Antifraud

Overview

The anti-fraud module strengthens transaction security by analyzing behavioral, device, and network data before authorization. It evaluates multiple signals (such as IP address, customer identity, and device characteristics) to identify risk patterns and prevent fraudulent activity.

When creating a purchase, Bamboo first validates the completeness of the request model. Once the request passes structural validation, the anti-fraud engine evaluates behavioral, device, and network data to detect risk patterns and reduce fraudulent activity.

Although none of these fields are strictly mandatory, some are highly recommended for accurate risk evaluation and to minimize false declines.

Highly recommended parameters

The following parameters are strongly recommended to ensure accurate fraud detection and risk scoring. These fields significantly improve the system’s ability to distinguish legitimate transactions from potential fraudulent activity.

💡

Before antifraud scoring, Bamboo validates that all optional objects or fields included in the request are complete. For example, if Customer.Document or Customer.PhoneNumber is sent, all required values must be filled; otherwise, the request fails validation.

⚠️

Transactions missing these parameters may experience less accurate risk assessment and higher false-positive rates.

Recommended parameters

The following parameters enrich the anti-fraud model and improve transaction scoring, but are not critical for initial evaluation. Their inclusion provides additional context about the payer’s environment and behavior.

ℹ️

Validation rules apply before antifraud evaluation. When an optional object (e.g. Customer.Address) is present, all of its subfields must be completed.

Device Fingerprint Setup

The device fingerprint library collects device, browser, and behavioral information from the payer’s session. Although not mandatory, its use is recommended to enhance risk evaluation and accuracy in the fraud scoring model.

JavaScript library import

The library must be imported directly from Bamboo’s public endpoint, including the merchant’s PublicAccountKey as a query parameter.

<script 
  src="{API_Environment}/v1/Scripts/Antifraud.js?key={PublicAccountKey}" 
  type="text/javascript">
</script>

⚠️

The script must always be loaded directly from Bamboo’s domain. It must not be downloaded, cached, or served from a local server or third-party CDN. This ensures that merchants always use the latest version and maintain compliance with Bamboo’s security standards.

getSessionAntifraud

This method initializes the fingerprint process and returns a unique SessionId (string). The value must be sent in the purchase request as AntifraudData → AntifraudFingerprintId.

<script type="text/javascript">
  var sessionId = getSessionAntifraud();
  console.log("Antifraud SessionId:", sessionId);
</script>

ℹ️

The fingerprint session is automatically tied to the payer’s device and browser context. It is recommended to generate a new SessionId for each checkout attempt to ensure accuracy in risk evaluation.

Discover the API

Once the anti-fraud fields are properly implemented, the next step is to integrate them within the Create Purchase operation.