Suspicious Activity Risk Scores (flags) are calculated based on a weight divisor assigned to each type of risk. That divisor (shown in square brackets for each item below) is an assessment of how many same-sized risks would together make an account or transaction suspicious -- a higher divisor means less risk. Risk factors with a negative divisor (shown in green) are mitigating.
Risk scores are then proportional to the sum of the inverses of those weight divisors - a higher score means more risk. For transactions, the score is further multiplied by the transaction amount and divided by the "unusually large" threshold, set VERY conservatively to $200. All risk scores are finally multiplied by 100 and rounded to the nearest integer. So 100 is the minimum "suspicious" score.
For example, a $300 transaction with two risk factors having weight divisors of 3 and 5 respectively, would be scored as FLOOR ( (⅓ + ⅕) * (300 / 200) * 100 ) = 80 (asterisk here means multiply, slash means divide).
| adminOk | [-0.3] | A Common Good community administrator says this account is low risk (flag set by administrator). |
| trusted | [-4] | Has access to, was invited by, or is proxy to, other account(s) in good standing. This risk factor is multiplied by the number of other accounts that trust this member. Being chosen as an alternate proxy counts as half. Likewise being chosen as someone's proxy's proxy counts as half. |
| hasBank | [-3] | Has a connected bank account. |
| geography | [4] | Resides in a High Intensity Drug Trafficking Area. Federal and state law enforcement agencies have identified 28 High Intensity Drug Trafficking Areas (HIDTAs), which include 16 percent of all counties in the United States and 60 percent of the U.S. population. For example, Washtenaw County, Michigan has been designated as part of the Michigan HIDTA. Unfortunately, since such a high proportion of the U.S. population lives in these areas, the risk weight here is very low, for practical reasons. |
| cashCo | [2] | Is a type of business that has been identified by regulators as high risk (flag set by administrator). |
| new | [5] | Recently moved to current address (before opening a Common Good account). This risk factor is divided by the number of years the member (individual or company) has been at its current address. |
| moves | [3] | Has changed counties several times in the past decade. This risk factor is multiplied by the number of times the member has moved, over the past decade (if known) |
| rents | [10] | Rents (rather than owns) a residence. |
| badConx | [2] | Has access to, or was invited by, other suspicious account(s). This risk factor is multiplied by the number of such connections. |
| homeCo | [20] | An individual account has the same postal address as this company account. |
| shady | [3] | A web search for this individual or company produces sketchy results (flag set by administrator). |
| miser | [5] | Contributed an unusually small amount to support administration and promotion of Common Good. |
| addrOff | [5] | Address does not match address on photo ID (flag set by administrator) or cannot be verified by geocoding. |
| ssnOff | [1] | Something is awry in the account's social security number lookup (flag set by administrator). |
| dobOff | [4] | Member's birth date could not be confirmed or is at odds with social security number lookup data. |
| poBox | [5] | Postal address is a post box. |
| fishy | [2] | Something just seems a little off (flag set by administrator on intuition). |
| moreIn | [2] | Recipient has received 20% more than usual over the past seven weeks. |
| moreOut | [2] | Payer has spent 20% more than usual over the past seven weeks. |
| bigDay | [1] | Has an unusually large transaction volume per employee (in the top 5% of all participants) over the past day. For individual accounts, the number of "employees" is 1. |
| bigWeek | [1] | Has an unusually large transaction volume per employee (in the top 5% of all participants) over the past week. (see bigDay) |
| big7Week | [1] | Has an unusually large transaction volume per employee (in the top 5% of all participants) over the past 52 days (about 7 weeks). (see bigDay) |
| bigYear | [2] | Has an unusually large transaction volume per employee (in the top 5% of all participants) over the past year. (see bigDay) |
| txAdminOk | [-0.3] | A Common Good community administrator says this transaction is low risk. |
| redo | [2] | The transaction reverses another transaction that itself reversed a transaction.. |
| exchange | [2] | A member trades cash for another member's Common Good credit. |
| cashIn | [5] | A member trades cash for a company's Common Good credit. |
| cashOut | [2] | A member trades Common Good credit for a company's cash. |
| fromBank | [5] | Transfers funds from a bank account to a Common Good account. |
| toBank | [2] | Transfers funds from a Common Good account to a bank account. |
| b2p | [2] | A company pays an individual who is not an employee. |
| p2p | [2] | An individual member pays another individual member. |
| inhouse | [2] | An employee, owner, or consultant pays the company. |
| fromSuspect | [3] | A suspicious account pays out. This risk factor is multiplied by the suspicious account risk, divided by the "unusually large" threshold: $200. |
| toSuspect | [3] | A suspicious account receives funds. This risk factor is multiplied by the suspicious account risk, divided by the "unusually large" threshold: $200. |
| absent | [4] | Transaction by web browser (not in-person). |
| invoiceless | [4] | Company pays a supplier or consultant without mention of an invoice. And no mention of an invoice in the transaction description. |
| bigFrom | [3] | An unusually large expenditure by this payer (in the top 10% over the past seven weeks). |
| biggestFrom | [3] | The largest single expenditure by this payer over the past seven weeks. |
| oftenFrom | [3] | Recipient has received unusually many payments from this payer over the past seven weeks. |
| bigTo | [3] | An unusually large payment to this recipient (in the top 10% over the past seven weeks). |
| biggestTo | [3] | The largest single payment to this recipient over the past seven weeks. |
| oftenTo | [3] | Payer has made unusually many payments to this recipient over the past seven weeks. |
| offline | [10] | Payment was taken offline (without an internet connection). |
| firstOffline | [3] | Payment was taken offline, with no photo verification. |
| origins | [16] | Receipts by this payer over the past year are suspicious in aggregate. This risk factor is multiplied by the average risk of the payer's receiving transactions over the past year. |
| suspectOut | [2] | A suspicious account trades Common Good credit for US Dollars. This risk factor is multiplied by the suspicious account risk, divided by the "unusually large" threshold: $200. |