How we can coonfigure a threshold which will give me an alert if there are more than 10 "Consecutive" decline transactions from same BIN.
If we able to do it then I will apply the same logic for MID, Terminal Id based consecutive decline transaction.
What would be the interval time? because transaction volume would be different for each BIN, so we should be able to trigger an alert when it is 10th consecutive decline transcation. It should not be like, it will trigger an alert when interval time is over and then it check for decline count and then it will trigger an alert.
Kindly let me know if any clarification require on the requirement.
Thanks in advance,
By my understanding an Analyst monitoring TransactionDetail record should do the trick. Here's why:
Analysts are written in a script language. There's more about them in Online Help:
Here is an example of a similar scenario where a counter is used.
Analysts are very powerful in this respect but there is a lot to learn. Please let your IR account manager know if you are interested in getting assistance from IR to help yo ucreate an analyst solution.
Thanks Gerald, good suggestion.
To anyone considering this approach, please remember to ALWAYS use a LIMIT clause along with an appropriate WHERE clause in all analyst rules to avoid high overhead from processing too much data. This is a good example of where you could have a huge overhead due to processing thousands of TRANDET records if not using a LIMIT.
Tushar, there are easier ways if you can meet the business objectives without needing to be strict on the '10 consecutive' occurrences so it might be worth going back to see if it can be approached another way. For example TSV rules could be used to check for 10 declines on same BIN within a minute (or any other time period you require) See https://help.prognosis.com/prognosis/116/transaction-surveillance-rules-13607845.html
Thank you @PeterPindsle for your suggestions.
Is there any way by which I can use TSV rules with "consecutive occurances" criteria? beacuse in requirement only it is clearly mention consecutive declined by BIN. Like wise BIN, I also need to configure the same based on MID,TerminalID and some more parameters.
Thank you @GeraldC1 for your suggestion.
Can you push me little with it.
Please find attached analyst rule to identify the consecutive decline transaction scenario.
Where/how I can set BIN in it? I don't want to hardcode any particular BIN here. Script should fetch it from TRANDET and increase/reset the counter based on transaction occurrences.
Ideally there should be different counter for each unique BIN and it should reset the counter if any success transaction come in. Or it should increase the counter when decline transaction comes in.
Hope I clear my concept here.
Please let me know if any clarification is require.
SECTION CONFIG MAX_SIZE 5.0 MB NUMERIC TXNCOUNT  := 0 NUMERIC ALERTFLAG  := 1 END_SECTION SECTION RULE_DEF RULE TRANCODE_COUNT PRIMARY RECORD TRANDET WHERE ALL REFRESH 30 SECONDS NODE ( \WHONODE1 ) SORT ASC LOGTIME !Increment the counter when the transaction is declined IF @TRANDET.RESPCODE <> "000" SET TXNCOUNT := TXNCOUNT + 1 END_IF !Check if the counter value is greater than the threshold and if the send alert flag is on (1) !If the condition is true, set the alert flag to off (0) to avoid the sending of multiple alerts IF TXNCOUNT > 9 AND ALERTFLAG = 1 LOG PROBLEM_SUMMARY 0100 IMMEDIATELY SET ALERTFLAG := 0 END_IF !Reset the counter when the transaction is approved IF @TRANDET.RESPCODE = "000" SET TXNCOUNT := 0 END_IF END_RULE !Rule to reset the send alert flag to on (1) and reset the counter to 0 after x seconds/minutes !x seconds/minutes refresh has to match the refresh interval in the rule above RULE RESET_ALERT_FLAG PRIMARY RECORD PNODES WHERE ALL REFRESH 30 SECONDS NODE ( \WHONODE1 ) ACTION SET ALERTFLAG := 1 SET TXNCOUNT := 0 END_ACTION END_RULE END_SECTION SECTION MSG_TEXT MSG 0100 "Declined transaction count is @TXNCOUNT@" END_SECTION
Is there any way by which I can use TSV rules with "consecutive occurances" criteria?
No, that's not possible in TSV rules at the moment but if you take a step back to look at the *business* requirement, it may be possible to meet that requirement either with TSV rules, Transaction Summary thresholds or maybe a combination of those. That will probably be easier to implement than using a analyst rules. If you do use an analyst, please remember to always use a LIMIT clause in each rule
Hi @PeterPindsle ,
Can you provide me a syntax to declare limit in Analyst Rule.
Please find below rule.
RULE TRANCODE_COUNT PRIMARY RECORD TRANDET WHERE ALL REFRESH 10 SECONDS NODE ( \NI003 ) SORT DESC LOGTIME !Increment the counter when the transaction is declined IF @TRANDET.BIN = "443913" AND @TRANDET.SRCNAME = "UATBA2" AND @TRANDET.RESPCODE <> "00" AND @TRANDET.RESPCODE <> "01" AND @TRANDET.RESPCODE <> "000" AND @TRANDET.RESPCODE <> "001" SET TXNCOUNT := TXNCOUNT + 1 END_IF !Reset the counter when the transaction is approved IF @TRANDET.BIN = "443913" AND @TRANDET.SRCNAME = "UATBA2" AND @TRANDET.RESPCODE = "00" OR @TRANDET.RESPCODE = "01" OR @TRANDET.RESPCODE = "000" OR @TRANDET.RESPCODE = "001" SET TXNCOUNT := 0 END_IF END_RULE
Not sure if I understand 100% but in TSV I would have done something like this:
NAME = SUSPICIOUS-BIN
KEEP = 24 HOURS
WHERE1 = SOURCE = "POS" AND
WHERE2 = RESPTYPE = "D"
OCCURRENCE = 10 TIMES WITHIN 60 MINUTES
OCCURRENCE-MATCH = BIN+TERMID
You can then use the TSV Rules Summary to display the rule or you can setup a treshold to send alerts.
Hope this help.
Thanks for your response.
Your suggested Exception rule will work for 10 decline transactions within 1 hour but it will also log an exception even if transactions are not declined consecutively.
I was looking for a alert which will trigger after 10th consecutive declined transaction.
Approved - A
Declined - D
Transaction occurance order:
DDDADDDADDDD - No Alert
ADDDDDDDDADD - No Alert
AADDDDDDDDDD - Alert
I think I understand your question 100% now, didn’t look at the “consecutive” declines and yes, that is something that will assist especially when looking at declines after changes were made to bin tables, merchants, devices etc.
Are you looking at specific bins / merchants or do you want to use it over several bins / merchant combinations?
In my opinion this type of threshold should run over all bins / merchants depending on volume.
Will scratch around a bit as this type of threshold might also assist us some day.
Thank you and regards,