Fraud Dispositions 1.3

Field NameTypeSizeField Format/Description

authPostFlag

Text

1

Type of transaction:

  • A = Authorization or other payment-card-initiated transaction (for example, ATM inquiry). Also includes credit-card transactions initiated by balance-transfer or convenience checks.
  • P = Posting

batchNumber

Text

7

Number (in ascending order) assigned to each batch.

blockDate

Date

8

Format: yyyymmdd

Account block date.

blockTime

Date

6

Format: hhmmss

Account block time.

caseCreationDate

Date

8

Format: yyyymmdd

Date of case creation. Time zone is specified by gmtOffset.

caseCreationTime

Date

6

Format: hhmmss

Time of case creation. Time zone is specified by gmtOffset. This time is typically populated by the Falcon Case Manager.

caseType

Text

2

String indicating the valid values for case type:

  • 00 = non-fraud
  • 10 = fraud at origination (on-us)
  • 01 = fraud at destination (on-us)
  • 11 = fraud at both origination and destination (on-us)
  • 20 = fraud at origination (not-on-us)
  • 02 = fraud at destination (not-on-us)
  • 22 = fraud at both origination and destination (not-on-us)

clientIdFromHeader

Text

16

Unique identifier for the client or subclient. The value of this field is determined jointly by the client and FICO.

customerAcctNumber

Text

40

Unique identifier for the account associated with the transaction/record.

customerIdFromHeader

Text

20

Customer Identifier. Financial institution's unique identifier for the customer associated with this record. If not available, the primary customer identifier for the account.

dataSpecificationVersion

Text

5

1.3

dateOfFirstIncident

Date

8

Format: yyyymmdd

Date of first fraudulent transaction or first suspicious non-fraud transaction of case being investigated. Time zone is specified by gmtOffset.

dateOfLastIncident

Date

8

Format: yyyymmdd

Date of last fraudulent transaction or last suspicious non-fraud transaction of case being investigated. Time zone is specified by gmtOffset.

decisionCode

Text

1

Response to request or the message disposition:

  • 1 = Approved
  • 0 = Not Approved
  • blank = unknown

depositWithdrawalFlag

Text

1

The deposit withdrawal flag:

  • D = Deposit
  • W = Withdrawal

deviceId

Text

16

Provides the specific identification number of the device where the transaction has been initiated:

  • ATM ID[16] = ATM based transaction
  • Branch ID[16] = Teller based transaction
  • Web ID[16] = online transaction
  • Telephone Num[16] = telephone transaction
  • Terminal ID[16] = POS transaction

expandedBIN

Text

20

The first 8–12 digits of the card number (pan).

externalTransactionId

Text

32

Client-generated unique transaction ID that is unique across all data feeds for a specific installation of Falcon Fraud Manager.

externalTransactionIdReference

Text

32

Value of field externalTransactionId of the transaction (for example, a credit authorization) which initiated this record.

fiTransactionIdReference

Text

32

FICO-generated transaction ID which uniquely identifies the transaction (for example, a credit authorization) associated with this record.

fileIdModifier

Text

1

To distinguish multiple files between the same participants created on the same date.

fraudFindMethod

Text

3

String indicating how the fraud was detected:

  • 0 = Unknown
  • 1 = Customer reported
  • 2 = Flagged by FICO
  • 3 = CVV/CVC check
  • 4 = Flagged by non-FICO system

fraudFlag

Text

2

String indicating the fraud status at the level specified by messageType:

  • 0 = non-status
  • 1 = confirmed fraud
  • 2 = unconfirmed fraud
  • 3 = confirmed non-fraud
  • 4 = unconfirmed non-fraud

fraudType

Text

3

String indicating the fraud subset:

  • 1 = Application fraud
  • 2 = Counterfeit (Other than skimming.)
  • 3 = Friendly fraud (account compromised by cardholder)
  • 4 = Skimming
  • 5 = Internet order fraud.
  • 6 = Convenience check fraud.
  • 7 = Lost
  • 8 = Mail/phone order fraud.
  • 9 = Non-receipt
  • 10 = Other
  • 11 = Stolen
  • 12 = Takeover
  • 13 = Zero loss fraud
  • 14 = First party fraud
  • 15 = ID theft
  • 16 = Check kiting

gmtOffset

Numeric

6

Specifies the Greenwich Mean Time (GMT) offset associated with all date-time fields in the record body (positions 161 onward). Format is (-)nn.nn, where the digits to the right of the decimal point represent decimal fractions of an hour. For example, a GMT offset of 5 hours and 45 minutes (Nepal) is expressed as 5.75. Note that gmtOffset changes during Daylight Saving Time if Daylight Saving Time is observed in the date-time fields in the record body.

liability

Text

1

Indicates whether the client is liable for losses on origination and destination accounts or not:

  • 0 = client is NOT liable for origination or destination accounts
  • 1 = client is liable only for origination account
  • 2 = client is liable only for destination account
  • 3 = client is liable for both origination and destination accounts
  • blank = unknown

mcc

Text

4

Merchant Category Code.

membership

Text

1

Indicates whether the origination and destination accounts are with the client or not:

  • 0 = Neither origination nor destination accounts are with the client
  • 1 = only origination account with the client
  • 2 = only destination account with the client
  • 3 = both origination and destination accounts with the client
  • blank = unknown

merchantId

Text

20

Merchant ID.

messageType

Text

4

Type of the Fraud Record:

  • CUST = Customer level
  • ACCT = Account level
  • PAN = Primary Account Number (PAN) level
  • INST = Payment-Instrument (Plastic) level
  • TRAN = Transaction level

originatingAcctNumber

Text

40

Originator Account Number.

The account number of the originator with the originating bank. This can be channel-specific and does not need to be the same across all channels.

For example, Checking Account Number or Credit Card Number.

originatingBankId

Text

20

Originating Bank ID.

This field identifies or contributes to the identification of the Origination Account of the transaction.

originatingCustomerId

Text

20

Identifies the customer who is the origination of the transaction.

pan

Text

19

Primary Account Number (PAN) of the payment instrument. This is the number encoded or embossed on the payment instrument.

paymentInstrumentId

Text

30

Unique identifier for the payment instrument.

paymentType

Text

2

The first two bytes of the Processing Code:

  • 00 = Bulk Authorization
  • 10 = Single Immediate Payment
  • 20 = Return Payment
  • 25 = Scheme Return Payment
  • 30 = Standing Order
  • 40 = Forward Dated Payment
  • 50 = Corporate Bulk Payment

postDate

Date

8

Format: yyyymmdd

Authorization: Blank.

Posting: Date posting was processed.

receivingBankId

Text

20

Receiving Bank ID

Routing number of the bank (branch) where the receiver's account is held.

Note: For an on-us (Internal) transaction, the receiving customer is on the same bank as the originating customer.

receivingCustomerAcctNumber

Text

40

Receiver Account Number.

This field identifies or contributes to the identification of the destination account of the transaction.

receivingCustomerId

Text

20

Receiver Identification Number.

This field identifies the customer who is the destination of the transaction.

recordCreationDate

Date

8

Format: yyyymmdd

Date that this record was created. Time zone must be GMT.

recordCreationMilliseconds

Numeric

3

Format: sss

Milliseconds portion of the time that this record was created.

recordCreationTime

Date

6

Format: hhmmss

Time that this record was created. Time zone must be GMT.

recordSource

Text

1

String indicating source of case or fraud record:

  • 1 = Any case management system (or customer management system)
  • 2 = System of record or fraud reporting system (after cases are adjudicated)

recordType

Text

8

FRD13

recordTypeReference

Text

8

Value of field recordType in the transaction that initiated this record.

sequenceItemNumber

Text

15

Check Transactions.

Check serial number: includes the check serial number contained on the source document used for the entry.

Terminal Transactions.

Transaction serial number: Number assigned by the terminal at the time transaction is originated.

timeOfFirstIncident

Date

6

Format: hhmmss

Time of first fraudulent transaction or first suspicious non-fraud transaction of case being investigated. Time zone is specified by gmtOffset.

timeOfLastIncident

Date

6

Format: hhmmss

Time of last fraudulent transaction or last suspicious non-fraud transaction of case being investigated. Time zone is specified by gmtOffset.

traceNumber

Text

15

Trace number to uniquely identify each entry within a batch in an input ACH file. Together with BATCH Number, Date, File ID Modifier.

transactionAmount

Numeric

22

Format: nnnnnnnnnnnnnnnnnn.nnn

The monetary amount associated with the transaction.

transactionCountryCode

Text

3

This field identifies the country where the transaction has occurred. ISO Numeric Country Code.

transactionCurrencyCode

Text

3

ISO 4217 three-digit numeric currency code. This is the currency unit used for all currency-based fields. If using a Falcon or Fraud Predictor model, consult the model report for information on supported currencies.

transactionCurrencyConversionRate

Numeric

13

Format: nnnnnn.nnnnnn

The multiplicative currency conversion rate that is used to convert the currency specified in transactionCurrencyCode to US dollars. The number of US dollars in the currency specified in transactionCurrencyCode.

transactionDate

Date

8

Format: yyyymmdd

Date of transaction. Time zone is specified by gmtOffset.

transactionPostalCode

Text

10

This field identifies the postal code of the location where the transaction has occurred.

transactionTime

Date

6

Format: hhmmss

Time of transaction. Time zone is specified by gmtOffset.

transactionTimeMilliseconds

Numeric

3

Format: sss

Milliseconds of the transaction. Time zone is specified by gmtOffset.

workflow

Text

16

Contains the name of the workflow to be executed by Falcon Fraud Manager.
Fraud Dispositions 1.3 Field Descriptions
  • www.fico.com