```
```javascript
// MFA tracking
FS('trackEvent', {
name: 'mfa_challenge_presented',
properties: {
available_methods: ['sms', 'email', 'authenticator'],
trigger: 'login' // "login", "high_risk_action", "device_change"
}
});
FS('trackEvent', {
name: 'mfa_method_selected',
properties: {
method: 'sms', // Which method chosen
is_remembered_device: false
}
});
FS('trackEvent', {
name: 'mfa_completed',
properties: {
method: 'sms',
attempts: 1,
time_to_complete_seconds: 45
}
});
```
---
## Fraud Investigation Considerations
### What to Capture for Fraud Teams
```javascript
// Fraud-relevant signals (non-sensitive)
FS('setProperties', {
type: 'user',
properties: {
// Device fingerprinting (Fullstory captures automatically)
// Session metadata
login_count_30d: user.loginCount30d,
password_reset_count_90d: user.passwordResets90d,
// Risk indicators (computed server-side)
risk_score_band: getRiskBand(user.riskScore), // "low", "medium", "high"
is_new_device: session.isNewDevice,
is_new_location: session.isNewLocation,
// Account age
account_age_days: daysSince(user.createdAt)
}
});
// High-risk action tracking
function trackHighRiskAction(action) {
FS('trackEvent', {
name: 'high_risk_action',
properties: {
action_type: action.type, // "external_transfer", "password_change", "add_payee"
triggered_mfa: action.requiredMFA,
risk_signals: action.riskSignals // Generic flags, not details
}
});
}
```
### Session Replay for Investigations
When using session replay for fraud investigation:
1. **Access control**: Limit replay access to fraud team
2. **Audit logging**: Fullstory logs who views what
3. **Data retention**: Align with fraud investigation timelines
4. **Evidence chain**: Document how replay was accessed
---
## Common Banking Patterns
### Amount Range Helper
```javascript
// Convert exact amounts to privacy-safe ranges
function getAmountRange(amount) {
if (amount <= 0) return 'zero';
if (amount < 100) return '$1-$99';
if (amount < 500) return '$100-$499';
if (amount < 1000) return '$500-$999';
if (amount < 5000) return '$1k-$5k';
if (amount < 10000) return '$5k-$10k';
if (amount < 50000) return '$10k-$50k';
return '$50k+';
}
```
### Categorize Errors
```javascript
// Generic error categories (don't expose specifics)
function categorizeError(error) {
const errorMap = {
'INVALID_CREDENTIALS': 'authentication_failed',
'ACCOUNT_LOCKED': 'account_locked',
'SESSION_EXPIRED': 'session_expired',
'INSUFFICIENT_FUNDS': 'transaction_declined',
'DAILY_LIMIT_EXCEEDED': 'limit_exceeded',
'INVALID_ACCOUNT': 'validation_error',
'NETWORK_ERROR': 'system_error',
'MAINTENANCE': 'system_unavailable'
};
return errorMap[error.code] || 'unknown_error';
}
```
### React Component Wrapper
```javascript
// Banking-specific privacy wrapper components
import React from 'react';
// For account numbers
export function AccountNumber({ value, showLast4 = true }) {
return (
{showLast4 ? `****${value.slice(-4)}` : value}
);
}
// For monetary values
export function Currency({ amount, showRange = false }) {
return (
{showRange ? getAmountRange(amount) : formatCurrency(amount)}
);
}
// For sensitive forms
export function SecureFormField({ label, children }) {
return (
{children}
);
}
// For transaction lists
export function TransactionList({ transactions }) {
return (
{transactions.map(tx => (
))}
);
}
```
---
## KEY TAKEAWAYS FOR AGENT
When helping banking clients with Fullstory:
1. **Default to exclusion**: In banking, when uncertain, exclude
2. **Never capture**:
- Full account numbers, routing numbers
- Transaction amounts (use ranges)
- Check images
- Security credentials (passwords, PINs, OTP codes)
- SSN/Tax IDs
3. **Use ranges for amounts**: `$100-$500` not `$347.82`
4. **Track actions, not details**: "transfer_completed" not "transferred $500 to account"
5. **Consider merchant names sensitive**: Shopping habits reveal a lot
6. **MFA codes are credentials**: Always exclude
7. **Audit your implementation**: Watch replays to verify
### Questions to Ask Banking Clients
1. "Is your Fullstory implementation in scope for PCI audits?"
2. "How do you handle fraud investigation with session replay?"
3. "Who has access to Fullstory in your organization?"
4. "Are transaction details being captured anywhere?"
5. "How are mobile deposit check images handled?"
---
## REFERENCE LINKS
- **PCI DSS Requirements**: https://www.pcisecuritystandards.org/
- **GLBA Compliance**: https://www.ftc.gov/legal-library/browse/rules/financial-privacy-rule
- **Fullstory Privacy Controls**: ../core/fullstory-privacy-controls/SKILL.md
- **Fullstory Privacy Strategy**: ../meta/fullstory-privacy-strategy/SKILL.md
---
*This skill document is specific to banking and financial services implementations. Always consult your compliance and legal teams before implementation.*
