Two-Way Messaging Service for Payment Risk Platform

👍

Availability

This product is accessible to all financial institutions, whether you manage your own fraud policy or use SoFi Tech Solutions' managed services.

Use the Two-Way Messaging Service for the Payment Risk Platform (PRP) to help reduce fraud losses by automatically contacting cardholders via SMS about suspicious transactions. This allows cardholders to confirm a transaction's legitimacy in near real-time, delivering a clear signal for you to take immediate, automated action.

While PRP's advanced AI/ML capabilities provide real-time fraud detection, the best predictions benefit from this kind of direct feedback. Without it, legitimate transactions that are correctly flagged as high-risk could be declined simply because the cardholder had no way to validate them. Gathering this feedback also helps train the AI/ML model, improving PRP's fraud detection over time.

Benefits

• Reduce false declines — Retain interchange revenue and improve the cardholder experience by verifying and approving legitimate transactions that PRP might have declined otherwise.
• Build cardholder trust — Protect your customers from potential fraud with transparent, real-time communication about suspicious activity on their account.
• Improve fraud-model accuracy — Create a direct feedback loop that helps train and improve the SoFi Tech Solutions transaction risk score (GScore) and its fraud-risk decisions.
• Automate your fraud response — Initiate SMS alerts automatically based on PRP fraud detection and process cardholder responses in near real-time.
• Enable a quick implementation — Add an industry-standard fraud-response solution to your PRP setup.

Cardholder experience

When PRP flags one of your cardholder's transactions as suspicious, the cardholder receives an immediate, clear two-way SMS alert asking them to confirm whether they attempted the transaction. This direct communication allows the cardholder to instantly validate a legitimate purchase or report actual fraud, giving them peace of mind and a quick path to resolution.

Use cases

The primary use case is to verify suspicious transactions directly with the cardholder, allowing for immediate action on potentially fraudulent activity and quick resolution for legitimate purchases.

Use case 1: Legitimate purchase

When a cardholder attempts a large, unusual online purchase, PRP flags the transaction as high risk and declines it. The cardholder immediately receives a two-way SMS alert asking to verify the purchase. After they reply "YES," the system temporarily allows the authorization and sends a follow-up SMS asking them to retry the transaction. The PRP then approves the cardholder's second attempt.

Use case 2: Fraudulent attempt

When a fraudster attempts an online purchase with stolen card details, PRP flags the transaction as high risk and declines it. The legitimate cardholder, who did not make the purchase, receives an unexpected SMS about the attempt. They reply "NO," and the SoFi Tech Solutions instantly freezes the card to prevent any further fraudulent activity.

Decisions to make

As part of the implementation process, work with SoFi Tech Solutions to make the following key decisions for your program:

• Obtaining consent — You are responsible for obtaining and managing prior expressed consent from your cardholders to receive automated fraud alerts via SMS. This alert is strictly for fraud prevention and is not for marketing activities. Use the Set Account Feature endpoint to register the decision.
• Providing data — You must provide the cardholder's first and last name and a valid phone number where they receive alerts.
• Defining your SMS policy — As part of the setup process, work with SoFi Tech Solutions to define your SMS policy. This policy specifies which PRP fraud rules trigger an alert, the automated actions for each cardholder response (including a lack of response), and the content of any follow-up messages.
• Approving message templates — Review and approve the standard message templates used for alerts to ensure clarity and compliance with your program's standards.

Workflow

This sequence describes the complete two-way messaging process from fraud detection to resolution.

1. The cardholder opts-in to receiving the SMS messages. You send a Set Account Feature call with these settings:
   • featureType: 35
   • featureValue: Y
2. The cardholder initiates a transaction with a merchant.
3. SoFi Tech Solutions checks the transaction against fraud rules:
   • No fraud-rule violation — SoFi Tech Solutions sends you the BAUT: auth event, which means the transaction was approved as usual.
   • One or more fraud-rule violations — SoFi Tech Solutions sends you the DAUT: denied_auth event. The rules_results field contains the action determined by PRP:
     • deny — Suspected fraud.
     • warn — Flagged as suspicious.
     • deny_freeze — Suspected fraud, card is frozen and the FRZN: frozen event is sent to your system.
4. Following the fraud trigger, SoFi Tech Solutions sends a two-way SMS alert to the cardholder to verify the transaction. The system then waits for a preconfigured amount of time for a response from the cardholder:
   • YES or NO – SoFi Tech Solutions receives the response and performs these actions:
     • Updates the internal blocklist or allowlist and calls the Add Customer Note endpoint to add a customer note in the CST
     • Sends the NOTE: note event to your system.
     • Sends the prp_sms_suspicious_txn_alert event to your system via the Events API webhook.
   • No response — SoFi Tech Solutions initiates your preconfigured follow-up action, such as sending a second SMS or removing a temporary block.