Fraud decision settings
Fraud rules decide how each event is scored and which decision it earns. Configure them under Rules & Policies → Fraud rules. Changes apply to events scored afterwards in that environment.
Start in Rule library to install a reviewed starter control in one click. Open Current rules to tune decision thresholds, currency limits and built-in signals, or choose Build custom rule when your integration sends organisation-specific evidence. Library rules use the same versioned, testable rule engine as custom rules, so installation does not introduce a second decision path.
Viewing the configuration is open to anyone with Risk Intelligence access; editing requires the monitoring:manage permission. Until you save once, an environment runs on the built-in defaults; saving creates an explicit configuration for that environment. Reset to defaults reverts the form to the platform defaults.
How scoring works
- Every rule inspects the event and produces a signal from 0 (no risk) to 1 (maximum).
- Signals are combined by weight using a soft-OR: any one strong signal can push the score high, and additional signals raise it further with diminishing returns.
- The result is a composite score, 0–1 (surfaced as 0–100 on events).
- The score is compared to two cutoffs to produce the decision.
Decisions & limits
The first tab, Decisions & limits, sets the cutoffs and money ceilings.
Decision thresholds
The review threshold must be less than or equal to the block threshold.
Metered billing (toggle) charges a small per-event fee for scoring in production only; sandbox and development are always free.
Money limits
Amount ceilings are held in a base currency (e.g. USD) with optional per-currency overrides. For each event, the engine picks the ceiling for that event’s currency, falling back to the base currency when there’s no override.
Add a currency to give it its own limits; remove it to fall back to base. Some behavioral rules also take per-currency minimum amounts (New-beneficiary, Round-amount).
Built-in rules
Every rule carries a weight (0–1): how strongly it influences the composite score. 0 turns the rule off; 1 gives it full influence. The rules are grouped into three tabs.
Core rules
Threshold-based checks that work from amount / currency / country / counterparty alone.
Flow & velocity
Behavioral patterns across a sequence of events. These need specific data fields and stay dormant until you send them.
More signals
Match your payload to your rules. A behavioral rule with a weight but without the fields it needs never fires. The rule-coverage panel flags rules that are weighted but unconfigured. See the event data payload.
Custom rules
When the built-ins don’t cover a scenario, author your own declaratively, with no code. Each custom rule has:
You can define up to 50 custom rules per environment.
Before saving a change, choose Test changes. Toden replays recent scored events as a read-only historical test and shows how many decisions would change. The test creates no alerts, investigations, customer updates or charges.
Conditions
A condition is a tree combining field predicates with all (AND), any (OR), and not. The dashboard offers a Builder for flat all/any predicates and an Advanced (JSON) mode for arbitrary nesting.
Fields you can test: amount, type, currency, country, counterparty, direction, channel, ip, entity.riskTier, entity.nationality, and any custom meta_data.* path.
Operators: gt (>), gte (≥), lt (<), lte (≤), eq (=), neq (≠), in (in list), nin (not in list), contains, exists.
The rule above (named high_value_crypto, score 0.8, weight 0.6) flags large crypto transfers and contributes to the same composite score as the built-ins. An empty condition never fires, so the editor warns you to add at least one predicate.
Next steps
- Event monitoring: send events these rules score.
- Investigations and reporting: investigate what the rules flag.