A shop that has been defrauded twice by the same person usually discovers it twice. The second time carries no more warning than the first, because nothing the shop can see has changed. Meanwhile a shop two streets away has already been through it. This article is about the gap between those two facts, and about who is in a position to close it.
The property
Repeat fraud crosses the shop boundary days before it crosses the payment boundary. A payment provider sees the card and the amount, and a shop sees the basket, the session and the account. Neither sees the other shops. A signal shared between shops is the only place all three meet.
Why it holds
What each party can actually observe
Fraud detection is usually described as a modelling problem. It is more useful to treat it first as a visibility problem, because a model can only be as good as what reaches it, and what reaches each party is fixed by where that party sits.
A payment provider observes the instrument and the amount. It is very good at what that supports: stolen card patterns, issuer signals, the geography of a charge. It does not observe that the basket was ten gift cards, that the account was created ninety minutes ago, that the session went straight to the product page without ever seeing the catalogue, or that the browser reports a language nobody in this shop's market reads. Those are facts about a purchase, not about a payment, and they stop at the shop.
A shop observes all of that, and observes it about one shop. It has no way of knowing that the same traits were at a checkout somewhere else this morning. Both parties are looking hard. Neither is looking at the thing that would settle the question.
Where the delay is
The second half of the gap is time. A chargeback is a fact about a payment, and it arrives when the cardholder's bank says so, which is weeks after the order and sometimes months. Any system whose ground truth is chargebacks is learning about a fraud pattern long after the run is finished.
A merchant's label is a fact about an order, and it arrives when the merchant notices, which is days. That is the entire argument for a signal that merchants label themselves: the truth arrives sooner, and it arrives attached to the context the payment never carried.
This is not a claim that a payment provider's model is weak. It is a claim about what reaches it, and when. The model is not the constraint. The inputs are.
Figure 1
Why sharing is the product
One shop learns from its own history. A shop in a shared signal learns from harm that other shops have confirmed, before the same traits reach its checkout. That is the whole of the value, and it is worth being precise about where it lives: not in any one shop's data, and not in a model, but in the fact that several shops label independently and the labels are visible to all of them.
Everything else in this library is a consequence of taking that seriously. If shops are going to share a signal, then what one shop's label can reach must be limited (corroboration), the shared thing must not become a lookup tool for curious members (enumeration), the identifiers must not be worth stealing (identity), and the whole arrangement must never be able to stop a sale (advisory).
Verify it
This claim is about where information can exist, so it is checked by reading rather than by calling. Two things you can do without an account:
curl -s https://api.heatrail.eu/disclosureThat is the page we publish for the person buying something, and it lists what a shop sends and what comes back. Compare it against what your payment provider's fraud tooling accepts as input, and note which of the two can see the basket, the account age and the session. The comparison is the argument.
Then look at your own chargeback dates. Take the last dispute you handled and measure the distance between the order date and the day you learned about it. That interval is the latency any chargeback-trained system is working under, and it is the number this product is built to go around.
Legal footing
Each shop is the controller for its own orders and relies on Article 6(1)(f) GDPR, a legitimate interest in preventing fraud, which Recital 47 names as an example of exactly such an interest. Heatrail OÜ acts as processor under Article 28, on the documented instructions concluded at registration, and never determines the purposes of the processing. What is shared between shops is limited to categories about an order rather than records about a person, which is Article 5(1)(c) applied at the interface rather than promised in a policy. See the data processing agreement and the trust center.
Related
- Advisory by construction, on why a shared signal is allowed nowhere near the checkout it informs.
- Trails, on what is actually linked when we say the same buyer appeared in three shops.
- Density beats volume, on why a small dense market is the best place for a shared signal.