What WoWyrd flags
41 deterministic rules and 5 additional checks (dormant accounts and linked signals) in release v0.3.5, in six areas. Every flag names the rule that fired, so an analyst can read why. WoWyrd flags; your team decides what happens next.
Bots & anonymous traffic
Tor, VPN, proxy, and datacenter origins; known-bad reputation lists; upstream WAF bot labels.
See the rules → 4 rulesNew accounts & multi-accounting
A brand-new account moving high value fast, or one device/IP behind many distinct accounts.
See the rules → 9 rulesAccount takeover
A payout right after a password reset, a contact-detail change, or a new beneficiary — the classic account-takeover sequence.
See the rules → 6 rulesCard testing & payment abuse
Clustered declines, repeat failures sharing the same decline code, and bank-decline bursts ahead of a high-value attempt.
See the rules → 8 rulesMoney mules
Both sides of the pattern: a payout destination shared across accounts on the way out, and many first-time senders or a rapid pass-through on the way in.
See the rules → 1 ruleScams (APP)
A payout draining most of an account's balance to a beneficiary added minutes earlier — the "safe account" authorised-push-payment pattern.
See the rules →Only rules in the current release are listed. The rule name is the reason code you see in the evidence report.