#101 - The ring you just blocked is innocent

Two accounts. Same credit card number.

Same person, right? If one is fraud, you should block them both.

But that instinct might have just cost you a good customer.

How so? If one of those accounts belonged to the man whose card got stolen, the actual victim. The other belonged to the fraudster who took it.

Here’s the thing about a link between two accounts - all it gives you is the fact that they’re related somehow.

But it doesn’t necessarily prove they are the same person.

And proving that is the whole craft of network detection.

A link lies to you

Every network is defined by its atomic units: the links between two accounts. You find one, then another, and a cluster lights up.

The trouble starts the moment you decide what that cluster means.

Identities get stolen, common addresses are shared, and sometimes the seller processes payments on their own device.

So when two accounts share a card number, you’re looking at a relationship, but you have no idea which one.

Maybe these are family members with two separate accounts. Maybe a fraudster is trying to squeeze what they can from the card. Or maybe it’s both.

Three completely different stories - same link.

So how do you decide between them?

You ask two questions - how unique this link is, and who does it belong to?

Question one: is this a unique identifier?

Links are always based on identifiers - names, addresses, devices, etc. You never link accounts together by timestamps or shipping costs, right?

So the first question is to understand how unique this identifier is, or how likely it is to be shared between different people.

A unique identifier is supposed to belong to exactly one person, and only that person should ever have it. A card number, an SSN, a personal email address.

When two accounts share one, they share a strong connection.

A non-unique identifier can legitimately be shared by a handful of people: a shipping address, an IP, the customer’s name.

It still says something about the relationship, but it doesn’t necessarily mean we’re looking at the exact same person.

Remember that weak links can appear as unique identifiers.

For example, devices: a personal phone is about as unique as it gets, but a seller’s terminal in a live event booth is non-unique by design.

Another example are corrupted/default data values: a generic email that gets filled in specific user-flows might link accounts that have nothing in common. 

Question two: are you linking the identity or the user?

Every identifier belongs to one of three worlds:

Offline identity covers name, billing address, card. Everything that makes a person on paper. Remember that fraudsters steal or fabricate all of it.

Online user covers device, IP, and the behavior of that user on your platform: their actions, their pace, their biometrics. This is a much stronger tell.

Contact details cover shipping address, email, phone. Normally, I would count them as part of the offline identity, but depending on your platform and product, they might expose the fraudster.

If you’re selling physical goods - the fraudster must use an address they have access to.

If you require email verification - the fraudster cannot use the victim’s one.

So these can be situational and change context depending on your business, and in some cases - even per event.

Strong links marry two worlds

Now put the two answers together. Reading a link on both axes at once is the real skill.

Start with uniqueness because that would help you narrow down how many accounts should share this link.

But remember - you’re looking for fraudsters, and fraudsters are the online users.

And  this is where most false positives happen - the same shipping address feels strong but we can easily link unrelated offline identities.

Maybe that address is the ecommerce room of a large office complex. Maybe it’s a university, or just a large apartment building. 

So one strong link, especially if it’s not of the online user, is rarely enough.

And this is where you start looking at the bigger picture by combining the different links together. 

One offline link plus one online link turns a loose relationship into the same hand at the keyboard.

Is this a shared 5G IP or a single fraudster coordinating a ring? If they all share the same niche, privacy email domain - you have your answer.

Separately, both would not be enough. Together - it creates a strong link between the accounts and allows you to operate at a ring level.

Are these 50 accounts that were just opened and buying from the same seller fraud, or are they reacting to a flash sale?

If they all share the same email pattern of “firstname_lastname_2_digits” - it’s more likely to be fraud than not.

At the same time, stacking two from the same world barely helps - a shared card and a shared billing name doesn’t tell you if the identity is stolen or not.

So, before you action that ring

A weak link tells you two accounts are touching.

A strong link tells you the story behind it:

Are these accounts operated by the same user, and if so - what is their intent?

Place every link on both axes - uniqueness and online/offline. Then compare it to the context of your own product and its user flows.

Do that, and your links stop lying to you.

Are you operating on rings as a whole? How do you make sure you’re not actioning on legitimate customers? Hit Reply -  Would love to hear your tricks.

In the meantime, that’s all for this week.

See you next Saturday.

P.S. If you feel like you're running out of time and need some expert advice with getting your fraud strategy on track, here's how I can help you:

Free Discovery Call - Unsure where to start or have a specific need? Schedule a 15-min call with me to assess if and how I can be of value.
​Schedule a Discovery Call Now »​

Consultation Call - Need expert advice on fraud? Meet with me for a 1-hour consultation call to gain the clarity you need. Guaranteed.
​Book a Consultation Call Now »​

Fraud Strategy Action Plan - Is your Fintech struggling with balancing fraud prevention and growth? Are you thinking about adding new fraud vendors or even offering your own fraud product? Sign up for this 2-week program to get your tailored, high-ROI fraud strategy action plan so that you know exactly what to do next. ​
Sign-up Now »

Enjoyed this and want to read more? Sign up to my newsletter to get fresh, practical insights weekly!

<