a report to your needs. For example, if you
want statistics on the review time of your orders, export your custom search results, and
use a spreadsheet to subtract the transaction date from the conversion date. The result is
the review time.

Action Results
You obtain this report if you download the result of an action performed on a group of
orders in the search results window. For example, if you accept an order and process the
payment (card or direct debit), two entries appear in the report: one for accepting the order
and one for processing the payment as a follow-on action.
You have the option to export the report to an XML file, which you can view in the browser
or export as a file. CyberSource recommends that you save these XML reports to quickly
find failed conversion attempts.
Example Assigning Orders to Another User
In this figure, the user successfully assigned two orders to another user.

Visualizing Case Search Results

The Case Search Visualization window graphically represents the relationships between
selected orders. In the Case Management Search Results table, select the orders you
want to analyze and click Visualize. This launches the Case Search Visualization window
where you can analyze the relationships between order elements, view case details, reject
or accept orders, and mark them as suspect. For information about how to review order
details, see "Reviewing Orders," page 223.
The Case Search Visualization windows requires that you use an Internet
Explorer version 9 and later or a Firefox version 18 and later browser.
Note

Case Search Visualization Icons
Transaction or order for review Accepted transaction or order
Rejected transaction or order Transaction or order marked as suspect
Transaction or order that does not

Customer payment card
use Decision Manager.
Email address IP address
Shipping address Device fingerprint

Navigating the Case Search Visualization Window
To use the navigation panel in the upper left corner of the window:
 Click an arrow to scroll in the direction that the arrow points.

 Click the center circle to return to the original centered location
in the window.
 Click the arrow cursor icon to select icons in the window. To

select multiple icons, hold down your mouse button and drag it
over the icons you want to select. When you release the
mouse button, the icons are selected.
 Click the arrow cursor icon and it changes to a hand cursor
that you can use to grab the visualization window surface and
move around the window.
 Click the plus and minus signs at either end of the slider to
zoom in and out from the window.
To use the navigation controls in the lower right corner of the

window:
1 Click the arrow and your cursor changes into a hand icon.
2 Use the hand cursor to grab the miniature viewing window to scroll
around the visualization.

Exploring Relationships Between Orders

To enhance the visualization of order data, click a button at the bottom of the visualization
window:
Standard Layout This layout behaves like the transactions are connected by springs
with tension. It spreads the nodes apart and minimizes the number
of crossing links, making the visualization easier to read.
Radial Layout This layout arranges nodes in concentric circles around a selected
transaction, making it easier to determine how many links exist
between the selected transaction and other nodes in the window. It
is useful when the order data is highly connected. Select a
transaction as the center node before you click Radial Layout.
Hierarchy Layout This layout arranges nodes in a hierarchy under a selected
transaction. It is useful when the order data is hierarchical. Select a
transaction as the apex of the hierarchy before you click Hierarchy
Layout.
Structural Layout This layout groups similar transactions together, making it easier to
view what transactions have similar elements. For example, if all of
the transactions use the same payment card or email address.
Hide Single Transactions This option removes transactions that have no relationships with
other transactions from the window.
Viewing Case Details in the Case Search

Visualization Window
You can navigate directly to the Case Management Details window to view transaction
details and review cases.
To view case details:
Step 1 In the Case Search Visualization window, right-click a transaction to select it.
Step 2 On the menu, click one of the following options:

 Open Case
Navigates away from the visualization window and opens the case in the Case
Management Details window.
 Open Case in New Tab

Opens the case in the Case Management Details window in a different browser tab.
This option leaves the visualization window open, enabling you to view details for
multiple cases without navigating away from the visualization window.

Marking Orders as Suspect in the Case Search

Visualization Window
When you mark orders as suspect, it flags the order as fraudulent and adds the
customer’s email address, shipping address, and payment card account number to the
negative list by default. To change the list of fields that are added to the negative list,
contact your Customer Support representative.
To mark a single order as suspect:
Step 2 On the menu, choose Mark as Suspect.
Step 3 In the Transaction Marking Tool, enter Marking Notes.
Step 4 Click Submit. The Case Management Search Results window reappears with a success
message at the top.
To mark multiple orders as suspect:
Step 1 In the Case Search Visualization window, use of these methods to select multiple orders:
 Hold down the Shift key or the Ctrl key while you click the transactions that you want
to mark.
 Using the arrow cursor, hold down your mouse button and drag it over the orders that
you want to select. When you release the mouse button, the icons are selected.
Step 2 Right-click one of the selected transactions, and choose Mark as Suspect.
Step 3 In the Mark as Suspect dialog box, enter Marking Notes. The same marking notes are
applied to each transaction that you selected in Step 1.
Step 4 Click Mark as Suspect. The results appear in the Case Management Action Results
window where you can export the list of orders marked as suspect or return to the Case
Search Results window.

Rejecting Orders in the Case Search Visualization

Window
To reject a single order:
Step 2 On the menu, choose Reject.
Step 3 In the Reject dialog box, select a reason and enter a comment.
Step 4 (Optional) If appropriate, check Mark as Suspect to flag the order as fraudulent and add
the transaction information to the negative list.
Step 5 Click Reject. The Case Management Search Results window reappears with a success
message at the top.
If you checked Mark as Suspect in Step 4, the Transaction Marking Tool appears in which
you can center marking notes.
To reject multiple orders:
Step 1 In the Case Search Visualization window, use one of these methods to select multiple
orders:
 Hold down the Shift key or the Ctrl key while you click the transactions that you want
to reject.
 Using the arrow cursor, hold down your mouse button and drag it over the orders that
you want to select. When you release the mouse button, the icons are selected.
Step 2 Right-click one of the selected transactions, and choose Reject.
Step 3 In the Reject dialog box, select a reason and enter a comment. The same reason and
comment are applied to each transaction that you selected in Step 1.
Step 4 (Optional) If appropriate, check Mark as Suspect to flag the order as fraudulent and to
add the transaction information to the negative list.
Step 5 Click Reject. The results appear in the Case Management Action Results window where
you can export the list of rejected orders or return to the Case Search Results window.
If you checked Mark as Suspect in Step 4, a Mark as Suspect dialog box appears in
which you can enter marking notes. The same marking notes are applied to each
transaction that you selected in Step 1.

Reviewing Orders
How you evaluate an order depends on the type and amount of information that you have
about the order. For example, your business rules may require that you review orders with
only one or two score factors, a "Score" within an appropriate range, and host severity is
no greater than 3 (which would indicate high risk). Each details window is divided into
several sections.
To review an order, click the order number or double-click the row. To decide whether to
accept or reject the order, review the rules that were triggered, the fraud score, the
information codes, and the reason(s) for the fraud score.
Order Information
This section contains the basic information about the order. The fields described below
may not be present in all orders.
This section contains the reference information for the order:

 Your CyberSource merchant ID.
 The request ID. The link takes you to the transaction details window where you can
view additional information, such as the service(s) requested.
 Your order or reference number for the order (Merchant Ref No).
 The date and time of the transaction in your time zone.
 The customer's personal information, including the account ID if available.

IP Address
This section appears only if the information exists for the order. The IP address appears
only for valid customer addresses if you submit in the request the information from the
customer’s browser. Other types of IP addresses, such as internal network and multicast,
do not appear in the details window. With these results, you can attempt to verify whether
the customer is legitimate by considering how and where your customers place orders:
 From home by using their usual ISP. In this case, the IP address most likely matches
the billing address.
 Elsewhere by using one of these methods:
 Their usual ISP. In this case, the IP address is different from that associated with
the home address.
 Another ISP. In this case, you may need to take action, such as contacting the
customer, to verify that the order is legitimate.
 An anonymizing proxy or unregistered satellite connection. These orders are the
riskiest because you cannot match the customer’s billing information to the
decoded address information. Although honest customers may be using these
routing methods, fraudulent customers are more likely to do so.
The degree of risk associated with the routing method varies greatly depending on the
routing method and on the country of origin of the order. The same routing method can
have a different amount of risk in different regions. For example, Fixed has an average
level of risk because you should be able to correlate with a reasonable degree of certainty
the IP address with the rest of the customer’s information. On the other hand, Satellite is a
riskier method because the customer can be anywhere within the beam pattern of the
satellite.
The quality of the results depend to a certain degree on the data that you provide in the
request field. If the IP address is present, two lines of data appear in this format:
<IP address> | ARIN | RIPE
<routing method> | <decoded IP city>, <decoded IP state> <decoded IP
country>

IP Address Directly or Indirectly Used by the Customer

The IP address provides important information about the level of risk. The IP address is
compared with the city, state, and country from which the order originated. For example, if
the IP address does not match the customer's city, you receive the MM-IPBC information
code and possibly the factor code D (Risky IP or email address).
When the IP address is present, links for the Internet registries ARIN and RIPE also
appear. These links take you to databases where you can search for the precise location
and other information about the customer's computer. Each database supplies IP
addresses for specific regions of the world:
 ARIN (American Registry for Internet Numbers): North America, part of the Caribbean,
and sub-Saharan Africa.
 RIPE (Réseaux IP Européens Network Coordination Centre): Europe, Middle East,
and parts of Africa and Asia.
Routing Method
The routing method, if present, appears after the ARIN and RIPE links. Routing method
provides information about the customer's type of connection to the Internet and the
inherent risk associated with each method:
 Anonymizer: This value applies to IP addresses that are hidden because the customer
is extremely cautious, wants absolute privacy, or is fraudulent.
 AOL, AOL dialup, AOL POP, and AOL proxy: This value applies to AOL members. In
most cases, the country can be identified, but the state and city cannot.
 Cache proxy: The customer uses a proxy through either an Internet accelerator or a
content distribution service. The customer may be located in a country different from
that indicated by the IP address.
 Fixed: The IP address is near or at the same location as the user.
 International proxy: A proxy that contains traffic from multiple countries. The customer
may be located in a country different from that indicated by the IP address. In many
cases, corporate networks are routing the traffic from international offices through a
central point, often the corporate headquarters.
 Mobile gateway: A gateway to connect mobile devices to the public Internet. Many
mobile operators, especially in Europe, service more than one country and route
traffic through centralized network hubs. The customer may be located in a country
different from that indicated by the IP address.
 POP: The customer is dialing into a regional ISP most likely near the IP location but
possibly across geographical boundaries.
 Regional proxy: A proxy that contains traffic from multiple states within a single
country. The customer may be located in a state different from that indicated by the IP
address. In many cases, corporate networks are routing the traffic from regional
offices through a central point, often the corporate headquarters.

 Satellite: This value applies to satellite connections. If the uplink and the downlink are
registered, the routing method is considered standard because the sender is known.
However, if the downlink is not registered, the customer can be anywhere within the
beam pattern of the satellite, which may span a continent or more.
 SuperPOP: The customer is dialing into a multi-state or multi-national ISP that is not
likely near the IP location; the customer may be dialing across geographical
boundaries.
 No value: When the routing type is unknown, and the cost of using location
information incorrectly is low, you may want to treat empty fields as fixed connections.
Comparing IP Address Data to Customer-supplied Address Data

You need to compare the city, state, and country decoded from the IP address with that
provided by the customer. If the data matches, the customer's location is authenticated. If
the data does not match, the case details probably contain factor and/or information
codes.
Example 5 Average Risk Order
This order is marked for review because the billing address does not match the address
information decoded from the IP address. To attempt to convert the order into a sale, the
reviewer contacts the customer and finds out that, while traveling, the customer placed an
order from a computer in the country associated with the IP address. Because the routing
method used for the order is standard, the ISP is probably legitimate. You decide to accept
it.
Billing Information
Name John Smith
Address 670 Fairoaks Ave, Sunnyvale, CA, 94086 US
Phone Number 4082606108
Email Address jsmith@myemail.com
IP Address 202.67.64.1
IP Address Information
Country au
State new south wales
City lismore
Routing Method standard
Factor Definitions I - Internet inconsistencies
Reply Message Review
Example 6 High Risk Order
You received an order with a shipping address in Belgium. However, the API reply
suggests that the order may have been placed from Africa or Eastern Europe. If the origin
is true, the order is riskier than in the first example, and most likely the reviewer would
reject this order.

Example 7 Very Risky Order
The IP address extracted from the customer’s browser is decoded as follows:
IP Address Information Country: us

State: va
City: ashburn
Routing Method: anonymizer
Factor Code D - Risky IP or email address
Information Codes FREE-EM - Free email provider
MM-IPBST - IP address inconsistent with billing state
Most likely, the reviewer would reject this order because the routing method is inherently
risky, and the factor and information codes suggest suspicious data.
Account Details
This section about your customer's payment account appears only if the information exists
for the order. You can view payment data for cards, electronic checks, direct debits,
PayEase China Processing, PayPal Express Checkout, or PayPal services in this format:
#<account suffix>(country code) | <card scheme> | <account type>

AVS/CVN:<code>/<code> | ECI <number> | <issuer/bank name>

Table 29 Possible Values for Account Details
Account Details Field Possible Values

#<account suffix> (country code) The last four digits of the account number followed by the two-
letter country code enclosed in parentheses. For example:
#2142(gb)
<card scheme> One of the following values appears:
Visa Credit
Visa Debit
Mastercard Credit
Mastercard Debit
Mastercard Charge Card
American Express Debit
American Express Credit
American Express Charge Card
ATM Debit
Bankcard(Inactive) Debit
China Union Pay Credit
China Union Pay Debit
Dankort Debit
Discover Credit
Discover Debit
JCB Credit
Laser Debit
Maestro Debit
Private Label Card Debit
RBS Gift Card Debit
Solo Debit
Switch/Maestro Debit
Note Additional values may be present.
<account type> Type of payment card account. This field can refer to a credit
card, debit card, or prepaid card account type.
AVS/CVN: <code> / <code> If present, address and card verification codes derived from
the customer’s address and card information. These codes
can appear if the payment is processed. For a list of codes,
see "Information and Reply Codes," page 318.
ECI <number> ECommerce indicator number. One of the following values
appears:
0 - No authentication data collected
1 - Incomplete card authentication (Mastercard)
2 - Successful card authentication (Mastercard)
5 - Successful card authentication (Visa, American Express,
JCB, and Diners Club)
6 - Incomplete card authentication (Visa, American Express,
JCB, and Diners Club)
7 - Failed card authentication
<issuer/bank name> Name of the entity that issued the account.

Customer ID
If available, this section contains an optional account ID, tracking number, reward number,
or other unique number that you assigned to the customer.
Billing and Shipping Information

This section contains the billing and shipping information provided by your customers
before it is normalized by Decision Manager. Consequently, the address information may
not match the information codes, which are based on the normalized address.
When the shipping address is present, the billing and shipping information is the same for
most good orders. The shipping method might also appear in this pane of the window if it
is available.
To obtain more information about the customer, use the links provided:
 Phone number: if present, click it for more information about the number at
www.whitepages.com. At that site, you may be able to find the type of phone, the
provider, the location, and other information about the customer if available.
 Map of the address area: If a globe icon is present, click it to view an online map of the
immediate area where the address is located. This information can help you to
determine whether the address is genuine.
Available Actions
If you have the correct permissions, you can perform these actions:
 Marking a transaction or removing it from history:

 Mark for Review: adds order data to the review list.
 Mark as Suspect: adds order data to the negative list and tags the order as
potentially or confirmed fraudulent.
 Clear Mark as Suspect: removes order data from the negative list for an order that
was previously tagged as suspect and prevents transaction information from
affecting future transactions.
 Mark as Temporarily Trusted: adds order data temporarily to the positive list.
 Mark as Trusted: adds order data to the positive list.
 Remove from History: hides order data from the negative list by removing it from
the fraud history.
For more information, see "Completing the Review Process," page 252.

 Payment options: Settlement or debit

In the settlement window, you can modify the card settlement amount, but you can
process debits only for the complete amount. Because the payment transaction is
separate from the review process, the order is not automatically assigned to you or
resolved if you do not already own it or if it has not been accepted or rejected.
Similar Searches
To locate other transactions containing the same customer and order elements, use the
Similar Searches links to modify your search. The options appear only if the
corresponding order data is present. For example, you can search for the same email
address only if the order contains an email address as in the example below. In the
example below, if you select By All from the Similar Searches links, the search returns all
orders that contain these elements: same name, email address, account number, and
shipping address.
You can compare all the related orders to find possible patterns by using all elements,
name, email address, account number, IP address, shipping address, or billing phone.
Visualizing the Results of Similar Searches

To view relationships between orders that are returned for Similar Searches, click
Visualize in the Similar Searches results grid:

Orders that contain the order element you select from the Similar Searches menu appear
in the visualization window. The order that originally contained the element, which
originates the similar search, is highlighted in the visualization window:
For more information about the visualization feature, see "Visualizing Case Search
Results," page 217.

Case Information
This section shows the status of the order, possible actions, case properties, and the
Advanced Fraud Screen (AFS) information.
Possible Actions
If you have the correct permissions, the Accept, Reject, and Take Ownership buttons
appear. If you click an action and another reviewer owns the order, a message appears,
indicating that another review owns the order. When you accept an order, a dialog pane
opens where you can enter comments and settle the order. When you reject an order, a
dialog pane also opens where you can enter comments and mark the order as suspect.
The “settle” and “mark as suspect” options are available only if you have the correct
permissions. The “clear mark as suspect” option is available only if the order has been
marked as suspect. The Take Ownership action is also available only if you have the
correct permissions. This action enables you to take ownership of an order that is
assigned to another reviewer.
Order Status
The current status displays in the top left corner of the Case Information pane.
The status Accepted by Reviewer and Rejected by Reviewer also apply to

orders that were accepted or rejected automatically after the reviewing time
Note limit passed.

Hold Option
Adjacent to the order status field is a Hold button. Use this button to move the order into
the queue that is defined as the hold queue in the Queue Definitions window. If no hold
queue has been defined, this button is not present. For more information, see "Setting Up
Review Queues," page 45. When an order is moved to the hold queue, the move policy
configured for that queue takes effect immediately.
Order reviewers must have the Move Orders permission and the Order Conversion
permission to view or use the Hold button.
Case Properties
This pane shows the order owner, order priority, the queue, and the action that occurs if
the reviewing time limit passes or No Time Limit if none has been configured for the
queue. For orders that are owned by an internal or managed risk reviewer, the owner is
listed as CYBS. The time limit expiration information is displayed only for cases currently in
review. Unless you have the Case Administration permission, you must own the case to
reset or disable the reviewing time limit. The ability to alter individual case properties
depends on your user permissions.
If you have the appropriate permissions, click the pencil icon in the upper-right corner of
the Case Properties pane, and the Case Properties dialog box appears:
 Priority: This option lists the priority levels that you can assign to the order. For more
information on order priority, see "Defining a Profile," page 81.
 Owner: This option enables you to assign the order to any reviewer with the correct
permissions or to remove the current owner. An administrator can assign orders to
reviewers regardless of the reviewer’s ownership limit.
 Queue: This option allows you to move the order to any existing queue.

 Time Limit: This element displays the action that occurs automatically after the time
limit passes. One or more check boxes may appear depending on the available
actions for the order.
These actions apply only to the case currently in review. The other orders in the queue
are not affected. In addition, the status of a case (time limit reset or disabled)
supersedes that of the queue in which the order is placed.
 Reset Time Limit: The time limit is reset to start at the current date and time and is
reset to the service-level agreement (SLA) time limit of the queue. If you check the
box and save your change, the date and time are changed to the new expiration
date and time.
 Disable Time Limit: The date and time limit is removed from the order and the
word Disabled replaces the date and time. When you disable the time limit, the
queue time limit is disabled and no decision is made to accept or reject the order.
Example Disabling Time Limit
An order was marked for review on August 8, 2014, at 3:14 PM. The current date
and time is August 9, 2014, 7:00 AM. The reviewing time allowed for that queue is
8 hours. If you check the reset box, the new expiration date and time is August 9
2014, 03:00 PM.
 Note: You can write a comment to explain your changes to the order. For more
information, see "Notes," page 244.
Reviewer Permissions for the Case Information Pane

Depending on your permissions, you can view or perform only specific actions.
Queue Search and Can view the current owner and queue assignments
Order Conversion Permissions and can reset the time limit.
Ownership Release Permission Can return the order to the pool of unassigned
orders.
Ownership Stealing and Can appropriate orders that are marked for review.
Unrestricted Order Review Permissions However, you cannot exceed the maximum number
of numbers that your administrator allows you to
own. To appropriate rejected orders, you must have
the Rejected Order Conversion permission. The
editing option is present.
Time Limit Disabling permission Depending on the current status of the order
(enabled or disabled), the check boxes to enable or
disable the order appear. These options are
described below under Time limit in the next section.

Administrator Permissions for the Case Information Pane

You can change the priority of an order, assign orders to any other reviewer, and move
orders between queues. When assigning orders, you can exceed a reviewer’s order
ownership limit. You can change order assignments at any time.
Advanced Fraud Screen (AFS) Information

This section contains all the Advanced Fraud Screen information returned for the order.
Score
The fraud score is calculated by adding the effect of all order data inconsistencies. Make
sure that you know how to evaluate the score according to the settings of the order profile
used to screen the order.
Risk Model
The risk model that is used for the transaction. Risk models are set in the order profile.
See "Risk Model," page 83.
Factor and Information Codes

This section shows the codes that were triggered by the order. All codes are described in
"Information and Reply Codes," page 318.
 Address information: All information codes are based on the normalized address.
Therefore, these codes may appear not to match the address information, which is
shown before it is normalized by Decision Manager.
 Travel orders: If you process travel orders, not only the customer who placed the order
but also the passengers listed in the travel section may have triggered one or more
information codes. These negative list information codes are specific to passenger
information:
NEG-PID Passenger’s account ID

NEG-PPH Passenger’s phone number
NEG-PEM Passenger’s email address

 Past orders: This section can also contain information codes that are links to past
orders.
NEG-HIST Link to the previous transaction that contains the same suspicious elements
that were added to the negative list.
NEG-* Link to the negative list search results window that shows other transactions
that have the same suspicious elements that were added to the negative list.
MVEL-* Link to the recent velocity results window, which shows other transactions
with the same merchant-specific velocity information code.
Even if reviewers accept an order that contains elements added to the

negative list, all subsequent orders with the same elements trigger the
Important negative list rule.
Recent Velocity Transaction Results (“MVEL-” Codes)

Information codes that begin with “MVEL-,” such as MVEL-R1 in the figure below, are links
to lists of up to 10 of the most recent orders that triggered the same rule.
The definitions refer to the parameter, account number, that is tracked by the rule. Order
velocity information codes are in the format MVEL-R; product velocity information codes
are in the format MVEL-P. The quantity of items that counted toward the threshold can be
viewed in the Offer Details section of the Case Management Details window.
Merchant-specific velocity is discussed in detail in "Merchant Velocity," page 175.

Rule Evaluation
This section shows the profile name, the rules that were triggered by the order, and a link
to the result of the evaluation of passive rules. Rules that have an impact on Decision
Manager's original decision (review or reject) appear, but to view the rules that did not
affect the status of the order, click the double arrow in the bottom right corner to expand or
collapse the section as shown in this figure:
To understand how the transaction was processed, compare the triggered rules with the
rest of the order data and with the various codes returned, such as in this example:
Example Comparing Triggered Rules with Order Data and Returned Codes
A profile containing 30 rules was used to evaluate an order. Only the rules shown below
were triggered. Because only the first rule was set to review in the order profile, it is the
only one that appears automatically. To view the other rules, you need to click the link. The
combined results of the rules set to ignore caused the first rule to be triggered, which in
turn caused the order to be marked for review.
Rule Name Profile Impact

Order is above your AFS threshold for review. Review
Billing and/or shipping address: correctable errors Ignore
High number of different payment cards
No AVS match
Order exceeds your maximum amount.

To try to resolve the issues in this order, you may need to contact the
customer to verify the address and the payment card, and you may need to
contact the card-issuing bank to verify the customer's information.
If at least one passive profile was used to evaluate this order, expand the Rule Evaluation
section, and click View Passive Rule Evaluation at the bottom:
The Passive Rule Evaluation window that appears shows the name of the passive profile
and any rules that were triggered. Use this passive evaluation to view how rules might
affect your orders if they were in an active profile.
Your business process should be designed to help your reviewers verify information on
suspected orders during the review process. When reviewing the rules, consider
reviewing also the purpose of each rule in finding risky orders. The following sections
describe each predefined rule and how to use the results to review your orders. predefined
business rules represent common tests that many merchants can use to evaluate orders.
Most rules is based on potentially risky factors that you want to avoid.

Address Verification
The Address Verification Service (AVS) is a feature of the bank card authorization process
that returns a code after analyzing the numeric portion of the street address (up to the first
five numbers) and the postal code. AVS is available only for U.S.-issued cards and some
U.K.-issued cards. However, bank records are not always up to date, and fraudulent
customers who commit identity theft have access to address information. Use AVS as a
part of the order acceptance decision. For a complete list of AVS codes, see the Decision
Manager Using the Simple Order API Developer Guide (PDF | HTML) or the Decision
Manager Using the SCMP API Developer Guide (PDF | HTML).
Partial AVS match This rule is linked to the following Address Verification Service codes that
apply to U.S.- and non-U.S.-issued cards: A, B, K, L, O, P, and W. Either the
card member’s name, the street address, or the 5- or 9-digit postal code match
but not all.
No AVS match This rule is linked to the following Address Verification Service codes that
apply to U.S.- and non-U.S.-issued cards (AVS codes C, I, and N) and to
PayPal transactions (AVS code 4). The address and the 5- or 9-digit postal
code do not match or cannot be verified.
AVS service not available This rule is linked to the following Address Verification Service codes that
apply to U.S.- and non-U.S.-issued cards: R and U. This rule is triggered when
the service is unavailable.
Account issued in country other This rule, linked to a Suspicious Data information code, is triggered when the
than country in customer's account was issued outside of United States, which indirectly verifies the
billing address customer’s address (country). This test verifies U.S. and some U.K. accounts.

Card Verification Number
Decision Manager can evaluate the CVN only if the authorization service was
part of the request. If you request only the score service, Decision Manager
Important does not recognize the CVN even if you provide the number in the request.
These tests apply only to bank card transactions.
The card verification number (CVN) is a three- or four-digit number printed on the front or
back of a bank card. The CVN is named differently by Visa, Mastercard, and American
Express. Because the CVN sometimes becomes unreadable, customers can make errors
when entering it. Also, lists of card account numbers with accompanying card verification
numbers are available to fraudulent customers. Use the card verification number as part of
the order acceptance decision. This test is most effective when combined with other tools.
No CVN match This rule is linked to all Card Verification codes (except M); this rule is triggered
when the card verification number is not matched because no bank data
exists, the number is not processed or is not supported.
CVN not submitted This rule is triggered when the card verification number exists but was not
submitted in the request, or the card-issuing bank did not return a value.
CVN service not available This rule is triggered when the processor returned an unrecognized value for
the card verification response or did not return a card verification result code.
CVN not supported by This rule is triggered when the card-issuing bank does not support card
cardholder's bank verification.

Order Data Quality

These tests provide information about content in the order that may affect its validity.
Obscenities in the name or email CyberSource uses a dictionary of known obscene terms to search the
address of order customer’s information for obscenities in the text of the name, address, city,
and email address. When triggered, this rule may indicate obscene content or
(false-positive result) text similar to obscenities that is actually proper in the
language of the individual placing the order.
Letter combinations not found in This rule searches the customer’s information for nonsensical input in the text
English of the customer’s name and address. This rule often reveals highly suspicious
orders. The presence of gibberish may indicate nonsensical content or (false-
positive result) text that is non English-based that is actually proper in the
language of the individual placing the order. False-positive results may also
result from abbreviations of company names.
Billing and/or shipping address This rule is triggered when no match is found. This rule may indicate a
not verifiable fraudulent attempt to place an order or the result of an error. Fraudulent
customers often attempt to change the shipping address after the items are
shipped. (Australia, Canada, The Netherlands, United Kingdom, and United
States produce the most reliable address information.)
Correctable errors in billing and/ This rule is triggered when no exact match is found. This rule may indicate a
or shipping addresses fraudulent attempt to place an order, a closely related address, or the result of
an error. (Australia, Canada, The Netherlands, United Kingdom, and United
States produce the most reliable address information.)
Shipping address different from This rule is triggered when the billing and the shipping address have different
billing address streets, cities, states, postal codes and/or countries.
Order outside the U.S. To determine the outcome of this business rule, CyberSource examines the
Bank Identification Number (BIN) (first six digits of the card account number),
the IP Address, and the billing and shipping address.
Geolocation inconsistencies in This rule combines several tests that examine inconsistencies among the
order telephone area code and the billing, shipping, and email addresses.

Customer Data Validation

These tests provide information about the customer’s information that may affect the
validity of the order.
Free email provider Free email providers may be riskier than standard ones. The domain name of
the email provider is compared to a list of known free email providers. Because
this business rule can return many false positives, CyberSource recommends
that you use this business rule in conjunction with the fraud score.
Suspicious telephone number CyberSource performs several tests on the telephone number. For example,
the length and form of the phone number must be correct. Many tests are
specific to the area code and prefix of the directory of North American
Numbering Plan, which includes the Caribbean Islands, Canada, and the U.S.
Other tests are specific to telephone numbers outside of North America.
To be included in the negative list, the first six digits of a telephone number
must have a very high fraud pattern. Fraud patterns are frequently analyzed for
statistical relevance, and the list of telephone areas along with their statistical
risk factor is frequently updated.
As with all history check values, a single rule does not raise the fraud score to
the point of disqualifying an order. Because this business rule can return many
false positives, CyberSource recommends that you use this business rule in
conjunction with the fraud score. This rule is linked to a Phone information
code.
Suspiciously high number of CyberSource checks the order database for merchants who use the fraud
different email addresses score. This business rule identifies orders in which most elements are identical
but email address(es) are different. Fraud patterns are frequently analyzed for
statistical relevance: a statistically derived weighting value is extracted, and
this value is applied to fraud scores in which this rule returns a value. This rule
is triggered with more than four email addresses.
As with all history check values, a single rule does not raise the fraud score to
the point of disqualifying an order. This business rule is particularly sensitive to
changes in identity. This rule is linked to a Information Factor code.
Suspiciously high number of This business rule is similar to the rule above, but it pertains to account
account numbers numbers. This rule is linked to a Score Factor code.
Payer Authentication
For more information on Payer Authentication, see Payer Authentication Using the Simple
Order API (PDF | HTML) or Payer Authentication Using the SCMP API (PDF | HTML).
These business rules apply only to CyberSource customers who use Mastercard and Visa
Payer Authentication.
Customer not enrolled in Verified This rule is triggered when the cardholder is not enrolled in Verified by Visa but
by Visa the attempt to authenticate is recorded. This transaction transfers financial
liability.
Customer not enrolled in This rule is triggered when the Mastercard cardholder is not enrolled in
Mastercard SecureCode SecureCode.

Order Monetary Quality

These tests, which apply only to bank card transactions, provide information about the
amount and the currency used for the order.
Value of order exceeds currency This rule is triggered when the customer’s order exceeds the threshold that
value you have selected for this rule.
Value of order less than certain This rule is triggered when the customer’s order is less than the threshold that
currency value you have selected for this rule.
Incorrect currency This rule is triggered when the customer’s currency differs from the one that
you accept.
Velocity
These tests provide information about purchase frequency to detect fraudulent attempts
by customers to make purchases on your Web site.
Similarities of this order to other This rule, which is linked to the velocity information codes, is triggered when
recent orders (Global Velocity) certain parameters that contribute to the fraud score are exceeded, such as
account numbers and email addresses. For more information, see "Global
Velocity," page 173.
Merchant-specific order velocity This rule, which applies specifically to your business, is triggered when the
customer’s order appears to be a repeated order.
Merchant-specific product This rule, which applies specifically to your business, is triggered when the
velocity customer’s order contains a repeated combination of product, interval, and
tracking parameter above the threshold that you set.
Other Tests
These additional tests provide valuable information about the level of risk that an order
may represent.
Customer on the negative list The negative list contains information about orders that resulted in
chargebacks, fraud, or other unacceptable behavior. You can use the negative
list to help protect yourself against subsequent orders from risky customers.
The negative list is specific to your business. For more information, see
"Positive, Negative, and Review Lists," page 119.
Customer on the positive list The positive list contains information specific to your business. For more
information, see "Positive, Negative, and Review Lists," page 119.
Order outside merchant's region This rule returns a value when the customer’s order is outside the list of
countries that you selected in the Merchant Region custom list.

Notes
This section shows all the notes previously added by reviewers who have looked at the
order and the actions that have been performed on the order. Each note can contain up to
4000 characters. Longer notes are truncated. The oldest note is at the bottom. This
example shows an order for which the user took ownership and added a note about
attempting to contact the customer.
Use this section to document your actions, tasks, and the corresponding results. You can
add as many notes as you want. All the notes added and the events logged appear in the
search results and case details windows. Only the three most recent notes are shown. To
view additional notes, click View All Notes.
Adding a Note
To add a note:
Step 1 In the Notes section of the Case Management Details window, click Add Note.
The window contains a list of the most common options when contacting the customer,
such as Called cardholder: left voice mail.
Step 2 Choose an option.

For each note, you can select more than one reason by Ctrl-clicking each note that you
want. Multiple reasons are separated by a pipe ( | ).

Step 3 Optionally, enter a comment and click Add Note.
Later, you can view the notes in the Conversion Detail Report and the Case Management
Order Status report that is sent to the notification URL. These reports are described in
detail in the Decision Manager Reporting Guide (PDF | HTML).
Offer Details
This section shows the detailed contents of the transaction. To view all results, drag the
dotted line at the bottom of the section. To move the section up or down in the window, use
the handle to the left of the title.
Above the table, at the far right of the title line, the transaction amount and currency used
appear in the search results window and, if applicable, the amount converted to your local
currency:
The amounts in converted currency are approximate because conversion rates

fluctuate during the reporting periods.
Note
 If the transaction and local currencies are the same, the amount and currency appear
once without brackets.
 If the transaction and local currencies are different, the transaction currency converted
to the local currency appears in brackets to the left of the transaction currency, for
example: Total: [74.07 USD] / 50.75 EUR
Each line item contains the information that applies to the items ordered and the services
requested, for example: item, quantity, SKU, price, tax, and order currency. The tax
amount applies to the entire offer line. Offer details are essentially informational because
they do not usually affect the outcome of an order.

For travel data, each line item can contain travel and nontravel data. Alternately, the
product information can appear in the offer line with the passenger information in the travel
information section immediately below.
Travel Information
This table describes the content of the Travel Information section:
Time to Departure Amount of time until departure. If you refresh the window, the number
decreases. After departure time, the value is Departed.
Journey Type Type of travel, such as one way or round trip.
Complete Route Complete travel route for all passengers in this format: ORIG1-
DEST1[:ORIG2-DEST2...:ORIGn-DESTn].
Passenger Name Passenger's first and last names.
Note The passenger’s name may be different from the customer’s name.
Passenger ID Your company's ID for the passenger to whom the ticket was issued.
Note The passenger’s ID may be different from the customer’s ID.
Passenger Status Your company's passenger classification, such as with a frequent flyer
program. In this case, you might use values such as standard, gold, or
platinum.
Type Passenger classification associated with the price of the ticket. One of
these values appears:
 ADT: Adult
 CNN: Child
 INF: Infant
 YTH: Youth
 STU: Student
 SCR: Senior Citizen
 MIL: Military
Passenger Phone Passenger's phone number. The passenger’s phone number may be
different from the customer’s phone number, even if the customer is the
passenger. Some customers may prefer to use different contact
information for different purposes.
Passenger Email Passenger's complete email address, such as jdoe@example.com. The
passenger’s email address may be different from the customer’s email
address, even if the customer is the passenger. Some customers may
prefer to use different contact information for different purposes.

Third-Party Services
This section displays external services: "192.com," "Accurint," "Credilink," "Emailage,"
"TARGUSinfo," "Whitepages Pro," and "Export Compliance Service" that you can use to
verify the customer's identity or other order data. Use the information obtained from these
services with your business rules to review and decide the outcome of your orders.
The Export Information link is present only if the order data was matched to a restricted
list. For 192.com, Accurint, Credilink, Emailage, Perseuss, TARGUSinfo, and Whitepages,
one or more links or a message appears:
Links With the correct permission, you can request the information. After the service has
been successfully requested, results appear.
Messages  You do not have permission to request the information.
 The login information to the service is incorrect.
 The address is in a country other than the U.S.
 The service is not available.
192.com
CyberSource provides a link to 192.com. If you have a contract with 192.com, you can use
the ProveID service that uses the order data to obtain real-time information about persons
and businesses. For more information, contact your 192.com representative. You are
charged directly by 192.com for each request.
192.com uses the order data to provide information about persons and businesses in the
U.K., Germany, Sweden, the U.S., and Canada. The information that you receive can vary
among the countries. If the data is available, you can view detailed information about
names, addresses, and many different types of public records. Each category and entry
can contain one of these results:
Match Information about the customer was found in a database.

No Match Information about the customer was not found in a database, which is suspicious.
No Match Information about the customer was not found in a negative database.
Caution Information about the customer was found in a negative database.
- Not used to evaluate the order.

For detailed information about the results that are returned and for examples, see
"192.com," page 297.
Accurint
This service applies only to U.S. addresses. The person search feature of Accurint
provides a real-time tool to obtain background information about individuals. Accurint
requires the customer's name and address to find information available about the
customer: previous addresses, phone numbers, and names. If the person has moved
several times, many records may be returned. If the link in the case details window is
present, but the customer information does not match any records, you receive a no
results available message. For detailed information about the results that are returned and
for examples, see "Accurint," page 304.
Credilink
This service uses the Brazilian Cadastro de Pessoas Fisicas (CPF) identification number
for individuals and the Cadastro Nacional da Pessoa Juridica (CNPJ) identification
number for businesses to provide complete name, address, and phone records. Credilink
can be used to verify order data for customers who submit a CPF or a CNPJ identification
number with their order data. It is not necessary that the customer or customer’s business
be located in Brazil. For more information about the results you can receive from this
service, see "Credilink," page 306.
Emailage
Email addresses are one of the most widely used forms of data and can be used to
identify risk. Emailage provides identity intelligence and information based on a
customer’s email address. For instance, it can determine whether a customer name
matches the email owner, or the creation date of the email address. Within Decision
Manager, the Emailage service can be used manually or in real time.
For more information about the results you can receive from this service, see "Emailage,"
page 308.
Perseuss
This service applies to travel merchants who are processing passenger-related
information. Perseuss is an enrollment-required service which keeps records of negative-
fraud traveler information. Merchants can reference the Perseuss service with passenger
information, and Perseuss provides risk scores based on matches in the Perseuss
system. Within Decision Manager, the Perseuss service can be used manually or in real
time.
For more information about the results you can receive from this service, see "Perseuss,"
page 309.

TARGUSinfo
This service applies only to U.S. addresses. TARGUSinfo provides information in real time
to verify legitimate transactions and identify risky ones by using one of these methods:
 By confirming the accuracy of the customer’s name, address, and phone number and
verifying the relationship between these elements
 By verifying wireless and non-public phone numbers
 By accessing phone-stability indicators, such as length of service, phone distance to
address, and recent changes in listing status
The Request Information link appears only when the required customer information is
present. The service requires either the address or the phone number. The information
that you can verify is based on the completeness and accuracy of the customer's billing
information.
For detailed information about the results that are returned and for examples, see
"TARGUSinfo," page 310.
Whitepages Pro
Whitepages Pro delivers consumer identity verification data with risk signals that can be
used for building rules and/or manual review. Identity Check provides a search function
that verifies a customer’s name, addresses, phone number(s), email, and IP match
statuses. The Whitepages Pro integration within Decision Manager can be used to help
manage manual review.
For more information about the results you can receive from this service, see "Whitepages
Pro," page 314.
Export Compliance Service

This section shows the information that can be returned in the case details when you
request the CyberSource export service with Decision Manager. If the information is
available, all users who can review orders can view it. For additional information on
restricted and denied parties, see the FAQ in the Resource Center of the U.S. Department
of the treasury and Verification Services Using the Simple Order API (PDF | HTML) or
Verification Services Using the SCMP API (PDF | HTML).
To view the information, click the View Information link. The results contain all the
instances where the entity was found in lists of restricted parties or entities. The amount of
data varies with each person or entity. Any or all of the following information might appear:
the name of the customer, the programs, the reason for the match, and all relevant notes,
addresses, and aliases. Some of this information is available also in the API reply. If the
customer is not found on a list, a No Matches Found message appears under the name of
the list.

Each example below shows a different type and amount of result.
Example 8 Product Export to North Korea Restricted
No restriction information exists in the list of the Bureau of Industry and Security (BXA)
and the Terrorist Exclusion List (TEL). However, in the list of the Office of Foreign Assets
Control (OFAC), product export to North Korea is restricted.
Example 9 Customer on the Denied Persons List
No restriction information exists in the list of the Office of Foreign Assets Control (OFAC)
and the Terrorist Exclusion List (TEL). However, in the list of the Bureau of Industry and
Security (BXA), the customer is on the Denied Persons List until 08/08/2017.

Example 10 Business Name on List of the Office of Foreign Assets Control
No restriction information exists in the list of the Bureau of Industry and Security (BXA)
and the Terrorist Exclusion List (TEL). However, the customer used a business name that
was found in the list of the Office of Foreign Assets Control (OFAC). Although it appears to
be a genuine charity registered and located in the U.K., this entity has five aliases, five
addresses, and has been labeled Specially Designated Global Terrorist.
Mark as Suspect History

This section appears when order data is added to your negative list either by you, one of
your reviewers, or because of chargebacks. The table shows the action that was taken
(Creditback, Fraud Chargeback, Non-Fraud Chargeback, or Suspected), the reason, the
date, the reviewer who performed the action, and possibly a comment. Later, if the data is
removed from history, an additional row appears in the table without the reviewer's name.
Example Reviewer Added Transaction to Negative List Without Notes
The reviewer added the transaction to the negative list with the reason suspected on the
date and time specified. The reviewer did not add notes.

Example Reviewer Made Multiple Updates to Transaction Marking Reason
The reviewer added the transaction to the negative list with the marking reason suspected
then cleared the suspect marking and removed it from the negative list. Later, the reviewer
added the transaction back to the negative list with the reason suspected and finally
updated the marking reason as fraud chargeback.
Additional Information
This optional section can contain up to 100 merchant-defined data fields with any type of
information that is not included in the other sections, such as all details pertaining to a
customer’s travel order. You can view all the fields that your development team has
included in the request.
Completing the Review Process

After you have reviewed an order, you are ready to make a decision and to process other
services. You can accept or reject an order either from the Case Management Search
Results window or the Case Management Details window. If you have the Payment
Capture/Settlement/Debit permission, you can process the payment at the same time you
accept the order in the Case Management Details window.

Accepting or Rejecting Orders in the Case

Management Search Results Window
To accept or reject an order in the Case Management Search Results

window:
Step 1 Check the box in the Select column of the order on which you want to perform the action.
Step 2 If the order does not belong to you, click Take Ownership and then click OK.
Step 3 Check the box in the Select column of the order again, and click Accept or Reject.
Step 4 In the Accept or Reject dialog box, select a reason from the drop-down list and enter
comments:

Step 5 If you are accepting an order and have permission to settle orders, continue as follows:
 To immediately bill the customer's account, check Perform settlement/debit when
applicable and click Accept.
The process differs depending on the payment type:
 Card payments: The credit card settlement window appears. Complete the fields
and click Settle. Note that you can settle for an amount different from the order
amount.
 Check and direct debit payments: The payment is processed for the original
amount as soon as you click Submit. No other window appears.
or
 To settle the transaction later, click Accept without checking Perform settlement/
debit when applicable.
The Case Management Search Results window reappears with a success message.
Step 6 If you are rejecting an order and want to add the order data to your negative list, check
Mark as Suspect, and then click Reject. The Transaction Marking Tool appears. See
"Adding Customers to the Negative List," page 129.
The Case Management Search Results window reappears with a success message.

Accepting or Rejecting Orders in the Case

Management Details Window
To accept or reject an order in the Case Management Details window:
Step 1 If the order does not belong to you, click Take Ownership.
Step 2 Click Accept or Reject.
Step 3 In the Accept or Reject dialog box, select a reason from the drop-down list and enter
comments.
Step 4 If you are accepting an order and have permission to settle orders, continue as follows:
 To immediately bill the customer's account, check Perform settlement and click
Accept.
The process differs depending on the payment type:
 Card payments: The credit card settlement window appears. Complete the fields
and click Settle. Note that you can settle for an amount different from the order
amount.
 Check and direct debit payments: The payment is processed for the original
amount as soon as you click Submit. No other window appears.
or
 To settle the transaction later, click Accept without checking Perform settlement.
The Case Management Search Results window appears with a success message.

Step 5 If you are rejecting an order and want to add the order data to your negative list, check
Mark as Suspect, and then click Reject. The Transaction Marking Tool appears. See
"Adding Customers to the Negative List," page 129.
The Case Management Search Results window appears with a success message.
The order that you accepted or rejected is no longer in the Case Management Search
Results window. To find it, you need to search for orders that are no longer in any of the
review queues: All resolved, Accepted by reviewer, or Rejected by reviewer.
If you are settling orders that contain Level III data, do not open a different
browser window for each order. Otherwise, the order settled may not contain
Note the correct Level III data for the order.
After you have decided the outcome of an order, the other services that you may have
requested are processed.
Now that you have updated the status of the order in the Business Center, you receive the
Case Management Order Status report if your system is configured for it. For detailed
information about this report, see the Decision Manager Reporting Guide (PDF | HTML).
You must manually update your system to reflect the new status for the order.
You can return to the Case Management windows to review other orders.
Reviewing Digital Goods Transactions

Many of the guidelines for managing risk related to transactions that involve physical
goods (clothing, electronics, and so on) also apply to transactions that involve digital
goods (merchandise or services that can be downloaded or streamed to fulfill the
purchase). A general best practice for managing risk requires that you gather as much
information as possible on each transaction. For example, make sure that you collect as
many payment card details as possible, including payment card verification codes.
In addition to general best practices for reviewing all types of transactions, follow these
guidelines when you review digital goods transactions:
 Consider using device fingerprinting. For example, you can use device fingerprints to
determine whether the same device is used for otherwise unrelated transactions,
which may be a strong indication of fraud. See the Decision Manager Device
Fingerprinting Guide (PDF | HTML).
 Because no physical goods are shipped, any physical address that your customer
provides is valuable only for comparing with other order details. This comparison
enables you to assess whether the order information is plausible and therefore less
likely to be fraudulent.

 Determine whether your customer’s IP address indicates:

 A physical location that is near the customer billing address, which may indicate
lower fraud risk. The farther a device is located from the billing location, the more
risky the transaction may be.
 A mismatch between the IP country and the customer’s billing address country,
which may indicate greater fraud risk.
 An IP country that is considered high risk for your products.
 Many transactions originating from the same IP address. Receiving many
otherwise unrelated transactions from the same IP address may be a strong
indication of fraud.
 Examine IP routing information that is returned in the CyberSource reply to determine

whether a proxy or an IP anonymizer is being used. Proxies may make it difficult to
identify the country from which the request originates. IP anonymizers may indicate a
high fraud risk because the customer is attempting to hide their location. See “Using
the Customer IP Address to Assess the Level of Risk” in Appendix D of the Decision
Manager Using the Simple Order API Developer Guide (PDF | HTML) or the Decision
Manager Using the SCMP API Developer Guide (PDF | HTML).
 Closely monitor order velocity so that you can quickly identify unusual purchasing
behavior. A large number of purchases made by the same customer or same payment
card in rapid succession over a short period of time may be a strong indication of fraud
in progress. See Chapter 6, "Velocity," on page 173.
 Make note of the customer email address. Free email addresses from high-risk
countries may indicate a higher fraud risk. On the other hand, email accounts with
private domains may indicate a lower fraud risk.
 Review transaction details for unusually large purchases. An unusually large

purchase alone may not indicate fraud. However, if other transaction characteristics
that are noted here are present, the likelihood of fraud may rise along with the
additional risk of losing more value in merchandise.
 Look for inconsistencies in customer details across multiple purchases. For example,
the same email address with different customer names provided for multiple
transactions may indicate fraudulent transactions.
 Look for transactions that contain obviously fake information, such as a fake phone
number or an email address composed of gibberish like blahblahblah@blahmail.com.
 Look for many failed attempts to place an order by the same customer name or email
address, which may indicate failed attempts to commit fraud.

APPENDIX
Custom Rules Elements and
Examples
A
This appendix lists the order and customer elements that you can use in the Rule Editor to
create custom rules.
Not all the order elements are actual API fields that you can send in your
requests or receive in your replies. Some of the elements are created
Note specifically for use in the Rule Editor.
Comparison Operators
This section describes in detail how to use the comparison operators.
Operator Element
Equal Matches complete order element.
Trigger: Exact match with any comparison value, including values in a list.
Single element Example 1: Billing city is equal to shipping city
Example 2: Billing city is equal to <custom list of cities>
Example 3: Email address is equal to <custom list of email addresses>
Example 4: <custom field> is equal to <custom value, list, and/or field>*
* By using ctrl-select, you can choose one or more comparison values.
Multiple element Use with order elements that can contain multiple values in the API field, such as
information codes, and with all values and lists as comparison values. Your rule can
contain all possible comparison values in one condition.
Example: Fraud score velocity information is equal to "Account number short
interval”, “Email address short interval”
Contains Matches part of an order element. Use with order elements and comparison values
that are lists.
Trigger: Exact match of any comparison value to part of a single or multiple order
element, for example domains (part of the email address), SKUs, and information
codes (in code instead of text format).

Appendix A Custom Rules Elements and Examples
Operator Element
Single element Example 1: Email address contains <single email domain>
Example 2: Alphanumeric custom field contains <custom value or field>
Multiple element Example 1: Fraud score customer list information contains "NEG-"
Example 2: Fraud score customer list information contains "NEG-", “REV-”
Greater Use with numeric values (amounts and dates) only. When the data type is a date,
greater than represents after and less than represents before.
Less
Trigger: Exact match with the comparison value.
Single element Example 1: Authorization amount is greater than 50
Example 2: Transaction date is less than 05/21/2010
Example 3: <custom field> is greater/less than <custom value>
Multiple element —
Starts Use with order elements that can contain single or multiple values in the API field,
such as information codes, and with comparison values that can be lists.
Ends
Trigger: Exact match (starts with or ends with) with any comparison value.
Single element Example 1: Merchant product SKU starts/ends with <custom value, list, and/or
field>
Example 2: Credit card number starts with “1234”
Example 3: <custom field> starts/ends with <custom value, list, and/or field>
Multiple element Example: Fraud score customer list information starts with "NEG-"
REG EXP Use with alphanumeric order elements, including lists, such as information codes.
Each comparison value is now evaluated individually.
Trigger: Exact match.
Single element Example 1: Triggers all orders with card numbers starting with 1234:
Credit card number REG EXP ^1234
Example 2: Triggers all orders with card numbers starting with 1234, 3456, or 9876:
Credit card number REG EXP ^(1234|3456|9876)
Example 3: <custom field> REG EXP <custom value or custom field>
Multiple element Example 1: Triggers all orders that contain negative list information codes:
Fraud score customer list information REG EXP ^NEG
Example 2: Triggers all orders that contain negative or review list information
codes: Fraud score customer list information REG EXP ^(NEG|REV)
Example 3: Triggers all orders that contain billing address information codes:
Fraud score customer list information REG EXP BA$

Operator Element
Negative Applies to these operators: not equal to, is not a member of, does not contain, does
operators not start with, and does not end with.
Use with these elements: fraud score information codes, factor codes, export
information codes, export match programs, and true and proxy IP address activities
and attributes.
Trigger: Exact match, empty field, or absent field.
Multiple element Example 1: Triggers all orders that contain no customer list information code
starting with NEG- and all orders for which the field has no value or is absent.
Fraud score customer list information does not start with "NEG-"
Present Whether or not the comparison value is present in the order data.
Order Elements
These order elements can be used to create rule conditions for custom rules or profile
selector rules.
Use fields marked with (Single Offer) or (Single) to create rules that tag multiple
order elements within the same offer line or line item of the order. See "Order
Note Elements with Unique Characteristics," page 101.
Customer Fields
Use these fields to find specific customer’s billing or shipping information:
 Billing fields, except for the second street address field, are required for authorization.
 Shipping fields are optional for the card authorization but are required for the fraud
score.

Table 30 Customer Fields
Field Description
Billing city
Billing country
Billing first name
Billing last name
Billing phone number Customer billing information
Billing postal code
Billing state
Billing street address 1
Billing street address 2
Company name Name of the customer’s company.
CPF/CPNJ Cadastro de Pessoas Fisicas (CPF) identification
number for individuals or the Cadastro Nacional da
Pessoa Juridica (CNPJ) identification number for
businesses. These identification numbers are used by
the Brazilian revenue agency, Receita Federal. Use for
Brazilian customers only.
Customer account ID Your company’s identifier for the customer
Email address Customer’s email address
Note CyberSource recommends using this field to obtain a
comprehensive fraud score. For orders that do not have
email address information included, such as call center
orders, discuss this issue with your Customer Support
representative.
Shipping city
Shipping country
Shipping first name
Shipping last name
Shipping phone number Customer shipping information
Shipping postal code
Shipping state
Shipping street address 1
Shipping street address 2

Export Fields
If you use the export service with businessRules_ignoreExportResult (Simple Order
API) or ignore_export_result (SCMP API) in your request fields, you can create rules
with the information that is returned in the API reply. For information about these API
fields, see Verification Services Using the Simple Order API (PDF | HTML) or Verification
Services Using the SCMP API (PDF | HTML).
Table 31 Export Fields
Field Description
Denied Parties List address match 1 First address returned when the customer’s information
is found on a Denied Parties List
Denied Parties List name match 1 First name returned when the customer’s information is
found on a Denied Parties List
Export information Information code returned when the Denied Parties list
check or the export service declined the order
Export match program Denied Parties List sublists that returned a match for the
order data
Fraud Score Fields

Use these elements to find specific fraud score information. To broaden the scope of your
fraud score, CyberSource recommends that you also use these fields: IP address, email
address, shipping address, and phone number.
Table 32 Fraud Score Fields
Field Description
Fraud score address information Mismatch between the customer’s billing and shipping
addresses
Fraud score customer list Customer information associated with transactions that
information are on your customer lists
Fraud score factors Information that affected the score of the order
Fraud score host severity Risk associated with the customer's email domain
Fraud score identity information Excessive identity changes
Fraud score Internet information Problem with the customer’s email address, IP address,
or billing address
Fraud score phone information Problem with the customer’s phone number
Fraud score result Total score calculated for this order
Fraud score suspicious information Potentially suspicious information provided by the
customer
Fraud score velocity information High velocity (purchase frequency) for a customer
Merchant-specific velocity Velocity specific to your business

Not all order Fraud Score element fields are currently available for profile
selection. Fields generated from model processing are only available after
Note profile selection for use in profile rules.
Order Fields
You can use these order element fields when you want to find the following information:
 Order origin
 Tracking information
 Product information
 Screening results
Table 33 Order Fields
Field Description
Connection method Method of sending the order to CyberSource
Customer’s IP address IP address used by the customer to contact you
Note CyberSource recommends using this field to obtain a
comprehensive fraud score. Leave blank if the order comes
from a call center or from the customer's browser.
Decline AVS flags Prevents orders from being declined by Advanced Fraud
Screen (AFS) because of the AVS tests results
Decoded email country Name of the country determined from the email address
Decoded host name country Name of the country determined from the host name
Decoded IP anonymizer status Status of the anonymous proxy determined from the IP
address
Decoded IP city Name of the city determined from the IP address
Decoded IP country Name of the country determined from the IP address
Decoded IP routing method Name of the routing method determined from the IP address
Decoded IP state Name of the state determined from the IP address
Distributor product SKU (Offer) Distributor’s or vendor’s product identifier code
Distributor product SKU (Single Distributor’s or vendor’s product identifier code
Offer)
Note Use (Single Offer) fields to find order elements within
the same offer line (line item) of the order.
Gift wrap Indicates whether the customer requested gift wrapping for
this purchase
Host name Customer’s host name for the IP address. For example, the
fictitious host name jaguar.ic.ac.us consists of a local
part, jaguar, and a domain name, ic.ac.us
Merchant descriptor Merchant description that appears on the cardholder's
statement

Table 33 Order Fields (Continued)
Field Description
Merchant product SKU (Offer) Your product’s identifier code
Merchant product SKU (Single Your product’s identifier code
Offer)
Merchant reference number Order or tracking number
Product code (Offer) Type of product in the offer. This field can be used to
determine the product category, such as electronic, service,
or shipping.
Product code (Single Offer) Type of product in the offer. This field can be used to
determine the product category, such as electronic, service,
or shipping.
Product name (Offer) Name of the product
Product name (Single Offer) Name of the product
Product risk (Offer) Level of risk for the product
Product risk (Single Offer) Level of risk for the product
Reason code Reason for a rejected order whether rejected by
CyberSource, the payment processor, or the issuing bank.
Returns accepted Indicates whether returns are accepted for this order
Shipping method Shipping method for the order
Transaction date Calendar date of the authorization (UTC)
Transaction day of week Day of the week of the authorization (UTC)
Transaction time of day Time of day of the authorization (UTC)

Payment Fields
You can use these fields when you want to find specific payment information.
 Card authorization results
 Card information
 Monetary information
Table 34 Payment Fields
Field Description
Amount (Grand total) Total amount of the order
Amount (Offer) Price of each item
Amount (Single Offer) Price of each item
Amount (Subtotal) Sum of the offers totals calculated for you by the system
Authorization amount Total amount of the authorization if you use CyberSource for
authorizations. With the Multi-Currency Service, this value is
in the customer’s local currency.
Authorization AVS code Results of address verification
Authorization card verification Result of processing the card verification number
result
Authorization EV email address Result of the electronic verification mapping for the
customer’s email address
Authorization EV billing address Result of the electronic verification mapping for the
customer’s street address
Authorization EV last name Result of the electronic verification mapping for the
customer’s last name
Authorization EV phone number Result of the electronic verification mapping for the
customer’s phone number
Authorization EV postal code Result of the electronic verification mapping for the
customer’s postal code
AVS code (external) Result of address verification when you request an
authorization.a.
Card account type Type of customer
Card BIN Six-digit card issuer bank identification number
Card BIN Country Country associated with the origin of the card
Card issuer Name of bank
Card scheme Subtype of card account (credit or debit)
China payment mode Payment mode for PayEase China Processing Services
Credit card expiration month Expiration month of the credit card
Credit card expiration year Expiration year of the credit card

Table 34 Payment Fields (Continued)
Field Description
Credit card number Customer’s credit card number
Card verification number Security code of the customer’s credit card
Credit card type Customer’s credit card type
Currency Customer’s currency
CV result (external) Result of card verification when you request an
authorization.a.
E-commerce indicator Type of transaction
Maestro (UK Dom.) issue Issue number for some Maestro (UK Domestic) and Solo
number credit cards
Maestro (UK Dom.) start month Starting month for Maestro (UK Domestic) and Solo credit
cards
Maestro (UK Dom.) start year Starting year for Maestro (UK Domestic) and Solo credit
cards
PA authentication result Raw result of the authentication check.
PA authentication result (raw) Raw authentication data returned by the issuing bank
PA authentication e-com. Reply information returned by Visa transactions
indicator
PA enrollment e-com. indicator Reply information returned by Visa transactions
PA enrollment check result Enrollment check result
Payment solution Visa Checkout, Apple Pay, or a custom value
Payment type Credit card, direct debit, electronic check, and PayPal
Quantity (Offer) Quantity of the product being purchased
Quantity (Single Offer) Quantity of the product being purchased
Sum of offer quantities Sum of the quantity fields in all of the offer lines
Total number of offers Number of offer lines or different products purchased
a. Use this option only if you use a service other than CyberSource for authorizations, and you add
your external data manually when requesting the Advanced Fraud Screen service.
Fingerprint Fields
Fingerprint Fields are described in the Decision Manager Device Fingerprinting

Guide (PDF | HTML).
Note

Travel Fields
Table 35 Travel Fields
Field Description
Complete travel route Concatenation of individual travel legs.
Journey type Type of travel, such as one way or round trip.
Number of passengers Sum of offer lines with passenger data derived by Decision Manager.
Time to departure Amount of time until departure in the format hours:minutes.
Several order elements are also provided so that you can create rules that filter on
passenger first name, last name, ID, status, type, email address, or phone number. Use
the fields with (Single) appended to the field name to find order elements within the same
offer line (line item) of the order.
Velocity Morphing Count

Use these elements to find specific velocity morphing count information. The element
name is comprised of the velocity rule name followed by the field name. For more details,
see "Creating Velocity Rules," page 178.
When you delete a velocity rule, any rule conditions referencing that rule will no
longer be triggered. As a result, custom rules created with these elements no
Important longer function. Be sure to modify or delete these custom rules immediately.
Third-Party Credilink Fields

These values are provided by Credilink. To see these order elements in the Business
Center, you must enable real-time callouts with Credilink as described in "Credilink,"
page 68.
Table 36 Third-Party Credilink Fields
Field Description
Full name Full customer name
Date of birth Customer date of birth
Telephone 1
Telephone 2
Telephone 3 Customer telephone numbers
Telephone 4
Telephone 5

Table 36 Third-Party Credilink Fields (Continued)
Field Description
Address 1
Address 2
Address 3 Customer street addresses
Address 4
Address 5
City 1
City 2
City 3 Customer cities
City 4
City 5
State 1
State 2
State 3 Customer states
State 4
State 5
Zip 1
Zip 2
Zip 3 Customer postal codes
Zip 4
Zip 5
Third-Party Emailage Fields

These values can be used to create rules with the Emailage service. To see these order
elements in the Business Center, you must enable real-time callouts with Emailage as
described in "Emailage," page 70.
Table 37 Third-Party Emailage Fields
Field Description
Domain Category The category type for the company’s email domain.
Domain Corporate Indicates that domain is registered to a business.
Domain Creation Date Creation date of the domain.
Domain Creation Date-Days Old Number of days since the email domain was created.
Domain Exists Verification of whether the email domain exists.
Domain Name The email address domain name.
Domain Risk Provides the risk level for the domain.

Table 37 Third-Party Emailage Fields (Continued)
Field Description
Email Creation Date Creation date of the email. This field may be blank for
some queries. Returned in UTC format.
Email Creation Date-Days Old Number of days since the email account was created.
Email Exists Verification that the email address exists.
Email First Seen Date The oldest time stamp found for records associated with
the email address.
Email First Seen Date-Days Old Number of days since the email was first seen.
Email Name Match Indicates status of the name of the customer matching the
email owner.
Emailage Reason Provides relevant information to understand the Emailage
Risk Score.
Emailage Recommendation Recommendation based on results of other Emailage
fields.
Emailage Risk Band Indicates the number associated with certain Emailage
Score ranges. Default is 1-6.
Emailage Score Proprietary algorithm that calculates the fraud risk
associated with an email address.
IP Anonymous Proxy Indicates whether the user's IP address is an anonymous
proxy.
IP Reputation Reputation of the proxy. Indicates the likelihood that the
user's IP address is an open proxy.
IP Risk Level Provides the fraud risk level for the IP address.
Phone Syntax Validation Indicates whether the phone syntax is valid.
Social Media Friends Total friends for the email owner located on social media
sites.

Third-Party Perseuss Fields

These values can be used to create rules with the Perseuss service. To see these order
elements in the Business Center, you must enable real-time callouts with Perseuss as
described in "Perseuss," page 71.
Table 38 Third-Party Perseuss Fields
Field Description
Passenger maximum score Maximum passenger score
Passenger minimum score Minimum passenger score
Passenger score Any of the passenger scores received for the transaction
Passenger score (Single) Any of the passenger scores received for the transaction.
When combined with other (Single) elements in a rule, the
score has to appear within the same offer line (line item)
as the other (Single) elements.

Third-Party Whitepages Pro Fields

These values can be used to create rules with the Whitepages Pro service. To see these
order elements in the Business Center, you must enable real-time callouts with
Whitepages Pro as described in "Whitepages Pro," page 73.
Table 39 Third-Party Whitepages Pro Fields
Field Description Response Examples

Billing Phone and Shipping Phone Checks
Billing Phone Valid Flag Indicates whether the phone is a  TRUE
valid phone number and has been
Shipping Phone Valid Flag  FALSE
assigned to a carrier.
 null
Billing Phone-to-Name Match Verifies whether the subscriber  Match
Status name for the phone matches the
 No match
input name.
Shipping Phone-to-Name
Match Status  No name found
 null
Billing Phone-to-Address Verifies whether the address  Match

Match Status associated with the phone matches
 Postal match
the input address. A no match can
Shipping Phone-to-Address
be the result of family plans or  Zip+4 match
Match Status
phones belonging to a business.
 City/State match
 No match
 null
Billing Phone Country Code Country code for the input phone. Use ISO country code value.
Shipping Phone Country
Code
Billing Phone Commercial Indicates whether the phone is  TRUE
Flag registered to a business.
 FALSE
Shipping Phone Commercial
 null
Flag

Table 39 Third-Party Whitepages Pro Fields (Continued)

Billing Phone Line Type Indicates the line type for the input  Mobile
phone such as landline, mobile,
Shipping Phone Line Type  Landline
fixed or non-fixed VoIP (including
Google Voice or Skype), premium  Fixed VOIP
number, toll-free number, or
 Non-fixed VOIP
international number.
 Premium
 Tollfree
 Voicemail
 Other
 Unknown
 null
Billing Phone Carrier The company that provides voice Use custom value and enter the name of
and/or data services for this phone the provider, for example, Verizon.
Shipping Phone Carrier
number.
Billing Phone Prepaid Flag Indicates whether a mobile number  TRUE
is part of a prepaid service plan.
Shipping Phone Prepaid Flag  FALSE
 null
Billing Address and Shipping Address Checks
Address Warnings Warning message.  Invalid input
 Not found
 Missing unit/apt/suite
number
 Invalid unit/apt/suite
number
 Empty array ([])
Billing Address Valid Flag Indicates whether the address is a  TRUE
valid existing address.
Shipping Address Valid Flag  FALSE
 null


Address Diagnostics Message to describe the level of  Premise empty
validation for an international
 Some corrections made
address.
 Validated only country
 Validated only city,
country
 Validated only postal code,
city, country
 Validated only street,
postal code, city, country.
Premise not validated
 Validated
Billing Address Active Flag Indicates whether the address is  TRUE
currently receiving mail.
Shipping Address Active Flag  FALSE
 null
Billing Address-to-Name Verifies whether the name for the  Match
Match Status address matches the input name.
 No match
Shipping Address-to-Name
Match Status  No name found
 null
Billing Address Commercial Indicates whether the address is a  TRUE
Flag business address.
 FALSE
Shipping Address
 null
Commercial Flag
Billing Address is Forwarder Indicates whether an address is  TRUE
performing freight forwarding or
Shipping Address is  FALSE
reshipping services.
Forwarder
 null
Billing Address Type Indicates delivery point for the  Commercial mail drop
address, such as commercial mail
Shipping Address Type  Multi unit
drop, multi unit, single unit, or PO
box.  Single unit
 PO Box
 PO Box Throwback
 Unknown address type
 null


Email Checks
Email Warnings Diagnostic message for the Email  The mailbox is invalid or
Valid Flag when the email is invalid. does not exist
 Timeout
 General syntax error
 Invalid character in
address
 Invalid domain syntax
 Invalid username syntax
 Invalid username syntax for
that domain
 Address is too long
 Address has unbalanced
parentheses, brackets, or
quotes
 Address does not have a
username
 Address does not have a
domain
 Address does not have an @
sign
 Address has more than one @
sign
 Invalid top-level-domain
(TLD) in address
 IP address not allowed as a
domain
 Comments are not allowed in
email addresses
 Unquoted spaces are not
allowed in email addresses
 Domain does not exist
 Domain does not have a
valid IP address


Email Warnings (Continued)  Domain cannot receive email
 The mailbox is invalid or
the username does not exist
at the domain
 Mailbox is full and cannot
receive email at this time
 Mail is not accepted for
this domain
 Addresses with that
username are not allowed
 Addresses with that domain
are not allowed
 Address is a bot or other
suppression
 Address is a role-based
account
 Address is a known bouncer
 Address is a spamtrap or
known complainer
 Address has opted out from
commercial email
 Internal error
Email Valid Flag Indicates whether the email address  TRUE
is valid and email deliverable.
 FALSE
 null
Email Valid Diagnostic Diagnostic message for the Email  Domain does not support
Message Valid Flag when the email is valid. validation (accepts all
mailboxes)
 Syntax OK
 Syntax OK and domain valid
according to the domain
database
 Syntax OK, domain exists,
and mailbox does not reject
mail


Email Auto-Generated Indicates whether the email is  TRUE
potentially auto generated.
 FALSE
 null
Email Domain Disposable Indicates whether the email domain  TRUE
is disposable.
 FALSE
 null
Email-to-Name Match Verifies whether the registered  Match
name for the email matches the
 No match
input name.
 No name found
 null
Email First Seen Days Days since the email was first seen. Enter numerical value/integer.
Email Domain Age in Days Days since the email domain was Enter numerical value/integer.
created.
Identity Checks
Identity Check Score Predictive score based on all 0 - 1000
Whitepages attributes. A higher
score indicates more risk.
Stolen Identity Risk Level Predictability of identity theft.  1 – low
 2 – medium
 3 – high
IP Address Checks
IP Warnings Warning message.  Invalid Input
 IP address is in private
range
IP Address Valid Flag Indicates whether the IP address is  TRUE
valid.
 FALSE
 null
IP Proxy Flag Indicates whether the IP address is  TRUE
a known proxy.
 FALSE
 null
Distance between IP and Distance between the IP Enter numerical value/integer.
Closest Input Address geolocation and closest physical
address.
Distance between IP and Distance between the IP Enter numerical value/integer.
Phone Registered Address geolocation and closest phone
location (primary or secondary).


IP Connection Type Connection type of the IP address.  Cable/DSL
 Corporate
 Cellular
 Dial-up
 null
IP Geolocation Postal Code Postal code corresponding to the IP Use postal code value.
geolocation.
IP Geolocation City City corresponding to the IP Use city name value.

geolocation.
IP Geolocation Country Country corresponding to the IP Use country name value.

Name geolocation.
IP Geolocation Continent Continent corresponding to the IP  EU

Code geolocation.
 AS
 NA
 AF
 AN
 SA
 OC
 null
IP Geolocation Country Code Phone country code corresponding Use ISO country code value.
to the IP geolocation.
Custom Fields
All the custom fields that you created are listed at the bottom of the menu in the order in
which they appear in the custom fields window. In that window, fields are listed according
to their mapping to the specific merchant-defined data field (from 1 to 100).

Sample Custom Rules

This section comprises a set of sample custom rules similar to those that you might create
for your business.
Except for regular expressions, rules are not case sensitive.
Important
Item and Amount Elements

The figure below represents a sample invoice with the amount and item fields:
 Card authorization results: These order elements apply only to card payments. You
receive several reply fields that interpret the results of your request to validate
authentication and authorize the transaction. You can use these fields singly or in
combination when you want to find specific results. For example, you can combine the
authorization card verification result field and the card verification result field to find
orders that may reveal specific card verification results.
 Card information
 Monetary information: You can use these fields when you want to find any monetary
information. The figure below represents a sample invoice with the amount and item
fields. If you send in the purchaseTotals_grandTotalAmount (Simple Order API) or
grand_total_amount (SCMP API) field without one or more line items, a line item is
created for you. Therefore, if you create custom rules that use Amount (Offer), which
is the Decision Manager equivalent of a line item in the Business Center, your custom
rule triggers whether or not you send an offer line in your API request. To avoid this
issue, CyberSource recommends that you always send a line item in your request.
Invoice Fields

Date and Time

This sample rule describes in detail how to create a rule; the sample rules that follow
provide only the values that you would select and the resulting rule.
These examples use order elements pertaining to the date and time when the order was
placed.
Time and Time Zone Conversion

In the Rule Editor, all days and times are in UTC. Make sure to calculate correctly the
offset of your time zone from UTC, keeping in mind the differences between standard and
daylight saving time, also called summer time. Daylight saving time is not observed in all
states and countries and may not start or end on the same date everywhere.
With daylight saving time, the offset from UTC is one hour less than with standard time.
For example, during standard time, EST is 5 hours behind UTC: 9 AM EST is 14:00:00
UTC, and 5 PM EST is 22:00:00 UTC. During daylight saving time, the offset from UTC is
4 hours. When using a date, use greater or less to represent after or before.

Day and Time of Payment

You can use these order elements to create rules to find payments for a specific day of the
week (Transaction day of week) or time of day (Transaction time of day). You need to
create different sets of rules for orders placed during business hours, which span one day,
versus those placed outside business hours, which span two days. For all these rules, you
can create the first condition (days of the week) in two ways: by adding the days that you
want to find or by excluding those that you do not want. You can also use a custom list
with the appropriate values.
Orders Placed During Business Hours

This custom rule would find orders placed during business days and business hours:
Monday – Friday from 9 AM – 5 PM EST.
Rule name Weekdays during business hours

First condition Monday – Friday
Order Element Transaction day of week
Comparison Operator is equal to
Comparison Value Monday Tuesday Wednesday Thursday Friday
by exclusion Comparison Operator is not equal to
Comparison Value Saturday Sunday
Second condition Starting business hour
Order Element Transaction time of day
Comparison Operator is greater than
Comparison Value 14:00:00
Third condition Ending business hour
Comparison Operator is less than
Condition relationship All conditions are true.

Orders Placed Outside Business Hours

Together, these two custom rules would find orders placed during business days but
outside business hours: from 5 PM EST Monday – Thursday to 9 AM Tuesday – Friday.
First rule name Weekdays 5 PM to midnight

Comparison Value Monday Tuesday Wednesday Thursday
Comparison Value Friday Saturday Sunday
Second condition Starting business hour

Second rule name Weekdays midnight to 9 AM

Comparison Value Tuesday Wednesday Thursday Friday
Comparison Value Saturday Sunday Monday
Second condition Ending business hour
Screening Your Customer Lists

To screen orders for more than one information or factor code, use the contains or does
not contain operators. To screen orders for a group of information codes, such as those for
the negative list, use the code’s prefix: NEG-.
Positive List
To ensure that the orders from your best customers are processed rapidly and efficiently,
screen orders for data added permanently or temporarily to your positive list. Because
addition to the positive list takes precedence over addition to the negative list, you can
also create a rule for data added to both lists. You can also screen orders with a rule
created with the score factor code E (positive list).
You can use this custom rule in a profile set to accept orders automatically.
Rule name Positive List

First condition Order Element Fraud score customer list information
Comparison Value Customer on permanent positive list

Second condition Order Element Fraud score customer list information

Comparison Value Customer on temporary positive list
Third condition Order Element Fraud score customer list information
Comparison Value Customer on positive and negative lists
Relationship At least one condition is true.
Negative List
To ensure that the orders from your undesirable customers are processed appropriately,
screen your orders for information that can appear on your negative list, such the card
account number, phone number, or shipping address, as shown in this example:
Rule name Negative List

Comparison Value Billing address on negative list
Comparison Value Card number on negative list
You can also create rules with the score factor code F and for any of the information codes
specific to the negative list.
Rule name Negative List

Condition Order Element Fraud score customer list information
Comparison Value "NEG-"
Condition relationship Not relevant.

Review List
Use the review list to watch for information without adding it to the negative list. The data
on the review list is the same data that can appear on your negative list.
To ensure that all orders are reviewed thoroughly, you can create rules to screen your
orders for specific information that can appear on your review list, such the card account
number, phone number, or shipping address. This example shows a rule that screens
orders for the billing address and account ID present in the review list.
Rule name Review List

Comparison Value Billing address on review list
Comparison Value Customer’s account ID on review list
Matching the Customer’s Billing Address to the

Order’s IP Address
In some cases, creating custom rules with information codes produces the most useful
results. For example, instead of creating a rule that compares non-U.S. IP addresses,
create a rule that screens orders for information codes that can be returned in these
cases. With this method, all non-U.S. IP addresses are marked for review or rejection
instead of only those that you added to the rule.
Your goal is to assess the level of risk associated with a customer by extracting the IP
address from the customer’s browser and comparing its decoded elements to the
customer’s physical location. These examples provide different combinations IP and
billing address information.

Reviewing Inconsistent Decoded IP and Billing Addresses

When adding this rule to a profile, set it to review all orders that the rule triggers.
Regardless of the order in which you list the comparison values, the tests are
always performed in this order: country > state > city.
Note
Rule name IP Address

Condition Order Element Fraud score Internet information
Comparison Value "IP address inconsistent with billing
country", "IP address inconsistent with
billing state", "IP address inconsistent
with billing city"
Condition relationship At least one condition is true.
Rejecting Risky or Unknown IP Routing Methods

When adding this rule to a profile, set it to reject all orders that the rule triggers.
Rule name Routing Method

Condition Order Element Fraud score Internet information
Comparison Value "IP address from risky source", "IP address
from anonymous proxy"
Reviewing or Rejecting Orders Originating Outside of U.S. or

Canada
When adding this rule to a profile, set it to review or reject all orders that the rule triggers.
Rule name Decoded IP country of origin

First condition Order Element Decoded IP country
Comparison Operator is not equal to
Comparison Value <custom list that contains U.S. and Canada>

Accepting Orders from Specific IP Address

This is an example of a rule to accept automatically orders that come from certain IP
addresses. Your options are to set the rule to Monitor, Accept, Review, or Reject.
Rule name Specific IP address

Condition Order Element IP Address
Comparison Value Custom list of IP addresses
Custom Fields and Custom Lists

You can create custom rules with data specific to your business.
note
When your custom field uses a date as data type, use the greater than or less
than operators to represent after or before. Use the same format as for the
Note predefined date order elements: mm/dd/yyyy (in UTC).
You can use the rules in the following examples with any profile. Your options are to set
the rules to Monitor, Review, or Reject.
Custom Field
Create the rule with these values:
Rule name Custom date field

Condition Order Element Payment Date
Comparison Value 05/08/2009
Condition relationship Not relevant

Custom List
This example shows how to create a custom rule to screen orders placed from specific
cities. After having created a custom list containing one or more city names, create a rule
with these values. In this rule, the comparison value is a custom list named Cities. By
using a list, you do not need to create many conditions to accomplish the same goal.:
Rule name Custom list of cities

Condition Order Element Billing city
Comparison Value Cities
AVS Codes
This example shows how to substitute a predefined rule with a custom rule. A merchant is
willing to ship up to $200 in merchandise if the street address matches the bank’s records
even if the postal code does not. However, the same merchant is willing to ship only up to
$50 if the street address does not match the bank's records, but the postal code does.
Because of the number of variables (address verification codes and authorization

amounts) and the possible combinations of these variables, you need two rules. Create
these rules by excluding the unwanted values.
Rules To screen these Create these conditions

orders...
High Amount Up to $200. Amount is greater than $200.
AVS Partial Match Street address W - Partial match: 9-digit postal code matches.
matches, but the
Z - Partial match: 5-digit postal code matches.
postal code does not.
Low Amount Up to $50. Amount is greater than $50.
AVS Partial Match Postal code matches, A - Partial match: address matches.
but the street address
does not.

Create the first rule as follows:
Rule name AVS Partial Match - High Amount

This rule marks for review orders over $200 where the street address matches, but the
postal code does not.
First condition Order Element Authorization Amount
Comparison Value 200
Second condition Order Element Authorization AVS code
Comparison Value W - Partial match: 9-digit postal code
matches
Z - Partial match: 5-digit postal code
matches
Create the second rule as follows:
Rule name AVS Partial Match - Low Amount

This rule marks for review orders over $50 where the postal code matches, but the street
address does not.
First condition Order Element Authorization Amount
Comparison Value 50
Second condition Order Element Authorization AVS code
Comparison Value A - Partial match: address matches
The next step is to set to Monitor the predefined rule named Partial AVS match (either the
street address or the postal code matches) and to add the above custom rules to your
profile(s):
Step 1 In the navigation pane, click Profiles.
Step 2 Click the name of the profile to which you want to add this custom rule.
Step 3 Set to Monitor the predefined rule named Partial AVS match (Either the street address or
the postal code matches).
Step 4 Set the custom rules either to Monitor or Review.

Export Data
You can use the reply data from the export service to ensure that no restrictions exist with
any of the data in the order.
Restricted Countries and Lists

This sample rule screens orders for restricted countries and entities on specific restricted
sublists or programs within lists.
Rule name Export Information

First condition Order Element Export Information
Comparison Value(s) "Billing country restricted", "shipping
country restricted"
Second condition Order Element Export match program
Comparison Value <custom list of programs>
Restricted Individuals and Organizations

This sample rule screens orders for restricted individuals or organizations. With this rule,
you can ensure that you match the name and the address instead of only the name, which
may yield false positive results.
Rule name Export Information

First condition Order Element Denied Parties List name match 1
Comparison Value(s) <custom list of customer names>
Second condition Order Element Denied Parties List address match 1
Comparison Value <custom list of billing or shipping addresses>
When adding this rule to a profile, set the rule to reject the order if it is triggered.

Velocity Rules
You can create rules by using the order element named Merchant-specific velocity. With
this element, you can use the default velocity rules and any of the velocity rule information
that you already have. The available comparison values are your order and product
velocity rules arranged alphabetically in the drop-down menu as follows: numbers,
uppercase letters, lowercase letters, and symbols.
Case
Merchant velocity rules that contain custom fields and product velocity rules
that contain product SKUs are case sensitive.
Important When you delete a rule, the corresponding information code is also deleted.
Therefore, immediately after you delete the rule, modify or delete the
condition or custom rule that you created with this information code.
This example shows how to use the information codes that were generated when you
created the order velocity rules. In the comparison values, instead of the actual
information code, the name of the velocity rule for which the information code was
generated appears.
Rule name Merchant velocity

Condition Order Element Merchant-specific velocity
Comparison Value Default rule 15-EM-3
Postal Codes (Regular Expressions)

You can use a regular expression in a custom rule to search for patterns in your orders,
such as part of a sentence, an email address, or a type of product. Regular expressions
are case sensitive.
When screening your orders for a specific postal code, you may want to screen for part of
a single postal code or a series of codes. These examples describe how to create simple,
multiple, and complex conditions. When using the postal code order element, you can
search for up to 10 characters.

Single Postal Codes with Simple Conditions

You want to create a custom rule to screen orders for the postal code starting with 940.
You cannot use the comparison operator called contains because it does not allow you to
distinguish between 94086 and 73940. Instead you can use this regular expression ^940
to create a rule with one condition with these parameters:
Rule name Single postal code

Condition Order Element Billing postal code
Comparison Operator REG EXP
Comparison Value ^940
Multiple Postal Codes with Multiple Conditions

To screen the orders with postal codes that start with 940 and 986, convert the regular
expression into a rule with two conditions:
Rule name Multiple postal codes

First condition Order Element Billing postal code
Comparison Value(s) ^940
Second condition Order Element Billing postal code
Comparison Value ^986
Multiple Postal Codes with Complex Conditions

You can minimize the number of rule conditions by grouping several elements in the same
condition. For example, if you want to identify all the individual postal codes within several
series, such as 9408 (9408X), 9404, 8523, and 7114, you can write a regular expression
such as this one: ^(9408|9404|8523|7114)
You translate the regular expression into a rule with a complex condition:
Rule name Complex condition (multiple postal codes)

Comparison Value ^(9408|9404|8523|7114)

Postal Codes +4 with Complex Conditions

You want to screen the orders that contain one or more postal codes +4. You can create a
regular expression such as this one: ^940[0-9]{2}(-[0-9]{4})?$. This expression
functions as follows:
^940[0-9]{2} This part searches for all 5-digit postal codes that start with 940 and end
with any two digits, such as 94099.
(-[0-9]{4})?$ This part searches for a postal code extension (if present) that starts with
a hyphen and ends with four digits between 0 and 9, such as 94099-
1238.
Rule name Postal code +4

Comparison Value ^940[0-9]{2}(-[0-9]{4})?$
The custom rule is not triggered by these postal codes: 94045- (four digits missing),
94045-123 (one digit missing), or 940456789 (no hyphen). Orders with these postal codes
are accepted.

API Fields
Next to each order element is the equivalent request or reply field name for the Simple
Order and SCMP APIs. Order elements for device fingerprinting are listed in the Decision
Manager Device Fingerprinting Guide (PDF | HTML).
Table 40 Order Element to API Field Mapping
Order Elements Simple Order API Field Names SCMP API Field Names
AVS code (external) afsService_avsCode avs
Amount (Grand Total) — —
Amount (Offer)
Amount (Single Offer) item_#_unitPrice amount
Amount (Subtotal) — —
Authorization amount ccAuthReply_amount auth_auth_amount
Authorization AVS code ccAuthReply_avsCode auth_auth_avs
Authorization card verification result ccAuthReply_cvCode auth_cv_result
Authorization EV billing address1 ccAuthReply_evStreet auth_ev_street
Authorization EV email address ccAuthReply_evEmail auth_ev_email
Authorization EV last name ccAuthReply_evName auth_ev_name
Authorization EV phone number ccAuthReply_evPhoneNumber auth_ev_phone_number
Authorization EV postal code ccAuthReply_evPostalCode auth_ev_postal_code
Billing city billTo_city bill_city
Billing country billTo_country bill_country
Billing first name billTo_firstName customer_firstname
Billing last name billTo_lastName customer_lastname
Billing phone number billTo_phoneNumber customer_phone
Billing postal code billTo_postalCode bill_zip
Billing state billTo_state bill_state
Billing street address 1 billTo_street1 bill_address1
Billing street address 2 billTo_street2 bill_address2
Card account type afsReply_cardAccountType score_card_account_type
Card BIN card_bin cc_bin
Card BIN country afsReply_binCountry bin_country
Card issuer afsReply_cardIssuer score_card_issuer
Card scheme afsReply_cardScheme score_card_scheme
Card verification number card_cvNumber customer_cc_cv_number
CV result (external) afsService_cvCode cv_result

Table 40 Order Element to API Field Mapping (Continued)
chinaPaymentService_
China payment mode paymentMode payment_mode
Company name billTo_company company_name
decisionManager_travelData_ decision_manager_travel_
Complete travel route completeRoute complete_route
Connection method — —
CPF/CNPJ billTo_personalID personal_id
Credit card expiration month card_expirationMonth customer_cc_expmo
Credit card expiration year card_expirationYear customer_cc_expyr
Credit card number card_accountNumber customer_cc_number
Credit card type card_cardType card_type
Currency purchaseTotals_currency currency
Customer account ID billTo_userID customer_account_id
Customer’s IP address billTo_ipAddress customer_ipaddress
Decline AVS flags businessRules_declineAVSFlags decline_avs_flags
Decoded email country — —
Decoded host name country — —
Decoded IP anonymizer status afsReply_ipAnonymizerStatus score_ip_anonymizer_status
Decoded IP city afsReply_ipCity score_ip_city
Decoded IP country afsReply_ipCountry score_ip_country
Decoded IP routing method afsReply_ipRoutingMethod score_ip_routing_method
Decoded IP state afsReply_ipState score_ip_state
Denied Parties List address match 1 deniedPartiesMatch_0_address_0 export_match1_address1
Denied Parties List name match 1 deniedPartiesMatch_0_name export_match1_name1
Distributor product SKU (Offer) —
Distributor product SKU (Single Offer) distributor_product_sku
E-commerce indicator ccAuthService_commerceIndicator e_commerce_indicator
Email address billTo_email customer_email
Export information exportReply_infoCode export_info
Export match program deniedPartiesMatch_N_program_N export_matchN_programN
Fraud score address information afsReply_addressInfoCode score_address_info
Fraud score customer list information afsReply_hotlistInfoCode score_hotlist_info
Fraud score factors afsReply_afsFactorCode score_factors
Fraud score host severity afsReply_hostSeverity score_host_severity
Fraud score identity information afsReply_identityInfoCode score_identity_info
Fraud score Internet information afsReply_internetInfoCode score_internet_info

Fraud score phone information afsReply_phoneInfoCode score_phone_info
Fraud score result afsReply_afsResult score_score_result
Fraud score suspicious information afsReply_suspiciousInfoCode score_suspicious_info
Fraud score velocity information afsReply_velocityInfoCode score_velocity_info
Gift wrap invoiceHeader_isGift customer_gift_wrap
Host name billTo_hostname customer_hostname
decisionManager_travelData_ decision_manager_travel_journey_
Journey type journeyType type
Maestro (UK Dom.) card issue number card_issueNumber customer_cc_issue_number
Maestro (UK Dom.) card start month card_startMonth customer_cc_startmo
Maestro (UK Dom.) card start year card_startYear customer_cc_startyr
Merchant descriptor invoiceHeader_merchantDescriptor merchant_descriptor
Merchant product SKU (Offer)
Merchant product SKU (Single Offer) item_#_productSKU merchant_product_sku
Merchant reference number merchantReferenceCode merchant_ref_number
Merchant-specific velocity decisionReply_velocityInfoCode decision_velocity_info
Number of passengers — —
payerAuthValidateReply_
PA authentication result authenticationStatusMessage pa_validate_pares_status
PA authentication result (raw) authenticationResult pa_validate_authentication_result
PA authentication e-com. indicator commerceIndicator pa_validate_e_commerce_indicator
payerAuthEnrollReply_
PA enrollment e-com. indicator commerceIndicator pa_enroll_e_commerce_indicator
payerAuthEnrollReply_
PA enrollment check result veresEnrolled pa_enroll_veres_enrolled
Passenger email
Passenger email (Single) item_#_passengerEmail passenger_email
Passenger first name
Passenger first name (Single) item_#_passengerFirstName passenger_firstname
Passenger ID
Passenger ID (Single) item_#_passengerID passenger_id
Passenger last name
Passenger last name (Single) item_#_passengerLastName passenger_lastname
Passenger phone
Passenger phone (Single) item_#_passengerPhone passenger_phone

Passenger status
Passenger status (Single) item_#_passengerStatus passenger_status
Passenger type
Passenger type (Single) item_#_passengerType passenger_type
Payment Type — —
Product code (Offer)
Product code (Single Offer) item_#_productCode product_code
Product name (Offer)
Product name (Single Offer) item_#_productName product_name
Product risk (Offer)
Product risk (Single Offer) item_#_productRisk product_risk
Quantity (Offer)
Quantity (Single Offer) item_#_quantity quantity
Reason code — —
Returns accepted invoiceHeader_returnsAccepted returns_accepted
Shipping city shipTo_city ship_to_city
Shipping country shipTo_country ship_to_country
Shipping first name shipTo_firstName ship_to_firstname
Shipping last name shipTo_lastName ship_to_lastname
Shipping method shipTo_shippingMethod shipping_method
Shipping phone number shipTo_phoneNumber ship_to_phone
Shipping postal code shipTo_postalCode ship_to_zip
Shipping state shipTo_state ship_to_state
Shipping street address 1 shipTo_street1 ship_to_address1
Shipping street address 2 shipTo_street2 ship_to_address2
Sum of offer quantities — —
Time to departure — —
Total number of offers — —
Transaction date — —
Transaction day of week — —
Transaction time of day — —

APPENDIX
Third-Party Services
B
This appendix describes each of the third-party service results.
For information about configuring Decision Manager to display third-party service

information in the case details window, see "Enabling Third-Party Services," page 65. For
information about how third-party services display in the case details window, see "Third-
Party Services," page 247.
192.com
The results comprise summary and detailed information.
Summaries
Do not use the summary results alone to decide the outcome of the order.
Report Summary
This section provides an overview of the possible categories of results that appear for
each order.
KYC Summary
The KYC (Know Your Customer) Summary is an overview section that provides the
number of times when the customer’s information was found in a database. When two
instances of the full name and address match that might be significant. However, the Alert
Count result is always significant.
Full Name and Number of instances in which the customer's first and last names match
Address Count the address.
Surname and Number of instances in which the customer's last name matches the
Address Count address.

Appendix B Third-Party Services
Address Count Number of instances in which the customer's address was verified.
Alert Count Number of instances in which the full name and address were found in a
negative database.
Input Details
This section describes the information used to screen the order.
Reference Number ID generated by the service for the order.

Merchant Ref No Your CyberSource order or reference number.
Search Date Date and time of the search in the format YYYY-MM-DD HH:MM:SS,
for example: 2008-05-28 08:10:47.
Name Complete name.
Address Complete address.
Telephone Number Customer's phone.
Email Customer’s email address.

Details
Credit Reference
Total Number of Number of verifications performed.
Verifications
Active Credit Account Active account open within the past six months. This field contains
either Match or No Match.
Date of Birth Customer's date of birth. The birth date is stored encrypted; it is not
displayed.
Electoral Roll Current Electoral Roll. This field contains either Match or No Match.
Electoral Roll Date of Birth Customer's date of birth in the current Electoral Roll. The Electoral
Roll contains very few dates of birth. This field contains either Match
or No Match.
Telephone Directory Last name with a telephone directory. This field contains either
Match or No Match.
Phone Number Phone number provided. This field contains either Match or No
Match.
Bank of England (BOE) HM Treasury (formerly Bank of England) Sanctions List. This field
contains either Match or No Match.
Politically Exposed (PEP) Politically Exposed Persons List. This field contains either Match or
No Match.
Office of Foreign Assets Office of Foreign Asset Control (US Treasury) Sanctions List. This
Control (OFAC) field contains either Match or No Match.
Deceased Deceased persons database. This field contains either Match or No
Match.
Change of Address Linked or forwarding address. This field contains either Match or No
Match.
CIFAS U.K.'s Fraud Prevention Service. This field contains either Match or
No Match.
Number of County Court Number of matches to full name and address.
Judgements (CCJs)
Number of Open Number of open accounts.
Accounts/Lenders
Standardized Address Complete address, including whether the address is current and the
number of months and years at that address.

Deceased
Source Source of the death record. This field can contain one of these
values:
 HALO
 ReAD
 Other
 Unknown
Confidence Level Each record is assigned a degree of confidence from 1 (least
accurate) to 10 (most accurate). Usually, 1 indicates data supplied
by third-party sources and 10 indicates data supplied by the
government's official death records.
Date of Death Month and year of death.
Directors
Name Complete name.
Marital Status This field can contain one of these values:
 Married
 Single
 Other
 Divorced
 Widowed
 Cohabiting / Living with partner
 Separated
 Unknown
Address Complete address, including whether the address is current.
Electoral Roll
Name Customer's name.
Address Complete address, including whether it is current and the number of
months and years at that address.
Example 21 Your St
Any Town, IM348AB GBR
Current=Yes
Time at Address=06 years 00 months
Years List of the years that the customer appeared in the Electoral Roll, for
example: 2007, 2008, 2009, 2010.

Fraud
Fraud Type This field can contain one of these values:
 Suspected Fraud
 Reported Fraud
 Other
Fraud Sector Sector of industry in which the fraud incident occurred. This field can
contain one of these values:
 Retail
 Gaming
 Finance and Banking
 Insurance
 Government
 Other
Fraud Date Date of the incident in this format: YYYY-MM-DD
Name Customer's name in the fraud database.
Commercial Entity Whether the customer is a business. This field can contain either
Yes or No.
Access Level Type of information. This field can contain one of these values:
 Public
 Private
 Restricted
Author Name of the organization or person who posted the record.
Address Customer's address containing the premises number, the postal
code, and whether the address is current.
Ship Address Customer's shipping address containing the premises number, the
postal code, and whether the address is current.
Email(s) Email address associated with the fraud instance.
IP Address IP address associated with the fraud instance.
Comments Additional information. If the card number is present, only the last
four digits are shown. Each comment used in scoring the order is
separated by a pipe ( | ). The number that appears in parentheses
after an element is a positive or negative score. A high positive
number represents a greater risk than a low positive number, which
represents a greater risk than negative numbers. For example,
Email used at multiple addresses (10) is riskier than More vowels
than consonants in email (1).

Telephone
Name Complete name.
Address Complete address, including whether the address is current.
Telephone Number Customer's telephone number.
Type Type of phone number. This field can contain one of these values:
 Home
 Home Fax
 Work
 Work Fax
 Mobile
 Landline
 Other
 Unknown
Customer Type Type of phone service. This field can contain one of these values:
 Residential
 Commercial
Listing Type This field can contain one of these values:
 Director Enquiries
 Director Enquiries Restricted
 Ex Directory

Examples
These examples show different types of results. Names and addresses are masked.
When evaluating results, you need to consider the rest of the order data and your
business rules.
Example 11 Information Found in a Few Databases
Match Found: some of the customer’s information was found in databases.

No Match Not found (suspicious): none.
No Match Not found in negative database: in general, the absence of a match does not affect
order evaluation.
Caution Found in a negative database: a match to the Deceased section is considered
negative when verifying the identity of the customer who placed the order because of
the possibility of fraud, such as with identity theft.
- Not used.
Example 12 Information Found in Various Sources
Match Found: A significant amount of the customer’s information was found in databases.
Although the address provided by the customer appears valid and legitimate, the
phone number was not found.
No Match Not found (suspicious): The phone number in the input details matches the number
in the Telephone Number section (phone directory database). However, this phone
number appears invalid. The customer may have accidentally entered an incorrect
number, or the number might be fraudulent.
No Match Not found in negative database: In general, the absence of a match does not affect
order evaluation.
The absence of phone number match is considered less risky in the credit reference
section than in the telephone section. For example, the phone number in the Credit
Reference section might be the customer’s old number.
Caution Found in a negative database: This information and the court judgment make this
order suspicious. The comments at the bottom of the fraud section describe the
suspicious elements and the number of times that were matched in parentheses, for
example:
Card used frequently (4)
Email used at multiple addresses (8)
High value spending at billing address (5)
Some of these elements may represent true fraud whereas others may not.
- Not used.

Accurint
Accurint can return the following information:
Name Customer's complete name

Address Customer's street address
City, State Postal Code Remainder of the customer's mailing address
Probable Current Address When several records exist, the most recent record is likely
to be current. The possible values are Yes and No.
Phone Number Customer's complete phone number in the format
1234567890
Phone Account Holder Complete name of the telephone customer
Deceased Whether the customer is likely to be deceased
Date Record Verified Verified date range for the address. A range displaying only
the years or the year and the month might appear.
Figure 92, page 305, shows the complete result, a total of 10 records, for a fictitious
customer. After reviewing these results, you would compare the information with that
provided by the customer and with the results of any other service before deciding
whether to accept or reject the order.
 The name varies slightly among the records (John Doe, John Benjamin Doe, etc.), but
all records appear to refer to the same person.
 This customer has three past addresses (records 1 – 4, 5 – 6, and 7 – 10) with minor
syntax differences in each address. Only the first address is listed as the probable
current address.
 The phone number is present in only half of the records. Therefore, you might need to
use another service to obtain or verify the number.
Each record was valid for the time period listed; the total time span ranges from February
1997 to February 2008.

Figure 92 Accurint Result Example

Credilink
Credilink requires only the Cadastro de Pessoas Fisicas (CPF) identification number for
individuals or the Cadastro Nacional da Pessoa Juridica (CNPJ) identification number for
businesses to return information that is maintained by the Brazilian revenue agency,
Receita Federal. Credilink returns the following information:
Table 41 Information Returned by Credilink
CPF or CNPJ Identification number submitted

Name Complete name associated with the CPF or CNPJ
Gender Gender of the individual (applies to CPF only)
Phone Number Full telephone number associated with the CPF or CNPJ
Address Street address
Complement Additional street address information
Town District or borough within the city of the entity’s address
Postal Code Postal code for the entity’s address. For example, in the U.S., this is the
zip code. In Brazil, this is the Codigo de Enderecamento Postal (CEP).
City City of the entity’s address
State Federative unit of the entity’s address. For example, in the U.S., this
indicates the state where the entity resides. In Brazil, this indicates the
Unidades Federativas where the entity resides.

The information that Credilink returns appears in the Business Center as follows:
Figure 93 Credilink Results Example (U.S. English)
Figure 94 Credilink Results Example (Brazilian Portuguese)

Emailage
Emailage provides identity intelligence and information based on a customer’s email
address.
Emailage returns the Emailage Score and other results assigned to that customer and
transaction. The information that Emailage returns appears in the Business Center as
follows:
Figure 95 Emailage Results Example

Perseuss
Perseuss is an enrollment-required service which keeps records of negative-fraud traveler
information. It applies to travel merchants who are processing passenger-related
information.
Perseuss returns the Passenger Identifier and Score assigned to that passenger and
transaction. Click the Perseuss Results link to log into the Perseuss site with your
Perseuss credentials to see more information.
The information that Perseuss returns appears in the Business Center as follows:
Figure 96 Perseuss Results Example

TARGUSinfo
The sections below explain the possible results, including an order example in which the
data is modified to illustrate how the order can be evaluated by the service.
Possible Results
The following tables list the results that you can receive with an explanation for each
result.
Match Results
This table shows the overall result of the order evaluated by the service.
Table 42 TARGUSinfo Match Results

No result is available Input data does not meet any match criteria.
Invalid address and phone number Address cannot be standardized according to the USPS,
and the phone number is invalid.
Name, address, and phone number Name, address, and phone number match.
match
Name and phone number match; Name and phone number match, but address
address unavailable information is not available.
Name and phone number match; Name and phone number match, but a different address
different address is associated with the phone number.
Address and phone number match; Address and phone number match, but no name is
name unavailable associated with phone number.
Address and phone number match; Address and phone number match, but different
different customer name customer name is associated with phone number.
Name and address match; business Name and address match; phone number is associated
phone number with a business.
Name and address match; invalid Name and address match, but phone number is invalid.
phone number
Name and address match; business Name and the address match; phone number is
phone number associated with a business.
Name and address match; wireless Name and address match; phone number is wireless.
phone number
Name and address match Name and address match.
Name and phone do not match; Different customer name is associated with phone
different customer name number.
Name and phone number do not Different business name associated with phone number.
match; different business name

Table 42 TARGUSinfo Match Results (Continued)

Wireless phone number does not Phone number is wireless; does not match name or
match name or address address.
Valid address but invalid phone Address can be standardized according to USPS, but
number phone number is invalid.
No information available No information is available for name, address, or phone
number.
Based on the Phone

This section of the TARGUSinfo results means that by using only the phone number
provided in the billing information, TARGUSinfo can match the phone number to the name
and address listed. Compare this result to the billing information provided by the customer
and to the result obtained in the “Based on the address” section shown in Figure 97.
Figure 97 TARGUSinfo Phone and Address Results
Based on the Address

City, State Postal Code Rest of the customer's mailing address
This section of the TARGUSinfo results means that by using only the billing address,
TARGUSinfo can match the address to the name, standardized address, and phone
number listed. Compare this result to the billing information provided by the customer and
to the result obtained in the “Based on the phone number” section shown in Figure 97.

City, State Postal Code Rest of customer's mailing address
Phone Number Customer's complete phone number in format
1234567890

Additional Data
This section of the TARGUSinfo results provides other information about the phone
number that may help you determine how long the customer has lived at the address
provided and has used the current phone number.
Figure 98 TARGUSinfo Additional Data Results
Possible Types of Results

Phone in service longer than 6 months Phone number has been in service at present location
for longer than 6 months.
Phone on a do-not-call list Phone number is on state or national (FTC or DMA) do-
not-call list.
Phone is near address Phone number located within 6 miles of address.
Recent change in phone listing Recent change (up to 18 months history), such as
change of name or address, has occurred in phone
listing.
Phone provider Customer has changed provider or between land line
and wireless. Phone number is valid.
This section describes different combinations of name, address, and phone number that
you may encounter when reviewing your orders. Use your business rules to interpret your
data.
 All correct data: In these cases, the name, address, and phone number are complete
and correct.
 Inconsistency in address or phone number: In these cases, either the address

and/or the phone number is incorrect or cannot be linked. Several combinations of
data are possible:
 Correct address with incorrect phone number
 Incorrect address with correct phone number
 No phone number
When the phone number is absent, the results section called Based on the Phone
contains no results.
 All incorrect data

 Address or phone number outside the U.S.: In these cases, either the address or
the phone number is outside the U.S.
 Non-U.S. phone number with correct U.S. address: When the phone number is
outside the U.S., you receive a result for an invalid phone number.
You can receive data from the service only when the address or the phone number is
located in the U.S. When all the billing information is located outside the U.S., you receive
an error message because the service is available only for the U.S.
 Non-ASCII characters: In these cases, you can receive data from the service only
when some of the billing information is in Latin characters:
 Non-ASCII customer name with correct U.S. address.
 Non-ASCII billing address with correct phone number.
When the address contains non-ASCII characters, the results section called
Based on the Address contains no results.
 Non-ASCII billing address without a phone number.

Whitepages Pro
CyberSource customers can leverage the Whitepages Pro Identity Check API through
Decision Manager for building rules and manual review. Merchants do not need to call the
API on all orders. It is only called automatically on orders that are routed through a profile
that contains at least one rule with a condition utilizing Whitepages data.
Merchants who only use the API for manual review can trigger the API call from the Case
Management Details window by clicking Request Information in the Third-Party Services
section.
Figure 99 Whitepages Pro Request Information Link
The Whitepages API response will be saved and stored on each case for which it’s
accessed. If an order leveraged Whitepages Pro data in real time, the data is also saved.
If the data is saved, the link will read “View Information” instead of “Request Information.”
If you click a “View Information” link, you are not charged for that query as you are
accessing cached data.

The information that Whitepages returns appears in the Business Center as follows:
Figure 100 Whitepages Pro Results Example
Whitepages Pro can help reduce manual review and push risky orders into the queue. You
can leverage the service by writing new rules or modifying existing rules to accept, review,
or reject orders.
See "Third-Party Whitepages Pro Fields," page 271 for the order elements you can use in
the Rule Editor to create custom rules; it also includes response examples.
Not all Whitepages Pro results shown in the Case Management window are available as
elements in the Rule Editor.

APPENDIX
Countries Included in the
European Union Risk Model
C
Country Country Code

Aland Islands AX
Andorra AD
Austria AT
Belgium BE
Bouvet Island BV
British Indian Ocean Territory IO
Bulgaria BG
Cyprus CY
Czech Republic CZ
Denmark DK
Estonia EE
Faroe Islands FO
Finland FI
France FR
French Southern Territories TF
Germany DE
Gibraltar GI
Greece GR
Greenland GL
Guernsey GG
Hungary HU
Iceland IS
Ireland IE
Isle of Man IM
Israel IL
Italy IT
Jersey JE
Latvia LV

Appendix C Countries Included in the European Union Risk Model
Country Country Code

Liechtenstein LI
Lithuania LT
Luxembourg LU
Malta MT
Monaco MC
Netherlands NL
Norway NO
Poland PL
Portugal PT
Reunion RE
Romania RO
Saint Helena SH
San Marino SM
Slovakia SK
Slovenia SI
Spain ES
Svalbard & Jan Mayen Islands SJ
Sweden SE
Switzerland CH
Turkey TR
United Kingdom GB
Vatican City VA

APPENDIX
Information and Reply
Codes
D
These tables list the codes that appear in the case details window:
Address Verification Codes

Because several codes have the same meaning, and all codes are valid for all merchants,
any code can appear.
When you populate billing street address 1 and billing street address 2,
CyberSource through VisaNet concatenates the two values. If the
Important concatenated value exceeds 40 characters, CyberSource through VisaNet
truncates the value at 40 characters before sending it to Visa and the issuing
bank. Truncating this value affects AVS results and therefore might also affect
risk decisions and chargebacks.
Table 43 AVS Codes
Code Description
A Partial match: street address matches, but 5-digit and 9-digit postal codes do not match.
B Partial match: street address matches, but postal code is not verified. Returned only for
Visa cards not issued in the U.S.
C No match: street address and postal code do not match. Returned only for Visa cards
not issued in the U.S.
D&M Match: street address and postal code match. Returned only for Visa cards not issued in
the U.S.
E Invalid: AVS data is invalid or AVS is not allowed for this card type.
F Partial match: card member’s name does not match, but billing postal code matches.
G Not supported: issuing bank outside the U.S. does not support AVS.
H Partial match: card member’s name does not match, but street address and postal code
match. Returned only for the American Express card type.
I No match: address not verified. Returned only for Visa cards not issued in the U.S.

Appendix D Information and Reply Codes
Table 43 AVS Codes (Continued)
Code Description
K Partial match: card member’s name matches, but billing address and billing postal code
do not match. Returned only for the American Express card type.
L Partial match: card member’s name and billing postal code match, but billing address
does not match. Returned only for the American Express card type.
M See the entry for D & M.
N No match: one of the following:
 Street address and postal code do not match.
 Card member’s name, street address, and postal code do not match. Returned only
for the American Express card type.
O Partial match: card member’s name and billing address match, but billing postal code
does not match. Returned only for the American Express card type.
P Partial match: postal code matches, but street address not verified. Returned only for
Visa cards not issued in the U.S.
R System unavailable.
S Not supported: issuing bank in the U.S. does not support AVS.
T Partial match: card member’s name does not match, but street address matches.
Returned only for the American Express card type.
U System unavailable: address information unavailable for one of these reasons:
 The U.S. bank does not support AVS outside the U.S.
 The AVS in a U.S. bank is not functioning properly.
V Match: card member’s name, billing address, and billing postal code match. Returned
only for the American Express card type.
W Partial match: street address does not match, but 9-digit postal code matches.
X Match: street address and 9-digit postal code match.
Y Match: street address and 5-digit postal code match.
Z Partial match: street address does not match, but 5-digit postal code matches.
1 Not supported: one of the following:
 AVS is not supported for this processor or card type.
 AVS is disabled for your CyberSource account. To enable AVS, contact CyberSource
Customer Support.
2 Unrecognized: the processor returned an unrecognized value for the AVS response.
3 Match: address is confirmed. Returned only for PayPal Express Checkout.
4 No match: address is not confirmed. Returned only for PayPal Express Checkout.
5 No match: no AVS code was returned by the processor.

Card Verification Numbers

Table 44 CVN Codes
Code Description
D The transaction was determined to be suspicious by the issuing bank.
I The CVN failed the processor's data validation check.
M The CVN matched.
N The CVN did not match.
P The CVN was not processed by the processor for an unspecified reason.
S The CVN is on the card but was not included in the request.
U Card verification is not supported by the issuing bank.
X Card verification is not supported by the payment card company.
1 Card verification is not supported for this processor or card type.
2 An unrecognized result code was returned by the processor for the card
verification response.
3 No result code was returned by the processor.
Risk Factor Codes
Code Description
A Excessive address change. The customer changed the billing address two or more times in the last six
months.
B Card BIN or authorization risk. Risk factors are related to credit card BIN and/or card authorization checks.
C High number of account numbers. The customer used more than six credit cards numbers in the last six
months.
D Email address impact. The customer uses a free email provider, or the email address is risky.
E Positive list. The customer is on your positive list.
F Negative list. The account number, street address, email address, or IP address for this order appears on
your negative list.
G Geolocation inconsistencies. The customer’s email domain, phone number, billing address, shipping
address, or IP address is suspicious.
H Excessive name changes. The customer changed the name two or more times in the last six months.
I Internet inconsistencies. The IP address and email domain are not consistent with the billing address.
N Nonsensical input. The customer name and address fields contain meaningless words or language.
O Obscenities. The customer’s input contains obscene words.

Code Description
P Identity morphing. Multiple values of an identity element are linked to a value of a different identity element.
For example, multiple phone numbers are linked to a single account number.
Q Phone inconsistencies. The customer’s phone number is suspicious.
R Risky order. The transaction, customer, and merchant information show multiple high-risk correlations.
T Time hedge. The customer is attempting a purchase outside of the expected hours.
U Unverifiable address. The billing or shipping address cannot be verified.
V Velocity. The account number was used many times in the past 15 minutes.
W Marked as suspect. The billing or shipping address is similar to an address previously marked as suspect.
Y Gift Order. The street address, city, state, or country of the billing and shipping addresses do not correlate.
Z Invalid value. Because the request contains an unexpected value, a default value was substituted. Although
the transaction can still be processed, examine the request carefully for abnormalities in the order.
Information Codes
Address Information Codes

Codes Description
COR-BA The billing address has corrected elements or can be normalized.
COR-SA The shipping address has corrected elements or can be normalized.
INTL-BA The billing country is outside of the U.S.
INTL-SA The shipping country is outside of the U.S.
MIL-USA The address is a U.S. military address.
MM-A The billing and shipping addresses use different street addresses.
MM-BIN The card BIN (the first six digits of the number) does not match the country.
MM-C The billing and shipping addresses use different cities.
MM-CO The billing and shipping addresses use different countries.
MM-ST The billing and shipping addresses use different states.
MM-Z The billing and shipping addresses use different postal codes.
UNV-ADDR The address is unverifiable.

Internet Information Codes

Codes Description
FREE-EM The customer’s email address is from a free email provider.
INTL-IPCO The country of the customer’s IP address is outside of the U.S.
INV-EM The customer’s email address is invalid.
MM-EMBCO The domain in the customer’s email address is not consistent with the country in the billing
address.
MM-IPBC The customer’s IP address is not consistent with the city in the billing address.
MM-IPBCO The customer’s IP address is not consistent with the country in the billing address.
MM-IPBST The customer’s IP address is not consistent with the state in the billing address. However, this
information code may not be returned when the inconsistency is between immediately adjacent
states.
MM-IPEM The customer’s email address is not consistent with the customer’s IP address.
RISK-EM The customer's email domain (for example, mail.example.com) is associated with higher risk.
UNV-NID The customer’s IP address is from an anonymous proxy. These entities completely hide the IP
information.
UNV-RISK The IP address is from a risky source.
UNV-EMBCO The country of the customer’s email address does not match the country in the billing address.
Customer Lists Information Codes

Codes Description
CON- The order triggered both a positive and negative list match. The result of the positive list match
POSNEG overrides that of the negative list match.
NEG-ACRB The transaction was automatically marked as a creditback and is on the negative list.
NEG-AFCB The transaction was automatically marked as a fraud chargeback and is on the negative list.
NEG-ANFCB The transaction was automatically marked as a non-fraud chargeback and is on the negative list.
NEG-ASUSP The transaction was automatically marked as suspected fraud and is on the negative list.
NEG-BA The billing address is on the negative list.
NEG-BCO The billing country is on the negative list.
NEG-BIN The credit card BIN (the first six digits of the number) is on the negative list.
NEG-BINCO The country in which the credit card was issued is on the negative list.
NEG-BZC The billing postal code is on the negative list.
NEG-CC The credit card number is on the negative list.
NEG-CPF The CPF or CNPJ identification number is on the negative list.
NEG-CRB The transaction was marked as a creditback and is on the negative list.
NEG-EM The email address is on the negative list.

Codes Description
NEG-EMCO The country in which the email address is located is on the negative list.
NEG-EMDOM The email domain (for example, mail.example.com) is on the negative list.
NEG-FCB The transaction was marked as a fraud chargeback and is on the negative list.
NEG-FP The device fingerprint is on the negative list.
NEG-HIST A transaction was found on the negative list.
NEG-ID The customer’s account ID is on the negative list.
NEG-IP The IP address (for example, 10.1.27.63) is on the negative list.
NEG-IP3 The network IP address (for example, 10.1.27) is on the negative list. A network IP address
includes up to 256 IP addresses.
NEG-IPCO The country in which the IP address is located is on the negative list.
NEG-NFCB The transaction was marked as a non-fraud chargeback and is on the negative list.
NEG-PEM A passenger’s email address is on the negative list.
NEG-PH The phone number is on the negative list.
NEG-PID A passenger’s account ID is on the negative list.
NEG-PIP The proxy IP address is on the negative list.
NEG-PPH A passenger’s phone number is on the negative list.
NEG-SA The shipping address is on the negative list.
NEG-SCO The shipping country is on the negative list.
NEG-SID The Smart ID is on the negative list.
NEG-SUSP The transaction was marked as suspected fraud and is on the negative list.
NEG-SZC The shipping postal code is on the negative list.
NEG-TIP The true IP address is on the negative list.
POS-TEMP The customer is on the temporary positive list.
POS-PERM The customer is on the permanent positive list.
REV-BA The billing address is on the review list.
REV-BCO The billing country is on the review list.
REV-BIN The credit card BIN (the first six digits of the number) is on the review list.
REV-BINCO The country in which the credit card was issued is on the review list.
REV-BZC The billing postal code is on the review list.
REV-CC The credit card number is on the review list.
REV-CPF The CPF or CNPJ identification number is on the review list.
REV-CRB The transaction was marked as a creditback and is on the review list.
REV-EM The email address is on the review list.
REV-EMCO The country in which the email address is located is on the review list.
REV-EMDOM The email domain (for example, mail.example.com) is on the review list.
REV-FCB The transaction was marked as a fraud chargeback and is on the review list.

Codes Description
REV-ID The customer’s account ID is on the review list.
REV-IP The IP address (for example, 10.1.27.63) is on the review list.
REV-IP3 The network IP address (for example, 10.1.27) is on the review list. A network IP address
includes up to 256 IP addresses.
REV-IPCO The country in which the IP address is located is on the review list.
REV-NFCB The transaction was marked as a non-fraud chargeback and is on the review list.
REV-PEM A passenger’s email address is on the review list.
REV-PH The phone number is on the review list.
REV-PID A passenger’s account ID is on the review list.
REV-PIP The proxy IP address is on the review list.
REV-PPH A passenger’s phone number is on the review list.
REV-SA The shipping address is on the review list.
REV-SCO The shipping country is on the review list.
REV-SID The Smart ID is on the review list.
REV-SUSP The transaction was marked as suspected fraud and is on the review list.
REV-SZC The shipping postal code is on the review list.
REV-TIP The true IP address is on the review list.
Phone Information Codes

Codes Description
MM-ACBST The customer’s phone number is not consistent with the state in the billing address.
RISK-AC The customer's area code is associated with higher risk.
RISK-PH The U.S. or Canadian phone number is incomplete, or one or more parts of the number are risky.
TF-AC The phone number uses a toll-free area code.
UNV-AC The area code is invalid.
UNV-OC The area code and/or the telephone prefix are/is invalid.
UNV-PH The phone number is invalid.

Global Velocity Information Codes
The velocity information codes with the suffix -CC refer to credit card and direct
debit account numbers.
Important
Codes Description
VEL-ADDR Different billing and/or shipping states (U.S. and Canada only) have been used several times with
the credit card number and/or email address.
VEL-CC Different account numbers have been used several times with the same name or email address.
VEL-NAME Different names have been used several times with the credit card number and/or email address.
VELS-CC The account number has been used several times during the short tracking interval.
VELI-CC The account number has been used several times during the medium tracking interval.
VELL-CC The account number has been used several times during the long tracking interval.
VELV-CC The account number has been used several times during the very long tracking interval.
VELS-EM The customer’s email address has been used several times during the short tracking interval.
VELI-EM The customer’s email address has been used several times during the medium tracking interval.
VELL-EM The customer’s email address has been used several times during the long tracking interval.
VELV-EM The customer’s email address has been used several times during the very long tracking interval.
VELS-FP The device fingerprint has been used several times during the short tracking interval.
VELI-FP The device fingerprint has been used several times during the medium tracking interval.
VELL-FP The device fingerprint has been used several times during the long tracking interval.
VELV-FP The device fingerprint has been used several times during the very long tracking interval.
VELS-IP The IP address has been used several times during the short tracking interval.
VELI-IP The IP address has been used several times during the medium tracking interval.
VELL-IP The IP address has been used several times during the long tracking interval.
VELV-IP The IP address has been used several times during the very long tracking interval.
VELS-SA The shipping address has been used several times during the short tracking interval.
VELI-SA The shipping address has been used several times during the medium tracking interval.
VELL-SA The shipping address has been used several times during the long tracking interval.
VELV-SA The shipping address has been used several times during the very long tracking interval.
VELS-TIP The true IP address has been used several times during the short interval.
VELI-TIP The true IP address has been used several times during the medium interval.
VELL-TIP The true IP address has been used several times during the long interval.

Suspicious Data Information Codes

Additional suspicious data information codes are listed in Appendix A of the CyberSource
Decision Manager Device Fingerprinting Guide (PDF | HTML).
Codes Description
BAD-FP The device is risky.
INTL-BIN The credit card was issued outside of the U.S.
MM-TZTLO The device's time zone is inconsistent with the country's time zones.
MUL-EM The customer has used more than four different email addresses.
NON-BC The billing city is nonsensical.
NON-FN The customer’s first name and last name are identical.
NON-LN The customer’s last name is nonsensical.
OBS-BC The billing city contains obscenities.
OBS-EM The email address contains obscenities.
OBS-FN The customer’s first and last names contain obscenities.
OBS-LN The customer’s middle or last name contains obscenities.
RISK-AVS The combined AVS test result and normalized billing address are risky, such as when the AVS
result indicates an exact match, but the normalized billing address is not deliverable.
RISK-BC The billing city has repeated characters.
RISK-BIN In the past, this payment card BIN has shown a high incidence of fraud.
RISK-DEV Some of the device characteristics are risky.
RISK-FN The customer’s first and last names contain unlikely letter combinations.
RISK-GEO Indicates a suspicious combination of geographic location elements.
RISK-LN The customer’s middle or last name contains unlikely letter combinations.
RISK-PIP The proxy IP address is risky.
RISK-SD The inconsistency in billing and shipping countries is risky.
RISK-TB The day and time of the order associated with the billing address is risky.
RISK-TIP The true IP address is risky.
RISK-TS The day and time of the order associated with the shipping address is risky.

Excessive Identity Changes

These codes represent excessive identity changes. You receive an information code when
more than two identity changes occur.
Customer identity refers to one or more of these elements: account and phone numbers,
and billing, shipping, email, and IP addresses.
Additional excessive identity change information codes are listed in Appendix A of the
CyberSource Decision Manager Device Fingerprinting Guide (PDF | HTML).
Codes Description
MORPH-B The same billing address has been used several times with multiple customer identities.
MORPH-C The same account number has been used several times with multiple customer identities.
MORPH-E The same email address has been used several times with multiple customer identities.
MORPH-I The same IP address has been used several times with multiple customer identities.
MORPH-P The same phone number has been used several times with multiple customer identities.
MORPH-S The same shipping address has been used several times with multiple customer identities.

INDEX
Index
AB C D E F G H I J K L M N O P Q R S T U V W X Y Z
address normalization
Numerics creating rules 101
customer information, case details 229
192.com defined 119
fraud 301 information codes in case details 235
interpreting match, example marking order data 122
deceased persons database 303 uploading List Manager data 142
phone number not matched 303
address verification code, API field names 293
KYC summary 297
setting login information 66 address verification, predefined rules in case
supported countries 247 details 239
telephone 302 administrator
types of matches 247 assigning orders in search results 213
managing orders & reviewers in case
A details 235
ADT (adult) 246
account number
chargeback files 151 Advanced Fraud Screen in case details 235
global velocity 173 amount (offer)
List Manager search results 162 API field names 293
searching 199 order element 265
account types 228 anonymizer, decoded routing method 225
accounts, high number 242 anonymizing proxy 224
Accurint AOL, decoded routing method 225
description of 248 APAC mobile risk model 84
matches 304
APAC risk model 83
setting login information 66
API fields, equivalence table 293
Action Results report 216
ARIN 225
active profile 96
ASCII characters, TARGUSinfo 313
Address Information Codes 321
assigning queues to reviewers 62
address mismatch 241
AU NZ risk model 83

Index
A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
audit logs 30 case details

examples 37 properties 233
keywords 33 reviewer options 234
results, customizing 35 score 235
narrowing 36 velocity information codes 236
sorting content 36 Case Management Detail report 215
results, number 35
Case Management Order Status report 27
subcategories 32
format 27
authorization, API field names 293
case management roles
auto_, marking reason in negative list 164 creating 60
AVS code 228 defined 22
AVS codes case management search
custom rule examples 287 field & value tab 199
interpreting results in case details 239 account number 199
billing phone number 199
B CPF/CNPJ identification number 199
custom fields, merchant-defined data
best risk model 83 fields 199
billing address email address 199
decoded 226 IP address 199
order elements 261 order number 199
requirement for authorization 260 request ID 199
billing API field names 293 shipping phone number 199
true IP address 199
billing information outside U.S. 313
maximum number of results 195
billing phone number
multiple criteria tab 195
searching 199
current status 195
billTo_personalID API field 68 merchant 196
browser window, level III data 256 order ownership 196
priority range 198
C queue 197
narrowing search results 209
cache proxy, decoded routing method 225 profile/rule result tab 199
Canada risk model 83 outcome 200
card authorization results, order elements 265 profile 200
profile mode 200
card information in case details 227
rule 200
card number, searching 199 search parameters 195
card types 228 using transaction date 198
card verification result case re-assignment permission 57
API field name 293
case details 240
order element 266

Index
Case Search Visualization 217 comparison value, defined 103

browser versions supported 217 CON-POSNEG
hide single transaction 220 data in positive & negative list 126
hierarchy layout 220 reply data 123
radial layout 220
contains, using as comparison operator 258
standard layout 220
structural layout 220 conversion date, using in search range 198
case sensitivity in custom rules 100 converting orders

permission 57
categories of custom rules 117
processing payment 254, 255
CEMEA risk model 83 rejected orders, permission 58
character encoding for List Manager 142 cookie directive 20
chargeback cookies in browser, requirement 204
negative list 130
core rule
reason code 158
creating profile 80
review list 131
defined 118
chargeback files
countries in region
creating 150
predefined rule 91
formatting for CSV 153
selecting 112
formatting for XML 154
uploading 157 CPF/CNPJ identification number
validation errors 153 Credilink use of 68
searching 199
Chase Paymentech Solutions, chargeback
files 158 Credilink
Business Center results example 307, 309
check information in case details 227
description of 248
China risk model 83 list of information returned 306
CID 240 order elements 267
clear mark as suspect setting login information 68
example 121 credit card
option 122, 140 API field names 294
cloning a rule 115 number, searching 199
CNN (child) 246 creditback
defined 137
columns
negative list 130
auditing, changing 35
review list 131
search results, changing 204
search results 207
comments
currency
adding to case details 244
API field name 294
duration of storage 125
in velocity rules 182
comparison operator predefined rule 90
details 258 reviewer performance reports 74
summary 102 setting for reports 26

Index
currency & amount, interpreting results 243 D

custom field
data type
changing data type 114
custom field 114
maximum number 113
custom list 109
order element in custom rules 101
searching 199 date format, in chargeback files 152
special characters in name 114 date range
using a date in custom rules 286 performance statistics 74
custom list decline AVS flags, API field names 294
product group 109 decoded address, assessing risk 226
product velocity rule 179 decoded IP address, custom rule examples 284
warning when deleting 111
default active profile 96
custom rule 100
default risk model 83
adding to profile 92
adding to profile, number allowed 85 denied parties lists, order elements 262
case sensitivity 290 digital merchandise
cloning 115 mobile risk model 84
creating, number allowed 100 order review best practices 256
evaluating in reports 89 risk model 83
example with information codes 282 direct debit
operators 258 information in case details 227
profile impact 85 predefined rules 90
testing 105
use case 88
E
using score factor & information codes 41
customer lists E.U. risk model 83
adding data 121 early processing
differentiating content of lists 133 predefined rules 91
early processing 40 settings 25
formatting data to upload 143 East Asia risk model 83
marking order data 123
ECI 228
moving & deleting data 123
electronic checks, predefined rules 90
overview 120
preparing files for List Manager 142 email address
searching, maximum records 120 case management, searching 199
testing & reviewing settings 44 effect on score 24
CVN code 228 global velocity 173
large number, predefined rule 242
CVN, CVV2, CVC2, & CVV 240
cybs-gw.ic3.com 28

Index
Emailage G
Business Center results example 308
description of 248 geolocation inconsistencies 241
fields 308 gibberish
order elements 268 effect on score 24
setting login information 70 predefined rule 241
ends with, using as comparison operator 259 gift category 24
effect on score 24
equal to, using as comparison operator 258
errors in address, predefined rule 241 gift order
global velocity 174
European Union’s Privacy Directive 20
List Manager 139
countries 316
global mobile risk model 83
export compliance
information in case details 249 global velocity
defined 173
order elements 262
information codes 325
export restrictions, custom rules examples 289
predefined rule in profile 91
exporting List Manager time intervals 174
CSV format 166
Google map in case details 229
XML format 170
GPN, chargeback files 158
F greater than, comparison operator 259
false-positive results, global velocity 174 H

field & value search, case management 199
hedges, adjusting 24
filtering case management search results 209
hide single transaction. See Case Search
fixed routing method, decoded 225
Visualization
follow-on payment processing, reporting 216
hiding order data 140, 229
fraud chargeback
hierarchy layout. See Case Search Visualization
defined 137
negative list 130 history checks 140
review list 131 hold queue
search results 207 permissions required for 48
fraud information, in case details 235 setting or specifying 48
using 233
fraud model. See risk model
host severity 223
fraud patterns in global velocity 173
host, effect on score 24
fraud score, setting threshold 84
HTTP and HTTPS POST 27
free email provider 242

Index
I verifying file upload results 158

XML format
INF (infant) 246 downloading 170
information code preparing files 147
deleting velocity rule 183
List Manager process 122
IP address 225
Litle, chargeback files 158
international proxy routing method, decoded 225
local currency 26
Internet information codes 322
IP address M
case details 224
custom rule examples 284 Managed Risk service 39
effect on score 24 map in case details 229
global velocity 173 reviewer setting 62
searching 199 marked suspect
IP address (true), searching 199 case management search results 207
items purchased, case details 245 clearing 121
in performance statistics 74
J reviewer performance statistics 74
when rejecting an order 232
J: No entries marking action, effect on order data 123
marking reasons 137
K auto_ 164
keywords in audit log search 33 chargeback files 151
marking transactions
L case details 229
clearing 122, 140
LATAM risk model 83
permission 58
layouts. See Case Search Visualization updating multiple times 252
less than, using as comparison operator 259 Mastercard SecureCode, interpreting
level III data, settling orders 256 results 242
List Manager merchant SKU, product velocity rule 179
creating negative & review lists records 137 merchant velocity
creating positive list records 133 information codes in case details 236
CSV format predefined rule in profile 91
downloading 166 use cases 186
preparing files 144
merchant, searching 196
formatting data to upload 143
number of downloaded records 166 merchant-defined data fields, searching 199
preparing files to upload 142 merchant-defined fields in case details 252
search limit 160 MIL (military) 246
search options 160
mismatched address, predefined rule 241
search results 162

Index
mobile gateway routing method, decoded 225 order element

mobile risk models 83 (Single Offer) or (Single) fields 101
billing & shipping address 260
mode, profile searching 200
defined 101
merchant velocity 290
N velocity morphing count 267
negative & review lists records, creating with List order elements
Manager 137 listed 260
negative list order number, searching 199
choosing data 129 order priority, basing search on 198
field options 130
order priority, in case details 233
predefined rule
case details 243 order status
early processing 40 in case details 232
profile 91 notification setting 27
sample custom rule 283 order value velocity tracking element 180
NEG-HIST 236 orders
non-fraud chargeback converting or rejecting 252
defined 137 maximum allowed for reviewers 61
negative list 130 moving between queues, permission 57
review list 131 processing payment 23
search results 207 resolved in search results 203
searching on outcome in case
nonsense in order
management 200
effect on score 24
sorting in search results 208
predefined rule 241
time limit when moving 213
normalized address
orders outside the U.S. 241
creating rules 101
customer information, case details 229 owner, in case details 233
information codes in case details 235 ownership release permission 57
marking order data 122 ownership stealing permission 57
uploading List Manager data 142
ownership, searching 196
notes
adding to case details 244
P
duration of storage 125
notification URL, setting 28 passive profile selector 97
passive rule evaluation in case details 238
O PayEase China processing
information in case details 227
obscenities 241
predefined rules 90
effect on score 24
payer authentication results 242
offer details 245
payment account information in case details 227
order conversion permission 57

Index
payment permission 57 sample custom rule 282

payment processing 23 temporary fields options 42
in case details 230 viewing records 129
when converting order 254, 255 predefined rules
payment services allowed 23 countries in region 91
customer lists 41
PayPal
default settings 87
information in case details 227
global velocity 174
predefined rules 90
merchant velocity 175
performance statistics reports 74
priority
queues 74
administrator, changing in case details 233
reviewers 74
permission for changing 57
permissions rule 86
combining into roles 60 searching for highest 194
Decision Manager 21
priority, searching orders for 198
order conversion 57
order moving 57 processor message, with chargebacks 159
ownership release 57 product information in product velocity rule 179
payment 57, 59 profile
performance statistics 57, 74 activity mode, selecting 95
priority change 57 cloning 92
rejected order conversion 58 creating with core rules 80
Perseuss editing 92
Business Center results example 309 priority, assigning 81
description of 248 queue, selecting 82
fields 309 rule impact 85
order elements 270 searching for in case management 200
setting login information 71 special uses 80
personal_id API field 68 velocity rules 91
phone information codes 324 profile modes
searching 200
phone number, billing, searching 199
profile selector
phone number, effect on risk score 24
active 96
phone number, shipping, searching 199 creating 93
POP routing method, decoded 225 number of rule limits 93
positive list overriding 94
adding trusted data during review 126 passive 97
adding with List Manager 133 sorting 98
customer scenarios 128 Profile Statistics report 98
duration of addition 124 profile/rule result search, case management 199
field options 127
predefined rule 40, 243
profile 91

Index
Q reports
Action Results 216
queue performance report 74 Case Management Detail 215
queue permissions 57 Case Management Order Status 27
queues Conversion Detail 28
administrator, changing in case details 233 finding notes 245
assigning to reviewers 62 Profile Statistics 74
configuration examples for SLAs 50 Queue Statistics 74
defining 46 Reviewer Statistics 74
in case details 233 request ID
list in search results 203 chargeback files 151
modifying definition 48 marking data 122
number allowed 45 searching in case management 199
possible actions 46
resetting time limit, permission 58
reports 46
resolved orders, finding 256
reviewing time limit 47
searching 197 review list
specifying a hold queue 48 adding data 131
support for SLAs 45 field options 131
using a hold queue 233 sample custom rule 284
Quick Search links 194 review list information codes 323
reviewer
R comments, duration of storage 125
number of orders allowed 61
radial layout. See Case Search Visualization performance 74
regional proxy routing method, decoded 225 settings, permission 58
regular expression in custom rules reviewing cases, maximum open 211
case sensitivity 278
RIPE 225
comparison operator 259
risk model
example with product SKU 109
choosing 83
rejected order conversion, permission 58
default 83
removing order data from history 229 mobile 83
permission 58 risk, assessing in decoded address 226
reply codes for customer lists 123
roles, default settings 60
reply flags for SCMP API 29 routing method
case details 224
custom rule example 285
decoded 225
rule configuration in profile, setting 107
rule priority 86

Index
rules Simple Order API field names 293

cloning 115 (Single Offer) or (Single) order elements 101
evaluating effectiveness 97
SKU
grouping in categories 117
case details 245
searching for in case management 200
using in velocity product group 109
SLAs, support for 45
S
standard layout. See Case Search Visualization
sample invoice, amount & item elements 278
starts with, using as comparison operator 259
satellite connection 224
structural layout. See Case Search Visualization
satellite routing method, decoded 226
STU (student) 246
SCMP API
SuperPOP routing method, decoded 226
field names 293
reply flags 29 suspected data
negative list 130
score model. See risk model
review list 131
score threshold, setting 84 search results 207
score, in case details 235 suspected, marking reason defined 137
SCR (senior citizen) 246 suspicious data information codes 326
search results suspicious history, in case details 251
assigning orders 213
suspicious telephone number 242
content, described 205
customizing 204 system columns, queue table in search
exporting 215 results 203
maximum number 195
resetting layout 209 T
resetting time limit 214
Take Next Case button 194
search parameters 202
taking next case, in search results 212
taking next case 212
taking ownership, limit 213 TARGUSinfo
SecureCode, interpreting results 242 address match results 310
billing phone match results 311
service-level agreements. See SLAs
complete results evaluation 312
settling orders description of 249
in case details 230 phone service match results 312
with level III data 256 setting login information 72
shipping address, requirement for tax amount in case details 245
authorization 260
telephone number, effect on risk score 24
shipping phone number
temporary positive list
searching 199
data added 125
Similar Searches expiration time 124
visualizing results 230 informing customers 44
similar searches options 230 records 124

Index
temporary positive list fields U

expiration 63
options 63 U.S. risk model 83
settings 42 UK risk model 83
test intervals in global velocity 174 unrestricted order management permission 59
third-party services unrestricted order review permission 59
Credilink 267 user permissions
Emailage 268 described 56
error messages in case details 247 setting 21
permissions 58 user roles 22
Perseuss 270
Whitepages Pro 271
V
time limit
exception when moving orders 213 velocity
expiration, search results 207 custom rule 290
in case details 233 early processing 25
resetting in search results 214 effect on risk score 24
resetting, permission 58 thresholds example 188
setting in queues 47 velocity information codes in case details 236
time of day, effect on score 24 velocity morphing count
time zone conversion, example custom rule 279 order elements 267
time zone, List Manager search results 160 velocity predefined rules results 243
tracking element, in merchant velocity rule 179 velocity rules, planning 184
transaction date, using in search range 198 velocity threshold, cumulative subtotals 181
travel fields Verified by Visa (VbV), interpreting results 242
order elements 267 visualization
travel information Case Search Results 217
case details 246 Similar Searches results 230
search results 208
travel mobile risk model 84 W
travel risk model 83 weighted tests 24
true IP address Whitepages Pro
searching 199 Business Center results example 315
description of 249
fields 314
order elements 271
setting login information 73
whitepages.com 229
wild card, using in velocity product group 109

Index
X
X: No entries
Y
YTH (youth) 246
Z
Z: No entries

DM Users Guide

Transféré par

Informations du document

Titre original

Copyright

Formats disponibles

Partager ce document

Partager ou intégrer le document

Options de partage

Avez-vous trouvé ce document utile ?

Ce contenu est-il inapproprié ?

Droits d'auteur :

Formats disponibles

DM Users Guide

Transféré par

Droits d'auteur :

Formats disponibles

Title Page

CyberSource Decision Manager

For sales questions about any CyberSource Service, email sales@cybersource.com or

Restricted Rights Legends

Recent Revisions to This Document 12

About This Guide 13

Decision Manager User Guide | January 2018 3

Searching the Auditing Logs 30

Decision Manager User Guide | January 2018 4

Chapter 3 Order Profiles 80

Chapter 4 Custom Rules and Custom Lists 100

Decision Manager User Guide | January 2018 5

Chapter 5 Positive, Negative, and Review Lists 119

Decision Manager User Guide | January 2018 6

Chapter 6 Velocity 173

Chapter 7 Case Management 193

Decision Manager User Guide | January 2018 7

Visualizing Case Search Results 217

Decision Manager User Guide | January 2018 8

Additional Information 252

Appendix A Custom Rules Elements and Examples 258

Decision Manager User Guide | January 2018 9

Velocity Rules 290

Appendix B Third-Party Services 297

Appendix C Countries Included in the European Union Risk Model 316

Decision Manager User Guide | January 2018 10

Appendix D Information and Reply Codes 318

Decision Manager User Guide | January 2018 11

Decision Manager User Guide | January 2018 12

Using or configuring Decision Manager requires familiarity with case management

Decision Manager User Guide | January 2018 13

Note, Important, and Warning Statements

A Note contains helpful suggestions or references to material not contained in

An Important statement contains information essential to successfully

A Warning contains information or instructions, which, if not heeded, can result

Text and Command Conventions

Decision Manager User Guide | January 2018 14

Refer to the Support Center for complete CyberSource technical documentation:

Decision Manager User Guide | January 2018 15

Decision Manager User Guide | January 2018 16

The following figure shows the components of Decision Manager.

Figure 1 Decision Manager Components

Decision Manager User Guide | January 2018 17

 Administrators set up options and permissions for reviewers, manually add

Figure 2 List Manager Settings

Decision Manager User Guide | January 2018 18

Figure 3 Case Management Components

Decision Manager User Guide | January 2018 19

Notice to European Union Merchants

Decision Manager User Guide | January 2018 20

Decision Manager Administrator

Assigning Permissions and Roles

Configuration and Order Review Management

Table 1 Decision Manager Configuration and Order Review

Decision Manager User Guide | January 2018 21

Table 1 Decision Manager Configuration and Order Review

Table 2 Decision Manager Reporting Permissions

Permission Reports Description

Decision Manager User Guide | January 2018 22

For example, to enable an employee to create or modify all components of a profile,

Choosing Global Decision Manager Settings

Decision Manager User Guide | January 2018 23

Table 3 Hedge Settings