Threshold for consecutive declines from particular BIN

[TushR]

Hi There,

How we can coonfigure a threshold which will give me an alert if there are more than 10 "Consecutive" decline transactions from same BIN.

If we able to do it then I will apply the same logic for MID, Terminal Id based consecutive decline transaction.

What would be the interval time? because transaction volume would be different for each BIN, so we should be able to trigger an alert when it is 10th consecutive decline transcation. It should not be like, it will trigger an alert when interval time is over and then it check for decline count and then it will trigger an alert.

Kindly let me know if any clarification require on the requirement.

Thanks in advance,

Tushar Devkar 

[GeraldC1]

Hi Tushar,

By my understanding an Analyst monitoring TransactionDetail record should do the trick. Here's why:

• Assuming decline is a response code:
• TransactionSummary records will provide numbers of transactions in an interval with each response code. But not *consecutive* occurrences per BIN.
• TransactionDetail (TRANDET) record could be the better choice with 1 row per transaction. 
• Thresholds cannot alert on a condition over multiple rows / transactions and cannot count consecutive occurrences.
• Analysts can be used for this kind of scenario. In the analyst code a variable can be set to count consecutive occurrences.

Analysts are written in a script language. There's more about them in Online Help:

https://help.prognosis.com/prognosis/116/analyst-13600495.html

Here is an example of a similar scenario where a counter is used.

https://community.ir.com/t5/Unified-Communications/Analyst-code-to-trigger-on-qty-of-rows-returned-i...

Analysts are very powerful in this respect but there is a lot to learn. Please let your IR account manager know if you are interested in getting assistance from IR to help yo ucreate an analyst solution.

HTH

[PeterPindsle]

Thanks Gerald, good suggestion.

To anyone considering this approach, please remember to ALWAYS use a LIMIT clause along with an appropriate WHERE clause in all analyst rules to avoid high overhead from processing too much data.  This is a good example of where you could have a huge overhead due to processing thousands of TRANDET records if not using a LIMIT.

Tushar, there are easier ways if you can meet the business objectives without needing to be strict on the '10 consecutive' occurrences so it might be worth going back to see if it can be approached another way.  For example TSV rules could be used to check for 10 declines on same BIN within a minute (or any other time period you require)  See https://help.prognosis.com/prognosis/116/transaction-surveillance-rules-13607845.html

[TushR]

Thank you @PeterPindsle for your suggestions.

Is there any way by which I can use TSV rules with "consecutive occurances" criteria? beacuse in requirement only it is clearly mention consecutive declined by BIN. Like wise BIN, I also need to configure the same based on MID,TerminalID and some more parameters.

Regards,

Tushar Devkar

[TushR]

Thank you @GeraldC1 for your suggestion.

Can you push me little with it.

Please find attached analyst rule to identify the consecutive decline transaction scenario.

Where/how I can set BIN in it? I don't want to hardcode any particular BIN here. Script should fetch it from TRANDET and increase/reset the counter based on transaction occurrences.

Ideally there should be different counter for each unique BIN and it should reset the counter if any success transaction come in. Or it should increase the counter when decline transaction comes in.

Hope I clear my concept here.

Please let me know if any clarification is require.

Regards,

Tushar Devkar

SECTION CONFIG
  MAX_SIZE 5.0 MB 
  NUMERIC TXNCOUNT [0] := 0
  NUMERIC ALERTFLAG [0] := 1
END_SECTION
 
SECTION RULE_DEF
 
RULE TRANCODE_COUNT PRIMARY
 
  RECORD TRANDET
  WHERE ALL
  REFRESH 30 SECONDS
  NODE ( \WHONODE1  ) 
  SORT ASC LOGTIME 
 
!Increment the counter when the transaction is declined
 
  IF @TRANDET.RESPCODE <> "000" 
        SET TXNCOUNT := TXNCOUNT + 1                 
  END_IF
 
 
!Check if the counter value is greater than the threshold and if the send alert flag is on (1)
!If the condition is true, set the alert flag to off (0) to avoid the sending of multiple alerts
 
  IF TXNCOUNT > 9 AND ALERTFLAG = 1
        LOG PROBLEM_SUMMARY 0100 IMMEDIATELY
        SET ALERTFLAG := 0
  END_IF 
 
 
!Reset the counter when the transaction is approved
 
  IF @TRANDET.RESPCODE = "000"
        SET TXNCOUNT := 0
  END_IF
 
END_RULE
 
 
!Rule to reset the send alert flag to on (1) and reset the counter to 0 after x seconds/minutes 
!x seconds/minutes refresh has to match the refresh interval in the rule above
 
RULE RESET_ALERT_FLAG PRIMARY
 
  RECORD PNODES
  WHERE ALL
  REFRESH 30 SECONDS
  NODE ( \WHONODE1 )
 
  ACTION
        SET ALERTFLAG := 1
        SET TXNCOUNT := 0
  END_ACTION
 
END_RULE
 
END_SECTION
 
SECTION MSG_TEXT
   MSG 0100 "Declined transaction count is @TXNCOUNT@"
END_SECTION

[PeterPindsle]

Is there any way by which I can use TSV rules with "consecutive occurances" criteria?

---

Hi Tushar,

No, that's not possible in TSV rules at the moment but if you take a step back to look at the *business* requirement, it may be possible to meet that requirement either with TSV rules, Transaction Summary thresholds or maybe a combination of those.  That will probably be easier to implement than using a analyst rules.  If you do use an analyst, please remember to always use a LIMIT clause in each rule

---

[TushR]

Hi @PeterPindsle ,

Can you provide me a syntax to declare limit in Analyst Rule.

Please find below rule.

RULE TRANCODE_COUNT PRIMARY

RECORD TRANDET
WHERE ALL
REFRESH 10 SECONDS
NODE ( \NI003 ) 
SORT DESC LOGTIME 

!Increment the counter when the transaction is declined

IF @TRANDET.BIN = "443913" AND @TRANDET.SRCNAME = "UATBA2" AND @TRANDET.RESPCODE <> "00" AND @TRANDET.RESPCODE <> "01" AND @TRANDET.RESPCODE <> "000" AND @TRANDET.RESPCODE <> "001" 
SET TXNCOUNT := TXNCOUNT + 1 
END_IF

!Reset the counter when the transaction is approved
IF @TRANDET.BIN = "443913" AND @TRANDET.SRCNAME = "UATBA2" AND @TRANDET.RESPCODE = "00" OR @TRANDET.RESPCODE = "01" OR @TRANDET.RESPCODE = "000" OR @TRANDET.RESPCODE = "001"
SET TXNCOUNT := 0
END_IF

END_RULE

[Therone]

Hi,

Not sure if I understand 100% but in TSV I would have done something like this:

[TRANSACTION-EXCEPTION-RULE-0]
NAME = SUSPICIOUS-BIN
KEEP = 24 HOURS
WHERE1 = SOURCE = "POS" AND
WHERE2 = RESPTYPE = "D"
OCCURRENCE = 10 TIMES WITHIN 60 MINUTES
OCCURRENCE-MATCH = BIN+TERMID

You can then use the TSV Rules Summary to display the rule or you can setup a treshold to send alerts.

Hope this help.

Regards,

Therone

[TushR]

@Therone ,

Thanks for your response.

Your suggested Exception rule will work for 10 decline transactions within 1 hour but it will also log an exception even if transactions are not declined consecutively.

I was looking for a alert which will trigger after 10th consecutive declined transaction.

Scenario : 

Approved - A

Declined - D

Transaction occurance order: 

DDDADDDADDDD - No Alert

ADDDDDDDDADD - No Alert

AADDDDDDDDDD - Alert

Thanks,

Tushar Devkar

[Therone]

Hi Tushar,

I think I understand your question 100% now, didn’t look at the “consecutive” declines and yes, that is something that will assist especially when looking at declines after changes were made to bin tables, merchants, devices etc.

Are you looking at specific bins / merchants or do you want to use it over several bins / merchant combinations?

In my opinion this type of threshold should run over all bins / merchants depending on volume.

Will scratch around a bit as this type of threshold might also assist us some day.

Thank you and regards,
Therone