It's also partly due to them tending to be more international, meaning they are more likely to live in a different timezone.

The "outside of business hours" explanation is still a valid explanation but definitely not the whole story. Overall, I'd caution that when building fraud detection models understanding the stories behind the data is extremely important, or you risk having an algorithm that works for the wrong reasons.

For example, if suddenly your user base because more international (for example if you start allowing non-US users to use your website), you'll suddenly have a lot of false positives if you're not cautious because to your system it'll look like they're "operating outside of business hours".

It's also only a good signal as long as you aren't actioning on it.

As soon as it becomes advantageous enough to fit in with the normal user patterns, the attackers will modify their behavior accordingly.

The time-of-day, internationality, and many other signals mentioned in this post are easily evaded when it becomes profitable to do so.

The graphs say local time; I interpreted that to mean ip-address local time.

It may just be that they use US proxies. I did when I was overseas.

The "night owl thing" isn't misinterpretation. It is true that there are less total transactions at night, but the point and observation is that the fraud "rate" is higher at night.

Another way to put it: fraudsters are more likely to be night-owls than the rest of us.

Possibly, but you could also decide that there simply isn't enough signal to draw a conclusion. We don't know if time zones are accounted for properly. We don't know if this fraction represents a significant number of users - for example, the number of fraudulent users could be the least at 3AM, but if the decrease in users overall is greater, then the percentage increases. The data is misrepresented.

Hi there, I worked on retrieving and distilling this dataset at Sift Science. To address your concerns: Yes, time zones are accounted properly. And yes, the number of data points is significant.

As I've said earlier, you can see in the users count that fraudulent users are indeed the lowest at night (which makes sense, since fraudsters sleep as well). However, we are looking at the "fraud rate" (#fraud / all users in a given hour). I'm not sure what you even mean by "misrepresent" the data. The data speaks for itself.

Or they simply live on the other side of the world

If you read the labels for the graph, it says "local time" of the user / fraudster. If we didn't take into account the local time of the user, the data would not be very interesting to look at (mostly uniform) since we have users from all over the globe.

It could be both misinterpreting the data and not misinterpreting the data though. Let me explain...

The argument for misinterpreting the data is easy to use when you account for time zones. If (a) I'm in the US and (b) I notice that most of my fraudulent transactions occur around 3AM, then it follows that (c) most of my fraud occurs at night. However, if the corollary of "Most of my fraud occurs from India/Singapore/etc", then it's simply a matter of time zones. Does most of my fraud occur at night? It does if I'm in the US but, if I'm the hacker in India/etc, then it occurs during the day. It's 3:45AM where I am in the US (CDT) but it's 2:15PM somewhere in India...

However, if I was to write a training manual for my employees who worked in the same building as me (US CDT), then I'm not misinterpreting the data. The data is the "truth" here - if it shows that most fraudulent transactions occur around 3AM local time, then that's the truth and I'd be foolish to over-complicate the issue when trying to train new hires on how to spot fraud.

If I were to try to understand these data, I'd like to know (a) How are "fraudulent transactions" determined? (b) Is the mechanism perfect or just very good? (c) What fraction of fraudulent transactions does it capture? All? Or just most? (d) And I'd like the detailed data series.

Statistically speaking, I'm suspicious regarding the conclusion about lunch hours. In order to identify that feature robustly, it's necessary to very accurately know the variability of the background signal. Does it always dip at lunch hours and all at the same time? Does it always have the same shape? Recall what's being done here is separating the background "non-fraud transactions" from "fraud transactions". If the latter are much smaller in number than the former, and the determination of fraud has a finite miss rate or a finite false alarm rate, then all the implications of Bayes Rule apply, and the fraud signals being seen could be just some transfer function of the fraud mechanism applied to the background signal.

Moreover, do fraudulent signals increase in proportion to total background? Or are they a constant amount?

I think more work needs to go into deconvolving the two kinds of signals before assigning meaning to their parts and features of their parts.

No doubt the story assigned to these is plausible and compelling, but it is based upon unproven inferences. And, in my opinion, assuming that identifying and acting on these signals is simpler than it looks is getting way ahead of the art.

this is crap. this describes almost every geek out there and chinese/rtl users who use numbers where they cannot type in their script. Looks like another self-proclaimed snake-oil-salesman-turned-security-guru bull shit.

honestly... frack the internet, you'r giving it too much weight

Probably politically incorrect and certainly not a valid sample but in my experience, most fraudulent callers at least have a strong Indian accent and try some sort of Microsoft support scam:

http://www.wired.co.uk/news/archive/2013-04/11/malwarebytes

The time difference would explain the prevalence of night owls and other factors often used in fraud detection. Only on my direct office phone number, I receive 5-10 such calls a week.

Yes - if you look at the first two graphs, you can more or less infer the third. The level of fraudulent orders and legitimate orders both decline at night, but the decline is not as marked in the fraudulent orders.