NS8 User Guides

Payment Risk Factors

Understanding the risk types used to score payments.

Along with the EQ8 Score, which looks at a wide range of attributes for each visitor to a website, NS8 has developed the Payment Risk Score (PRS). The PRS evaluates the attributes of a customer's payment and assigns a risk score to this payment. This risk score shows the percentage of risk presented by a payment, with 100% being the most risky and 0% being the least risky.

How Are Payments Scored?

Each payment may have several risk factors associated with it, or no risk factors at all. As a payment's risk factors increase, the EQ8 Score will be lowered and the PRS percentage will increase.

Using the PRS alongside the EQ8 Score helps merchants quickly identify orders that can be approved or declined based on customer and order profiles. For example, if an order was placed from a user whose device is in a different country than the shipping and billing address, and this order also has a high payment risk, it is much more likely to be fraud. Inversely, if an order has a low EQ8 Score because the user is a university student, but the order has a low payment risk score, a fraud reviewer may be able to approve the order with confidence.

Order Rules for Payment Risk

Many merchants using NS8 Protect have established order rules that quarantine orders based on payment risk in order to process these orders appropriately. Our internal research has shown that a PRS between 1% and 10% pose a medium risk. Orders with a PRS between 10% and 30% pose a high risk and should be manually reviewed. Orders with a payment risk greater than 30% are rarely valid; merchants will need to decide how to handle these orders. This article will show how to build an Order Rule for PRS and other attributes.

What are the Payment Risk Factors?

The list below represents many of the payment risk attributes identified by NS8 Protect. They are shown on the Suspicious Orders screen, as seen in the Payment Issues section of the image below.

Payment Risk Attributes

  • None: There was no payment risk found.
  • Transaction originated from a high-risk country: The country where the user was located when placing the order is considered high-risk.
  • The billing address does not match the country of the majority of customers using that bank identification number: The payment card is associated with a bank that is foreign to the order. For example, the card is issued by a European bank, but the order is placed in the United States.
  • The credit card is prepaid: The credit card is a prepaid card and not a revolving charge card. These payment cards historically carry more risk than traditional credit and debit accounts.
  • The device may be being used for multiple transactions: NS8's velocity checks have identified the device as being used for an unusual number of transactions.
  • The customer's email address is from a free service: The email is from a service that carries higher risk because it is free and requires less verification to establish an email address.
  • The customer's email address indicates high risk: NS8 has found the email address to be associated with high-risk activity, or the email has appeared on a blacklist or similar fraud-screening tool.
  • The shipping address is associated with fraudulent transactions: The shipping address has been identified with fraud in the past and therefore presents a high risk.
  • The shipping address has a postal code not in the city entered: The shipping postal code does not match the city provided by the customer.
  • Distance from shipping address to the device exceeds 100km: NS8's patented geolocation technology has identified that the customer is physically located an excessive distance from the shipping address (more than 100 kilometers, or 62 miles).
  • Distance from shipping address to billing address exceeds 100km: The distance between shipping and billing addresses are excessive (more than 100 kilometers, or 62 miles).
  • The shipping address is not in the country of the IP address the transaction originated from: NS8's patented geolocation technology has identified that the customer is physically located in a different country than where the transaction appears to originate.
  • The billing address has a postal code not in the city entered: The billing postal code does not match the city provided by the customer.
  • Distance from billing address to the device exceeds 100km: NS8's patented geolocation technology has identified that the customer is physically located an excessive distance from the billing address (more than 100 kilometers, or 62 miles).
  • The billing address is not in the country of the IP address the transaction originated from: NS8's patented geolocation technology has identified that the customer is physically located in a different country than the transaction's billing address.
  • The payment is rated as medium risk (more than a 10% chance of fraud): The payment has attributes that indicate a medium fraud risk.
  • The payment is rated as high risk (more than a 25% chance of fraud): The payment has attributes that indicate high fraud risk.
  • The payment is rated as an extreme risk (more than a 50% chance of fraud): The payment has attributes that indicate extreme fraud risk.
  • The user is using a public proxy: The user placed the order while using a public proxy to mask their technological identity.
  • The user is using an anonymous proxy: The user placed the order while using a anonymous proxy to mask their technological identity.
  • The user is originating from a high-risk IP address: NS8 has found the IP address to be associated with high-risk activity, or the IP address has appeared on a blacklist or similar fraud screening tool.

Payment Risk Factors


Understanding the risk types used to score payments.

Suggested Edits are limited on API Reference Pages

You can only suggest edits to Markdown body content, but not to the API spec.