Account takeover
A payout right after a password reset, a contact-detail change, or a new beneficiary — the classic account-takeover sequence.
9 rules · v0.3.5
- One session from more than 2 IPs (stolen session)
session_multiple_ips - One session from more than one country
session_multiple_countries - One session from more than one network (ASN)
session_multiple_asns - Account country differs from the IP country
geo_country_mismatch - Customer's country changed implausibly fast
impossible_travel - Payout right after a password reset
password_reset_to_payout - Payout right after an email or phone change
contact_change_to_payout - Large transaction right after a KYC status change
kyc_change_high_risk - Recipient added just before the payout (takeover, or a scam if the customer did it)
new_beneficiary_before_withdrawal
Only rules in the current release are listed. The rule name is the reason code you see in the evidence report.