Consumer Alerts services may also be known as consumer notifications, transaction alerts, login alerts, or event confirmation notifications.
Consumer Alert services are often used by financial institutions, card issuers, social media companies, telecommunication service providers, gaming and gambling companies, asset trading platforms and any organization that offers user accounts.
These alerts provide a no-friction way of conveying a potential risk event in a low-to-medium risk transaction or login attempt. While most organizations have higher friction forms of step-up authentication for login attempts showing higher risk signals, fewer employ low- or no-touch step-up checks for low to medium risk signals.
Consumer Alerts may be sent via email or SMS text message. In addition to notifying a user about suspicious activity on their account, they can include details such as the IP address used for a login, the purchase amount, merchant name and/or items ordered.
Consumer Alerts can include a Call to Action, allowing users to state that they did not make the transaction or login in question, which then allows the organization to cancel the order, end a login session and/or force a change password process.
Even when the consumer is being alerted for a legitimate login or transaction, the act of providing Consumer Alerts alone can instill increased confidence among consumers in an organization's risk and security practices to build brand trust.
THE FRAUD PRACTICE
KEY NOTES
Alternative Solutions - Consumer Alerts are an automated notification system with no direct alternatives, although organizations could perform these notifications via email or phone call as a form of verification during manual review.
Building this In-House - Many enterprise organizations have built these in-house with automation tools and/or the use of messaging operators. To do this, make a list of event triggers and setup a process automation to notify consumers of the event with an email template or leveraging an SMS customer contact vendor.
Estimated Cost - Typically this service is offered on a fixed cost basis covering a set amount of notifications with an additional charge per notification if the monthly allotment is exceeded. The charge per alert is a fraction of one cent and cost decreases with higher monthly volume.
Sample Venders - Deduce
CONSUMER ALERTS TECHNIQUE OVERVIEW
Consumer Alerts are a service, either supported directly by an organization or via a vendor, that notify consumers of suspicious activity related to their account. This includes notifications from card issuers for transactions over a certain dollar threshold as well as suspicious login activity with banks, social media companies and others, such as logins coming from a different IP address region and/or Device ID. Such alerts and thresholds or events that trigger an alert may be chosen by the consumer and/or set by the organization.
Key considerations when implementing or buying this functionality include:
What events can trigger an alert and what flexibility or customization is supported? Important capabilities can include ability to set differing dollar thresholds per consumer based on different characteristics and the ability to apply compound rule logic in determining if an alert is sent.
Do customers have the ability to turn alerts on or off and/or set their own dollar thresholds for when alerts are triggered?
How are alerts delivered to customers? Via email, SMS text message or both? Do customers have the option to choose either or both?
Is there a Call to Action in the alert that can allow a potential fraudulent transaction or account takeover attempt to be quickly stopped? This can be a link to click in an email or response (Y/N) to an SMS text message.
Is there ability to setup actions that will occur automatically when a consumer responds to an alert saying they did not attempt this login or transaction?
HOW DOES IT WORK?
Whether built in-house or utilized via a third-party service, Consumer Alerts are a method of notifying a customer or user of an event that shows some level of increased risk. The act of notifying the customer is one component while the ability to recognize an event, such as account takeover or a fraudulent transaction on the consumer's card or account, provides an additional dimension of protection and risk mitigation.
Consumers will receive either an email or SMS text message notification of a given event. This can range from any transaction to a login attempt. The business and/or the consumer may choose to set events to trigger based on characteristics of the transaction or event. For payment card transactions or bank account transfers, alerts may be issue for any dollar amount or when above a certain threshold. Similarly for login events, an alert may be sent for every login or only when there is some element of uncertainty such as an unrecognized device or different IP address location. Information such as the IP address and region may be included in the alert.
Organizations, or their Consumer Alerts provider, should have some sort of platform for controlling the settings that dictate when alerts are sent. There should be some degree of flexibility controlled by the organization as well as given to the consumer in terms of what thresholds or events trigger an alert. With purchases or bank transfers, the outcome of risk modeling or fraud scoring may dictate when a Consumer Alert is issued. For potential account takeover events, login risk scoring as well as key events such as account password or email changes may trigger an alert.
When consumers receive such alerts there should also be a Call to Action that allows them to report if the transaction or login attempt was not legitimate.
Consumer Alert services are often used by financial institutions, card issuers, social media companies, telecommunication service providers, gaming and gambling companies, asset trading platforms and any organization that offers user accounts.
HOW DO YOU USE THE RESULTS?
When consumers are sent an alert, they will either click or respond to a call to action or they will ignore it.
If the customer confirms that they did indeed place the order in question or were behind the suspicious login attempt, than the organization could do nothing or they could record that the given IP address and/or unrecognized device is safe or low risk.
If the customer does not respond to an alert the organization should continue to allow the transaction or event to occur but not whitelist or mark the new data points as low risk.
If the user or customer does indicate that they did not initiate the transaction or login in question, the organization should take immediate measures to cancel the order or funds transfer, end the login session and/or initiate a change password process. Organizations may manually review such events or set up automated response protocols in response to a consumer claiming it was not them who logged-in or initiated a purchase, transfer or withdrawal.