Skip to main content
RoadmapStatusChangelogStart Building Now

Card Fraud Outreach

* This communication contains confidential information intended solely for the use of the recipient who received it directly from Unit Finance Inc. If you are not the intended recipient, please do not read, copy, distribute, or take any action based on its contents.

Card Transaction Monitoring for Suspected Fraud

Introduction​​

This guide provides a detailed overview of Unit's fraud monitoring services for suspected fraud card transactions, including those made with mobile wallets, virtual cards, and physical cards. We will explore the entire lifecycle of these services and how they will impact your customer experience.

Card Transaction Flow​​

The purchase card transaction flow lifecycle looks like this:

  1. Card is swiped by customer: The customer initiates a transaction using their card.
  2. Authorization or transaction initiated by merchant: The merchant sends the authorization request via Network to the issuer bank.
  3. Transaction risk scoring and authorization processing: The transaction is processed and the risk scoring model is applied.
  4. Transaction decline with Suspected Fraud reason: If the transaction is deemed suspicious, it is declined; in certain cases the card is also frozen. A card fraud case is created.
  5. White-Label Card Fraud Outreach: The customer will receive a white-label branded communication about the suspected fraud activity requesting their confirmation that the transaction was authorized or not.
  6. Action based on the customer response: Depending on the customer’s response, further action will be taken on the card:
    a. If the customer confirms that the transaction is legitimate, fraud restrictions are lifted for 24 hours and the customer can retry the transaction.
    b. If the customer confirms that the transaction was fraudulent, the card will be blocked. The customer will have the option of filing a dispute.
    c. If the customer does not respond to outreach communication within the specified timeframe, no additional actions are taken.

Transaction Risk Scoring and Authorization Processing​

During the authorization process, the transaction will be evaluated for fraud and risk.

Transaction Risk Scoring ​

First, the transaction is scored for fraud risk. The card transaction activity is categorized into different levels, with corresponding actions:

Fraud Risk LevelAuthorizationStatusCard StatusCustomer OutreachAction Taken
LowApprovedActiveNoNo intervention. The transaction is processed as normal.
HighDeclinedActiveYesTransaction is declined due to high fraud risk. The card remains active, pending customer verification of the transaction.
SevereDeclinedSuspectedFraudYesTransaction is declined. The card is immediately frozen with suspected fraud status due to high risk of fraud, pending customer verification of the transaction.

Authorization Processing​

If the authorization is approved in the previous step with Transaction Risk Scoring, additional checks are conducted to ensure the cardholder's account is in good standing. These checks include verifying the card status, limits, and available balance.

If you are using the programmatic authorization process, these checks occur after you've approved the authorization request. This ensures that the transaction is both authorized and also meets the cardholder's account requirements.

Decline with Suspected Fraud Reason and Card Fraud Case Creation​

Card Fraud Case Management​

When the card authorization or transaction (card activity) is declined due to suspected fraud, a card fraud case (resource) is automatically created. Each card fraud case is linked to specific suspicious activity and provides detailed information, including customer feedback, status, and history. Once activated, card fraud cases will automatically progress through their lifecycle based on customer actions.

Card Fraud Case Lifecycle (statuses, see diagram below):​

  1. Created: A new card fraud case is created and linked to a suspicious activity. The case is ready for further updates and the cardFraudCase.created webhook event is fired.
  2. Active: Outreach communication is sent to the customer to gather feedback. cardFraudCase.activated webhook event is fired.
  3. Closed: The case is resolved based on customer feedback:
    1. Fraud: The card is frozen. A new one can be issued upon customer request. cardFraudCase.fraud webhook event is fired.
    2. No Fraud: The card's block is removed and restrictions are lifted for 24 hours. cardFraudCase.nofraud webhook event is fired.
  4. Expired: No feedback is received within the specified expiration period (typically 72 hours). After expiration, card fraud cases cannot be acted upon. cardFraudCase.expired webhook event is fired.

Recommendation​

Even if you're using our White-Label solution, we recommend monitoring card fraud case webhook events and card status changes. This information can be used to make decisions and provide additional notifications for customers (e.g. mobile app notifications).

White-Label Card Fraud Case Outreach and Response Collection​

Our White-Label Card Fraud Outreach suite is designed to meet your specific needs and improve the customer experience. It streamlines the card fraud case lifecycle, automatically sends branded communications to customers, collects their responses, and updates their card status on your behalf.

It provides visibility into their card fraud case history and status, which can help you address customer requests. You’ll also have access to data about resolved cases and their fraud statuses.

Our White-Label experiences offer a high degree of customization to create branded web pages using Unit's infrastructure. These pages feature your company's domain and are accessible through secure links embedded in our outreach communication. This ensures a seamless and branded experience for your customers.

The service is free and is a part of our platform offering. You only need to perform a few simple configuration steps with assistance from our team. We’ll handle the complexities of card fraud management so that you can focus on your core business.

White-Label Card Fraud Outreach Process​

After the card fraud case is created, the outreach process will be activated to verify the suspected activity:

  1. Outreach communication: We’ll send the cardholder an email and/or SMS on your behalf with a secure link to our white-labeled verification experience based on your configured settings.
  2. Activity verification and response collection: When the customer clicks on the link, they’ll land on a secure page to confirm the activity or report it by selecting the suspicious transactions on the form.
  3. Actions: After confirming or reporting the transactions, the customer will be notified that their answer was collected and respective actions will be taken:
    1. Legitimacy (no fraud) confirmed: Their card will be unblocked. The fraud rules that triggered the original "Suspected Fraud" decline will be lifted for 24 hours.
    2. Fraud confirmed: The card will be blocked and require re-issuance. The customer may file a dispute via the designated phone number provided on-screen.
    3. No response: If the customer does not respond to the outreach communication within the specified timeframe, the card fraud case expires.

Important Notes:

  • Currently, only one outreach communication attempt is made per fraud case.
  • If a customer responds after the case expiration period, they’ll be notified that the response timeline has passed.
  • Customers can submit only one response per fraud case. Subsequent attempts will be acknowledged but not processed.
  • If the customer needs more help, they should contact your customer support using the telephone number provided within the outreach communication.
  • The card fraud case status will change at each stage, triggering a corresponding webhook event (see the diagram).

Card Fraud Outreach Communication ​

Fraud outreach communication will be sent according to the card fraud outreach policy settings. Once the communication is sent, a cardFraudCase.activated event is created.

Communication channels ​

Currently there are two types of communication channels available:

  • Email (default and mandatory)
  • SMS (optional)

Email communication (mandatory)

A branded email will be sent automatically to customers whenever a card fraud case is created. This email channel is mandatory and cannot be disabled.

To set up the email channel you need to:

For more information on email setup, please refer to the Implementation section.

SMS communication (optional)
You can also enable the SMS channel for card fraud outreach. This is optional. When activated, customers will receive an SMS message on each new card fraud case from a dedicated toll-free number.

The SMS will contain information about the suspected fraudulent activity and an invitation to verify it via a link to your web domain.

Customers can also opt out of receiving card fraud SMS communications at any time by replying with the word "STOP." This opt-out option is required under applicable law.

By enabling the SMS channel, you can provide additional outreach options to customers and increase the likelihood of receiving timely feedback.

To set up an SMS channel you need to:

For more information on SMS setup, please refer to the Implementation section. You can also reach out to our Solutions and Customer Success teams.

Fraud Outreach Response Collection ​

Our White-Label experiences leverage Unit's infrastructure to provide deep customization. For fraud outreach response collection, we’ll use web pages hosted by Unit but branded with your company's domain. This ensures a seamless and secure customer experience.

Outreach communications will include secure links to these branded landing pages, where your customers can confirm or report the transactions. This user-friendly interface simplifies the process and helps resolve fraud cases efficiently.

Customer Actions:

  • Confirm All Transactions: Customers can verify all transactions by clicking the "I confirm all purchases" button. This prevents future blocks for similar activities.

Outcome:

  • If the card is frozen, it will become active.

  • If the original transaction was declined, the customer can retry it.

  • Fraud rules will be temporarily suspended for 24 hours to prevent future declines of similar activities.

  • cardFraudCase.noFraud webhook event is triggered.

  • Identify Fraudulent Transactions: Customers can select specific unauthorized transactions and report them by clicking the "I do not confirm these purchases" button.

Outcome:

  • Selected transactions are marked fraudulent.

  • Card is blocked and requires re-issuance.

  • Customers may file a dispute via the designated phone number provided.

  • cardFraudCase.Fraud webhook event is triggered.

  • No response to the outreach
    If the customer does not respond to the outreach communication within the specified timeframe, or if they attempt to respond after the case has expired, they will receive a notification that the response period has passed. Outcome:

  • The card will remain in the status it had when the fraud case was created.

  • Authorization/Transaction will stay flagged as Suspected Fraud.

  • The existing fraud rules will not change.

  • cardFraudCase.expired webhook event is triggered.

  • Customers who require assistance or wish to file a dispute can contact your customer support team. They must use the telephone number provided in the outreach communication based on your fraud outreach policy settings. In this case:

    • If the customer confirms that the card was compromised, issue them a new card and refer them to the dispute intake service.
    • If the customer confirms that the card was not compromised, remove the suspected fraud block and contact Unit Support for further assistance.

Implementation ​

Our White-Label Card Fraud Outreach service is mandatory and included at no additional cost.

To activate it, follow these steps. Please create a technical support ticket if you need assistance.

  1. Set up White-Label Outreach Follow all steps outlined at link above.
  2. Set Up SMS Channel (Optional)
    If you want to activate SMS notifications, register a toll-free number and configure the SMS channel settings.
  3. [Define Card Fraud Outreach Policy (Mandatory)] (#define-card-fraud-outreach-policy)
    Establish the guidelines for managing card fraud cases and sending outreach communications.

Detailed Configuration Instructions​

  1. Follow all steps outlined here to set up White Label Outreach.

  2. Set Up SMS Channel (Optional)
    Optionally, the SMS channel can be used for Card Fraud Outreach communication in addition to email. To enable the channel:

1) Register the Toll-Free Telephone Number with Unit

The registration is handled by our Solutions team. You must provide the following information to apply for Toll-Free Telephone for SMS notifications:

  • Business Name: Your company's official name.

  • Business Website: Your company's website address.

  • Business Address: Your company's physical address.

  • SMS Opt-In Reference: A reference to the section in your customer terms and conditions where customers opt-in to SMS notifications.

    The registration and phone verification process with telecom providers typically takes 2-10 business days.

    Please reach out to your Customer Success Manager to discuss these requirements in more detail and initiate the SMS phone registration process.

    Note:

    Toll-Free Telephone Number for SMS communication and the notification service is provided for free.

    Optionally you can request a short code for SMS notifications. The cost of short code lease for US based numbers is $11,000 per year ($3,000 per quarter) + $1,000 one-time setup fee. These costs will be passed through to you by us.

  1. Domain for short URL configuration

    To ensure clear and concise SMS messages in your card fraud outreach, we utilize shortened URLs. We recommend using a dedicated short domain specific to your company for branding purposes. The recommended format is f.<client domain>.

    Please set up this short domain on your side:

  • Contact your web developer or IT team to create the recommended short domain (f.<client domain>).
  • Once you’ve set up the domain, configure it with short.io service:
  1. Go to your domain registrar, sign in, and locate the domain DNS Manage section.
  2. Create a new type CNAME record with a name 'f' (no quotes) and value 'cname.short.io' (no quotes). Save changes. You will see a new record: f CNAME cname.short.io.
  3. The server's updates may take 1-2 hours. We will notify you by email.
  4. Your domain will route all HTTP and HTTPS requests to short.io servers.

3) Configure SMS outreach settings
Request: 

curl -X POST 'https://api.s.unit.sh/outreach-settings' \
--H 'Content-Type: application/vnd.api+json' \
--H 'Authorization: Bearer ${TOKEN}' \
--data '{
"data": {
        "type": "messageOutreachSettings",
        "attributes": {
            "name": "Outlay SMS outreach",
            "senderPhone": {
                "countryCode": "1",
                "number": "559675598"
            },
            "messageChannels": [
                "Sms"
            ]
        }
}'
  1. Define Card Fraud Outreach Policy (Mandatory)
    Before activating Card Fraud Outreach, please ensure the following basic communication policies are configured:
  • Client Support Contact Phone: Provide your customer support phone number.
  • Client Support Contact URL: Specify the URL for your customer support website.
  • Expiration Period: Set the timeframe (in hours) after which the card fraud cases expire if no customer response is received.
  • Other: Refer to the Card Fraud Outreach Policy settings for additional details. Important:
    The following API call should be made by or together with our Solutions manager to ensure smooth activation of the service.

Request:

curl -X POST 'https://api.s.unit.sh/fraud-outreach-policies' \
--H 'Content-Type: application/vnd.api+json' \
--H 'Authorization: Bearer ${TOKEN}' \
--data '{
  "data":{
        "type":"fraudOutreachPolicy",
        "attributes": {
            "caseExpirationPeriodHours": 48,(if not provided 72 by default)
            "activitiesLookBackPeriodHours": 48, (if not provided 72 by default)
            "contactUrl": "thisIsMyDomain.unit.co",
            "contactPhone": {
                "countryCode": "213",
                "number": "5350405030"
            },
            "numberOfCardActivities": 5 (if not provided 3 by default)
        },
        "relationships": {
            "emailOutreachSettings": {
                "data": {
                    "type": "emailOutreachSettings",
                    "id": "10001"
                }
            },
            "org": {
                "data": {
                    "type": "org",
                    "id": "1"
                }
            },
            "whiteLabelTheme": {
                "data": {
                    "type": "whiteLabelTheme",
                    "id": "10001"
                }
            }
        }
    }
}'

You’re all set. By completing these steps, you can effectively manage card fraud cases and communicate with your customers using our White-Label Outreach service.

For more information, please refer to:

Testing in Sandbox​

Card Fraud Case Management and White-Label Fraud Outreach communication via email are available in Unit’s Sandbox environment.

Please follow the steps to set up White-Label Fraud Outreach Service in Sandbox and simulate “Suspected Fraud” transactions and email fraud outreach communication.

Note: for simulations, use your Sandbox org id.

Steps:

  1. Set up White-Label Outreach
  2. Setup Card Fraud Outreach Policy
  3. Create a card to be used for transactions simulation, with "email" to receive the fraud outreach communication: {{server_url}}/cards
  4. Activate the card created {{server_url}}/sandbox/cards/{cardId}/activate
  5. Simulate several authorizations/transactions {{server_url}}/sandbox/purchases
  6. Simulate suspected fraud transaction {{server_url}}/sandbox/authorizations/suspected-fraud
  7. Receive fraud outreach email with Fraud Alert
  8. Act upon the received email to test Fraud and No-Fraud scenarios
  9. Check webhooks
  10. Check Card Fraud Case statuses if needed {{server_url}}/card-fraud-cases/
  11. If Fraud is confirmed, the card will be blocked. To perform more test simulations if required, repeat steps 6-13.