Online Fraud Detection. Catching fraud in real-time across the web and mobile channels.

My Role

Sr. Product Designer. Synthesizing high-level business requirements into usable and compelling product experiences and design solutions; Creating detailed wireframes and dynamic prototypes; Maintaining consistent visual standards and updating the company Design System (“Astro”); Reviewing features implemented by engineering teams and providing guidance to ensure pixel-perfect designs.

What does this product do?

This product is a combination of modern online fraud detection tools (such as real-time behavioral navigation, behavioral biometrics, device attributes, network attributes) to detect sophisticated fraud attacks that bypass other detection tools. Online fraud detection automatically identifies trusted users and flags suspicious activities before fraudulent activities can take place.

The product helps our User (Fraud Analyst) to investigate the fraud cases. App navigation shows many different views which together present a clear picture of potentially illegal actions and behaviors.

My goal was to create an intuitive navigation, which turns a very complicated and tangled system into an understandable and robust product.

Who are our users?

Our user persona is a Fraud & Risk Security Analyst. It could be an engineer and also a business analyst (not a tech person) at a client's company. Usually there are multiple levels for this role:

1. Executive professional

Has an access to advanced features of the platform, can define the investigation process and set goals.

2. Mid-level professional

Retrieves the alerts and investigate the existing situation based on the predefined preferences.

The system allows for various methods of fraud investigation. Here are some of the common use cases:

Investigating via System Alerts

Analyst opens the screen "Alerts Analytics".
From the data displayed Analyst finds out that many alerts appeared between January 25 to Feb 2. He decides to focus his investigation on this period of time.
Analyst opens the Fraud Alerts screen. On this page, he defines the filters for time period, risk level, and country. The filtered results are displayed.
Analyst focuses on one of the selected Alerts and chooses to investigate its session (clicks on the Session link).
The Session screen opens. On this screen, Analyst can look closely at the session associated with an Alert.
From one of the displayed panels, Analyst opens the tab "Timeline view". This widget allows investigation of the session according to the User's browsing steps - screen after screen.
Another widget allows viewing the Alert details, Indicators, and also Clusters (to which this Alert belongs).
From the Clusters widget, Analyst may continue the investigation to a Clusters perspective (by clicking one of the clusters from the list).

Investigating via Clusters

Analyst accesses the screen "Clusters List".
The Clusters priority is very important for the investigation process. Analyst decides to change the priority (clicks the "Change Priority" button).
The priority numbers became editable. He changes the number. Save. It triggered the warning message, informing the user that changing the order may affect the system's behavior. Approves.
The next step is to have a close look at one of the suspicious Clusters. Analyst selects the High-risk Cluster from the list.
Cluster analysis page is shown.
Analyst investigates this Cluster from different perspectives: Total Alerts, Alerts consumed, Labels, Actions, and Indicators.

Investigation via user's Connections

Analyst opens the screen "Users Analytics".
If this user is a part of Fraud Rings - the indication button will appear at the right top corner. Analyst clicks the indication button. The Fraud Rings screen appears.
Fraud Ring screen shows the User's connections map. On the right panel, additional information is displayed. Analyst selects the device in the middle to view its details.
Then he would like to investigate the User's connections over time. He select the desired date on the timeline below. The connection map is changing and shows the picture of his connection at that time stamp.
The data presented on a relations map could be filtered, and zoomed in/out, according to the investigation's request.