Fighting Fraud with Virtual Card Numbers

As online payments become increasingly common, financial institutions seek new  ways to give customers more control over how their financial information is used online. My team at Capital One builds machine learning systems focused on digital commerce, merchant identity, and fraud. One system we’ve built provides customers with the power to bind a unique virtual card number (VCN) to a specific merchant where it can be used exclusively. To ensure a smooth customer experience, this real-time decision system is required to confirm whether the VCN is being used at the bound merchant. This presents an entity resolution challenge due to the complex and constantly evolving nature of merchant data. However, we discovered a way to use embeddings to overcome this challenge and ensure customers have reliable merchant-based transaction management that makes online shopping easier and safer.

As data scientists working in a financial institution, our most valuable asset for building solutions is the financial transaction graph, which represents the network of credit card transactions between customers and merchants. However, the financial transaction graph is both high dimensional and sparse, making it difficult to work with in traditional machine learning approaches. To solve for this, embeddings can be learned from the graph.

Capital One associates have discussed both embeddings in general and our embeddings in particular in a previous post and paper. To summarize briefly, embeddings are compact meaningful representations of complex data that are useful in a variety of applications. Embeddings capitalize on the fact that similar entities share similar contexts, resulting in similar embeddings. Additionally, embeddings capture relationships between entities in a vector space, enabling distance calculations. Finally, because embeddings are low dimensional, these calculations are very efficient.

The embeddings we use are based on a homogenous graph representation wherein two merchant nodes share an edge if at least one customer transacted at both merchants within a specified time window. For example, given a customer who transacts at Amazon and then transacts at Walmart shortly thereafter, Amazon and Walmart become a transaction pair. The valid pairs become positive training samples and random samples that don’t share an account can be taken as negative training samples.

Then, we can train a neural network to classify pairs as positive or negative. We don’t actually use the predictions of this model – we just want to use the learned classifier weights as the merchant embeddings. These embeddings capture the latent semantic relationships between merchants via the collaborative signal of customers in common between them. So, these embeddings are particularly informative in the type of entity resolution solution required by merchant-bound VCNs.

Merchant identification is at the heart of many of our data-enabled applications, including merchant binding for VCNs. Customers can use their credit card accounts to create multiple VCNs, which transact normally and work just like regular credit cards except that the customer can control the merchants at which VCNs can be used. Our VCN decision system approves a transaction if the merchant data for the bound merchant matches the merchant data for the merchant where a transaction is being requested (and declines those transactions where it detects the merchants don’t match). For example, if a customer creates a VCN for Amazon and later that VCN is used to attempt a transaction at Walmart, our system will decline this transaction. This capability, called “merchant binding,” leads to a substantial reduction in fraud rates when compared to other card not present transactions.

Verifying merchant-bound VCN transactions presents a constant challenge due to the ever-changing merchant data sent through payment terminals, as well as a number of other edge cases such as merchant partnerships and brand families. This has resulted in occasional false declines, which means a VCN transaction was declined because the system incorrectly determined that the request merchant was not the same as the bound merchant.

My team began researching whether merchant embeddings could overcome the entity resolution challenge presented by merchant data. The primary utility of merchant embeddings for entity resolution lies in the ease with which we can compute cosine similarity. Cosine similarity is the cosine of the angle between two vectors and provides a simple metric such that vectors with the same orientation have a cosine similarity of 1. We wanted to know whether our VCN decision system could use a cosine similarity measure to determine whether the bound merchant and the request merchant are in fact the same.

To find out, we sampled declined VCN transactions and labeled them as either true or false declines, indicating whether or not the system correctly identified a mismatch between the bound and request merchant data. Then we calculated the cosine similarity between the two merchant embeddings in every transaction. We found a clear separation between the cosine similarities of merchant embeddings where the transactions resulted in true declines as compared to transactions that resulted in false declines.

This indicated that there is a cosine similarity threshold above which we could successfully approve more valid transactions. By optimizing for this threshold, we discovered we could improve the precision of the VCN decision system by 17 percentage points as compared to using merchant data match alone. This shows how merchant embeddings can be used to reduce false declines and improve the reliability of VCNs while maintaining our commitment to protecting customers’ financial data during online transactions.