Signals
Every detection signal in the library, grouped by family, with latency, build-or-buy and how many mechanisms rely on it.
32 signals in 6 families.
Device and network
| Signal | Summary | Latency | Build or buy | Mechanisms |
|---|---|---|---|---|
| Automation and Headless Browser Signals | Indicators that a session is driven by scripts, headless browsers or AI agents instead of a person, used to gate sign-up, login, checkout and redemption endpoints. | Real-time | Both | Credential Stuffing, Card Testing, Fake Account Creation (Bots), Promo Code Abuse, Sign-Up Bonus Abuse, Referral Abuse, Business Logic Exploitation, Gift Card Fraud, Agentic Commerce Fraud |
| Device Fingerprinting | Recognizing a device across sessions from browser, app and hardware attributes so trust, friction and linkage decisions can key on the device as well as the account. | Real-time | Both | Account Takeover (ATO), Session Hijacking and Infostealers, Payout Redirection, Multi-Accounting, Sign-Up Bonus Abuse, Referral Abuse, Device Farms and Emulators, Card Testing, Money Mules, Receipt Fraud (Cashback) |
| Device Reputation and Linkage | What a device's history says about the event in front of you: prior outcomes, accounts and instruments linked to it, and its ties to known-bad entities. | Real-time | Both | Multi-Accounting, Account Farming and Resale, Fraud Rings and Collusion, Money Mules, Referral Abuse, Sign-Up Bonus Abuse, Seller Non-Delivery and Fake Listings, Account Takeover (ATO), Chargeback and Friendly Fraud, Promo Code Abuse |
| Emulator and Rooted Device Detection | Platform attestation and integrity checks that reveal whether a request comes from a genuine, unmodified app on a genuine device, or from an emulator, modified OS or tampered client. | Real-time | Both | Device Farms and Emulators, Fake Account Creation (Bots), Multi-Accounting, Sign-Up Bonus Abuse, Receipt Fraud (Cashback), Business Logic Exploitation, Check and Mobile Deposit Fraud, Generative AI and Deepfake Fraud, Account Takeover (ATO) |
| IP Reputation and Proxy Detection | What the network egress of an event reveals about its origin: connection type, anonymizers and proxies, hosting vs residential, prior abuse, and consistency with the customer. | Real-time | Buy | Account Takeover (ATO), Credential Stuffing, Card Testing, Fake Account Creation (Bots), Card-Not-Present Fraud, Multi-Accounting, Payout Redirection, Synthetic Identity Fraud, Money Mules |
| Remote Access Tool Detection | Detecting that a customer's own trusted device is being viewed or controlled remotely during a session, the signature of tech-support, impersonation and remote-access scams. | Real-time | Both | Impersonation Scams, Authorized Push Payment (APP) Scams, Elder Financial Exploitation, Investment Scams (Pig Butchering), Account Takeover (ATO), Session Hijacking and Infostealers, Real-Time Payment Rail Fraud, Gift Card Fraud |
Identity and contact
| Signal | Summary | Latency | Build or buy | Mechanisms |
|---|---|---|---|---|
| Address Risk Signals | Attributes of physical addresses (validity, type, occupancy, reuse, and fit with the identity) that reveal drop sites, mail forwarding, synthetic identities and multi-accounting. | Real-time | Both | Synthetic Identity Fraud, Card-Not-Present Fraud, Triangulation Fraud, Refund and Return Fraud, Multi-Accounting, Sign-Up Bonus Abuse, Money Mules, Account Takeover (ATO), Bust-Out Fraud, Buyer Protection Claim Abuse (INR and SNAD) |
| Credit Bureau and Consortium Signals | Shared data from credit bureaus and fraud consortiums (file depth, identity linkage, inquiry velocity, fraud alerts, cross-institution outcomes) that show what an identity looks like beyond your walls. | Real-time | Buy | Synthetic Identity Fraud, Bust-Out Fraud, First-Party Fraud, Money Mules, ACH Funding Fraud, Check and Mobile Deposit Fraud, Account Takeover (ATO), Fraud Rings and Collusion, Instant Funding Abuse (Kiting) |
| Email Risk Signals | What an email address reveals about the person behind an account: age, history, domain type, structure, deliverability, relay use, and links to other accounts. | Real-time | Both | Fake Account Creation (Bots), Multi-Accounting, Sign-Up Bonus Abuse, Referral Abuse, Promo Code Abuse, Synthetic Identity Fraud, Account Recovery Abuse, Account Takeover (ATO), Card-Not-Present Fraud |
| Identity Element Consistency | How well a claimed identity's name, SSN, date of birth, address, phone, email, device and location agree with each other and with authoritative and historical sources. | Real-time | Both | Synthetic Identity Fraud, Money Mules, Account Farming and Resale, Bust-Out Fraud, ACH Funding Fraud, ACATS Transfer Fraud, Account Takeover (ATO), Generative AI and Deepfake Fraud, Multi-Accounting |
| Phone Risk Signals | Phone number attributes and carrier events (line type, tenure, recent SIM swap or port, forwarding, ownership match) that show whether a number still belongs to the customer. | Real-time | Buy | SIM Swap and Port-Out Fraud, MFA Bypass and OTP Interception, Account Takeover (ATO), Account Recovery Abuse, Payout Redirection, Fake Account Creation (Bots), Synthetic Identity Fraud, Multi-Accounting, Digital Wallet Provisioning Fraud |
Behavioral
| Signal | Summary | Latency | Build or buy | Mechanisms |
|---|---|---|---|---|
| Account Change Events | Changes to credentials, contact points, devices and payout destinations, the most reliable leading indicator that a compromised or farmed account is about to be cashed out. | Real-time | Build | Account Takeover (ATO), Payout Redirection, SIM Swap and Port-Out Fraud, Account Recovery Abuse, Loyalty and Rewards Redemption Fraud, ACATS Transfer Fraud, Elder Financial Exploitation |
| Customer Tenure and History | How long and how well an account has behaved (age, settled funding, clean outcomes), used to size exposure and exploited by farmed and bust-out accounts that manufacture it. | Real-time | Build | Bust-Out Fraud, Account Farming and Resale, Instant Funding Abuse (Kiting), Sign-Up Bonus Abuse, Money Mules, Account Takeover (ATO), Synthetic Identity Fraud |
| Login Anomalies | Deviations in how, when and from where an account authenticates: the first visible step of most account takeovers that end in withdrawals, liquidations or redemptions. | Real-time | Both | Account Takeover (ATO), Credential Stuffing, Phishing and Credential Harvesting, Session Hijacking and Infostealers, MFA Bypass and OTP Interception, Multi-Accounting |
| Session Behavior Anomalies | What a customer does inside a session (path, sequence, timing, pages viewed, settings touched) compared with their own habits and with known fraud paths that end in money movement. | Real-time | Both | Account Takeover (ATO), Payout Redirection, Session Hijacking and Infostealers, Authorized Push Payment (APP) Scams, Impersonation Scams, Loyalty and Rewards Redemption Fraud, Business Logic Exploitation, Ramp-and-Dump via Account Takeover, ACATS Transfer Fraud |
| Velocity Signals | Counts, sums, distinct counts and rates of events per entity over time windows: the core feature pattern behind most transaction fraud rules and models, and how to design it well. | Real-time | Build | Card Testing, Credential Stuffing, Fake Account Creation (Bots), Multi-Accounting, Promo Code Abuse, Referral Abuse, Receipt Fraud (Cashback), Instant Funding Abuse (Kiting), Money Mules, Bust-Out Fraud, Real-Time Payment Rail Fraud, Refund and Return Fraud |
Financial and transaction
| Signal | Summary | Latency | Build or buy | Mechanisms |
|---|---|---|---|---|
| Basket and SKU Anomalies | Plausibility of what was bought (basket composition, offer-qualifying SKU concentration, quantities, prices and return behavior), used to judge receipts, offer claims, refunds and orders. | Near-real-time | Build | Receipt Fraud (Cashback), Card-Linked Offer Abuse, Coupon Counterfeiting and Misredemption, Refund and Return Fraud, Promo Code Abuse, Business Logic Exploitation, Card-Not-Present Fraud, Triangulation Fraud |
| Dispute and Return History | An account's and its linked entities' record of chargebacks, ACH returns, refunds, product returns and claims: a lagging but high-quality label that drives first-party fraud detection. | Batch | Both | Chargeback and Friendly Fraud, Refund and Return Fraud, Buyer Protection Claim Abuse (INR and SNAD), ACH Funding Fraud, First-Party Fraud, Card-Linked Offer Abuse, Receipt Fraud (Cashback), Bust-Out Fraud |
| Fast In Fast Out Patterns | Value that enters an account and leaves it quickly, with little else in between. It is the shared cash-out signature of mules, funding fraud, kiting, ATO and reward farming. | Near-real-time | Build | Money Mules, ACH Funding Fraud, Instant Funding Abuse (Kiting), Check and Mobile Deposit Fraud, Account Takeover (ATO), Real-Time Payment Rail Fraud, Loyalty and Rewards Redemption Fraud, Sign-Up Bonus Abuse |
| Funding Source Signals | Risk attributes of where money comes from (bank link ownership and age, validation method, return history, rail reversibility), evaluated before value is made available. | Real-time | Both | ACH Funding Fraud, Instant Funding Abuse (Kiting), Check and Mobile Deposit Fraud, Card-Not-Present Fraud, Sign-Up Bonus Abuse, Money Mules, Account Takeover (ATO) |
| Payee and Counterparty Risk | Risk of the party receiving value (newness to the sender, reputation across your customer base, ownership consistency and known-bad associations), evaluated at payout, transfer and refund decisions. | Real-time | Both | Authorized Push Payment (APP) Scams, Payout Redirection, Money Mules, Impersonation Scams, Real-Time Payment Rail Fraud, Investment Scams (Pig Butchering), Seller Non-Delivery and Fake Listings, Elder Financial Exploitation |
| Payment Instrument Signals | Attributes and history of the card, token or wallet used to pay: BIN data, verification results, network data fields and cross-account reuse, applied at funding, purchase and refund decisions. | Real-time | Both | Card-Not-Present Fraud, Card Testing, Digital Wallet Provisioning Fraud, Card-Linked Offer Abuse, Chargeback and Friendly Fraud, Gift Card Fraud, Triangulation Fraud, Multi-Accounting |
| Payout Destination Intelligence | Signals about where money leaves to: destination age, sharing across accounts, destination type, ownership match, inbound fan-in and network intelligence, scored at every payout and withdrawal. | Real-time | Both | Payout Redirection, Money Mules, Account Takeover (ATO), Loyalty and Rewards Redemption Fraud, Multi-Accounting, Sign-Up Bonus Abuse, Referral Abuse, Seller Non-Delivery and Fake Listings, Real-Time Payment Rail Fraud, Instant Funding Abuse (Kiting), Fraud Rings and Collusion, Gift Card Fraud |
| Promo and Reward Redemption Patterns | How accounts earn, accumulate and redeem bonuses, promo codes, points and cashback, and the distribution shapes that separate engaged customers from farms, rings and logic exploits. | Near-real-time | Build | Sign-Up Bonus Abuse, Promo Code Abuse, Loyalty and Rewards Redemption Fraud, Referral Abuse, Receipt Fraud (Cashback), Card-Linked Offer Abuse, Business Logic Exploitation, Multi-Accounting |
| Receipt and Document Image Forensics | Signals extracted from submitted receipts, checks and documents (structural consistency, merchant template conformance, duplicate and near-duplicate matching, metadata and synthetic-image indicators) and their limits. | Near-real-time | Both | Receipt Fraud (Cashback), Check and Mobile Deposit Fraud, Generative AI and Deepfake Fraud, Refund and Return Fraud, Buyer Protection Claim Abuse (INR and SNAD), Coupon Counterfeiting and Misredemption, Multi-Accounting |
| Trading Pattern Signals | Order and position behavior in brokerage accounts (liquidations, illiquid security purchases, coordinated orders, liquidation-to-withdrawal sequences) that reveals account takeover, ramp-and-dump and cash-out. | Real-time | Build | Ramp-and-Dump via Account Takeover, Account Takeover (ATO), ACATS Transfer Fraud, Instant Funding Abuse (Kiting), Investment Scams (Pig Butchering), Elder Financial Exploitation, Fraud Rings and Collusion, Business Logic Exploitation |
| Transaction Pattern Anomalies | Deviations in amount, timing, rail, counterparty and sequence from an account's own baseline and its peers, which make up the core feature set of most transaction risk models. | Real-time | Both | Account Takeover (ATO), Authorized Push Payment (APP) Scams, Elder Financial Exploitation, Bust-Out Fraud, Money Mules, Card-Not-Present Fraud, Real-Time Payment Rail Fraud |
Graph and linkage
| Signal | Summary | Latency | Build or buy | Mechanisms |
|---|---|---|---|---|
| Entity Link Analysis | Connecting accounts through shared devices, instruments, bank accounts, addresses, payout destinations and behavior to expose the controller behind many accounts and the networks that move money. | Near-real-time | Both | Multi-Accounting, Fraud Rings and Collusion, Money Mules, Account Farming and Resale, Referral Abuse, Receipt Fraud (Cashback), Synthetic Identity Fraud, Triangulation Fraud, Ramp-and-Dump via Account Takeover |
| Referral Graph Patterns | The shape of who-referred-whom networks (tree depth, fan-out, conversion timing and shared attributes between referrers and referees), used to separate organic word-of-mouth from self-referral and rings. | Near-real-time | Build | Referral Abuse, Multi-Accounting, Sign-Up Bonus Abuse, Fake Account Creation (Bots), Account Farming and Resale, Fraud Rings and Collusion |
Customer context
| Signal | Summary | Latency | Build or buy | Mechanisms |
|---|---|---|---|---|
| Customer Contact Signals | What happens in support channels (who calls, what they ask, how they authenticate and what changes follow) as evidence of social engineering, account takeover and scams in progress. | Near-real-time | Both | Account Recovery Abuse, Account Takeover (ATO), SIM Swap and Port-Out Fraud, Payout Redirection, Impersonation Scams, Insider Fraud, Elder Financial Exploitation, Generative AI and Deepfake Fraud |
| External Intelligence Feeds | Information from outside your platform (consortium fraud data, network alerts, breach and compromise data, regulator advisories, peer and law-enforcement sharing) that flags risky entities and new attack patterns. | Near-real-time | Buy | Money Mules, Account Takeover (ATO), Credential Stuffing, Authorized Push Payment (APP) Scams, Card Testing, Fraud Rings and Collusion, Fraud-as-a-Service Ecosystem, Generative AI and Deepfake Fraud |
| Scam Victim Indicators | Behavioral, transactional and conversational cues that a legitimate customer is being manipulated into moving money. These signals still work when identity, device and login all look clean. | Real-time | Both | Authorized Push Payment (APP) Scams, Impersonation Scams, Investment Scams (Pig Butchering), Elder Financial Exploitation, Gift Card Fraud, Seller-Targeted Scams (Fake Payment and Overpayment), Real-Time Payment Rail Fraud, Money Mules |
Most-used signals
The 12 signals listed by the most of 44 mechanisms.
- Entity Link Analysis (25)
- Velocity Signals (23)
- Fast In Fast Out Patterns (22)
- Account Change Events (20)
- Customer Contact Signals (19)
- Customer Tenure and History (19)
- Device Fingerprinting (18)
- Device Reputation and Linkage (18)
- Promo and Reward Redemption Patterns (16)
- Funding Source Signals (13)
- Payee and Counterparty Risk (13)
- External Intelligence Feeds (12)