Risk assessment

Multifactor authentication is not a single feature but instead is an approach that combines mechanisms to confirm identities. Your application defines a risk threshold, and executes authentication factors one at a time while observing the risk level. Gatekeeper returns scores for each factor and presents an overall risk assessment of all executed factors.

  • Results are in the form of session-level risk decisions (Authentic, Mismatch, Fraud, or Uncertain) as well as risk scores and reliability scores (the confidence level of the calculated risk).
  • Gatekeeper presents the session and the Engagement decision in the web applications for investigation by fraud analysts.
  • Your application can consult the results programmatically during a session after executing each factor. For example, when the session suggests fraudulent risk, your application can decide to execute a new factor and check if the risk is confirmed or mitigated.
  • Gatekeeper supplies the verify and identify authentication factors, combined with audio quality metrics and other fraud detection features. Some factors require custom agreements and licenses.
  • Gatekeeper provides default risk engine calibration models that are trained with all factors enabled (based on 467,135 trials for TI models and 284,049 trials for TD models). Recommended: Use these models for testing purposes and for training new models for your deployment. The AI risk engine leverages deep neural network (DNN) techniques and must be trained on a representative dataset generated from production data.

The figure shows the inputs and output of the risk engine. (Technically, the risk engine is a micro-service within the Gatekeeper ecosystem. It is drawn here as a separate component for clarity.)

Risk Engine

Flow description is as follows:

  1. At the start of a session, your application begins invoking authentication and fraud factors.
  2. The risk engine returns results for each factor along with session decisions and risk levels.
    • Gatekeeper uses the obtained risk level and reliability score to calculate the decision.
    • The risk engine returns one of the following decisions as indicators of overall session activities : Authentic, Mismatch, Fraud, or Uncertain.
    • Risk assessments that are below a certain threshold indicate authentic results, mid-range assessments indicate mismatches, and high risk scores indicate fraud. When the reliability is very low, the uncertainty is high. Here’s how it works:
    • When the risk is lower than the authentic threshold, the return indicates an authentic decision.
    • When the risk is higher than the fraud threshold, the return indicates a fraud decision.
    • When the risk is higher or equal to the authentic threshold and lower or equal to the fraud threshold, the return indicates a mismatch decision.
    • When the reliability is lower than the reliability threshold, the return indicates an uncertain decision.
  3. Your application checks results after each factor and takes the necessary business decisions. Your application can manage results at any level of detail: you can rely on the calculated session decision and risk assessment, you can review the result of each factor individually, or you can get raw scores and make your own calculations. If the session includes multiple requests for the same factor, the risk-engine only considers the last request.
  4. The application can adjust the risk threshold during the session, depending on the transactions involved. In other words, you can have different authentication levels for different risk levels of each session within the same engagement. For example, a more relaxed risk threshold for the customer logon, a more strict risk threshold when the customer requests private information, and a very strict risk threshold for a monetary transaction.

You must explicitly stop engagements to prevent subsequent sessions from affecting their engagement decisions. While an engagement is active, every session affects the engagement decision.

Once an engagement is closed, additional sessions do not affect the decision. The risk engine processes the additional sessions and factors, and they are going to have their own session and factor decisions and scores. But none of these affect the engagement decision.

The system automatically examines audio quality and factors the metrics into the risk engine. By default, the risk engine considers various audio quality metrics from the different factors, to determine whether the confidence of the risk score is reliable or not.