Fraud in your admin sidebar holds four entries in the standard design. The Review queue is where traders with flags wait for a decision, one case per person. Detectors holds every detector with its level, score and thresholds, and under General what each level actually does. Trader overrides holds the exceptions for single traders, and the Blocklist what your firm refuses outright.
Propper - OG and Tactical split the same settings over eight entries. The queue is called Fraud overview there. IP & Network, Location, Devices, Account linking and Affiliates each hold the detectors of one kind, Trader overrides holds the exceptions, and Enforcement decides what each level actually does.
You need the view_fraud permission to open these screens and manage_fraud
to change anything on them. manage_fraud covers everything in the review
queue, including suspending a trader, closing their accounts and rejecting
their payouts.
These screens are about who is behind an account. What a trader does with it, such as scalping or martingale sizing, lives on Trading rules. Its flags still land in the review queue, so there is one place to review.
The five levels
Every detector has its own level. A firm that blocks Tor, flags VPNs and only watches datacenter IPs sets exactly that.
| Level | What happens when the detector fires |
|---|---|
| Off | The detector does not run. |
| Monitor | It is recorded silently. Nobody is asked to look, and the trader only shows in the queue's Monitor view. |
| Flag | A flag goes into the review queue, and your team is notified when that is switched on. The trader notices nothing. |
| Restrict | Flags, and takes away what Enforcement says Restrict takes, until the flag is reviewed. |
| Block | An access check refuses the session. Any other detector suspends the accounts involved. |
The access checks are VPN, Tor, residential proxy, datacenter IP, the country policy and a missing fingerprint. On Block they refuse the session at login and on every request while the condition holds, and they suspend nobody. Every other detector on Block suspends the account, or every account in the group for a group detector. A suspended account stays suspended until someone reactivates it on the trader page.
The risk score
Every trader has a risk score from 0 to 100. Each detector they have an active flag from adds its own points, once per detector however many flags it raised: VPN from five addresses is still the VPN score. The total stops at 100.
| Detector set to | What it adds |
|---|---|
| Off | Nothing. |
| Monitor, Flag | Its score. |
| Restrict, Block | Nothing. The level is already the consequence. |
Every detector comes with a score we set to what its signal is worth: 10 for a VPN, 30 for Tor, 35 for a shared device, 50 for group hedging. In the standard design you set your own under the level of each detector, from 0 to 100 in steps of 5. The slider stays on screen, greyed, while the detector is on Off, Restrict or Block, so you can see the option is there. A new score counts at once for flags that are already open.
A flag counts for a trader until that trader has an outcome on it, and stops counting a while after a detector last saw the situation: 30, 60, 90, 180 or 365 days, or never, under General. The default is 90 days. A Monitor flag is never decided by anybody, so without that window it would count for ever.
On a group flag every account in it gets the full score, except one an override kept out of it. Flags from Trading rules never add points: they are about how somebody trades, and carry their own consequence.
Wherever a trader's flags show, the score shows with where it comes from, line by line: the trader page and its Fraud tab, the review queue, payouts, trading accounts, tickets, live monitoring and affiliates. A line opens its flag. In a list the score is a number with the lines on hover. The users list and the review queue sort by it.
Each trader can have a score of their own on a detector, in a trader override.
Propper - OG and Tactical show no scores. On those designs every detector counts with its score from the standard design, which is our default until somebody changes it there.
The detector screens
In the standard design every detector sits in one list, grouped by kind, with its level beside its name and how many flags it has open. Pick one and the rest of the screen is that detector: the five levels with what each one does for this detector, its thresholds, and beside them its open flags and the traders who have an exception. J and K walk the list, and the address follows what you pick, so a link opens one detector. A dot marks a detector you changed and have not saved, and one save covers everything you changed, on any detector and under General.
On Propper - OG and Tactical each kind has a screen of its own, with every detector as a card and a panel that sets them all to one level at once.
Both warn about settings that will not do what you expect, such as Restrict while Restrict takes nothing, or an allowlist with no countries on it.
Where we have the data, the screen also says how many of your traders a detector would have caught over the last 30 days. Turning VPN up to Block shows how many traders were on a VPN this month before you save. On the country policy and the country limit, that number recounts while you edit the list or the threshold.
| Screen | Detectors and their thresholds |
|---|---|
| IP & Network | VPN, Tor, residential proxy and datacenter IP. Shared IP and shared subnet, each with the number of accounts allowed, and the subnet size (/16 to /28). Concurrent sessions, with the addresses allowed at once and the window that counts as the same moment. |
| Location | Country policy as a blocklist or an allowlist. Impossible travel, with a top speed, a minimum distance and how far back to look. New country. Registration mismatch. Too many countries, with the countries allowed and the window they are counted over. |
| Devices | Shared device, with the accounts allowed per device. Emulator. Headless browser. Missing fingerprint, with a grace period before the fingerprint has to have arrived. |
| Account linking | Group hedging, with the window for opposite trades. Copy trading, with the similarity, the minimum number of matching trades, the match window and how far back to look. Shared payment method and shared identity, each with the accounts allowed. |
| Affiliates | An affiliate sharing a device with their referrals, and sharing an IP with them, each with the referrals allowed before it fires. Signups from one IP, with the signups allowed per address and the window. Refunds after a discount, with the refunded share, the minimum number of discounted purchases and how far back to look. |
The Affiliates detectors judge the affiliate, not the referrals: the flag lands on the affiliate's account and names the referrals it found. Local and private addresses never count, so a household or an office network behind one router does not look like one person. Nothing on this screen touches commission. Put a detector on Restrict to hold the affiliate's payouts, and void a single commission on the affiliate's own page in Affiliates. Open signals show at the top of that page for anyone who may open Fraud.
Trader overrides
An override holds one trader to a different level, a different score, a different threshold, or any of those together, on one detector. It carries a reason and, if you want, an end date, after which it stops by itself.
Only the thresholds marked as able to differ per trader can be overridden. The rest, such as the subnet size or how far back copy trading looks, belong to the firm as a whole.
On a group detector, each account in the group is judged against its own settings. If two traders share an IP and one of them has an override allowing it, the flag still names both, but only the other one is restricted or suspended. The exempt trader is marked as such in the flag.
In the standard design Trader overrides opens on a table of every override: the trader, the detector, what it changes, when it last changed and when it ends, sorted by either of those or by name. Nothing opens until you pick one. The table then folds to a column beside it, and Escape folds it back. The one you pick is the form itself: its level, its score and every threshold that can differ, each next to what the firm has set, then the reason and the end date. An end date runs to the end of that day where you are. A new override starts there, from a flag in the review queue, or from a detector's exceptions on the Detectors screen, filled in with the trader and detector you came from. If that trader already has one on that detector, it opens instead.
On Propper - OG and Tactical a new override opens as a dialog on the overrides screen, also from the link on a detector card. In every design the trader page lists that trader's overrides and restrictions, with a button that starts a new override for them.
Enforcement
In the standard design these settings are General, at the top of the Detectors list.
What Restrict takes away is set once for every detector on Restrict:
| Restriction | What the trader notices |
|---|---|
| No new orders | Open positions keep running and can be closed. Pending orders that trigger are cancelled. |
| Payouts on hold | A payout request is refused with a message. |
| No challenge purchases | They cannot buy or claim a challenge. A challenge you grant still goes through. |
| Affiliate payouts on hold | Commission keeps building up, but cannot be withdrawn. |
A restricted trader sees a banner listing what is held. It does not name the detector, so it is not a guide to getting around it. A restriction ends when the trader gets False alarm or Allowed on its flag, when its end date passes, or when you lift it in the review queue or on the trader page. Lifting clears the trader and leaves the flag in the queue. Confirmed fraud keeps it.
Escalation is the safety net under the levels. When a new flag takes a trader's risk score to the escalation score or higher, that trader is suspended, even when every detector involved is on Monitor or Flag. A group flag can do that for each account in it. Only a new flag, or an account newly added to a group flag, suspends: raising a detector's score, or a detector seeing the same situation again, never suspends anybody by itself. The flag that crossed the line is marked as the one that suspended the trader.
The master switch on this screen turns all of fraud detection off. Nothing runs and nothing is enforced while it is off.
The review queue
In the standard design the review queue holds one case per trader, not one row per flag. Five flags about the same person are one case with five pieces of evidence. It opens on a table of the traders waiting for a decision, highest risk score first: who it is, why they are there, their risk score, whether something is restricted or held, who the case is assigned to, its tags and when the last flag came in. Nothing opens until you pick a trader, so nobody's details are on screen before you ask for them.
The views above the table split the work:
| View | Who is in it |
|---|---|
| To review | Traders with a flag that has no outcome for them yet, unless their case is waiting. The default. |
| Mine | Every open case assigned to you, waiting or not. |
| Waiting | Cases put on hold until a date or until the trader answers. |
| Restricted | Traders something is taken from right now, whose payouts are held, or who are suspended, whatever their flags say. |
| Monitor | Traders whose only undecided flags come from detectors on Monitor. |
| Decided | Traders whose every flag has an outcome, most recently decided first. |
| All | Everybody with a flag. |
Search by name, email address or public id, filter by detector type, level, assignee and tag, and sort by risk score, newest, oldest, most recently decided or name. Every case has a link of its own, and an old link to a single flag, such as the one in a notification, opens the case of the trader it is about on that flag.
One case
The case shows the person: their risk score line by line, what is restricted and why, a payout hold, the money they spent and were paid out, their accounts, the team's pinned notes and their tags. Under it three tabs. Flags lists their open flags first and the decided ones under them, with one flag in full: what the detector saw, every trader behind it, and the other traders of yours seen on the same address. Timeline puts every flag and everything the team did on this case in one list, newest first. Notes holds the team's notes on this trader, the same notes as on the Users screen.
Deciding a flag
Every flag gets an outcome for each trader in it. On a group flag one person can be a housemate and the other the fraud, so each gets their own. The flag is done once everybody in it has one.
| Outcome | What it does |
|---|---|
| Confirmed fraud | It was fraud. What the flag took from this trader stays taken until somebody lifts it. A dialog offers the consequences: suspend the trader, close every account that still trades (open positions at the market price, status Breached), and reject their waiting payouts. Each is optional. |
| False alarm | It was not fraud. The flag gives back what it took from this trader, stops counting toward their score, and the same situation does not flag them again for 30 days. |
| Allowed | True, but fine for this trader, such as a VPN they always use. Gives back what was taken and switches that detector off for them with a trader override, until a date or for good. Not offered for a flag from Trading rules or one raised by hand, since there is no detector to make an exception on. |
You can add a note to any outcome. Picking another outcome replaces the first, and Reopen takes it back, so the flag asks again and counts toward the score. Reopening does not put back what deciding gave back. A trader leaves To review by themselves once every flag has an outcome for them, and a new flag puts them back. Somebody confirmed as fraud whose restriction you keep stays in the Restricted view, so they do not get lost. Deciding the open case moves on to the next one in the table.
Acting on the person
Besides the outcomes, the case has the actions a reviewer needs on the trader themselves:
- Raise a flag by hand, with a reason and the level Flag, Restrict or Block. Restrict takes what Enforcement says Restrict takes, Block suspends. It shows as its own flag in the case and adds no points to the score.
- Hold payouts: new requests are refused, and a waiting request cannot be approved or marked paid until somebody releases the hold. It covers their affiliate payouts too, carries a reason and an optional end date, and shows on Payouts.
- Lift a restriction, one at a time.
- Suspend or reactivate the trader. Suspending signs them out everywhere.
- Close accounts and reject payouts, the same as the consequences of Confirmed fraud, with a reason the trader reads.
- Contact them in a new ticket or a mail from your mail client.
- Wait until a date or until they answer. An answer in a ticket or a mail from their address ends the wait, and a date ends at the end of that day in your firm's timezone.
- Assign the case to somebody on your team. They are notified when a new flag comes in or the trader answers.
- Tags, which your team makes and colours itself.
- Add to the blocklist, which opens the Blocklist filled in with their address, domain or the IP address of a flag.
- An exception on a detector, which opens Trader overrides for them.
With a hand raised restriction or a payout hold you can write a text for the trader, separate from the reason your team reads. Without one they see the standard banner.
Select several cases in the table to give them the same outcome on all their open flags, assign them, tag them or put them on hold in one go.
None of this lifts a suspension by itself: reactivating a suspended trader is always its own decision.
In the older designs
Propper - OG and Tactical keep the queue per flag, with Resolve for a flag that was handled and Dismiss for a false positive. Both decide the flag for everybody in it and give back what it took. A dismissed flag does not come back for the same situation for 30 days. Reopening puts a flag back in the queue without putting back what deciding gave back. The decisions you make in either design show in the other: resolved reads as Confirmed fraud, dismissed as False alarm.
Settings from before this screen
Firms that had fraud detection set up before these screens existed keep what they had. Their old switches were converted to levels, with one exception made on purpose: a detector that used to restrict or block anything other than access came over as Flag. Nobody gets restricted or suspended by an upgrade. Turn those up yourself once you have looked at what they would catch.