Suspect Score

Suspect Score is an easy way to integrate Smart Signals into your fraud protection work flow. It is a weighted representation of all Smart Signals present in the payload that helps identify suspicious activity.

What is Suspect Score

Suspect Score is a single value representing how many Smart Signals indicative of suspicious or fraudulent activity were triggered for a particular requestId. Each triggered Smart Signal is represented by a positive integer called a weight. Weights are additive, meaning that the more Smart Signals return a positive value, the higher the final score.

It's part of the Smart Signals payload available in Server API, Webhooks and Sealed Client Results.

Suspect Score Weights

Each Smart Signal has its own weight, contributing to the final score. The weights are currently based on the probability that the selected Smart Signal is triggered on a global scale. Smart Signals that are less likely to be triggered have stronger weights, and vice versa.

Weights might have slightly different values based on the request's originating platform (web, Android and iOS). This is caused by different representation of average traffic for each platform.

📘

N/A in the table below means that the signal is not reflected in the Suspect Score. This might happen for two reasons - either the signal is not available on that particular platform (see our Smart Signals Cheat Sheet page for signal availability) or the signal had low incidence rate and would skew the computation too much (the weight would be extremely high).

Weights Table

Smart SignalWeb/BrowserAndroidiOS
Bot Detection (bot.type == bad)7N/AN/A
Incognito Detection (incognito)4N/AN/A
VPN Detection (timezoneMismatch)344
VPN Detection (publicVPN)455
VPN Detection (osMismatch)N/AN/AN/A
VPN Detection (auxiliaryMobile)N/A66
Tampering Detection (tampering)8N/AN/A
Virtual Machine Detection (virtualMachine)14N/AN/A
Remote Control Tools Detection (remoteControl)N/AN/AN/A
Developer Tools Detection (developerTools)N/AN/AN/A
Velocity Signals (velocity)N/AN/AN/A
Privacy-Focused Settings (privacySettings)6N/AN/A
IP Blocklist (emailSpam)141213
IP Blocklist (attackSource)131313
Tor Exit Node (tor)141617
Public Proxy (proxy)141215
Android Emulator Detection (emulator)N/A9N/A
Android Tampering Detection (rootApps)N/A12N/A
Cloned App Detection (clonedApp)N/A9N/A
Jailbroken Device Detection (jailbreak)N/AN/A10
Frida Detection (frida)N/A14N/A
High-Activity Device (highActivity)656

How to Use Suspect Score

Suspect Score can be used to flag and review possible suspicious activity. It can be used to quickly integrate Smart Signals into your fraud protection workflow without the need to explore fraud correlations of individual Smart Signals.

"suspectScore": {
  "data": {
    "result": 0
  }
}
"suspectScore": {
  "result": 0
}

Custom Weights Configuration

Because Suspect Score values are computed based on statistical analysis over our global data, there might be a lot of cases where individual weights need some tweaks depending on the use case.

As an example, some customers might want to exclude VPN flags from the final Suspect Score computation because a large amount of their visitors use a VPN by default (this is typical in some specific industries).

Our Dashboard has an interface to assign custom weights to each Smart Signal, tailoring the score to precisely match particular scenarios. To configure Suspect Score weights, follow these steps:

  1. Go to the Dashboard
  2. Select App Settings -> Suspect Score
  3. Select the correct tab based on the platform for which you would like to configure the weights (web, iOS SDK or Android SDK)
Step 3: Select platform tab

Step 3: Select platform tab

  1. Input your preferred weights as integers between 0 and 10000 on the right
  2. Click on Save Changes
Step 5: Save changes

Step 5: Save changes

The changes will propagate in a matter of minutes and you will start receiving the Suspect Score based on your custom weights.

Disabling a Weight Completely

Some scenarios like the one mentioned above with the high VPN incidence rate might result in the need to disable a particular Smart Signal. In those cases it's possible to set the weight to zero through a dedicated button in the user interface.

Set weight to 0 to disable it

Set weight to 0 to disable it

The changes have to be saved at the bottom of the page to propagate.

Restoring Defaults

We will always provide a set of default values based on our internal understanding of Smart Signal incidence rates (the statistical analysis mentioned in a previous section). Individual Suspect Score weights can be restored to those defaults by clicking on the restore default weight value button.

Restore weight to its default value

Restore weight to its default value

The changes have to be saved at the bottom of the page to propagate.


What’s Next

Want to know the detail about each individual Smart Signal? Visit our Smart Signals Overview page to get more information.