What is a Suspect Order
A suspect order is an order that has been quarantined by NS8's EQ8 Scoring Engine as potential fraud. An order can be quarantined as suspect due to NS8's review of the order or because of an order rule that you created. In either case, you will need to decide if the order will be approved, SMS verified, or canceled.
Potential fraud indicators can include issues with the user's device, location, or payment, among other things. Fraud review is not a one-size-fits-all process, therefore you will need to decide how the fraud review process will work best for your business. Contact our support team using the chat icon below if you need assistance with reviewing your order data.
The ideal process for most businesses will use automation to verify a majority of suspect orders, and save manual review for the edge cases. The focus of this article is manual review of a quarantined order. The article below will help you understand some fraud screening automation best practices.
Suspect Order Recommendations
The NS8 Status field and NS8 Recommendation fields will contain values to help guide your course of action.
This recommendation indicates that there is a low to medium degree of suspicion associated with the order and further investigation is warranted.
This recommendation indicates that the order has a high degree of suspicion and you should consider canceling the order. This can be due to an order rule that sets the order to high risk or a strong fraud indicator like an extreme payment risk. These orders will not be automatically canceled unless you create an order rule to do so.
Reviewing a Suspect Order in NS8 Protect
The Suspicious Orders Screen is where you can review the details of an order. The steps below will help you apply that information to your customer profile. Understanding your good customers is key to fraud screening. For example, for some businesses a billing and shipping address mismatch may be a strong fraud indicator, but for other businesses where sales are often gifts, this will be less important. Another indicator is order size, since unusually large orders can indicate fraud. These are some key factors to consider in your manual fraud review:
- Payment Issues - The information in this screen will indicate if potential issues with a payment have been identified. If there are payment issues identified, you will probably want to SMS verify or contact the customer before approving the order.
- Primary User Issue - The risk factor identified will indicate how NS8 Protect™ (formerly Complete Storefront Protection) determined the risk associated with the order.
- Locations - Locations can be a strong indicator of fraud by comparing billing and shipping information to the device location, so that you can evaluate an order's risk. Depending on the profile of your customers, orders shipped to a different country than from where the order originated are an example of a high risk order. A device located in a different country than the orders addresses can also be a fraud indicator. The ISP Organization field should also be reviewed, for example a user coming from a data center is highly suspect.
- Navigation - A user that navigates ten pages very quickly or in a pattern inconsistent with normal behavior for your store is an indicator of suspicion.
- User Details - The details of the user can help you identify fraudulent activity. For example, an email address that is a random selection of letters and numbers can indicate a throw away account. Order history can also help you determine a user's validity if they deviate from your store's norms.
- Session Details - If these details do not align with the rest of the information gathered about a user, this is also a fraud indicator. For example, the browser Safari is not available for products not made by Apple, so a user with Safari as a browser and Windows as a platform would be deemed suspicious.
- Identity Check - This is a beta service for Shopify customers only at this time. This service will verify the user's information and compare it to records indicating who the owner of a physical address, email address, and phone number is. This information compared to the details of your order can be very helpful in determining suspicion.
Fraud Review Results
Once you have reviewed these factors, you can decide what action to take based on your review:
Approve - This will accept the order and have it continue down your fulfillment path.
SMS Verify - This will ask the customer to verify their order. If they respond positively, the order will be approved.
Cancel - This will cancel the order and communicate the cancellation to your website to act accordingly.
Many merchants will either email or call a customer if they want to verify an order where fraud review leaves them with some degree of suspicion. Using automation and the data available in NS8 Protect, this should only be required a small amount of the time.
After reviewing an order, it is a good idea to analyze the ability to automate review based on patterns in your store. For example, if you find that orders with billing and shipping mismatches with different states are reason to investigate an order, you can build a rule to SMS Verify the orders automatically. Building order rules to automate the review process can help you act both safely and efficiently.