It's also only a good signal as long as you aren't actioning on it.
As soon as it becomes advantageous enough to fit in with the normal user patterns, the attackers will modify their behavior accordingly.
The time-of-day, internationality, and many other signals mentioned in this post are easily evaded when it becomes profitable to do so.
The graphs say local time; I interpreted that to mean ip-address local time.
Re:Seven habits of highly fraudulent users
by true_religion on Thursday July 31, 2014 @06:25PM
(#8117377)
It may just be that they use US proxies. I did when I was overseas.
The "outside of business hours" explanation is still a valid explanation but definitely not the whole story. Overall, I'd caution that when building fraud detection models understanding the stories behind the data is extremely important, or you risk having an algorithm that works for the wrong reasons.
For example, if suddenly your user base because more international (for example if you start allowing non-US users to use your website), you'll suddenly have a lot of false positives if you're not cautious because to your system it'll look like they're "operating outside of business hours".