IRIS core functions are:

• Assessment and interception of fraudulent transactions in real-time
• Case investigation, employing a built-in workflow engine
• Sophisticated analytics, including:
  
  • Fully automatic and user assisted generation of decision models
  • Simulation of fraud countermeasure efficiency
  • Fraud and risk control specific statistics
• Management reporting

These functions are delivered by a number of software modules, all built around IRIS’ central Real-Time Data Management Core.

IRIS' strength comes from what it does not have:

• It does not have a relational database system
• It does not rely on an application server or middleware
• It dos not use high-level programming languages

Instead, what IRIS does have is high performance and lightweight. Its data management core performs all transaction data handling, and has been optimized for real-time transaction processing and data analysis in 24*7 environments.

IRIS responds to up to 10,000 authorisation requests per second “in flight”, with latency of a few milliseconds. In the simulation environment, a full simulation of a fraud countermeasure with multiple hundred million transactions is performed in just minutes (in a typical card issuing fraud application).

At the same time, these performance figures are achieved on standard hardware, and cluster functionality for high availability setups is built-in.

Each active fraudster constitutes a major potential threat to your profitability and reputation. The longer the fraudster can operate undetected, the more damage can be inflicted on your business. Hence, it is crucial to detect and stop fraudulent activities as soon as possible.

The largest savings related to fraud prevention are realised by intercepting an illicit authorisation request in “true” real-time, frequently referred to as “in-flight”. In other words, before the money is lost. This necessitates the recognition and blocking of the first of a series of damaging fraudulent transactions, before the initial monetary loss has occurred.

Each instance of IRIS delivers up to 10,000 authorisation requests per second “in flight”. “In-flight” real-time operation is the key to preventing – rather than only detecting – fraud. All IRIS decisions are computed in real-time (typically in a few milliseconds), allowing for in-flight integration into the authorisation process without any noticeable impact on response times.

Any fraud countermeasures must be thoroughly tested before they are activated to verify their effectiveness, and to avoid unnecessary customer disruptions.

A fraud prevention system can only be truly controlled if its performance can be analysed in detail during operations. Only constant monitoring of the efficiency of the fraud prevention processes, and the ability to adapt decision models on a same-day basis, allows you to keep tight control.

IRIS provides a complete simulation environment that enables fraud analysts to tightly control risk and fraud. Interactive simulation technology guides fraud analysts through decision model generation. The effects of all potential changes are instantly visible, enabling fraud analysts to "feel" the effects of such changes immediately.

In addition to interactive decision model generation, this approach also features a “fully auto” mode that creates complete decision models from scratch or optimises existing ones.

The simulation functionality makes use of past transaction data stored in IRIS. At the same time, this functionality is independent of production operation and does not interfere with transaction processing performed by the Real-Time Service.

Decision-making processes can be configured extremely flexibly with IRIS. In typical fraud prevention scenarios, IRIS will decide in real-time whether to authorise or decline a transaction, or to refer it for manual authorisation.

IRIS can also generate investigation cases and features a complete case management workflow supporting all required business processes. Cases are generated on alarms that the Real-Time Service creates based on evaluating each transaction during real-time processing.

The first step of the IRIS case investigation workflow is to consolidate multiple alarms into a single case. This avoids multiple investigators working in parallel on alarms that actually belong to the same account. Cases are sorted by IRIS into queues. Different queues can be defined, for instance representing different suspected fraud patterns and also for special purposes (VIPs etc). Within a queue, cases are associated with a score that expresses the importance (and profitability) of the investigation of the case concerned. In their queues, cases are sorted by this score to ensure that investigators are always directed to those cases in which their effort is most likely to stop further fraud losses.

IRIS case investigation also comes with fully configurable support workflows for these business processes. This includes full audit trails that not only provide complete documentation on how the case was investigated, but also ensure that, if another investigation case deals with the same circumstances at a later date, the earlier information is automatically made available to the investigator. In addition, the case management tool supports collaboration between investigators, thereby supporting the organisation of fraud management.

Within the case management workflow, it is possible to define precisely which data is to be assimilated into the case investigation report used by the investigator during his work. This data may include, for example, the transaction history and account holder data for the transaction that triggered the case, as well as a detailed listing of the decision logic rules and patterns applied.

How much fraud have we stopped? Are our fraud investigators working efficiently? How many transaction does the system currently process? Is all batch data coming in regularly?

IRIS provides widely configurable management reports and dashboard type views that answer such typical questions arising during day-to-day operations.

In addition, if pre-defined thresholds are hit, the system can generate notfications as emails or text messages.