MaxMind minFraud¶

MaxMind minFraud provides IP risk scoring, geo matching, and BIN lookup for checkout traffic. The extension calls the minFraud v2.0 Score, Insights, or Factors API (selectable by tier), enriches each request with the full checkout context, and returns an allow / review / block decision against configurable thresholds. It also implements the Report Transaction feedback loop, sending chargeback and fraud-decision outcomes back to MaxMind to train its models.

What It Provides¶

• A FraudScoringStrategy implementation registered under the provider name maxmind (per-provider registration). The core fraud engine resolves it with channel-enablement awareness and merges its result with the core rule engine's own factors — see Fraud Scoring Extensions.
• Checkout scoring (score_checkout) and post-payment scoring (score_post_payment) — both submit a minFraud purchase event; post-payment requests additionally carry AVS/CVV results, card BIN and last four, 3-D Secure outcome, and authorization status collected after the charge.
• Login scoring (score_login) — submits a minFraud account_login event instead of purchase, so the event type matches the action being scored.
• Request enrichment — sends all available context: device (IP, user agent, session ID, Accept-Language), account ID, email (MD5-hashed, plus domain), billing and shipping addresses (name, address, region, phone — plus delivery speed on shipping), credit card (BIN, last four, AVS/CVV results, 3-D Secure), payment (method, processor, authorization outcome), order (amount, currency, discount code), and shopping cart line items.
• Signal extraction — on the Insights and Factors tiers the response is parsed into signals: IP risk and anonymity traits (is_anonymous_vpn, is_public_proxy, is_residential_proxy, is_tor_exit_node, is_hosting_provider), high-risk IP country, credit-card issuer match / country / prepaid / virtual flags, email intelligence (disposable, free, first seen), device intelligence (ID, confidence, last seen), shipping and billing address distance-to-IP checks, custom-rule dispositions, risk score reasons (Factors tier), API warnings, and remaining funds/queries.
• Decision feedback (report_decision) — posts to the minFraud Report Transaction endpoint, mapping platform decisions to MaxMind tags: block/review → suspected_fraud, allow → not_fraud, chargeback → chargeback, spam → spam_or_abuse. MaxMind reports that this feedback loop improves scoring accuracy by 10–50%.
• Decision mapping — the minFraud risk_score (0–99) is compared against the thresholds: at or above block_threshold the decision is block, at or above review_threshold it is review, otherwise allow. The score is also normalized to the platform's 0–1 risk scale.

Setup¶

1. Enable MaxMind minFraud for the channel under Settings > Extensions (extension enablement is per-channel).
2. Provide your MaxMind account ID and license key. license_key is a secret config field (encrypted at rest and masked in the admin); the strategy factory also falls back to the MAXMIND_ACCOUNT_ID and MAXMIND_LICENSE_KEY environment variables — see the credential-resolution note under Operational Notes.
3. Choose the API tier matching your minFraud subscription (score, insights, or factors) and tune the review/block thresholds.

Configuration Reference¶

Permissions¶

This extension declares no permissions in its manifest.

Operational Notes¶

• Fail-open — with missing credentials, or on any API failure (logged as a warning), the strategy returns allow with score 0; checkout is never aborted by a provider outage. Scoring and report calls use a 10-second timeout.
• Authentication — requests use HTTP Basic auth with account_id:license_key. An unrecognized tier value falls back to score.
• Privacy — email addresses are MD5-hashed before being sent to minFraud; only the email domain is sent in clear text.
• Merged scoring — the extension score is combined with the core rule engine; the merged result records its provider as core+maxmind. A pre-payment block aborts checkout; a post-payment review sets the order's fraud status to pending_review, and a post-payment block additionally moves the order to HeldForReview.
• One provider per channel — if more than one fraud extension is enabled on a channel, checkout logs a warning and uses the alphabetically-first provider name.
• Quota visibility — funds_remaining and queries_remaining from each minFraud response are stored in the score's signals.
• Not the GeoIP provider — core registers a separate, core-owned IP geolocation provider also named maxmind (GeoLite2 lookups); it is independent of this extension.