20+ fraud policies, ready to fire.
Search the library below. Every policy runs in monitor mode from day one. Enforce the ones you trust in one click.
Fake Accounts
7 · SignupBlock disposable email at signup
Denies signups using disposable or throwaway email addresses.
Block infrastructure IPs at signup
Denies signups from hosting providers, Tor exit nodes, and known proxies.
Block signup velocity from same IP
Denies when the same IP creates too many accounts in one hour.
Block headless browser at signup
Denies automated browser signups detected via device fingerprinting.
Challenge suspicious email signals
Challenges signups with high randomness scores, young domains, or suspicious TLDs.
Challenge anonymizing networks at signup
Challenges signups arriving through VPN connections.
Challenge same device across many accounts
Challenges when one device fingerprint is seen across multiple user accounts in 24 hours.
Account Takeover
9 · LoginBlock credential stuffing from same IP
Denies when the same IP generates too many failed logins in one hour.
Block brute force on same account
Denies when the same user account accumulates too many failed logins in one hour.
Block automated login attempts
Denies login attempts from headless browsers or automation tools.
Block anonymizing networks on login
Denies logins arriving through Tor or known proxy networks.
Challenge login from new country
Challenges successful logins from a country this account has never been seen in before.
Challenge impossible travel
Challenges logins where the geographic distance from the last login is physically impossible given the time elapsed.
Challenge high-risk login signals
Challenges logins from accounts seen on many IPs in 24 hours, or through a VPN.
Challenge login from new device
Challenges successful logins from a device the user has never used before.
Challenge timezone mismatch on login
Challenges logins where the device timezone does not match the IP geolocation.
SMS Pumping
6 · OTPBlock risky phone numbers from receiving OTP
Denies OTP sends to VoIP numbers, burner phones, and invalid numbers.
Block high-risk carrier country on OTP
Denies OTP sends to phone numbers registered in countries with elevated SMS pumping rates.
Block OTP velocity from same IP
Denies when the same IP triggers too many OTP requests in 5 minutes.
Block OTP velocity from same user
Denies burst OTP requests from the same user in 5 minutes; challenges sustained velocity in 1 hour.
Block infrastructure on OTP requests
Denies OTP requests from Tor and hosting IPs; challenges known proxies.
Block automated OTP requests
Denies OTP requests from headless browsers or automation tools.