Fraud Dispositions 1.5

Field NameTypeSizeField Format/Description

authPostFlag

Text

1

Type of transaction:

  • A = Authorization or other payment-card-initiated transaction (for example, ATM inquiry). Also includes credit-card transactions initiated by balance-transfer or convenience checks.
  • P = Posting

blockDate

Date

8

Format: yyyymmdd

Block date. The level of the block is indicated in the blockLevel field. Time zone is specified by gmtOffset.

blockLevel

Text

1

Specifies the level of the block defined by the blockDate and blockTime fields:

  • C = Customer level
  • A = Account level
  • P = Primary Account Number (PAN) level
  • I = Payment-Instrument level
  • N = No block applied

blockTime

Date

6

Format: hhmmss

Block time. The level of the block is indicated in the blockLevel field. Time zone is specified by gmtOffset.

caseCreationDate

Date

8

Format: yyyymmdd

Date of case creation. Time zone is specified by gmtOffset.

caseCreationTime

Date

6

Format: hhmmss

Time of case creation. Time zone is specified by gmtOffset. This time is typically populated by the Falcon Case Manager.

caseTag

Text

2

String indicating the fraud status at the case level. This field is used to specify the case level tag when messageType = TRAN. Otherwise, this field will match the fraudFlag field:

  • 0 = non-status
  • 1 = confirmed fraud
  • 2 = unconfirmed fraud
  • 3 = confirmed non-fraud
  • 4 = unconfirmed non-fraud

clientIdFromHeader

Text

16

Unique identifier for the client or subclient. The value of this field is determined jointly by the client and FICO.

creditAcctNumber

Text

40

The unique identifier for the account having funds credited.

creditBranchId

Text

20

The branch ID associated with the account having funds credited.

creditCustomerId

Text

20

The customer id for the customer who has the account having funds credited.

customerAcctNumber

Text

40

Unique identifier for the account associated with the transaction/record.

customerIdFromHeader

Text

20

Customer Identifier. Financial institution's unique identifier for the customer associated with this record. If not available, the primary customer identifier for the account.

dataSpecificationVersion

Text

5

1.5

dateOfFirstIncident

Date

8

Format: yyyymmdd

Date of first fraudulent transaction or first suspicious non-fraud transaction of case being investigated. Time zone is specified by gmtOffset.

dateOfLastIncident

Date

8

Format: yyyymmdd

Date of last fraudulent transaction or last suspicious non-fraud transaction of case being investigated. Time zone is specified by gmtOffset.

debitAcctBranchId

Text

20

The branch ID associated with the account having funds debited.

debitAcctNumber

Text

40

The unique identifier for the account having funds debited.

debitCustomerId

Text

20

The customer id for the customer who has the account having funds debited.

decisionCode

Text

1

Authorization Decision Code:

  • A = Approve
  • D = Decline
  • I = Approve with positive ID
  • P = Pick up card
  • R = Refer
  • Blank = Unknown/other

depositWithdrawalFlag

Text

1

Specifies whether the transaction is a deposit or withdrawal of funds with respect to the account specified in the customerAcctNumber field:

For transactions on electronic funds accounts:

  • D = Funds are credited to the account (deposit)
  • Q = Funds are debited from the account (withdrawal)

For transactions on card-connected accounts, such as credit cards and prepaid cards:

  • C = Funds are credited to the referenced credit card on the account
  • P = Funds are credited to the referenced prepaid card on the account

This field is populated if tagging account to account payments at the transaction level.

deviceId

Text

40

This field provides the specific identification number of the device where the transaction has been initiated:

  • ATM ID = ATM based transaction
  • Branch ID = Teller based transaction
  • Web ID = online transaction
  • Telephone Number = telephone transaction
  • Terminal ID = POS transaction
  • IMEI = Mobile transaction

expandedBIN

Text

100

The first 8–12 digits of the card number (pan).

externalTransactionId

Text

32

Client-generated unique transaction ID that is unique across all data feeds for a specific installation of Falcon Fraud Manager.

externalTransactionIdReference

Text

32

Value of field externalTransactionId of the transaction (for example, a credit authorization) which initiated this record.

fiTransactionIdReference

Text

32

FICO-generated transaction ID which uniquely identifies the transaction (for example, a credit authorization) associated with this record.

fraudFindMethod

Text

3

String indicating how the fraud was detected:

  • 0 = Unknown
  • 1 = Customer reported
  • 2 = Flagged by FICO
  • 3 = Standard information checking (for example, CVV, PIN, Expiration Date)
  • 4 = Flagged by non-FICO system

fraudFlag

Text

2

String indicating the fraud status at the level specified by messageType:

  • 0 = non-status
  • 1 = confirmed fraud
  • 2 = unconfirmed fraud
  • 3 = confirmed non-fraud
  • 4 = unconfirmed non-fraud

fraudType

Text

3

String indicating the case level fraud subset:

  • 1 = Application fraud
  • 2 = Counterfeit (Other than skimming, or if the type of counterfeit cannot be differentiated.
  • 3 = Friendly fraud (Fraud perpetrated by accountholder's family or friends)
  • 4 = Skimming
  • 5 = Internet order fraud. (Only used if all the fraudulent transactions were Internet order frauds.)
  • 6 = Convenience check fraud. (Only used if all the fraud transactions were convenience check frauds.)
  • 8 = Mail/phone order fraud. (Only use if all fraud transactions were mail/phone order frauds.)
  • 9 = Non-receipt
  • 10 = Other
  • 11 = Lost/Stolen
  • 12 = Takeover
  • 13 = Zero loss fraud (fraud is attempted on a card, but none of the fraud attempts post)
  • 14 = First party fraud
  • 15 = ID theft
  • 16 = Check kiting
  • 17 = Kidnapping
  • 18 = Phishing
  • 19 = SIM-related
  • 20 = Number Porting (or Porting)
  • 21 = Malware
  • 22 = Check Fraud: Customer Responsible
  • 23 = Check Fraud: Customer Victim
  • 24 = Check Fraud: Autopay Customer Victim
  • 25 = Deposit Fraud: Internal/Employee
  • 26 = Deposit Bad: Credit-Overdraft
  • 27 = Deposit Bad: Advance
  • 28 = Social Engineering Fraud
  • 29 = Scam

gmtOffset

Numeric

6

Specifies the Greenwich Mean Time (GMT) offset associated with all date-time fields in the record body (positions 161 onward). Format is (-)nn.nn, where the digits to the right of the decimal point represent decimal fractions of an hour. For example, a GMT offset of 5 hours and 45 minutes (Nepal) is expressed as 5.75. Note that gmtOffset changes during Daylight Saving Time if Daylight Saving Time is observed in the date-time fields in the record body.

liability

Text

1

Indicates whether the client is liable for losses created from the fraud:

  • N = client is not liable for fraud losses
  • S = client shares liability with another party
  • L = client is liable for fraud losses
  • Z = zero losses

mcc

Text

4

Merchant Category Code.

merchantId

Text

20

Merchant ID.

messageType

Text

4

Type of the Fraud Record:

  • CUST = Customer level
  • ACCT = Account level
  • PAN = Primary Account Number (PAN) level
  • INST = Payment-Instrument (Plastic) level
  • TRAN = Transaction level

nonmonCode

Text

4

The code defining the nonmonetary event. Refer to the table of nonmonetary codes.

onUsFlag

Text

1

Specifies if the transaction is on or off us. It is assumed the customerAcctNumber is with the financial institution so the following values apply to the other account:

  • E = The transaction is external (off-us)
  • O = The transaction is intra-brand (on-us)
  • W = The transaction is inter-brand (on-we)

pan

Text

19

Primary Account Number (PAN) of the payment instrument. This is the number encoded or embossed on the payment instrument.

paymentInstrumentId

Text

30

Unique identifier for the payment instrument.

paymentOrderFlag

Text

1

Indicates whether this is the set-up or the processing of the payment:

  • P = Payment/Transfer
  • O = Payment Order (payment set-up for delayed or recurring payments)

pinVerifyCode

Text

1

PIN verification:

  • I = Invalid
  • V = Valid
  • X = PIN entered but not verified or verification results unknown
  • Y = PIN not entered, not using a card association network
  • Z = PIN not entered, using a card association network

Deprecated value:

  • P = PVKI value zero or blank
  • Blank = not checked

postDate

Date

8

Format: yyyymmdd

Authorization: Blank.

Posting: Date posting was processed.

recordCreationDate

Date

8

Format: yyyymmdd

Date that this record was created. Time zone must be GMT.

recordCreationMilliseconds

Numeric

3

Format: sss

Milliseconds portion of the time that this record was created.

recordCreationTime

Date

6

Format: hhmmss

Time that this record was created. Time zone must be GMT.

recordSource

Text

1

String indicating source of case:

  • F = FICO Case Manager
  • N = Non-FICO Case Manager
  • S = System of Record
  • O = Other Source

recordType

Text

8

FRD15

recordTypeReference

Text

8

Value of field recordType in the transaction that initiated this record.

timeOfFirstIncident

Date

6

Format: hhmmss

Time of first fraudulent transaction or first suspicious non-fraud transaction of case being investigated. Time zone is specified by gmtOffset.

timeOfLastIncident

Date

6

Format: hhmmss

Time of last fraudulent transaction or last suspicious non-fraud transaction of case being investigated. Time zone is specified by gmtOffset.

transactionAmount

Numeric

19

Format: nnnnnnnnnnnnnnnn.nn

The monetary amount associated with the transaction.

transactionCountryCode

Text

3

This field identifies the country where the transaction has occurred.

transactionCurrencyCode

Text

3

ISO 4217 three-digit numeric currency code. This is the currency unit used for all currency-based fields. If using a Falcon or Fraud Predictor model, consult the model report for information on supported currencies.

transactionCurrencyConversionRate

Numeric

13

Format: nnnnnn.nnnnnn

The multiplicative currency conversion rate that is used to convert the currency specified in transactionCurrencyCode to US dollars. The number of US dollars in the currency specified in transactionCurrencyCode.

transactionDate

Date

8

Format: yyyymmdd

Date of transaction. Time zone is specified by gmtOffset.

transactionPostalCode

Text

10

This field identifies the postal code of the location where the transaction has occurred.

transactionReferenceNumber

Text

32

The Transaction Reference Number for retail banking transactions. This number uniquely identifies a given transaction.

transactionTime

Date

6

Format: hhmmss

Time of transaction. Time zone is specified by gmtOffset.

transactionTimeMilliseconds

Numeric

3

Format: sss

Milliseconds of the transaction. Time zone is specified by gmtOffset.

userCode1

Text

3

User-defined information.

userCode2

Text

3

User-defined information.

userData01

Text

10

User-defined information. Editable in Falcon Expert rules.

userIndicator01

Text

1

User-defined information. Editable in Falcon Expert rules.

workflow

Text

16

Contains the name of the workflow to be executed by Falcon Fraud Manager.
Fraud Dispositions 1.5 Field Descriptions

  • ©2022 Fair Isaac Corporation. All rights reserved.

    • www.fico.com