About Using the Fraud Monitor User Interface
The Fraud Monitor user interface has several recurring elements. At the very top, you have the bar which gives access to admin settings. Below the bar on the right is the navigation menu that lets you navigate to the main pages: Overview page, Learning Period, Incidents page, Learning Page, Details page, and the Settings page.
The Overview page shows the current fraud status at a glance. It has big warning indicators as well as a table of the recent potential fraud incidents. From there you can further analyze the latest issues.
The Incidents page displays the full table of recent incidents, with related rules, and from there you can pick an incident for further investigation.
The Learning Period page displays information learned over time by Fraud Monitor.
The Details page shows a single user and his incidents. This page contains a short history of the potential fraud that might have occurred.
Overview Page
The Overview page is the landing page that appears automatically after you log in. The Overview page displays the status information on processed calls, incidents, users, as well as general information about how Fraud Monitor works. You use this page to check for recent incidents and then navigate to other pages to further investigate the user.
Figure 1-3 Overview Page
Viewing the Status for the Last Hour
The Status for the Last Hour section displays the total number of calls processed for the day and the number of incidents detected in the last hour. The incident counts are accompanied by large icons for quickly establishing overall status. If no incidents are detected, a large green tick image is displayed. If any warning incidents are detected, a large orange warning sign image is displayed. If any critical incidents are detected, a large red stop sign image is displayed. It's possible for warning incidents and critical incidents to be detected in the same time frame. When an icon is not being displayed, it remains faded grey in the background.
Note:
If the calls processed counter is not increasing, you may not have configured your Mediation Engine correctly.
Viewing the Latest Incidents
On the right-hand side of the page, the Latest Incidents section shows a small list of the most recently detected incidents. A more extensive list can be found on the Incidents page. Double-clicking on an incident will take you to the Details page for that particular offending user which shows information such as Timestamp, Suspect, Score, Level.
Viewing the Highest Scoring Users
On the right-hand side of the page, the Highest Scoring Users section shows a small list of the users with the highest scores. Double-clicking on a user will take you to the Details page for that particular offending user.
Learning Period Page
The Learning Period page displays information learned over time by Fraud Monitor.
Accessing the Learning Period Page
You can access the Learning Period page using the Learning Period link on the Fraud Monitor Home Page.
The Learning Period page is visible only to Admin users and displays user information for the following dynamic rules:- Destination-based call volume
- Destination-based traffic spikes
- Source-based traffic spikes
- Source-based call volume
Figure 1-4 User Listing on the Learning Period Page
You can view 50 users and search dynamically learned user data for specific users. For each selected user, Fraud Monitor displays 7 days of previously captured user activities.
On hovering over the graph, you can see the name of the rule, the value for the user, and the interval ended at.
You can also search for a specific user using the User Search option.
Searching for Users in the Learning Period Page
The Learning Period Page displays user information and metric type rules.
Viewing the Learning Period Graph
You can view the Learning Period graph for a specific user.
- Select a user from
the
User
Listing section.
The Learning Period graph is shown in first section of the page.
- The X-axis of the graph shows time in hours.
- The Y-axis of the graph displays the average duration of the call for destination-based-traffic-spikes and source-based-traffic-spikes. For source-based-call-volume and destination-based-call-volume the graph displays average calls per second and maximum active calls.
Figure 1-5 Learning Period graph
Incidents Page
The Incidents page lists all the calls that have triggered incidents. This includes warning and critical incidents. See the Settings page to configure incident levels. As incidents are triggered they are added to the Incidents page in real-time.
The latest incidents are on top and incidents are not cleared; they stay forever unless you delete them yourself (see below). The Suspect column is the callers/callee number or IP address.
Note:
Fraud Monitor captures only the Phone number and not the call conversation.
The Comments column displays the comments added by the fraud detection team. Reviewing the comments helps team to know if an action has been taken on single/multiple incidents. The comments help the team to prioritize and analyze incidents.
You can add, edit, delete comments using the Edit Comment button. To manage comments for multiple incidents, use the Shift key and click, or select the check box. You can also search for incidents based on the comments using the Comment Search option.
When a line is selected, the panel on the right - Message section shows the details of this incident including the comments. It displays the caller as well as which rule or rules caused the incident to be triggered.
Figure 1-6 Incidents page
Figure 1-7 Add/Edit Comments in the Incidents Page
The Rule Broken column displays the name of the rule that was broken or violated against an incident.
If you double-click on an incident, you will go to the Details page for that user. Selecting a row and clicking Go to User Details button does the same.
In the Details page, when you click Incidents, you will be redirected to the Possible Incidents page. In this page, you will be able to edit comments or delete the Incidents.
If a user first triggers a warning incident and later upgrades that to a critical incident, both will be listed.
You can delete a single incident or multiple incidents by selecting the check box next to it and clicking Delete. This removes the incident or incidents from the list.
To avoid a surge of incidents for the same suspect, Fraud Monitor notifies the user by raising an incident, once in every 10 minutes internally, although Fraud Monitor analyzes and records the user into the database every time the suspect is evaluated. When the user causes multiple incidents of the same level (warning or critical) within 24 hours, a new incident is not triggered. Deleting a row from the incident list will not reset that timer. Deleting an incident is useful when, after investigation, you conclude that an incident is not fraudulent.
Times are in the local time zone.
Details Page
The Details page shows information on a particular user. Also, the Allowlist for countries of this user can be maintained on this page and all records associated with this user may be deleted.
The Details page can be reached using the top menu or from the Incidents page.
Typically, in this view one will search a user, if none is selected yet, and then consider the metrics to determine if an incident is justified. In case no user has been chosen, one must be selected using the search field. Then the scores, the calls, and the geographical data for this user are displayed. Each of these topics is explained in the following sections.
Figure 1-8 Details Page
Performing a User Search
The New search field allows you to select a user for display by IP or phone number. After four characters matches are shown. Select one of the proposed matches, press return or click Search to display the user.
Deleting User-Specific Records
Click Delete records to remove all information regarding the user. This includes metric values, scores and incident related information.
Viewing Score Information
The Score Information diagram shows scoring information of all incidents for the last 24 hours, going back from the current time. It is not possible to go further back than 24 hours. For each incident measuring interval, a bar displays the score reached.
Viewing Metric Information
The Metric Information diagram show metrics of selected rules. For each ten minute interval, the values of the last 24 hours are shown in comparison to the average over the last two weeks.
The y-axis displays the number of minutes or calls, while the x-axis specifies the intervals. A red line displays the averages, while the bars show the current data.
By using the check boxes in the top right corner, you can choose what values to display.
-
The traffic spikes
The alternative display modes in the top left corner, Total Values and Value Differences, toggle between displaying the current values as absolute values and as the difference to the average.
User Menu
The User menu is located on the top right corner of the page on the header bar. A drop-down menu appears when you click on your user name.
Figure 1-9 User Menu
Editing the User Profile
You can edit your own profile details by selecting My Profile in the User menu. A dialog box appears giving you the option to change your user name, email and password. Fill out the new values for the details you would like to change and click Finish to save the changes. Click Cancel to exit the window without making changes.
Viewing System Information
You can view the current system information by selecting System Settings in the User menu.
Viewing License Information
You can view the product license terms and conditions by selecting License in the User menu.
Settings Page
The Settings page of the Fraud Monitor user interface lets you configure the rules, manage the users, adapt the notifications, specify blocklists, Allowlists, ratelimit, redirect, import/export lists, and generate automatic lists required for a successful operation of Fraud Monitor.
Among the settings, rules is the most important setting. In the Rules section, you can enable and configure patterns that are used to detect fraud and trigger incidents.
Figure 1-10 Settings Page
