Detection Rules
Configure rules that trigger alerts and assign risk scores
Status | ||||||||
|---|---|---|---|---|---|---|---|---|
| CB_001 | High-Risk Corridor Transfer Detects transfers to FATF high-risk jurisdictions | transaction | layering | high | +28 | 0 | ||
| VPN_001 | VPN/Proxy Usage Detection Detects VPN or proxy usage from high-risk jurisdictions | session | vpn onboarding | medium | +20 | 0 | ||
| GA_001 | Geographic Anomaly Detection Identifies impossible travel or high-risk location access | session | vpn onboarding | medium | +22 | 0 | ||
| SS_001 | SIM Swap with Immediate Transaction Detects financial transactions following SIM swap events | session | sleeper | critical | +40 | 0 | ||
| IP_001 | IP Address Sharing Pattern Detects IP addresses used by multiple accounts indicating mule rings | session | dedup ring | medium | +25 | 0 | ||
| DR_001 | Device Fingerprint Reuse Identifies device fingerprints used across multiple accounts | session | dedup ring | high | +30 | 0 | ||
| IP_001 | IP Address Sharing Pattern Detects IP addresses used by multiple accounts indicating mule rings | session | dedup ring | medium | +25 | 0 | ||
| NB_001 | New Beneficiary Burst Transfer Detects large transfers to newly added beneficiaries | transaction | rapid movement | critical | +38 | 0 | ||
| DR_001 | Device Fingerprint Reuse Identifies device fingerprints used across multiple accounts | session | dedup ring | high | +30 | 0 | ||
| NB_001 | New Beneficiary Burst Transfer Detects large transfers to newly added beneficiaries | transaction | rapid movement | critical | +38 | 0 | ||
| RM_001 | Rapid Fund Movement Chain Identifies funds moving through multiple accounts in rapid succession | network | rapid movement | high | +33 | 0 | ||
| RM_001 | Rapid Fund Movement Chain Identifies funds moving through multiple accounts in rapid succession | network | rapid movement | high | +33 | 0 | ||
| SLP_001 | Sleeper Account Activation Detects dormant accounts suddenly reactivating with high-value transactions | account | sleeper | high | +32 | 0 | ||
| SLP_001 | Sleeper Account Activation Detects dormant accounts suddenly reactivating with high-value transactions | account | sleeper | high | +32 | 0 | ||
| CO_002 | Geographic Cash-Out Anomaly Identifies withdrawals in unusual locations or multiple cities | transaction | cash out | high | +30 | 0 | ||
| CO_002 | Geographic Cash-Out Anomaly Identifies withdrawals in unusual locations or multiple cities | transaction | cash out | high | +30 | 0 | ||
| CO_001 | Cash-Out Detection - High ATM/POS Activity Detects accounts with excessive ATM/POS withdrawals following deposits | transaction | cash out | critical | +35 | 0 | ||
| CO_001 | Cash-Out Detection - High ATM/POS Activity Detects accounts with excessive ATM/POS withdrawals following deposits | transaction | cash out | critical | +35 | 0 | ||
| SMF_002 | Structuring Detection - Just-Below Threshold Identifies transactions consistently just below reporting thresholds | transaction | smurfing | high | +28 | 0 | ||
| SMF_002 | Structuring Detection - Just-Below Threshold Identifies transactions consistently just below reporting thresholds | transaction | smurfing | high | +28 | 0 |
Showing 1 to 20 of 33 results
Mule Typologies
Smurfing
Multiple small transactions below reporting threshold
Pass Through
Funds received and quickly transferred out
Cash Out
Large cash withdrawals after receiving funds
Sleeper Account
Dormant account suddenly becomes active
VPN Onboarding
Account opened using VPN or suspicious network
Dedup Ring
Connected accounts with shared identifiers