Digital banking factors for mobile application events

Risk Analytics offers different types of default factors for digital mobile banking:

  • Factors based on mobile device information
  • Factors based on mobile device location
  • Factors based on mobile session information

  • Factors based on mobile application data

  • Factors based on mobile application protection (OneSpan Mobile Application Shielding)
  • Other factors common to mobile non-monetary events and transactions
  • Factors specific to mobile non-monetary events
  • Factors specific to mobile transactions

The following tables provide information on the factors specific to digital banking and mobile applications.

Table legend

  • Factor: name of the factor as displayed in Presentation Service.
  • Configuration label: name of the factor in the Decision Analytics configuration file and the Risk Analytics database.
  • Factor Type: the type of factor.
  • Execution Type: interval at which the factor is executed. Possible intervals are real time or daily. In real-time execution, the factor is computed in real time, based on existing information. In daily execution, the factor is computed by the DecisionAnalyticsComputeDailyJob job embedded in the Jobs web service. By default this job is launched once a day.

 

Factors based on mobile device information
Factor Factor type Description
(Configuration label) Execution type
B_NEW_OS_VERSION

(IsNewOSVersion)

BOOLEAN

Real time

 Checks if the operating system (OS) version is new for the bank.
C_NUM_OS_VERSION

(NumOSVersion)

NUMBER

Real time

 Number of customers using this OS version.
IS_DEVICE_CODE_MISMATCH

(IsDeviceCodeMismatch)

BOOLEAN

Real time

 Checks if the device model code no longer matches the registered code.
IS_DEVICE_ROOTED

(IsDeviceRooted)

BOOLEAN

Real time

 Checks if the device is rooted (as received in the CDDC event).
IS_PREVEVT_SAME_ROOTED_STATE

(IsSamePreviousDeviceRooted)

BOOLEAN

Real time

 Checks if the device state is the same as for the previous event received for the device.
NUM_ROOTED_CHANGE_CURWEEK

(NumRootedChangeCurrentWeek)

NUMBER

Daily

 Checks how often the rooted state has changed in the last week.
IS_WIFI_ENABLED

(IsWifiEnabled)

BOOLEAN

Real time

 Checks if Wi-Fi is enabled on the device (as received in the CDDC event).
IS_BLUETOOTH_ENABLED

(IsBluetoothEnabled)

BOOLEAN

Real time

 Checks if Bluetooth is enabled on the device (as received in the CDDC event).
IS_DATA_ENABLED

(IsDataEnabled)

BOOLEAN

Real time

 Checks if mobile data is enabled on the device (3G/4G).
B_NEW_DEVICE

(NewBankDevice)

 BOOLEAN Checks if it is the first event received from this device for the bank.
C_NEW_DEVICE_SESSION

(IsNewCustomerDevice)

BOOLEAN

Real time

 Checks if it is the first event received from this device for this customer.
SAME_SESSION_DEVICE

(SamePreviousDevice)

 BOOLEAN Checks if the device ID used in the previous event was the same for the current session.
IS_OS_ENCRYPTED

(IsOSEncrypted)

BOOLEAN

Real time

 Checks if the OS is encrypted.
IS_OS_ENCRYPTED_MISMATCH

(IsOSEncryptedMismatch)

BOOLEAN

Real time

 Checks if the OS is no longer encrypted. This means that previously, an event has been received where the operating system had been encrypted.
B_NEW_NETWORK

(IsNewBankNetwork)

BOOLEAN

Real time

Checks if it is the first event sent over the GSM network for the bank.

Depends on the availability for the mobile device.
C_NEW_NETWORK

(IsNewCustomerNetwork)

BOOLEAN

Real time

Checks if it is the first event sent over the GSM network for this customer.

Depends on the availability for the mobile device.
IS_PREVEVT_SAME_NETWORK

(IsSamePreviousNetwork)

BOOLEAN

Real time

 Checks if the GSM network used in the previous event was the same for the same relationship_ref value.
C_NUM_DISTINCT_DEVICE

(NumDeviceForCustomer)

NUMBER

Real time

 Number of different devices for the customer.
B_NUM_CUST_SAME_DEVICE

(NumCustomerForDevice)

NUMBER

Real time

 Number of bank customers linked to this device.
IS_PASSWORD_VISIBLE

(IsPasswordVisible)

BOOLEAN

Real time

 Checks if the device shows the password in clear text.
IS_GEOLOCATION_ON

(IsGeolocationOn)

BOOLEAN

Real time

 Checks if geolocation is enabled for the device.
IS_NF_ON

(IsNfcOn)

BOOLEAN

Real time

 Checks if the near-field communication (NFC) is enabled for the device.
IS_SIM_CARD

(IsSimCard)

BOOLEAN

Real time

 Checks if the device supports a SIM card.
IS_MULTI_SIM_CARD

(IsMultiSimCard)

BOOLEAN

Real time

 Checks if the device supports multiple SIM cards.
NUM_EVENT_FOR_SIMCARD

(NumEventForSimCard)

NUMBER

Real time

 Checks the number of events received from this device using this SIM card ID.
IS_ROAMING_ON

(IsRoamingOn)

BOOLEAN

Real time

 Checks if the SIM card is in roaming mode.
B_NUM_EVENT_TIME_ZONE

(NumEventTimeZone)

NUMBER

Real time

 Number of bank events received from this device using this time zone.
Factors based on mobile device location
Factor Factor type Description
(Configuration label) Execution type
PREVIOUS_EVT_DISTANCE

(PreviousEventDistance)

NUMBER

Real time

 Distance in km from the previous mobile event for the same relationship_ref value. The distance is calculated based on the latitude and longitude.1
IS_PREVEVT_SAME_GIS_CITY

(IsSamePreviousGisCity)

BOOLEAN

Real time

 Checks if the city used in the previous event (NME or TXN) is the same for the same relationship_ref value.
IS_PREVEVT_SAME_GIS_COUNTRY

(IsSamePreviousGisCountry)

BOOLEAN

Real time

 Checks if the country used in the previous event (NME or TXN) is the same for the same relationship_ref value.
IS_PREVEVT_SAME_GIS_CONTINENT

(IsSamePreviousGisContinent)

BOOLEAN

Real time

 Checks if the continent used in the previous event (NME or TXN) is the same for the same relationship_ref value.
CUST_CITY_VELOCITY

(CustomerGisCityVelocity)

NUMBER

Real time

 Checks the number of events received for this customer using this city.
CUST_COUNTRY_VELOCITY

(CustomerGisCountryVelocity)

NUMBER

Real time

 Checks the number of events received for this customer using this country.
CUST_CONTINENT_VELOCITY

(CustomerGisContinentVelocity)

NUMBER

Real time

 Checks the number of events received for this customer using this continent.
Factors based on mobile session information
Factor Factor type Description
(Configuration label) Execution type
AVG_CUSTOMER_WEEKLY_ SESSION

(AverageCustomerWeeklySession)

NUMBER

Daily

 Average number of sessions opened within a week during the last period (default value: six months).
AVG_CUSTOMER_MONTHLY_ SESSION

(AverageCustomerMonthlySession)

NUMBER

Daily

 Average number of sessions opened within a month during the last period (default value: six months).
TIME_SINCE_LAST_SESSION

(TimeSinceLastSession)

NUMBER

Real time

 Time (in seconds) elapsed since the last session was closed (time since the event in the previous session).
TIME_SINCE_LAST_REQUEST

(TimeSinceLastRequest)

NUMBER

Real time

 Time (in seconds) elapsed since the last request within the same session (time between two events within the same session).
NUM_REQUEST_IN_SESSION

(NumRequestInSession)

NUMBER

Real time

 Number of requests submitted in the current session.
EARLY_MORNING

(EarlyMorning)

BOOLEAN

Real time

 NME/TXN between 6 a.m.and 9 a.m.
LATE_MORNING

(LateMorning)

BOOLEAN

Real time

 NME/TXN between 9 a.m.and 12 a.m.
EARLY_AFTERNOON

(EarlyAfternoon)

BOOLEAN

Real time

 NME/TXN between 12 a.m.and 3 p.m.
LATE_AFTERNOON

(LateAfternoon)

BOOLEAN

Real time

 NME/TXN between 3 p.m. and 6 p.m.
EARLY_EVENING

(EarlyEvening)

BOOLEAN

Real time

 NME/TXN between 6 p.m.and 9 p.m.
LATE_EVENING

(LateEvening)

BOOLEAN

Real time

 NME/TXN between 9 p.m. and 12 p.m.
NIGHT

(Night)

BOOLEAN

Real time

 NME/TXN between 12 p.m. and 6 a.m.
BEGIN_MONTH

(BeginMonth)

BOOLEAN

Real time

 NME/TXN between the 1st and the 10th day of the month.
MIDDLE_MONTH

(MiddleMonth)

BOOLEAN

Real time

 NME/TXN between 11th and the 20th day of the month.
END_MONTH

(EndMonth)

BOOLEAN

Real time

 NME/TXN after 20th day of the month.
Factors based on mobile application data
Factor Factor type Description
(Configuration label) Execution type
C_NEW_APPUID

(IsNewCustomerApplicationId)

BOOLEAN

Real time

Checks if the application UID is new for this customer..
B_NEW_BANK_APPUID

(IsNewBankApplication)

BOOLEAN

Real time

 Checks if the application UID is new for the bank.
B_NEW_APP_VERSION

(IsNewApplicationVersion)

BOOLEAN

Real time

 Checks if the version of the application is new (i.e. not known to the bank).
APP_VERSION_COUNT

(ApplicationVersionCount)

NUMBER

Real time

 Checks the number of different app versions used by the customer (the number is incremented each time the current version changes).
APP_RELEASE_AGE

(ApplicationReleaseAge)

NUMBER

Real time

 Checks the number of days since the release date.
IS_APP_OS_LANGUAGE_MATCHING

(IsApplicationOSLanguageMatch)

BOOLEAN

Real time

 Checks if the application language and the OS language are the same.
IS_PIN_PROTECTED

(IsPinProtected)

BOOLEAN

Real time

 Checks if the application is PIN-protected (as received in the CDDC event).
PIN_ENTROPY

(PinEntropy)

NUMBER

Real time

 Checks if the PIN entropy value corresponds to the value received in the CDDC event.
IS_PREVEVT_SAME_PIN_PROT

(IsSamePreviousPinProtected)

BOOLEAN

Real time

 Checks if PIN protection is the same as for the previous event for the same relationship_ref and application UID values.
PIN_PROT_CHANGE_CURWEEK

(PinProtectedChangeCurrentWeek)

NUMBER

Daily

 Checks how often PIN protection has changed in the last week.
IS_FINGER_PROTECTED

(IsFingerPrintProtected)

BOOLEAN

Real time

 Checks if the application is fingerprint-protected (as received in the CDDC event).
IS_PREVEVT_SAME_FINGER_PROT

(IsSamePreviousFPProtected)

BOOLEAN

Real time

Checks if fingerprint protection is the same as for the previous event for the same relationship_ref and application UID values.
FINGER_PROT_CHANGE_CURWEEK

(FPProtectedChangeCurrentWeek)

NUMBER

Daily

 Checks how often the fingerprint protection has changed in the last week.
IS_FACE_PROTECTED

(IsFaceProtected)

BOOLEAN

Real time

 Checks if the application is face-protected.
IS_PREVEVT_SAME_FACE_PROT

(IsSamePreviousFaceProtected)

BOOLEAN

Real time

Checks if face protection is the same as for the previous event for the same relationship_ref and application UID values.
FACE_PROT_CHANGE_CURWEEK

(FaceProtChangeCurrentWeek)

NUMBER

Daily

Checks how often face protection has changed in the last week.
IS_FACE_ENROLLED

(IsFaceEnrolled)

BOOLEAN

Real time

 Checks if the face of the end user has been enrolled.
IS_FACE_ENROLLED_ON_DEVICE

(IsFaceEnrolledOnDevice)

BOOLEAN

Real time

 Checks if the face of the end user has been enrolled from this device.
LAST_FACE_VERIFICATION_SCORE

(LastFaceVerificationScore)

NUMBER

Real time

 Checks the face recognition verification score computed during the authentication. The value must be between –1 and 1, >=0 means authenticated.
IS_FACE_SPOOFING_DETECTED

(IsFaceSpoofingDetected)

BOOLEAN

Real time

 Checks if a spoofing attack has been detected during face verification.
C_NUM_FACE_SPOOFING_PERIOD

C_NUM_FACE_SPOOFING_SHTTIME

C_NUM_FACE_SPOOFING_MEDTIME

C_NUM_FACE_SPOOFING_LNGTIME

(NumFaceSpoofingShtTime)

(NumFaceSpoofingMedTime)

(NumFaceSpoofingLngTime)

NUMBER

Daily

Checks how often spoofing attacks were detected on the device for the last period as defined (short, medium, long time).

Default values:

  • short time: one week
  • medium time: one month
  • long time: three months
FACE_SAMPLE_QUAL

(FaceSampleQuality)

NUMBER

Real time

 Checks the quality of the captured samples during face verification. The value must be between 0 and 1.
IS_BEHAVIOR_PROTECTED

(IsBehaviorProtected)

BOOLEAN

Real time

Checks if the application is user-behavior-protected.

Values: BEHAVIOR_PROTECTED=

  • 0: disabled
  • 1: client only (not applicable – reserved future use)
  • 2: client/server
IS_PREVEVT_SAME_BEHAVIOR_PROT

(IsSamePreviousBehaviorProt)

BOOLEAN

Real time

 Checks if the behavior protection is the same as for the previous event for the same relationship_ref and application UID values.
BEHAVIOR_PROT_CHANGE_CURWEEK

(BehavProtChangeCurrentWeek)

NUMBER

Daily

Checks how often user behavior protection has changed in the last week.
IS_BEHAVIOR_TRAINED

(IsBehaviorTrained)

BOOLEAN

Real time

Checks if the authentication server is trained to be able to authenticate the user’s behavior.

This factor is deprecated. OneSpan recommends using directly the input field BEHAVIOR_TRAINED which provides the same information.
LAST_BEHAV_VERIFICATION_SCORE

(LastBehaviorVerifScore)

NUMBER

Real time

Checks the user behavior verification score computed during the authentication. The value ranges from 0 to 1.

This factor is deprecated. OneSpan recommends using directly the input field BEHAVIOR_SCORE which provides the same information.
LAST_BEHAV_VERIFICATION_CONF

(LastBehaviorVerifConf)

NUMBER

Real time

Checks the confidence of the user behavior verification score computed during the authentication. The value ranges from 0 to 1.

This factor is deprecated. OneSpan recommends using directly the input field BEHAVIOR_CONFIDENCE which provides the same information.
PROTECTION_TYPE

(ProtectionType)

NUMBER

Real time

Checks the type of protection(s) used for OTP generation.

The value is a combination of one or more protection type bitmask values below:

  • 1: No Password
  • 2: Password
  • 4: User Fingerprint
  • 8: Face Recognition
  • 16: User Behavior

IS_PROT_NOPIN_CUST_PERIOD

IS_PROT_NOPIN_CUST_SHTTIME

IS_PROT_NOPIN_CUST_MEDTIME

IS_PROT_NOPIN_CUST_LNGTIME

(IsProtNoPinCustShtTime)

(IsProtNoPinCustMedTime)

(IsProtNoPinCustLngTime)

BOOLEAN

Daily

Checks if an event with NO PIN protection related to the customer has been received during the last period as defined (short, medium, long).

Default values:

  • short time: one week
  • medium time: one month
  • long time: three months

IS_PROT_PIN_CUST_PERIOD

IS_PROT_PIN_CUST_SHTTIME

IS_PROT_PIN_CUST_MEDTIME

IS_PROT_PIN_CUST_LNGTIME

(IsProtPinCustShtTime)

IsProtPinCustMedTime)

(IsProtPinCustLngTime)

BOOLEAN

Daily

Checks if an event with PIN protection related to the customer has been received during the last period as defined (short, medium, long).

Default values:

  • short time: one week
  • medium time: one month
  • long time: three months

IS_PROT_FPRINT_CUST_PERIOD

IS_PROT_FPRINT_CUST_SHTTIME

IS_PROT_FPRINT_CUST_MEDTIME

IS_PROT_FPRINT_CUST_LNGTIME

(IsProtFPCustShtTime)

(IsProtFPCustMedTime)

(IsProtFPCustLngTime)

BOOLEAN

Daily

Checks if an event with fingerprint protection related to the customer has been received during the last period as defined (short, medium, long).

Default values:

  • short time: one week
  • medium time: one month
  • long time: three months

IS_PROT_FACE_CUST_PERIOD

IS_PROT_FACE_CUST_SHTTIME

IS_PROT_FACE_CUST_MEDTIME

IS_PROT_FACE_CUST_LNGTIME

(IsProtFaceCustShtTime)

(IsProtFaceCustMedTime)

(IsProtFaceCustLngTime)

BOOLEAN

Daily

Checks if an event with face recognition protection related to the customer has been received during the last period as defined (short, medium, long).

Default values:

  • short time: one week
  • medium time: one month
  • long time: three months

IS_PROT_BEHAV_CUST_PERIOD

IS_PROT_BEHAV_CUST_SHTTIME

IS_PROT_BEHAV_CUST_MEDTIME

IS_PROT_BEHAV_CUST_LNGTIME

(IsProtBehavCustShtTime)

(IsProtBehavCustMedTime)

(IsProtBehavCustLngTime)

BOOLEAN

Daily

 Checks if an event with user behavior protection related to the customer has been received during the last period as defined (short, medium, long).

Default values:

  • short time: one week
  • medium time: one month
  • long time: three months

C_NUM_NOPIN_OTP_CUST_PERIOD

C_NUM_NOPIN_OTP_CUST_SHTTIME

C_NUM_NOPIN_OTP_CUST_MEDTIME

C_NUM_NOPIN_OTP_CUST_LNGTIME

(NumNoPinOtpCustShtTime)

(NumNoPinOtpCustMedTime)

(NumNoPinOtpCustLngTime)

NUMBER

Daily

 Checks the number of OTPs generated by the customer with NO PIN protection during the last period as defined (short, medium, long).

Default values:

  • short time: one week
  • medium time: one month
  • long time: three months

C_NUM_PIN_OTP_CUST_PERIOD

C_NUM_PIN_OTP_CUST_SHTTIME

C_NUM_PIN_OTP_CUST_MEDTIME

C_NUM_PIN_OTP_CUST_LNGTIME

(NumPinOtpCustShtTime)

(NumPinOtpCustMedTime)

(NumPinOtpCustLngTime)

NUMBER

Daily

 Checks the number of OTPs generated by the customer with PIN protection during the last period as defined (short, medium, long).

Default values:

  • short time: one week
  • medium time: one month
  • long time: three months

C_NUM_FING_OTP_PERIOD

C_NUM_FING_OTP_SHTTIME

C_NUM_FING_OTP_MEDTIME

C_NUM_FING_OTP_LNGTIME

(NumFPOtpCustShtTime)

(NumFPOtpCustMedTime)

(NumFPOtpCustLngTime)

NUMBER

Daily

 Checks the number of OTPs generated by the customer with fingerprint protection during the last period as defined (short, medium, long).

Default values:

  • short time: one week
  • medium time: one month
  • long time: three months

C_NUM_FACE_OTP_PERIOD

C_NUM_FACE_OTP_SHTTIME

C_NUM_FACE_OTP_MEDTIME

C_NUM_FACE_OTP_LNGTIME

(NumFaceOtpCustShtTime)

(NumFaceOtpCustMedTime)

(NumFaceOtpCustLngTime)

NUMBER

Daily

 Checks the number of OTPs generated by the customer with face protection during the last period as defined (short, medium, long).

Default values:

  • short time: one week
  • medium time: one month
  • long time: three months
IS_SECURE_ELEMENT

(IsSecureElement)

BOOLEAN

Real time

 Checks if the application is using a secure element (hardware) to store secret keys.
IS_SECURE_ELEMENT_MISMATCH

(IsSecureElementMismatch)

BOOLEAN

Real time

 Checks if the application is no longer using a secure element to store secret keys.
IS_RASP_PROTECTED

(IsRaspProtected)

BOOLEAN

Real time

 Checks if the application is App Shielding-protected.
IS_RASP_PROTECTED_MISMATCH

(IsRaspProtectedMismatch)

BOOLEAN

Real time

 Checks if the application is no longer App Shielding-protected.

NUM_DIST_BSSID_PERIOD

NUM_DIST_BSSID_SHTTIME

NUM_DIST_BSSID_MEDTIME

NUM_DIST_BSSID_LNGTIME

(NumDistBSSIDShtTime)

(NumDistBSSIDMedTime)

(NumDistBSSIDLngTime)

NUMBER

Daily

 Checks the number of different connected Wi-Fi BSSID during the last period as defined (short, medium, long).

Default values:

  • short time: one week
  • medium time: one month
  • long time: three months
NUM_EVENT_FOR_KBD

(NumEventForKeyboard)

NUMBER

Real time

 Checks the number of events received for the customer app using this keyboard ID.
NUM_EVENT_FOR_LAUNCHER

(NumEventForLauncher)

NUMBER

Real time

 Checks the number of events received for the customer app using this launcher ID (Android only).
NUM_DP_FOR_CUST_APPLICATION

(NumDPForCustomerApplication)

NUMBER

Real time

 Checks the number of Digipass authenticators used by the customer instance of the application. (Digipass authenticator means distinct serial and sequence numbers.)
NUM_CUST_APPLICATION_FOR_DP

(NumCustomerApplicationForDP)

NUMBER

Real time

 Checks the number of application instances using the same Digipass authenticator. (Digipass authenticator means distinct serial and sequence numbers.)
Factors based on mobile application protection (App Shielding)
Factor Factor type Description
(Configuration label) Execution type
IS_REPACKAGED_APPLICATION

(IsRepackaged)

BOOLEAN

Real time

Checks if the host application was repackaged.

Only for App Shielding applications running under iOS.
IS_DEBUGGER_ATTACHED

(IsDebuggerAttached)

BOOLEAN

Real time

Checks if a debugger is attached to the host application.

Only for App Shielding applications running under iOS.

DEBUGGER_CUST_PERIOD

DEBUGGER_CUST_SHTTIME

DEBUGGER_CUST_MEDTIME

DEBUGGER_CUST_LNGTIME

(DebuggerCustomerShtTime)

(DebuggerCustomerMedTime)

(DebuggerCustomerLngTime)

NUMBER

Daily

Checks the number of events with an attached debugger received for the customer during the last period as defined (short, medium, long).

Default values:

  • short time: One week
  • medium time: One month
  • long time: Three months

Only for App Shielding applications running under iOS.

DEBUGGER_DEV_PERIOD

DEBUGGER_DEV_SHTTIME

DEBUGGER_DEV_MEDTIME

DEBUGGER_DEV_LNGTIME

(DebuggerDeviceShtTime)

(DebuggerDeviceMedTime)

(DebuggerDeviceLngTime)

NUMBER

Daily

 Checks the number of events with an attached debugger received from the device during the last period as defined (short, medium, long).

Default values:

  • short time: One week
  • medium time: One month
  • long time: Three months

Only for App Shielding applications running under iOS.
IS_SCREENSHOT_DETECTED

(IsScreenshotDetected)

BOOLEAN

Real time

Checks if a screenshot of the application has been taken.

Only for App Shielding applications running under iOS.

SCREENSHOT_CUST_PERIOD

SCREENSHOT_CUST_SHTTIME

SCREENSHOT_CUST_MEDTIME

SCREENSHOT_CUST_LNGTIME

(ScreenshotCustomerShtTime)

(ScreenshotCustomerMedTime)

(ScreenshotCustomerLngTime)

NUMBER

Daily

 Checks the number of events with a detected screenshot received for the customer during the last period as defined (short, medium, long).

Default values:

  • short time: One week
  • medium time: One month
  • long time: Three months

Only for App Shielding applications running under iOS.

SCREENSHOT_DEV_PERIOD

SCREENSHOT_DEV_SHTTIME

SCREENSHOT_DEV_MEDTIME

SCREENSHOT_DEV_LNGTIME

(ScreenshotDeviceShtTime)

(ScreenshotDeviceMedTime)

(ScreenshotDeviceLngTime)

NUMBER

Daily

 Checks the number of events with a detected screenshot received from the device during the last period as defined (short, medium, long).

Default values:

  • short time: One week
  • medium time: One month
  • long time: Three months

Only for App Shielding applications running under iOS.
IS_LIBINJECT_DETECTION

(IsLibraryInjectionDetection)

BOOLEAN

Real time

Checks if there was an attempt to inject an untrusted library into the application during runtime.

Only for App Shielding applications running under iOS.

LIBINJECT_CUST_PERIOD

LIBINJECT_CUST_SHTTIME

LIBINJECT_CUST_MEDTIME

LIBINJECT_CUST_LNGTIME

(LibInjectionCustShtTime)

(LibInjectionCustMedTime)

(LibInjectionCustLngTime)

NUMBER

Daily

 Checks the number of events with a detected library injection received for this customer during the last period as defined (short, medium, long).

Default values:

  • short time: One week
  • medium time: One month
  • long time: Three months

Only for App Shielding applications running under iOS.

LIBINJECT_DEV_PERIOD

LIBINJECT_DEV_SHTTIME

LIBINJECT_DEV_MEDTIME

LIBINJECT_DEV_LNGTIME

(LibInjectionDeviceShtTime)

(LibInjectionDeviceMedTime)

(LibInjectionDeviceLngTime)

NUMBER

Daily

 Checks the number of events with a detected library injection received from the device during the last period as defined (short, medium, long).

Default values:

  • short time: One week
  • medium time: One month
  • long time: Three months

Only for App Shielding applications running under iOS.
ROOTING_PROBABILITY

(RootingProbability)

NUMBER

Real time

Checks the probability that the device has been rooted using heuristics. The value ranges from 0 and 100.

Only for App Shielding applications running on Android.

AVG_ROOTING_PROBA_PERIOD

AVG_ROOTING_PROBA_SHTTIME

AVG_ROOTING_PROBA_MEDTIME

AVG_ROOTING_PROBA_LNGTIME

(AvgRootingProbaShtTime)

(AvgRootingProbaMedTime)

(AvgRootingProbaLngTime)

NUMBER

Daily

 Checks the average rooting probability for the last period as defined (short, medium, long).

Default values:

  • short time: One week
  • medium time: One month
  • long time: Three months

Only for App Shielding applications running on Android.
IS_UNTRUSTED_KBD

(IsUntrustedKeyboard)

BOOLEAN

Real time

Checks if the keyboard is untrusted.

Only for App Shielding applications running on Android.

UNTRUSTED_KBD_CUST_PERIOD

UNTRUSTED_KBD_CUST_SHTTIME

UNTRUSTED_KBD_CUST_MEDTIME

UNTRUSTED_KBD_CUST_LNGTIME

(UntrustedKbdCustShtTime)

(UntrustedKbdCustMedTime)

(UntrustedKbdCustLngTime)

NUMBER

Daily

 Checks the number of events with an untrusted keyboard received for the customer during the last period as defined (short, medium, long).

Default values:

  • short time: One week
  • medium time: One month
  • long time: Three months

Only for App Shielding applications running on Android.

UNTRUSTED_KBD_DEV_PERIOD

UNTRUSTED_KBD_DEV_SHTTIME

UNTRUSTED_KBD_DEV_MEDTIME

UNTRUSTED_KBD_DEV_LNGTIME

(UntrustedKbdDeviceShtTime)

(UntrustedKbdDeviceMedTime)

(UntrustedKbdDeviceLngTime)

NUMBER

Daily

 Checks the number of events with an untrusted keyboard received from the device during the last period as defined (short, medium, long).

Default values:

  • short time: One week
  • medium time: One month
  • long time: Three months

Only for App Shielding applications running on Android.
IS_UNTRUSTED_SCREEN

(IsUntrustedScreen)

BOOLEAN

Checks if the screen reader is untrusted.

Only for App Shielding applications running on Android.

UNTRUSTED_SCREEN_CUST_PERIOD

UNTRUSTED_SCREEN_CUST_SHTTIME

UNTRUSTED_SCREEN_CUST_MEDTIME

UNTRUSTED_SCREEN_CUST_LNGTIME

(UntrustedScreenCustShtTime)

(UntrustedScreenCustMedTime)

(UntrustedScreenCustLngTime)

NUMBER

Daily

 Checks the number of events with an untrusted screen reader received for the customer during the last period as defined (short, medium, long).

Default values:

  • short time: One week
  • medium time: One month
  • long time: Three months

Only for App Shielding applications running on Android.

UNTRUSTED_SCREEN_DEV_PERIOD

UNTRUSTED_SCREEN_DEV_SHTTIME

UNTRUSTED_SCREEN_DEV_MEDTIME

UNTRUSTED_SCREEN_DEV_LNGTIME

(UntrustedKbdDeviceShtTime)

(UntrustedKbdDeviceMedTime)

(UntrustedKbdDeviceLngTime)

NUMBER

Daily

 Checks the number of events with an untrusted screen reader received from the device during the last period as defined (short, medium, long).

Default values:

  • short time: One week
  • medium time: One month
  • long time: Three months

Only for App Shielding applications running on Android.
IS_HOOKING_FRMWORK

(IsHookingFrmWork)

BOOLEAN

Real time

Checks if one or more hooking frameworks are present in the process.

Only for App Shielding applications running on Android.

HOOKING_FRMWORK_CUST_PERIOD

HOOKING_FRMWORK_CUST_SHTTIME

HOOKING_FRMWORK_CUST_MEDTIME

HOOKING_FRMWORK_CUST_LNGTIME

(HookingFrmWorkCustShtTime)

(HookingFrmWorkCustMedTime)

(HookingFrmWorkCustLngTime)

NUMBER

Daily

 Checks the number of events with a detected hooking framework received for the customer during the last period as defined (short, medium, long).

Default values:

  • short time: One week
  • medium time: One month
  • long time: Three months

Only for App Shielding applications running on Android.

HOOKING_FRMWORK_DEV_PERIOD

HOOKING_FRMWORK_DEV_SHTTIME

HOOKING_FRMWORK_DEV_MEDTIME

HOOKING_FRMWORK_DEV_LNGTIME

(HookingFrmWorkDevShtTime)

(HookingFrmWorkDevMedTime)

(HookingFrmWorkDevLngTime)

NUMBER

Daily

 Checks the number of events with a detected hooking framework received from the device during the last period as defined (short, medium, long).

Default values:

  • short time: One week
  • medium time: One month
  • long time: Three months

Only for App Shielding applications running on Android.
IS_NATIVE_CODE_HOOK

(IsNativeCodeHook)

BOOLEAN

Real time

Checks if native code hooks are present.

Only for App Shielding applications running on Android.

NATIVE_CODE_HOOK_CUST_PERIOD

NATIVE_CODE_HOOK_CUST_SHTTIME

NATIVE_CODE_HOOK_CUST_MEDTIME

NATIVE_CODE_HOOK_CUST_LNGTIME

(NativeCodeHookCustShtTime)

(NativeCodeHookCustMedTime)

(NativeCodeHookCustLngTime)

NUMBER

Daily

 Checks the number of events with native code hooks present received for the customer during the last period as defined (short, medium, long).

Default values:

  • short time: One week
  • medium time: One month
  • long time: Three months

Only for App Shielding applications running on Android.

NATIVE_CODE_HOOK_DEV_PERIOD

NATIVE_CODE_HOOK_DEV_SHTTIME

NATIVE_CODE_HOOK_DEV_MEDTIME

NATIVE_CODE_HOOK_DEV_LNGTIME

(NativeCodeHookDevShtTime)

(NativeCodeHookDevMedTime)

(NativeCodeHookDevLngTime)

NUMBER

Daily

 Checks the number of events with native code hooks present received from the device during the last period as defined (short, medium, long).

Default values:

  • short time: One week
  • medium time: One month
  • long time: Three months

Only for App Shielding applications running on Android.
Other common factors
Factor Factor type Description
(Configuration label) Execution type
C_NUM_SESS_SAME_NETWORK

(NumSessionSameNetworkCust)

NUMBER

Real time

 Number of sessions using the current GSM network for this customer (i.e. relationship_ref). The number of sessions excludes the current one.
C_NUM_SESS_SAME_DEVICE

(NumSessionSameDevice)

NUMBER

Real time

 Number of sessions using the device for this customer (i.e. relationship_ref). The number of sessions excludes the current one.
C_NUM_SESS_SAME_BENEF

(NumSessionSameBenef)

NUMBER

Real time

 Number of sessions using the beneficiary or creditor for this customer (i.e. relationship_ref). The number of sessions excludes the current one.
C_IP_NETWORK_AGE

(IPNetworkAgeCust)

NUMBER

Real time

 Number of days since the customer (i.e. relationship_ref) first used the current GSM network.
C_GIS_CITY_AGE

(GisCityAgeCust)

NUMBER

Real time

 Number of days since the first event sent by the customer (i.e. relationship_ref) from the city identified by GIS_CITY.
C_GIS_COUNTRY_AGE

(GisCountryAgeCust)

NUMBER

Real time

 Number of days since the first event sent by the customer (i.e. relationship_ref) from the country identified by GIS_COUNTRY.
C_DEVICE_AGE

(DeviceAge)

NUMBER

Real time

 Number of days since the customer (i.e. relationship_ref) first used this device.
C_BENEFICIARY_IBAN_AGE

(BeneficiaryIbanAge)

NUMBER

Real time

 Number of days since the customer (i.e. relationship_ref) first used this beneficiary.
C_BENEFICIARY_BANK_COUNTRY_AGE

(BeneficiaryBankCountryAge)

NUMBER

Real time

 Number of days since the customer (i.e. relationship_ref) first used this beneficiary bank country.
C_BENEFICIARY_BANK_AGE

(BeneficiaryBankAge)

NUMBER

Real time

 Number of days since the customer (i.e. relationship_ref) first used this beneficiary bank.
B_OS_VERSION_AGE

(OSVersionAgeAnyCustomer)

NUMBER

Real time

 Number of days since any customer of the bank first used the current OS version.
C_OS_VERSION_AGE

(OSVersionAgeCurrentCustomer)

NUMBER

Real time

 Number of days since the customer (i.e. relationship_ref) first used the current OS version.
AUTHENT_STATUS

(AuthentStatus)

NUMBER

Real time

Status on a customer authentication that possibly occurs for the current event.

Possible values:

0: No Authentication.

1: Simple Authentication Failed

2: Simple Authentication Success

3: Strong Authentication Failed

4: Strong Authentication Success

C_LAST_SCA_DATE

(LastScaDateCustomer)

DATE

Real time

Date of the last successful Strong Customer Authentication (SCA) for the current customer.

1/1/1970 00:00:00 if the customer has never performed a strong authentication.

C_LAST_SCA_AGE

(LastScaAgeCustomer)

NUMBER

Real time

Number of days since the last successful SCA for the current customer. Number of days since 1/1/1970 00:00:00 if the customer has never performed a strong authentication.
C_TPP_LAST_SCA_CONSENT_DATE

(TppLastScaConsentDateCustomer)

DATE

Real time

Date of the last successful SCA applied to access the account (XS2A) consent for the current customer (i.e. relationship_ref) and the current TPP (i.e. tpp_ref).

1/1/1970 00:00:00 if the customer has never performed a strong authentication to give XS2A consent to this TPP.

C_TPP_LAST_SCA_CONSENT_AGE

(TppLastScaConsentAgeCustomer)

NUMBER

Real time

Number of days since the last successful SCA applied to XS2A consent for the current customer (i.e. relationship_ref) and the current TPP (i.e. tpp_ref). Number of days since 1/1/1970 00:00:00 if the customer has never performed a strong authentication to give XS2A consent to this TPP.
C_IS_BENEF_TRUSTED

(IsBenefTrustedCustomer)

BOOLEAN

Real time

Indicates if the beneficiary of the current event or transaction is trusted for the current customer .

Possible values:

0: the beneficiary is not trusted

1: the beneficiary is trusted

C_BENEF_TRUSTED_AGE

(BenefTrustedAgeCustomer)

NUMBER

Real time

Number of days since the beneficiary became trusted for the current customer.

0 if the beneficiary is not or no longer trusted.

C_NUM_FAILED_TXN_CUST_PERIOD

C_NUM_FAILED_TXN_CUST_SHTTIME

C_NUM_FAILED_TXN_CUST_MEDTIME

C_NUM_FAILED_TXN_CUST_LNGTIME

(NumFailedTxnShtTime)

(NumFailedTxnMedTime)

(NumFailedTxnLngTime)

NUMBER

Daily

Number of failed transactions in the last period as defined (short, medium, long) for this customer.

Default values:

  • short time: one day
  • medium time: one week
  • long time: one month
SAME_SESSION_COUNTRY

(SameSessionCountry)

BOOLEAN

Real time

Checks if the GIS country of the event is the same as the country used for the previous web or mobile event in the session.
PREVIOUS_WEB_MOB_EVT_DISTANCE
(PreviousWebMobEventDistance)

NUMBER

Real time

 Distance in km from the previous event (web or mobile) for the same relationship_ref value. The distance is calculated based on the latitude and longitude.
Factors specific to mobile non-monetary events
Factor Factor type Description
(Configuration label) Execution type
C_NUM_FAILED_LOGIN_PERIOD

C_NUM_FAILED_LOGIN_SHTTIME

C_NUM_FAILED_LOGIN_MEDTIME

C_NUM_FAILED_LOGIN_LNGTIME

(NumFailedLoginShtTime)

(NumFailedLoginMedTime)

(NumFailedLoginLngTime)

NUMBER

Daily

Number of failed login attempts by this customer during the last period as defined (short, medium, long).

Default values:

  • short time: One day
  • medium time: One week
  • long time: One month
NUM_SAME_NME_TYPE

(NumSameNMEType)

NUMBER

Daily

 Number of non-monetary events of the same type occurring in the last period (default value: three months) for this customer.
AVG_WEEKLY_LOGIN

(AverageWeeklyLogin)

NUMBER

Daily

Average number of weekly successful logins of this customer in the last six months.

C_NUM_LOGIN_CURRENT_WEEK

(NumLoginCurrentWeek)

NUMBER

Daily

 Number of logins by this customer in the current week (covers a time period of the last 7 days).
HIGH_ACTIVITY

(HighActivity)

BOOLEAN

Real time

 Checks if the number of logins of the current customer during the current week is higher than the average number of weekly logins (NumLoginCurrentWeek > AverageWeeklyLogin?).
CHANGE

(Change)

BOOLEAN

Real time

 Checks if the profile status has changed.
C_NEW_BENEFICIARY_IBAN_SESS

(NewCustomerBeneficiaryIBAN)

BOOLEAN

Real time

Checks if the beneficiary account (e.g. IBAN) is on the list of known accounts used by this customer during the last period (default value: one year).
C_NEW_BENEFICIARY_BANK_SESS

(NewCustomerBeneficiaryBank)

BOOLEAN

Real time

Checks if the beneficiary bank is on the list of known beneficiary banks used by this customer during the last period (default value: one year).

C_NEW_BENEFICIARY_COUNTRY_SESS

(NewCustomerBeneficiaryCountry)

BOOLEAN

Real time

Checks if the beneficiary country is on the list of known beneficiary countries used by this customer during the last period (default value: six months).

C_NEW_BENEFICIARY_NAME_SESS

(NewCustomerBeneficiaryName)

BOOLEAN

Real time

Checks if the beneficiary name is on the list of known beneficiary names used by this customer during the last period (default value: six months).
CHANGE_SUCCESS

(NumChangeSuccess)

NUMBER

Daily

 Number of successful updates to contacts (create new or change existing fields) during the last week.
CHANGE_FAIL

(NumChangeFail)

NUMBER

Daily

 Number of failed updates to contacts (create new or change existing fields) during the last week.
B_NEW_BENEFICIARY_IBAN

(NewEverBeneficiaryIBAN)

BOOLEAN

Real time

 Checks if this beneficiary's IBAN is known to the bank.
C_NUM_NEW_BENEFICIARY_SUCCESS

(NumNewBeneficiarySuccess)

NUMBER

Daily

Number of successful instances to create new beneficiaries for this customer during the last period (default value: six months).
C_NUM_NEW_BENEFICIARY_FAIL

(NumNewBeneficiaryFail)

NUMBER

Daily

 Number of failed attempts to create new beneficiaries for this customer during the last period (default value: six months).
Factors specific to mobile transactions
Factor Factor type Description
(Configuration label) Execution type
NUM_ACC_LINK_TO_BENEF

(NumAccountLinkToBeneficiary)

NUMBER

Real time

 Number of different accounts performing transactions to this beneficiary over the last week. It also checks if these are included in the whitelist.

ACC_TXN_AMOUNT_PERIOD

ACC_TXN_AMOUNT_SHTTIME

ACC_TXN_AMOUNT_MEDTIME

ACC_TXN_AMOUNT_LNGTIME

(TxnAmountAttemptShtTime)

(TxnAmountAttemptMedTime)

(TxnAmountAttemptLngTime)

NUMBER

Daily

Transfer sums of outgoing transfer attempts for this account over the last period as defined (short, medium, long).

Default values:

  • short time: One week
  • medium time: One month
  • long time: Three months

ACC_NUM_TXN_ATTEMPT_PERIOD

ACC_NUM_TXN_ATTEMPT_SHTTIME

ACC_NUM_TXN_ATTEMPT_MEDTIME

ACC_NUM_TXN_ATTEMPT_LNGTIME

(NumTxnAttemptShtTime)

(NumTxnAttemptMedTime)

(NumTxnAttemptLngTime)

NUMBER

Daily

Number of outgoing transfer attempts for this account over the last period as defined (short, medium, long).

Default values:

  • short time: One week
  • medium time: One month
  • long time: Three months
NUM_SAME_CREDITOR_ATTEMPT

(NumSameCreditorAttempt)

NUMBER

Daily

 Number of outgoing transfer attempts to the same beneficiary during the last period (default value: three months).

ACC_TXN_AMOUNT_SUCCESS_ PERIOD

ACC_TXN_AMOUNT_SUCCESS_ SHTTIME

ACC_TXN_AMOUNT_SUCCESS_ MEDTIME

ACC_TXN_AMOUNT_SUCCESS_ LNGTIME

(TxnAmountSuccessShtTime)

(TxnAmountSuccessMedTime)

(TxnAmountSuccessLngTime)

NUMBER

Daily

Transfer sums of successful outgoing transfers for this account over the last period as defined (short, medium, long).

Default values:

  • short time: One week
  • medium time: One month
  • long time: Three months
ACC_NUM_TXN_SUCESS_PERIOD

ACC_NUM_TXN_SUCESS_SHTTIME

ACC_NUM_TXN_SUCESS_MEDTIME

ACC_NUM_TXN_SUCESS_LNGTIME

(NumTxnSuccessShtTime)

(NumTxnSuccessMedTime)

(NumTxnSuccessLngTime)

NUMBER

Daily

Number of successful outgoing transfers for this account over the last period as defined (short, medium, long).

Default values:

  • short time: One week
  • medium time: One month
  • long time: Three months
NUM_SAME_CREDITOR_SUCCESS

(NumSameCreditorSuccess)

NUMBER

Daily

 Number of successful outgoing transfers to the same beneficiary in the last period (default value: three months).

ACC_TXN_AMOUNT_FAIL_PERIOD

ACC_TXN_AMOUNT_FAIL_SHTTIME

ACC_TXN_AMOUNT_FAIL_MEDTIME

ACC_TXN_AMOUNT_FAIL_LNGTIME

(TxnAmountFailShtTime)

(TxnAmountFailMedTime)

(TxnAmountFailLngTime)

NUMBER

Daily

Transfer sums of failed outgoing transfers for this account over the last period as defined (short, medium, long).

Default values:

  • short time: One week
  • medium time: One month
  • long time: Three months

ACC_NUM_TXN_FAIL_PERIOD

ACC_NUM_TXN_FAIL_SHTTIME

ACC_NUM_TXN_FAIL_MEDTIME

ACC_NUM_TXN_FAIL_LNGTIME

(NumTxnFailShtTime)

(NumTxnFailMedTime)

(NumTxnFailLngTime)

NUMBER

Daily

Number of failed outgoing transfers for this account over the last period as defined (short, medium, long).

Default values:

  • short time: One week
  • medium time: One month
  • long time: Three months
NUM_SAME_CREDITOR_FAIL

(NumSameCreditorFail)

NUMBER

Daily

 Number of failed outgoing transfers to the same beneficiary during the last period (default value: three months).
C_NUM_TXN_TO_BENEF

(NumCustTxnToCreditor)

NUMBER

Real time

 Number of outgoing transfers from the customer to this beneficiary.
C_STDDEV_TXN_AMOUNT_SHT

(StdDevTxnAmountShtTime)

NUMBER

Daily

 Standard deviations between the customer (i.e. relationship_ref) amount mean (for the last month) and the current transaction amount.
C_STDDEV_TXN_AMOUNT_LNG

(StdDevTxnAmountLngTime)

NUMBER

Daily

 Standard deviations between the customer (i.e. relationship_ref) amount mean (for the last three months) and the current transaction amount.
C_MEAN_TXN_AMOUNT_SHT

(MeanTxnAmountShtTime)

NUMBER

Daily

 Customer (i.e. relationship_ref) transaction amount mean for the last month.
C_MEAN_TXN_AMOUNT_LNG

(MeanTxnAmountLngTime)

NUMBER

Daily

 Customer (i.e. relationship_ref) transaction amount mean for the last three months.