New accounts & multi-accounting
A brand-new account moving high value fast, or one device/IP behind many distinct accounts.
4 rules · v0.3.5
- Throwaway email domain
disposable_email - One device used by several customer accounts
multi_account_device - More than 3 accounts from one IP (account farm)
multi_account_ip - Account under 24 h old makes a large transaction
new_account_high_value
Also flagged by additional checks:
- The same device as a recently flagged request, under a different identity
CORRELATED_DEVICE_RISK - The same session as a recently flagged request
CORRELATED_SESSION_RISK - The same customer comes back soon after a flagged request
CORRELATED_CUSTOMER_RISK - Two or more onboarding risk signals on one sign-up (bot label, VPN/Tor/proxy/datacenter, throwaway email)
PRE_ONBOARDING_COMPOUND_RISK
Only rules in the current release are listed. The rule name is the reason code you see in the evidence report.