NS8 User Guides

Payment risk factors

Understanding the risk types used to score payments.

Along with our score, which looks at a wide range of attributes for each visitor to a website, NS8 has developed the Payment Risk Score (PRS). The PRS evaluates the attributes of a customer's payment and assigns a risk score to this payment. This risk score shows the percentage of risk presented by a payment, with 100% being the riskiest and 0% being the least risky.

How are payments scored?

Each payment may have several risk factors associated with it, or no risk factors at all. As a payment's risk factors increase, the score will be lowered and the PRS percentage will increase.

Using the PRS alongside the score helps you quickly identify orders that can be approved or declined based on customer and order profiles. For example, if an order was placed from a user whose device is in a different country than the shipping and billing address, and this order also has a high payment risk, it is much more likely fraud. Inversely, if an order has a low score because the user is a university student, but the order has a low payment risk score, a fraud reviewer may be able to approve the order with confidence.

Order rules for payment risk

You can use NS8 to establish order rules that quarantine orders based on their payment risk score to process them appropriately. Our internal research has shown that orders with a payment risk score between 1% and 10% pose a medium risk. Orders with a payment risk score between 10% and 30% pose a high risk and should be manually reviewed. Orders with a payment risk greater than 30% are rarely valid; you'll need to decide how to handle these orders. Consult our article about how to build an order rule using payment risk score and other attributes.

What are the payment risk factors?

The list below represents many of the payment risk attributes identified by NS8. They appear on the Suspicious Orders page, as seen in the Payment Issues section of the image below.

Payment Risk Attributes

  • None: There was no payment risk found.
  • Transaction originated from a high-risk country: The country where the user was located when placing the order is considered high-risk.
  • The billing address does not match the country of the majority of customers using that bank identification number: The payment card is associated with a bank that is foreign to the order. For example, the card is issued by a European bank, but the order is placed in the United States.
  • The credit card is prepaid: The credit card is a prepaid card and not a revolving charge card. These payment cards historically carry more risk than traditional credit and debit accounts.
  • The device may be being used for multiple transactions: NS8's velocity checks have identified the device as being used for an unusual number of transactions.
  • The customer's email address is from a free service: The email is from a service that carries a higher risk because it is free and requires less verification to establish an email address.
  • The customer's email address indicates high risk: NS8 has found the email address to be associated with high-risk activity, or the email has appeared on a blacklist or similar fraud-screening tool.
  • The shipping address is associated with fraudulent transactions: The shipping address has been identified with fraud in the past and therefore presents a high risk.
  • The shipping address has a postal code not in the city entered: The shipping postal code does not match the city provided by the customer.
  • Distance from shipping address to the device exceeds 100km: NS8's patented geolocation technology has identified that the customer is physically located an excessive distance from the shipping address (more than 100 kilometers, or 62 miles).
  • Distance from shipping address to billing address exceeds 100km: The distance between shipping and billing addresses are excessive (more than 100 kilometers, or 62 miles).
  • The shipping address is not in the country of the IP address the transaction originated from: NS8's patented geolocation technology has identified that the customer is physically located in a different country than where the transaction appears to originate.
  • The billing address has a postal code not in the city entered: The billing postal code does not match the city provided by the customer.
  • Distance from billing address to the device exceeds 100km: NS8's patented geolocation technology has identified that the customer is physically located an excessive distance from the billing address (more than 100 kilometers, or 62 miles).
  • The billing address is not in the country of the IP address the transaction originated from: NS8's patented geolocation technology has identified that the customer is physically located in a different country than the transaction's billing address.
  • The payment is rated as medium risk (more than a 10% chance of fraud): The payment has attributes that indicate medium fraud risk.
  • The payment is rated as high risk (more than a 25% chance of fraud): The payment has attributes that indicate high fraud risk.
  • The payment is rated as an extreme risk (more than a 50% chance of fraud): The payment has attributes that indicate extreme fraud risk.
  • The user is using a public proxy: The user placed the order while using a public proxy to mask their technological identity.
  • The user is using an anonymous proxy: The user placed the order while using an anonymous proxy to mask their technological identity.
  • The user is originating from a high-risk IP address: NS8 found the IP address to be associated with high-risk activity, or the IP address has appeared on a blacklist or similar fraud screening tool.

Updated 8 months ago

Payment risk factors


Understanding the risk types used to score payments.

Suggested Edits are limited on API Reference Pages

You can only suggest edits to Markdown body content, but not to the API spec.