Data collection to detect fraud

Learn how data collection works, what data is collected and how this data is used to help detect fraud. Find out what you need to consider depending on which type of Web integration you have built, and how to optionally add the data collection SDK to other pages in your website.

Requirements

Before you begin, take into account the following requirements and limitations.

Data privacy

Because personal data is processed to detect fraudulent payment activity, you have to consider data privacy and adhere to privacy laws.

Before processing any shopper data, make sure that you:

• Comply with obligations under the applicable privacy laws and regulations. Consult your legal department or an accredited third-party company to understand the data privacy regulations of the countries/regions that you operate in.
• Understand the requirements. Different jurisdictions may require different actions. For example, under European regulations, you are required to ask for your customer’s consent to process their data, and you have to be transparent about the use of that data. You can clarify how data is processed in your privacy and cookie statement. For example, when a shopper lands on the checkout page, your company's privacy policy could pop up and show a consent checkbox or button. It is your responsibility to keep track of the shoppers who have given consent.

How it works

Adyen collects data about how shoppers interact with and use the payment form. Protect then uses this data to detect fraudulent payment activity, analyze usage patterns, and mitigate fraud.

When you use our Web Drop-in or Components or the Custom Card Component for Web to build your checkout experience, or when you are using Hosted Checkout, data is automatically collected from the checkout page and sent to Adyen.

When you have built an API-only integration for Web, and have created your own checkout page, you can add a script that calls our standalone data collection SDK to collect the same data, retrieve the data, and then send it to Adyen in the payment request. See Configure data collection for API only for more details.

For all Web integrations, you can optionally add the data collection script to other pages than your checkout page, collecting even more data.

How Protect uses the data

To detect fraud, and to mitigate the effects of potential fraudulent activity, our latest risk engine uses the data that is collected.

This includes the following data:

• Device characteristics: for example the shopper's browser type, screen size, and device type.
• Activity information: for example if credit card details were copied and pasted into the payment form, and the time between payment requests.

The anonymized data may be used across customers to determine if a transaction is legitimate. Adyen does not use this data for anything else than to detect and mitigate fraud, and does not share or use this information for marketing purposes. For more details, see Adyen's privacy statement.

This data is one of the sources to help detect and mitigate fraud. To use Protect, you have to set up risk, and configure at least one risk profile.

Data collected by the SDK

The following data is collected:

Configure data collection for Drop-in and Components

Risk data collection is included in the Adyen checkout configuration, and is turned on by default when you build your integration with Web Drop-in or Components, the Custom Card Component or Hosted Checkout. It is a separate setting that is independent of your Protect configuration.

It is possible to turn off risk data collection, but this increases the chance that you will be exposed to and experience fraud.

To configure risk data collection, include the following in the AdyenCheckout configuration:

const configuration = {
  environment: 'test',
  clientKey: 'test_...',
  risk: {
    enabled: true // Set to false to not send potential fraud detection data to Adyen.
  }
  // Other global configuration...
};

Collect additional data outside of the checkout page

In addition to the data that you send when the shopper checks out, you can also optionally collect data to detect fraud outside of the checkout page. We recommend that you collect data about the shopper's activity on every page of your site.

To do this, add the following script to any of your web pages.

<script src="https://checkoutshopper-live.adyen.com/checkoutshopper/assets/js/datacollection/datacollection.js"></script>

When the shopper checks out, Drop-in or the Component sends all of the data collected by the script to Adyen. This includes the data from the checkout page as well as any data collected from other web pages that contain the script.

Configure data collection for API only

When you have built an API-only integration for Web, and built your own checkout page, you can collect data by following these steps:

1. Add the script that loads the data collection SDK to the checkout page on your website.
   When a shopper interacts with your checkout page, the SDK is loaded and collects data. The collected data is included in the client data when the shopper pays.
2. Send the data in the payment request.

Add the script to your checkout page

To add the data collection SDK, add a reference to the following script in your checkout page:

Add the reference in the iframe of the page where the shopper enters their payment details.

<html>
  <head>
    <title>Your website</title>
  </head>
  <body>
<p>Your checkout page.</p>
    <script type="text/javascript" src="https://checkoutshopper-live.adyen.com/checkoutshopper/assets/js/datacollection/datacollection.js"></script>
    <form action="http://www.yourdomain.com/checkout" method="POST">
      <!--
      Your other payment related fields
      -->
      <input type="submit" value="Submit" />
    </form>
  </body>
</html>

The data is automatically collected and continuously updated. You can optionally add the same reference to the script to other pages in your website and collect data from multiple pages.

To send the data to Adyen, continue with the next step.

Send the data to Adyen

After the data is collected and submitted to your server, you have to include the data in the payment request.

1. Call the adyenGetData() method to get the data. This method is included in the SDK.
2. When you make the /payments request, include the data in riskData.clientData.

For example:

curl https://checkout-test.adyen.com/checkout/v71/payments \
-H 'X-API-key: ADYEN_API_KEY' \
-H 'content-type: application/json' \
-d '{
      "amount":{
        "currency":"USD",
        "value":1000
      },
      "reference":"YOUR_ORDER_NUMBER",
      "paymentMethod": {
        "type": "scheme",
        "encryptedCardNumber": "adyenjs_0_1_18$MT6ppy0FAMVMLH...",
        "encryptedExpiryMonth": "adyenjs_0_1_18$MT6ppy0FAMVMLH...",
        "encryptedExpiryYear": "adyenjs_0_1_18$MT6ppy0FAMVMLH...",
        "encryptedSecurityCode": "adyenjs_0_1_18$MT6ppy0FAMVMLH...",
        "holderName": "S. Hopper"
      },
      "riskData": {
        "clientData": adyenGetData()
      },
      "returnUrl": "https://your-company.com/...",
      "merchantAccount":"YOUR_MERCHANT_ACCOUNT"
     }'

See also