Session Protection - Overviews

Session Protection

Overview

Session Protection is used at the time of in account activity, such as when saving a new payment method, transferring loyalty points, etc., in order to prevent malicious activity such as card testing, loyalty points theft, manipulation of verification methods and saved contact information.

Primary Use Cases

Credit Card Testing: Preventing fraudsters from checking validity of stolen card details by adding them to user accounts. Fraudsters leverage the merchant gateway's $0 auth to check whether the stolen card data is still valid.
P2P & Loyalty Transferring: Protecting peer to peer transferring of fund and other monetary equivalents such as loyalty points between accounts across the ecosystem.
Account / Profile Protections: Verifying users through account details change (email, phone, etc.), ensuring security while minimizing friction.
Account take over (ATO): To prevent incidents where fraudsters use stolen credentials to try and gain access to user accounts, leading to data theft, fraud, and brand damage.
Seller fraud: Protecting the ecosystem from fraudsters using the seller ecosystem to commit fraud (See Seller Item Listing tab).

Integration Steps

Front-end Integration

In your dedicated Forter portal, you will receive a JavaScript snippet for both sandbox and production. For native mobile apps, you will receive links to download Forter's Native SDKs. You'll paste the JS script on the appropriate pages of your website or call mobile SDK methods on relevant mobile app screens so that it can load and asynchronously collect important behavioral data from your customer. The script or mobileUID generated by the mobile SDK will also generate a unique token for each user on your site that should be included in the Account Sign Up API Request Body.

Request profile access or update decision

Forter's Profile access API can provide a decision to approve a frictionless account details change or suggest that Multi-Factor Auth if suspicious activity is detected. The relevant access type is denoted as the UPDATE_PAYMENT enum of the accessRequestType parameter in the request body.

Profile Access API Request
Primary Data Points for card testing:

Account ID
AccessRequestType: UPDATE_PAYMENT
ConnectionInformation - Cyber intelligence data to analyze browsing behavior, device, and connection quality such as IP address, user agent, and data collected via JS / mobile SDK
Details of the new item added to the user profile (phone, address, payment method).

{
    "accountId": "e520-ba9a-367-60b",
    "eventTime": 1415287568000,
    "connectionInformation": {
        "customerIP": "10.0.0.127",
        "userAgent": "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36",
        "forterTokenCookie": "2315688945984"
    },
    "channelType": "WEB",
    "accountOwner": {
        "email": "john_s@test.com",
        "accountId": "e520-ba9a-367-60b",
        "created": 141527316814,
    },
    "newPaymentMethods": {
        "billingDetails": {
            "personalDetails": {
                "firstName": "John",
                "lastName": "Smith",
                "email": "john_s@test.com"
            },
            "address": {
                "address1": "235 Montgomery st.",
                "city": "San Francisco",
                "country": "US",
                "zip": "94104"
            }
        },
        "creditCard": {
            "nameOnCard": "John R. H. Smith",
            "bin": "424242",
            "cardBrand": "VISA",
            "lastFourDigits": "4242",
            "expirationMonth": "03",
            "expirationYear": "2025",
            "verificationResults": {
                "avsFullResult": "Y",
                "cvvResult": "M"
            }
        }
    },
    "accessRequestType": "UPDATE_PAYMENT"
}

Profile Access API Response
The response will include the Forter decision and potential recommendations, as well as a correlation ID that should be stored and used when the merchant provides additional updates (e.g. result of MFA).

Key Fields:

forterDecision: The latest Forter decision regarding the attempted action. Said fields may hold one of various options:
- "APPROVE" for approved signup requests, where user should be allowed to register for new accounts;
- "DECLINE" for declined signup requests, where user should be declined from registering for new accounts;
- "VERIFICATION_REQUIRED" for signup requests, where user should be triggered an additional verification (via email, sms, etc.,);
- "NOT_REVIEWED"
recommendation: A specific recommendation for an action that might help the customer to complete their transaction/action (e.g. verify phone via SMS, verify via push notification, verify email, perform a 3DS check, etc.)
originalOrderId: Unique order/transaction identifier for which this access request is referring to, if relevant.

   {
       "forterDecision": "DECLINE",
       "decisionReason": "",
       "accountId": "e520-ba9a-367-60b",
       "originalOrderId": "HGJ7512345H3DE",
       "recommendation": ""
   }

Send new seller items for review

Relevant for marketplaces, Forter's Seller item listing API can provide a decision to approve a frictionless inventory change or suggest that Multi-Factor Auth if suspicious activity is detected.

Seller Item Listing API Request

{
    "accountId": "e520-ba9a-367-60b",
    "eventTime": 1415287568000,
    "connectionInformation": {
        "customerIP": "10.0.0.127",
        "userAgent": "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36",
        "forterTokenCookie": "2315688945984"
    },
    "channelType": "WEB",
    "accountOwner": {
        "email": "john_s@test.com",
        "accountId": "e520-ba9a-367-60b",
        "created": 141527316814
    },
    "listedItems": [
        {
            "basicItemData": {
                "category": "Apparel and accessories",
                "discount": {
                    "couponCodeUsed": "FATHERSDAY2015",
                    "couponDiscountAmount": {
                        "amountLocalCurrency": "105.55",
                        "amountUSD": "99.95",
                        "currency": "CAD"
                    },
                    "discountType": "COUPON"
                },
                "name": "White GenericBrand handbag",
                "price": {
                    "amountLocalCurrency": "105.55",
                    "amountUSD": "99.95",
                    "currency": "CAD"
                },
                "productId": "Ag54352R7768kkO",
                "productIdType": "SKU",
                "quantity": 1,
                "secondaryProductId": "2h8331lg4692B45p",
                "secondaryProductIdType": "ISBN",
                "type": "TANGIBLE",
                "value": {
                    "amountLocalCurrency": "105.55",
                    "amountUSD": "99.95",
                    "currency": "CAD"
                }
            }
        }
    ]
}

Seller Item Listing API Response
The response will include the Forter decision and potential recommendations, as well as a correlation ID that should be stored and used when the merchant provides additional updates (e.g. result of MFA).

Key Fields:

forterDecision: The latest Forter decision regarding the attempted action. Said fields may hold one of various options:
- "APPROVE" for approved signup requests, where user should be allowed to register for new accounts;
- "DECLINE" for declined signup requests, where user should be declined from registering for new accounts;
- "VERIFICATION_REQUIRED" for signup requests, where user should be triggered an additional verification (via email, sms, etc.,);
- "NOT_REVIEWED"
recommendation: A specific recommendation for an action that might help the customer to complete their transaction/action (e.g. verify phone via SMS, verify via push notification, verify email, perform a 3DS check, etc.)

   {
       "forterDecision": "DECLINE",
       "decisionReason": "",
       "accountId": "e520-ba9a-367-60b",
       "correlationId": "HGJ7512345H3DE",
       "recommendation": "MFA"
   }

Send authentication attempts

The Authentication result API is used to inform Forter of authentication results after an MFA was required by a previous Profile Access API request, using the provided correlation ID. While no decision is provided on this request, it is required in order to ensure optimal customer experience as well as continuously improving the decision model.

Authentication result API Request

{
    "accountId": "e520-ba9a-367-60b",
    "eventTime": 1415287568000,
    "connectionInformation": {
        "customerIP": "10.0.0.127",
        "userAgent": "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36",
        "forterTokenCookie": "2315688945984"
    },
    "channelType": "WEB",
    "additionalAuthenticationMethod": {
        "verificationOutcome": "SUCCESS",
        "correlationId": "87363864834"
    }
}

Authentication Result API Response
As this API is only used to provide Forter's model's additional information, the decision returned will always be "NOT_REVIEWED". Supplementary parameters like correlationId and accountId are also returned in the API response.

Send account status updates

The Account status API is used to provide Forter model's additional information: indication of accounts closed by the merchant or accounts that changed in status that reflect agreement or disagreement with Forter's sign up decision (use / ignore the decision). The Account status API is only intended to provide Forter with additional details and does NOT return a new decision. Rather, the response will always be "NOT_REVIEWED".

Account Status API Request Main data points are:
- status: updated status (Forter enum format): enumerated values include: ("ACTIVE"; "SUSPENDED"; "CLOSED"; "GUEST"; "PENDING")
- statusChangeReason: Merchant descriptive reason for closing the account
```
{
    "accountId": "e520-ba9a-367-60b",
    "eventTime": 1415287568000,
    "status": "SUSPENDED",
    "statusChangeReason": "user violation of coupon abuse policy",
    "connectionInformation": {
        "customerIP": "10.0.0.127",
        "userAgent": "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36",
        "forterTokenCookie": "2315688945984"
    },
    "type": "BUSINESS",
    "merchantAccountStatus": "open",
    "statusChangeBy": "MERCHANT_ADMIN"
}
```
Prepare and Upload Historical Data

To ensure the highest level of accuracy for our decisioning model, Forter customizes our model to fit the specific risk profile of each of our customers. We achieve this by training the model with your past signup and login data in order to provide you with better accuracy from Day 1.
Complete Integration Tests

The purpose of Forter's integration tests is to make sure that your integration covers all relevant use cases, while still in the sandbox or test environment. Each use case may need a different combination of attributes and values. To make sure you have covered each of the use cases we expect in your integration, please go through the test scenario list in the Integration Tests section of Portal. For each, you'll need to create the scenario in your sandbox site that will generate a call to Forter's API. Then, select the corresponding API request that Forter received and click Run to verify that the sample request meets the criteria.
Deploy to Production

Once the Integration tests have passed, and you've reviewed any gaps with a Forter Implementation Engineer, please deploy your code to your production environment, with two critical adjustments:
1. Replace your Site ID and secret key with your production credentials.
2. Update your Javascript snippet and Mobile SDKs to use your production Site ID and the production hash keys, if relevant. Please note that this does not yet complete your integration. Until Forter has switched your site to Live (after Data Validation and Listen Mode), all Forter decisions will return "Not Reviewed".
Data Validation

Once in production, Forter uses a Data Validation tool to execute a set of automated tests across your live data in aggregation. The test outputs are daily reports that validate the accuracy and completeness of the production data we receive from you. You can monitor this output in Forter Portal under Integration Center Tools. We recommend checking the report daily to identify any failed tests, which will prevent you from moving forward to Listen Mode.
Listen Mode

In "listen mode", we will monitor the production traffic on your site and calibrate our models before we begin to provide you with decisions. This is a critical stage to ensure you meet your KPIs, and usually lasts around 7-14 days. Your Implementation Engineer will update you on the specific timeline for your integration. During this time, Forter will continue to return "Not Reviewed" decisions in the API response.
Go Live

As Forter begins to send decisions and recommendations, confirm that your production site is handling responses as expected.

Session Protection

Overview

Primary Use Cases

Integration Steps

Front-end Integration

Request profile access or update decision

Send new seller items for review

Send authentication attempts

Send account status updates

Prepare and Upload Historical Data

Complete Integration Tests

Deploy to Production

Data Validation

Listen Mode

Go Live