RFC 5941
Sharing Transaction Fraud Data
Okay bestie, welcome to RFC 5941! 💖 It's called Sharing Transaction Fraud Data and it's basically a blueprint for how banks, merchants, and law enforcement can swap fraud intel without everyone speaking a different language. 🦋
The title block says it was written by D. M'Raihi (VeriSign), S. Boeyen (Entrust), M. Grandcolas (Grandcolas Consulting, LLC), and S. Bajaj (VeriSign). It's Informational (not a standard, just here to share knowledge 🧚), it's dated August 2010, and its ISSN is 2070-1721. The title block doesn't list anything it obsoletes or updates. ✨
Abstract
This doc describes a document format for exchanging transaction fraud (Thraud) information. It extends the Incident Handling Working Group (INCH WG) Incident Object Description Exchange Format (IODEF) incident reporting document format. 🎀
Status of This Memo
Okay so, this one is not an Internet Standards Track spec. It's published for informational purposes only. 📚
It is a product of the Internet Engineering Task Force (IETF), so it represents the consensus of the IETF community. It got public review and was approved for publication by the Internet Engineering Steering Group (IESG). Not every IESG-approved doc is a candidate for any level of Internet Standard, see Section 2 of RFC 5741. 💅
If you want the current status, any errata, or a way to send feedback, check http://www.rfc-editor.org/info/rfc5941. 🌸
Copyright Notice
Copyright (c) 2010 IETF Trust and the persons identified as the document authors. All rights reserved. ⭐
This doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as in effect on the date of publication. Please actually read these, because they spell out your rights and restrictions for this document. 🙈 Code Components pulled out of this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions, and they come without warranty as described in the Simplified BSD License. 🫶
Table of Contents
1. Introduction ....................................................4
2. Requirements Terminology ........................................5
3. Anatomy of a Transaction Fraud ..................................6
4. IODEF-Document Incident Class ...................................7
5. Thraud Record Class Definitions .................................8
5.1. FraudEventPaymentType Class ................................9
5.1.1. PayeeName ..........................................10
5.1.2. PostalAddress ......................................10
5.1.3. PayeeAmount ........................................10
5.2. FraudEventTransferType Class ..............................10
5.2.1. BankID .............................................11
5.2.2. AccountID ..........................................12
5.2.3. AccountType ........................................13
5.2.4. TransferAmount .....................................13
5.3. FraudEventIdentityType Class ..............................13
5.3.1. IdentityComponent ..................................13
5.4. FraudEventOtherType Class .................................14
5.4.1. OtherEventType .....................................15
5.4.2. OtherEventDescription ..............................15
5.5. AmountType Class ..........................................15
5.5.1. Class Contents .....................................15
5.5.2. Currency ...........................................15
5.6. AccountTypeType Class .....................................16
6. IODEF Profile for an Activity Thraud Report ....................16
6.1. Mandatory Components ......................................16
6.2. Recommended Components ....................................17
6.3. Deprecated Components .....................................17
7. IODEF Profile for a Signature Thraud Report ....................19
8. IODEF Additional Attribute Values ..............................19
8.1. Purpose Attribute .........................................19
9. Security Considerations ........................................19
10. IANA Considerations ...........................................21
10.1. Media Sub-Type ...........................................21
10.2. XML Namespace ............................................22
11. Conclusion ....................................................22
12. References ....................................................22
12.1. Normative References .....................................22
12.2. Informative References ...................................23
Appendix A. Thraud Record XML Schema...............................24
Appendix B. Example of a Thraud Report.............................261. Introduction ✨
Financial orgs and merchants that let people use their services online keep running into fraud aimed at their customers' accounts. 😤 To fight it, those orgs and their law enforcement agencies could get a LOT out of sharing intel about fraud incidents and patterns with similar orgs and agencies. This spec standardizes a document format so they can do exactly that. It's meant to make multi-vendor interoperability possible between conformant components of an open fraud reporting framework. 🔥
Info sharing can happen directly between financial orgs and merchants. BUT the power of shared intel multiplies big time when the info is gathered from multiple sources by a shared network, consolidated, and redistributed to participants. 👑
In this setup, incident reports sent to the network are called "inbound reports", and reports the network puts out are called "outbound reports". 🦋
Inbound reports get submitted with a push-style protocol, like email or the Simple Object Access Protocol (SOAP). Outbound reports can be distributed with either a push-style protocol or a request/response protocol, like HTTP. 🌈
Inbound reports identify the contributor, and that matters because it's how you judge how good the info is and how you reach the source to ask questions. 🧐 Outbound reports usually don't name the original sources, though, because those sources might not want to be identified to other subscribers. Such reports should, instead, identify the consolidator as the source. 🫶
A report can describe a particular transaction that is known to be fraudulent, or believed to be. It can also describe a pattern of behavior that's believed to point to fraud. The first kind is an "activity report" and the second is a "signature report". 💜
The schema defined here extends the IODEF XML incident reporting schema [RFC5070]. 🍓
Here's the roadmap. Section 3 introduces the actors in a typical transaction fraud. Section 4 covers fraud reporting using an IODEF-Document. Section 5 defines the elements of a Thraud Report. Section 6 describes the Activity Thraud Report profile of the IODEF specification, and Section 7 describes the profile for a Signature Thraud Report. Section 8 defines new attribute values for the IODEF Incident class. Security considerations are in Section 9. Section 10 has the IANA considerations about registering the associated media sub-type and XML namespace identifier. The Appendices hold the complete XML schema and a sample Thraud Report. 📚
Data elements in this document are expressed in Unified Modeling Language (UML) syntax [UML]. 🧩
XML namespace prefixes are used throughout this document to stand for their respective XML namespaces, as follows. 💅
iodef: urn:ietf:params:xml:ns:iodef-1.0
thraud: urn:ietf:params:xml:ns:thraud-1.0
xs: http://www.w3.org/2001/XMLSchema
xsi: http://www.w3.org/2001/XMLSchema-instance2. Requirements Terminology 🎀
Okay, the key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [RFC2119]. These are the official requirement words, so read them exactly as written. 🙏
3. Anatomy of a Transaction Fraud 🕵️♀️✨
okay so, here's the cast of characters in a typical transaction fraud, and it is giving drama 🎭 Check out Figure 1:
+--------------------------------------+
| Fraudsters |
| (collect & verify victim credentials |
| via phishing, malware, etc.) |
+--------------------------------------+
|
|recruit
|
| ----------------disburse profits-----------------
| | |
v v |
+-----------+ +--------------+ +-------+
| | | | | Fraud |
| |--Open Dest Acct-->| Financial |---->| Dest. |
| | | Organization | |Account|
| Fraud | +--------------+ +-------+
| Executors | ^ funds
| | | transfer
| | +--------------+ +-------+
| | | Victim's | | |
| |---Init Transfer-->| Financial |<-o--|Victim |
| | | Organization | | |Account|
+-----------+ +--------------+ | +-------+
v
+-----------+
| Fraud |
| Detection |
| Sensors |
|(realtime/ |
| offline) |
+-----------+
Figure 1. Transaction Fraud ElementsTransaction fraud usually has these actors 👀:
- Fraudsters 😈: the folks who collect victims' login credentials by any means they can, like phishing and malware, and then check that the creds work (usually by trying to log in to the victim's account). After that, the Fraudsters can either recruit Fraud Executors themselves, or sell the victims' credentials in bulk to other Fraudsters, who then go recruit Fraud Executors. Wild, right? 💀
- Fraud Executors 🏃♀️: the people who actually attempt the fraudulent funds transfer or payment. For fraudulent funds transfers, a destination account gets opened at either the same financial organization as the victim or a different one. Or, alternatively, the fraudulent payment is made using a check or an electronic transfer. 💸
- Victims 🥺: the people who get hit by both credential theft and transaction fraud. Not fair at all 💔
- Financial organizations 🏦: the banks (or similar) that hold the victim's account and the Fraud Executor's account.
- Sensors 📡: the detection systems at the financial organization that catch fraudulent transaction attempts, either in real time or after the fact.
Thraud reporting exists so that any organization that has spotted fraud can share that info, either inside its own walls or with other organizations that might be next on the list 🫶 The receiving organization can use the info in all sorts of ways. For example, it can set up manual review of transactions coming from suspicious IP addresses 🔍✨
4. IODEF-Document Incident Class 📋
A Thraud Report SHALL be an instance of the IODEF-Document class, as defined in [RFC5070]. The report SHALL contain at least one Incident object, as defined in [RFC5070]. Each Incident object SHOULD contain information about a single fraud strategy 🎯 One Incident object MAY contain information about multiple fraudulent transactions that match the same fraud strategy. Each fraudulent transaction SHALL be described in a separate EventData object. The data model for the Incident class is defined in [RFC5070], and it's repeated here as Figure 2, just for your viewing pleasure 🥰
+-------------+
| Incident |
+-------------+
|ENUM |<>----------[ IncidentID ]
| purpose |<>--{0..1}--[ AlternativeID ]
|STRING |<>--{0..1}--[ RelatedActivity ]
| ext-purpose |<>--{0..1}--[ DetectTime ]
|ENUM |<>--{0..1}--[ StartTime ]
| lang |<>--{0..1}--[ EndTime ]
|ENUM |<>----------[ ReportTime ]
| restriction |<>--{0..*}--[ Description ]
| |<>--{1..*}--[ Assessment ]
| |<>--{0..*}--[ Method ]
| |<>--{1..*}--[ Contact ]
| |<>--{1..*}--[ EventData ]<>--[ AdditionalData ]
| |<>--{0..1}--[ History ]
| |<>--{1..*}--[ AdditionalData ]
+-------------+
Figure 2. Data Model of the Incident ClassThe AdditionalData abstract class is an extension point in the schema of the EventData class 🧩 Implementers SHALL include exactly one of these objects in AdditionalData: FraudEventPayment, FraudEventTransfer, FraudEventIdentity, or FraudEventOther. Together, these are called Thraud Records ✨ The matching classes are defined by this spec in Section 5, down below 👇
The Thraud profile of the Incident class is defined in Sections 6 and 7, down below too 💖
5. Thraud Record Class Definitions 💅
Thraud Records are written in XML, so the dtype attribute of the AdditionalData element SHALL be given the value "xml" 🌸
A payment Thraud Record SHALL be structured as shown in Figure 3. See also Section 5.1.
+------------------+
| AdditionalData |
+------------------+
| ENUM dtype (xml) |<>-----[ FraudEventPayment ]
+------------------+
Figure 3. The FraudEventPayment ExtensionA funds-transfer Thraud Record SHALL be structured as shown in Figure 4. See also Section 5.2.
+------------------+
| AdditionalData |
+------------------+
| ENUM dtype (xml) |<>-----[ FraudEventTransfer ]
+------------------+
Figure 4. The FraudEventTransfer ExtensionAn identity Thraud Record SHALL be structured as shown in Figure 5. See also Section 5.3.
+------------------+
| AdditionalData |
+------------------+
| ENUM dtype (xml) |<>-----[ FraudEventIdentity ]
+------------------+
Figure 5. The FraudEventIdentity ExtensionOther Thraud Records SHALL be structured as shown in Figure 6. See also Section 5.4. The FraudEventOther class has an open definition, so it can act as a placeholder for event types that show up in the future 🔮
+------------------+
| AdditionalData |
+------------------+
| ENUM dtype (xml) |<>----[ FraudEventOther ]
+------------------+
Figure 6. The FraudEventOther Extension5.1. FraudEventPaymentType Class 💳
The FraudEventPaymentType class is used to report the payee instructions for a fraudulent payment or a fraudulent payment attempt. Fraudsters sometimes reuse the same payee instructions (amount included) across several fraudulent payment attempts 🙄 By reporting the payment instructions used in the fraud, other organizations may be able to catch similar fraudulent payment attempts going to the same payee 🕵️♀️
The structure of the FraudEventPaymentType class SHALL be as shown in Figure 7.
+-------------+
| FraudEvent- |
| PaymentType |
+-------------+
| |<>--{0..1}--[ PayeeName ]
| |<>--{0..1}--[ PostalAddress ]
| |<>--{0..1}--[ PayeeAmount ]
+-------------+
Figure 7. The FraudEventPaymentType ClassHere's what's inside the FraudEventPaymentType class. At least one component MUST be present 🫵
5.1.1. PayeeName 🧾
Zero or one value of type iodef:MLString. This is the name of the payee.
5.1.2. PostalAddress 📮
Zero or one value of type iodef:MLString. The format SHALL be as documented in Section 2.23 of [RFC4519], which defines a postal address as a free-form multi-line string separated by the "$" character 🫠
5.1.3. PayeeAmount 💰
Zero or one value of type thraud:AmountType. See Section 5.5.
5.2. FraudEventTransferType Class 🏧
The FraudEventTransferType class is used to report the payee instructions for a fraudulent funds transfer or a fraudulent funds transfer attempt. Fraudsters sometimes reuse the same payee instructions (amount included) across several fraudulent funds transfer attempts 😤 By reporting the funds transfer instructions used in the fraud, other organizations may be able to catch similar fraudulent funds transfer attempts going to the same payee 💜
The structure of the FraudEventTransferType class SHALL be as shown in Figure 8.
+--------------+
| FraudEvent- |
| TransferType |
+--------------+
| |<>--{0..1}--[ BankID ]
| |<>--{0..1}--[ AccountID ]
| |<>--{0..1}--[ AccountType ]
| |<>--{0..1}--[ TransferAmount ]
+--------------+
Figure 8. The FraudEventTransferType ClassThe contents of the FraudEventTransferType class are described below. At least one component MUST be present 🎀
5.2.1. BankID 💳
okay bestie, so BankID is zero or one value of type thraud:BankIDType 💖 The BankIDType class SHALL look exactly like Figure 9 ✨ The contents SHALL be xs:string, and the namespace attribute SHALL be xs:anyURI and SHALL name the numbering system used to identify the bank or account 🏦
+-------------------+
| BankIDType |
+-------------------+
| STRING |
| |
| STRING namespace |
+-------------------+
Figure 9. The BankIDType Classthe registered namespace identifiers live in one place, and it's this link: http://www.openauthentication.org/thraud/resources/bank-id-namespace.htm 🔗
these are the namespace attribute values that are registered, and what each one means:
🇺🇸 One of the nine-digit Routing Numbers registered to the financial organization holding the account, as administered by The American Bankers Association.
🇨🇦 The three-digit Institution Number registered to the financial organization holding the account, as administered by The Canadian Payments Association.
🌍 this one is a little different! The matching AccountID holds the ISO 13616 International Bank Account Number [ISO13616-1:2007] in the "electronic form" (aka containing no spaces) that's assigned to the account, as administered by the Society for Worldwide Interbank Financial Telecommunication (SWIFT). The matching BankID xs:string value SHOULD be set to the null string. Receiving organizations SHOULD ignore the matching BankID value 🙈
http://www.openauthentication.org/thraud/resources/bank-id-namespace.htm#iso13616_1_2007
🏛️ The eight-character Bank Identifier Code [ISO9362:1994] registered to the financial organization holding the account, as administered by SWIFT.
http://www.openauthentication.org/thraud/resources/bank-id-namespace.htm#iso9362_1994
other namespace values MUST be agreed upon among participants 🤝 If you want to register a new one, requests SHOULD be made here:
http://www.openauthentication.org/thraud/form/bank-id-namespace
heads up, the tea ☕ one organization can be identified by more than one value for any one or more of these namespaces. So receiving organizations SHOULD take this into account in their matching procedure 👀
5.2.2. AccountID 🧾
zero or one value of type xs:string 🌸 This is the destination primary account number, as administered by the financial organization named in the BankID element. If the BankID namespace attribute value is "iso13616_1_2007", this element SHALL contain the International Bank Account Number in the "electronic form" (containing no spaces) that's assigned to the account. In all other cases, the element SHALL contain only the account number, as administered by the financial organization holding the account. The reporting organization SHALL remove all prefixes that identify the country, bank, or branch 💅
5.2.3. AccountType 🪪
zero or one value of type thraud:AccountTypeType. See Section 5.6.
5.2.4. TransferAmount 💸
zero or one value of type thraud:AmountType. See Section 5.5.
5.3. FraudEventIdentityType Class 🎭
the FraudEventIdentityType class is for reporting a fraudulent impersonation, or an attempt at one 🕵️♀️ Reporting the impersonation helps other potential victims spot similar fraudulent impersonation attempts, which is so considerate of you 🫶
The structure of the FraudEventIdentityType class SHALL be as shown in Figure 10.
+--------------+
| FraudEvent- |
| IdentityType |
+--------------+
| |<>--{1..*}--[ IdentityComponent ]
+--------------+
Figure 10. The FraudEventIdentityType Classthe contents of the FraudEventIdentityType class are described below 👇
5.3.1. IdentityComponent 🧩
One or more values of type iodef:ExtensionType. This specification defines two extensions: EmailAddress and UserID ✨
5.3.1.1. EmailAddress 📧
when you're reporting an identity fraud event, the reporting institution MAY include the victim's email address 💌 This SHALL be done by putting an object of type iodef:Email in the IdentityComponent object. It SHALL contain the email address of the intended fraud victim.
The IdentityComponent.dtype attribute SHALL be set to the value "string".
The IdentityComponent.meaning attribute SHALL be set to the value "victim email address".
5.3.1.2. UserID 🆔
when you're reporting an identity fraud event, the reporting institution MAY include the victim's user identifier 🫧 This SHALL be done by putting an object of type iodef:ExtensionType in the IdentityComponent object. The data type of the extension contents SHALL be xs:string. It SHALL contain the user identifier of the intended fraud victim.
The IdentityComponent.type attribute SHALL be set to the value "string".
The IdentityComponent.meaning attribute SHALL be set to the value "victim user id".
5.4. FraudEventOtherType Class 🎁
the FraudEventOtherType class SHALL be used for reporting fraudulent events that aren't covered above 🌈 That includes brand new event types that might show up someday in the future. This class lets you report those events under this specification, even if nobody has formally pinned down their characteristics yet. Sharing the details of these unspecified event types can help other institutions catch similar fraudulent activity 🦋
The structure of the FraudEventOtherType class SHALL be as shown in Figure 11.
+-------------+
| FraudEvent- |
| OtherType |
+-------------+
| |<>----------[ OtherEventType ]
| |<>--{0..1}--[ PayeeName ]
| |<>--{0..1}--[ PostalAddress ]
| |<>--{0..1}--[ BankID ]
| |<>--{0..1}--[ AccountID ]
| |<>--{0..1}--[ AccountType ]
| |<>--{0..1}--[ PayeeAmount ]
| |<>--{0..1}--[ OtherEventDescription ]
+-------------+
Figure 11. The FraudEventOtherType Classlots of the components in the FraudEventOtherType class are also in the FraudEventPaymentType or FraudEventTransferType classes 🍓 They work exactly the same way in this class as they do in those, so we're not repeating the descriptions. Only the components that are unique to FraudEventOtherType get explained below 🧠
5.4.1. OtherEventType 🏷️
One value of type xs:anyURI. A name that classifies the event.
A list of registered "other event type" identifiers is maintained at:
http://www.openauthentication.org/thraud/resources/other-event-type.htm
Requests to register new values SHOULD be made at:
http://www.openauthentication.org/thraud/form/other-event-type
5.4.2. OtherEventDescription 📝
Zero or one value of type iodef:MLString. A free-form textual description of the event 💬
5.5. AmountType Class 💰
The AmountType class SHALL be as shown in Figure 12. It SHALL be used to report the amount of a payment or transfer fraud 🤑
+------------------+
| AmountType |
+------------------+
| DECIMAL |
| |
| STRING currency |
+------------------+
Figure 12. The AmountType Classthe contents of the AmountType class are described below 💖
5.5.1. Class Contents 🧮
REQUIRED DECIMAL. The amount of the payment or transfer.
5.5.2. Currency 🌎
REQUIRED STRING. The three-letter currency code [ISO4217:2008].
5.6. AccountTypeType Class 🏦
The AccountTypeType class SHALL be as shown in Figure 13. It SHALL be used to report the type of the destination account ✨
+-----------------+
| AccountTypeType |
+-----------------+
| STRING |
| |
| STRING lang |
+-----------------+
Figure 13. The AccountTypeType ClassReceiving organizations MUST be capable of processing contents containing spelling variations. 🙌 typos and creative spellings are going to happen, so be ready for them 💅
6. IODEF Profile for an Activity Thraud Report ✨
this section describes the profile of the IODEF Incident class for a compliant Activity Thraud Report 🦋
6.1. Mandatory Components 🚨
A Thraud Report SHALL conform to the data model specified for an IODEF-Document in [RFC5070]. The following components of that data model, even though they're optional in IODEF, are REQUIRED in a conformant Thraud Report 📋
Receiving organizations MAY reject documents that don't contain all of these components. So reporting organizations MUST populate them all 🫡
Except where noted, these components SHALL be interpreted as described in [RFC5070] 📖
Incident.Contact.ContactName- The name of the reporting organization. If the reporting organization acts as a consolidator of reports from other organizations, elements of this class SHALL contain the name of the consolidator.Incident.Contact.Email- An email address at which the reporting organization can be contacted 📬Incident.Contact.TelephoneIncident.EventDataIncident.EventData.AdditionalData- SHALL contain exactly one Thraud Record. 🌟
6.2. Recommended Components 🌟
Receiving organizations SHOULD be capable of processing the following components. However, they MUST NOT reject documents because they are either present or absent 🥰
If they're available, reporting organizations SHOULD include these components in Thraud Reports. Except where noted, these components SHALL be interpreted as described in [RFC5070] 💜
Incident.Contact.ContactIncident.Contact.Contact.ContactName- The name of the reporting fraud analyst.Incident.Contact.Contact.Email- The email address of the reporting fraud analyst.Incident.Contact.Contact.Telephone- The telephone number of the reporting fraud analyst.Incident.EventData.MethodIncident.EventData.Method.DescriptionIncident.Assessment.ConfidenceIncident.Assessment.ImpactIncident.Assessment.MonetaryImpactIncident.EventData.DetectTimeIncident.EventData.StartTimeIncident.EventData.EndTimeIncident.EventData.FlowIncident.EventData.Flow.SystemIncident.EventData.Flow.System.ServiceIncident.EventData.Flow.System.Node.NodeNameIncident.EventData.Flow.System.Node.Address
6.3. Deprecated Components 🥀
okay so this list is the "we're not really sure what to do with these" zone 💀. This profile gives receiving organizations zero guidance on how to process the components below, so the reporting org has no assurance the receiver will handle them properly. That means they SHOULD NOT include them in a Thraud Report. BUT, and this is the iconic part 🫶, receiving organizations MUST NOT reject reports that do contain these components.
Incident.DetectTime
Incident.AlternativeID
Incident.RelatedActivity
Incident.StartTime
Incident.EndTime
Incident.ReportTime
Incident.Description
Incident.Method
Incident.History
Incident.AdditionalData
Incident.ext-purpose
Incident.IncidentID.instance
Incident.Contact.Description
Incident.Contact.RegistryHandle
Incident.Contact.PostalAddress
Incident.Contact.Fax
Incident.Contact.TimeZone
Incident.Contact.AdditionalData
Incident.Contact.Contact.Description
Incident.Contact.Contact.RegistryHandle
Incident.Contact.Contact.PostalAddress
Incident.Contact.Contact.Fax
Incident.Contact.Contact.TimeZone
Incident.Contact.Contact.AdditionalData
Incident.Contact.ext-role
Incident.Contact.ext-type
Incident.Contact.Contact.ext-role
Incident.Contact.Contact.ext-type
Incident.EventData.Method.Reference
Incident.EventData.Method.Reference.Description
Incident.EventData.Method.AdditionalData
Incident.EventData.Method.Reference.URL
Incident.Assessment.TimeImpact
Incident.Assessment.AdditionalData
Incident.Assessment.Impact.type
Incident.EventData.Description
Incident.EventData.Contact
Incident.EventData.Assessment
Incident.EventData.Expectation
Incident.EventData.Record
Incident.EventData.EventData
Incident.EventData.Flow.System.OperatingSystem
Incident.EventData.Flow.System.Counter
Incident.EventData.Flow.System.Description
Incident.EventData.Flow.System.AdditionalData
Incident.EventData.Flow.System.ext-category
Incident.EventData.Flow.System.Node.Location
Incident.EventData.Flow.System.Node.DateTime
Incident.EventData.Flow.System.Node.NodeRole
Incident.EventData.Flow.System.Node.Counter
Incident.EventData.Flow.System.Node.Address.ext-category
Incident.EventData.Flow.System.Service.ProtoType
Incident.EventData.Flow.System.Service.ProtoCode
Incident.EventData.Flow.System.Service.ProtoField
Incident.EventData.Flow.System.Service.Application7. IODEF Profile for a Signature Thraud Report ✨
A Signature Thraud Report SHALL convey information about the behavior linked to fraudulent events, rather than spelling out the details of the specific events themselves. 🔍
Sharing Signature Thraud Reports helps receiving organizations spot suspicious behavior in their own systems. 🦋
A Signature Thraud Report SHALL conform to the profile described in Section 6. 💅
8. IODEF Additional Attribute Values 💜
Additional IODEF attribute standard values are defined here. 🎀
8.1. Purpose Attribute 🌸
The following additional values are defined for the Incident.purpose attribute. Ngl, these are the three main vibes:
Add- The enclosed Thraud Record values SHOULD be added to the corpus by the receiving organization. ➕Delete- The enclosed Thraud Record types SHOULD be deleted from the corpus by the receiving organization. 🗑️Modify- The enclosed Thraud Record values SHOULD replace the corresponding values in the corpus. Where no corresponding types currently exist in the corpus, the enclosed values SHOULD be added to the corpus by the receiving organization. ✏️
9. Security Considerations 🔐😭
okay this section is serious, bestie, so pay attention 🙈. This document describes a document format for exchanging information about successful or attempted transaction and authentication fraud incidents. The info is meant to make participants' fraud detection and prevention programs work better. Those programs depend HEAVILY on the accuracy, reliability, confidentiality, and timeliness of both the information and the participants exchanging it. Threats to accuracy, reliability, and confidentiality include (but are not limited to) the ones described here.
Fraudsters may try to slip in reports that delete or modify incident information in the corpus. Therefore, origin authentication MUST be employed. Human review SHOULD be performed before any modifications are made to the corpus. 🚨
Fraudsters may try to interrupt or redirect submissions, which would stop fraud intel from being shared about their strategies. Therefore, authenticated receipts SHOULD be employed. 📬
Fraudsters may try to impersonate legitimate submitters, which would wreck their reputations and make their future submissions useless. Origin authentication MUST be used to make sure the sources of reports are properly identified. 🪪
Fraudsters who can view incident reports may adapt their strategies to avoid detection. Therefore, reports MUST be protected by confidentiality services, including transport encryption and access control. 🔒
To prevent inadvertent disclosure of incident data, incident reports SHOULD be encrypted while in storage. 🗄️
The submitter of an incident report may incorrectly identify legitimate activity as a fraud incident. This may lead to denial of service by a receiving organization that relies on the report or information derived from the report. Receiving organizations SHOULD operate a reputation service, in which the reliability of the information from particular sources is assessed and tracked, and subsequent reports are weighted accordingly. The source of reports MUST be authenticated. Receiving organizations SHOULD use reports to step up authentication assurance, rather than simply denying service. ⚠️
A receiving organization may misuse a Thraud Report to deny service, which causes a loss for a legitimate user. If such a user were to learn the identity of the source of the information that led to the denial of service, then that source may become implicated in any resulting claim for compensation. This, in turn, may discourage reporting organizations from taking part in intelligence sharing. Therefore, original sources SHOULD NOT be identified in consolidated reports. 🙅♀️
Any origin authentication and data integrity mechanism that is acceptable to both parties MAY be used. ✅
Any transport confidentiality mechanism that is acceptable to both parties MAY be used. ✅
This specification does not include a data compression technique. Therefore, it does not introduce any denial of service vulnerabilities related to decompression. 🧚
10. IANA Considerations 📝
This specification registers two identifiers:
- The media sub-type name "thraud+xml" in the standard registration tree. 🎀
- The xml namespace identifier - urn:ietf:params:xml:ns:thraud-1.0. 🌈
10.1. Media Sub-Type 🍓
Here's the registration template for the media sub-type, copied exactly:
Type name: application
Subtype name: thraud+xml
Required parameters: none
Optional parameters: "charset": same as the charset parameter of
application/xml, as specified in [RFC3023].
Encoding considerations: same as encoding considerations of
application/xml, as specified in [RFC3023].
Security considerations: in addition to the security considerations
described in Section 9, this registration has all of the security
considerations described in [RFC3023].
Interoperability considerations: None beyond the interoperability
considerations described in [RFC3023].
Published specification: the media type data format is defined in RFC
5941.
Applications that use this media type: transaction and authentication
fraud analysis and reporting applications, and risk-based
transaction and authentication evaluation applications.
Additional information
Magic number(s): none
File extension: .tfi
Macintosh file type codes: none
Person and email address to contact for further information:
"D M'Raihi <davidietf@gmail.com>"
Intended usage: LIMITED USE
Restrictions on usage: thraud media are intended for no usage other
than the exchange of fraud intelligence data.
Author: D M'Raihi
Change controller: the IESG10.2. XML Namespace 🧁
IANA has registered the xml namespace identifier. Here's the full record, verbatim:
IANA has registered the xml namespace identifier:
URI: urn:ietf:params:xml:ns:thraud-1.0
Registrant Contact:
Siddharth Bajaj
VeriSign, Inc.
487 E. Middlefield Road
Mountain View, CA 94043
USA
Email: sbajaj@verisign.com
XML: None. Namespace URIs do not represent an XML specification.11. Conclusion 🎉
This specification introduces a transaction fraud (Thraud) reporting document structure that enables the sharing of fraud data. Built on the IODEF-Document format, the proposed extension makes interoperability easier, which helps increase the security of online applications. It's giving secure-by-sharing energy ✨👑
12. References 📚
12.1. Normative References 💖
[ISO13616-1:2007] Financial services - International bank account
number (IBAN) -- Part 1: Structure of the IBAN,
ISO 13616-1:2007.
[ISO4217:2008] Financial services - Codes for the representation
of currencies and funds, ISO 4217:2008.
[ISO9362:1994] Banking -- Banking telecommunication messages --
Bank identifier codes, ISO 9362:1994.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC3023] Murata, M., St. Laurent, S., and D. Kohn, "XML
Media Types", RFC 3023, January 2001.
[RFC4519] Sciberras, A., Ed., "Lightweight Directory Access
Protocol (LDAP): Schema for User Applications",
RFC 4519, June 2006.
[RFC5070] Danyliw, R., Meijer, J., and Y. Demchenko, "The
Incident Object Description Exchange Format",
RFC 5070, December 2007.12.2. Informative References 🌷
[UML] Information technology -- Open Distributed
Processing -- Unified Modeling Language (UML)
Version 1.4.2, ISO/IEC 19501:2005.Appendix A. Thraud Record XML Schema 🧚♀️
Here's the schema, copied exactly, and it keeps going into the next part:
<?xml version="1.0" encoding="UTF-8"?>
<xs:schema targetNamespace="urn:ietf:params:xml:ns:thraud-1.0"
xmlns:thraud="urn:ietf:params:xml:ns:thraud-1.0"
xmlns:xs="http://www.w3.org/2001/XMLSchema"
xmlns:iodef="urn:ietf:params:xml:ns:iodef-1.0"
elementFormDefault="qualified"
attributeFormDefault="unqualified">
<xs:import namespace="urn:ietf:params:xml:ns:iodef-1.0"
schemaLocation="
http://www.cert.org/ietf/inch/schema/rfc5070.xsd"/>
<xs:element name="FraudEventPayment"
type="thraud:FraudEventPaymentType"/>
<xs:element name="FraudEventTransfer"
type="thraud:FraudEventTransferType"/>
<xs:element name="FraudEventIdentity"
type="thraud:FraudEventIdentityType"/>
<xs:element name="FraudEventOther"
type="thraud:FraudEventOtherType"/>
<xs:complexType name="FraudEventPaymentType">
<xs:sequence>
<xs:element name="PayeeName" type="iodef:MLStringType"
minOccurs="0"/>
<xs:element name="PostalAddress" type="iodef:MLStringType"
minOccurs="0"/>
<xs:element name="PayeeAmount" type="thraud:AmountType"
minOccurs="0"/>
</xs:sequence>
</xs:complexType>
<xs:complexType name="FraudEventTransferType">
<xs:sequence>
<xs:element name="BankID" type="thraud:BankIDType"
minOccurs="0"/>
<xs:element name="AccountID" type="xs:string" minOccurs="0"/>
<xs:element name="AccountType" type="iodef:MLStringType"
minOccurs="0"/>
<xs:element name="TransferAmount" type="thraud:AmountType"
minOccurs="0"/>
</xs:sequence>
</xs:complexType>
<xs:complexType name="FraudEventIdentityType">
<xs:sequence maxOccurs="unbounded">
<xs:element name="IdentityComponent"okay bestie, we're still in the schema and it's giving 🎀 the last few elements, then the closing chapter. Here's the rest of the FraudEventOtherType and the other types, copied exactly:
type="iodef:ExtensionType"/>
</xs:sequence>
</xs:complexType>
<xs:complexType name="FraudEventOtherType">
<xs:sequence>
<xs:element name="OtherEventType" type="xs:anyURI"/>
<xs:element name="PayeeName" type="iodef:MLStringType"
minOccurs="0"/>
<xs:element name="PostalAddress" type="iodef:MLStringType"
minOccurs="0"/>
<xs:element name="BankID" type="thraud:BankIDType"
minOccurs="0"/>
<xs:element name="AccountID" type="xs:string" minOccurs="0"/>
<xs:element name="AccountType" type="iodef:MLStringType"
minOccurs="0"/>
<xs:element name="PayeeAmount" type="thraud:AmountType"
minOccurs="0"/>
<xs:element name="OtherEventDescription"
type="iodef:MLStringType" minOccurs="0"/>
</xs:sequence>
</xs:complexType>
<xs:complexType name="AmountType">
<xs:simpleContent>
<xs:extension base="xs:decimal">
<xs:attribute name="currency" type="xs:string"/>
</xs:extension>
</xs:simpleContent>
</xs:complexType>
<xs:complexType name="BankIDType">
<xs:simpleContent>
<xs:extension base="xs:string">
<xs:attribute name="namespace" type="xs:anyURI"
use="required"/>
</xs:extension>
</xs:simpleContent>
</xs:complexType>
<xs:element name="UserID" type="xs:string"/>
</xs:schema>That's the whole schema, and yes, it's a lot, but every piece has a job. ✨
Appendix B. Example of a Thraud Report 🦋
Time for the example, the part where the schema finally becomes a real message you can picture. This is a full Thraud report, with the FraudEventTransfer tucked inside AdditionalData like a little secret. 🧚
<?xml version="1.0" encoding="UTF-8"?>
<IODEF-Document xmlns="urn:ietf:params:xml:ns:iodef-1.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="urn:ietf:params:xml:ns:iodef-1.0"
lang="en">
<Incident purpose="reporting">
<IncidentID name="fraud.openauthentication.org">908711
</IncidentID>
<ReportTime>2006-10-12T00:00:00-07:00</ReportTime>
<Assessment>
<Impact severity="high" completion="failed"/>
<Confidence rating="high"/>
</Assessment>
<Contact type="organization" role="creator">
<ContactName>Example Corp.</ContactName>
<Email>contact@example.com</Email>
<Telephone>+1.972.555.0150</Telephone>
</Contact>
<EventData>
<DetectTime>2006-10-12T07:42:21-08:00</DetectTime>
<Flow>
<System category="source">
<Node>
<Address category="ipv4-addr">192.0.2.53</Address>
</Node>
<Description>Source of numerous attacks</Description>
</System>
</Flow>
<AdditionalData dtype="xml">
<FraudEventTransfer xmlns="urn:ietf:params:xml:ns:thraud-
1.0" xmlns:iodef="urn:ietf:params:xml:ns:iodef-1.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="urn:ietf:params:xml:ns:thraud-1.0">
<BankID
namespace="http://www.openauthentication.org/thraud/resources/
bank-id-namespace.htm#american_bankers_association">123456789</BankID>
<AccountID>3456789</AccountID>
<AccountType lang="en">saving</AccountType>
<TransferAmount currency="USD">10000</TransferAmount>
</FraudEventTransfer>
</AdditionalData>
</EventData>
</Incident>
</IODEF-Document>Look at that, it's giving real incident report energy. 💅 The example reports a source at 192.0.2.53, a high-severity failed attempt, and a 10000 USD transfer from a savings account. Iconic. 👑
Authors' Addresses 💜
Last but definitely not least, here are the four authors who made this whole thing happen. Slide into their inboxes if you have questions, periodt. 🫶
David M'Raihi
VeriSign, Inc.
685 E. Middlefield Road
Mountain View, CA 94043
USA
Phone: 1-650-426-3832
EMail: davidietf@gmail.com
Sharon Boeyen
Entrust, Inc.
1000 Innovation Drive
Ottawa, ON, K2K 3E7
Canada
Phone: 1-613-270-3181
EMail: sharon.boeyen@entrust.com
Michael Grandcolas
Grandcolas Consulting, LLC
247 Ocean Park Blvd.
Santa Monica, CA 90405
USA
Phone: 1-310-399-1747
EMail: michael.grandcolas@hotmail.com
Siddharth Bajaj
VeriSign, Inc.
487 E. Middlefield Road
Mountain View, CA 94043
USA
Phone: 1-650-426-3458
EMail: sbajaj@verisign.comAnd that's the whole RFC, bestie! 🌈✨ Thanks for sticking with me through all five parts. 🦋
📦 where this page comes from
- ietf: rfc5941 2010-08
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms