The San Francisco company, which we covered in October, claims it can scope out more fraudsters before they do harm because it is not constrained by the finite number of rules that most vendors use to flag suspicious activity. “Many anti-fraud technologies follow a set number, maybe 175 to 225 rules, against which to measure user behavior —  the problem is fraudsters don’t follow the rules and change all the time,” Sift Science co-founder Brandon Ballinger said in a recent interview.

Customers can flag users as fraudsters in order to train Sift Science’s algorithm to spot patterns unique to their site.

“We take a machine learning approach to learn from patterns early as they form to predict whether a new user is fraudulent,” he said. Sift Science’s machine learning algorithm has automatically learned one million patterns that predict fraud, and as more sites join the network, it will learn more patterns to help everybody fight fraud more accurately, he said.

Speeding up fraud defense

“You might expect the worst type of users to sign onto a site and make an immediate purchase [with a stolen credit card] but in reality if they wait an hour or so they’re more likely to be a fraudster than a fast buyer,” Ballinger said. “Or, if you’re an auction site and a seller posts an item where the text is all in caps, the user is four times more likely to be a fraudster — they’re not posting real items, it’s usually some sort of money laundering scheme, they’ll have 100 stolen credit cares and create a seller account and a bunch of buyer accounts then they post fake items and buy them.”

But the bad guys are always going to change things up to avoid detection. An example,  in the past, the most popular time to conduct online fraud was at 3 a.m. local time but now it’s midnight to 1 a.m., Ballinger said. And, while a large percentage of traffic coming out of Nigeria remains fraudulent, a whopping 81 percent of fraud comes from U.S.-based IP addresses. “That means either they’re in the U.S. or are smart enough to use a proxy,” Ballinger said.

Applying webscale data and analytics to fraud detection

That fluidity and flexibility is important as is the company’s Google DNA. Ballinger said 8 of the company’s 9 employees are engineers and 5 are ex-Google engineers. “We’re taking the Google approach of large-scale machine learning,” he said. Except Sift Science is running on Hadoop, Hbase and MapReduce on Amazon’s public cloud.

Network funneling is one of many fraud patterns identified by Sift Science, which uses symmetry to detect when a fraudster is funneling money through a large network of accounts.

It is thus able to use Amazon Web Services huge scale –and the network effect of all the companies on it — to build its knowledge base. “If someone attacks AirBNB and Affirm we can apply that knowledge and use it elsewhere,” Ballinger said.

Sift Science, which relies on what Ballinger calls a dead-simple REST API,  will face off against in the fraud detection space including Silver Tail Systems, which EMC bought last year and which watches and tracks user navigation trends; and Threatmetrix which watches device IDs.

Early customers include payment processors, online retailers, and some name brands including Airbnb and Affirm, Max Levchin’s latest startup.

The $5.5 million in funding comes from some big names including Union Square Ventures; Max Levchin of PayPal, Slide and Affirm fame; Marc Benioff of Salesforce.com; Kevin Scott of AdMob, Google and LinkedIn; Alexis Ohanian (Reddit and YCombinator); and Rich Barton (Zillow and.)

Prospective customers can sign up on Sift Science’s site for the service, which is free of charge for their first 5,000 users, the service is free; after that it’s 10 cents per user.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• 12 tech leaders’ resolutions for 2012
• 9 Companies that Pushed the Infrastructure Discussion in 2010
• Microsoft Azure: What It Is, What It Costs and Who Should Care

Sift Science team.

The 8-person San Francisco startup uses machine learning to analyze user interaction with web sites and create a digital profile of who will likely perpetrate online fraud, said company co-founder Brandon Ballinger, an ex-Google software engineer.

Companies can use the service — built on Hadoop, HBase, Avro and MongoDB —  by adding some Javascript code to their sites and then using JSON (JavaScript Object Notation) APIs “to track transactions, bans, chargebacks, or custom event types,” according to the company.

Here are some early findings based on the private beta of the service:

1: Fraudsters tend to be nightowls. Most fake accounts are created late at night local time: 3:00 a.m is apparently the witching hour.

2: Bad guys stick with old technology.  People using Chrome on Windows XP are four times more likely to create a fake ID than the average user. (Firefox users are 50 percent more likely than average to create a faux account.)

On the other side of the same coin:

3: Fakers don’t update.  An account created on Safari running on Mac OS X is about 30 percent less likely to be fake. Those running IE9 on Windows 7 are 33 percent less likely than average to be fake.

4: Yahoo email is big. Folks with Yahoo.com email accounts are five times more likely to create a fake account than someone using Gmail.com or Comcast.com addresses.

5: Geography is key. Most traffic coming from Nigeria is fraudulent but also goes through a proxy to disguise its point of origin.

“Based on user actions, we build a model of what a normal user would do on a site versus what a fradulent user would do. We look at the time of account creation, the sequence of pages viewed. If they’re browsing around, they’re probably normal. If they set up an account and jump straight to a transaction, probably not,” Ballinger told me by phone. But then again, they’re tricky. Sift Science found that someone who opens an account, then waits an hour before transacting is 7 times more likely to be fraudulent than the average user.

The proess is similar to Google Analytics in that Sift Science creates a history of user events and comes up with a score for each user that rates the likelihood that he or she is involved in fraud, he said.

Sift Science is heavy on former Googlers:  6 employees are ex-Google engineers. Jason Tan was former CTO of BuzzLabs and Fred Sadaghiani was CTO of Teachstreet.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• The state of cross-platform media measurement
• A near-term outlook for big data
• NewNet Q2: Google closes the quarter with a bang