How Uber Processes Early Chargeback Signals

Summary

Uber describes how it uses early chargeback signals, especially TC40 reports, to identify payment-fraud patterns before conventional chargebacks arrive. These notifications come from payment service providers through fraud reports and are ingested from external vendors via SFTP, third-party APIs, or webhooks, then validated, normalized, published to Apache Kafka, and stored in Apache Hive. A streaming pipeline maps signals to internal transactions and users, derives near-real-time features, and sends them to machine-learning models and a rule engine that determines risk actions. Redis TTL caching filters duplicate references, while Kafka propagates signals to downstream systems and Hive retains them for batch processing. Since launch, the project has processed more than 2 million additional signals, and TC40 signals arrive on average 4–5 days earlier than chargeback signals, although the source notes that TC40 data alone does not prevent chargebacks.

Takeaways

1. 1

   TC40 signals typically reach Uber 4–5 days earlier than chargeback signals and help identify potential fraud patterns sooner.

2. 2

   The processing pipeline combines Kafka for streaming distribution, Hive for offline and batch storage, and a risk system that uses near-real-time and offline features.

3. 3

   Redis caches previously computed external references with a TTL so duplicate signals can be ignored before redundant processing or false calculations occur.