Propper
PlatformFor your team07 of 14
Fraud detection

Find the person behind the accounts.

Detectors read every sign-in, every device and every trade across your firm. What they find adds up to one risk score per trader and lands in one review queue, riskiest first. Your team decides per flag and per person, and every outcome says exactly what it does.

Book a demoTry it below
DetectorsYour firm
VPNAn access check+10 points
Impossible travelFaster than 900 km/h+25 points
Shared device1 account per device+35 points
Group hedgingOpposite trades within 10 s+50 points
Copy trading85% alike, from 5 trades+40 points
EscalationSuspend when a new flag takes the score to 80
Restrict takes new orders and payouts
Across your firm
Device

Pick a trader to open their case.

What the detectors see
1Nadia signs in through a VPN203.0.113.24, a known VPN exitFlag raised, your team is told
2Marco and Ivo on one laptopOne device fingerprint behind 2 accountsFlag raised, your team is told
3Opposite trades, 4 seconds apartNQ: Marco buys 2, Ivo sells 2Not seen yet
4Sara and Tom trade alike11 of 12 trades matched, 92%Not seen yet
5Yuki in Lisbon, then Singapore11,900 km in 2 hours, 5,950 km/hNot seen yet
Review queue3 open
Fig. 07 · Try it · Detectors, a network and a review queueA simulation in your browser. Nothing is sent anywhere.
levels for every detector, from Off to Block
5
risk score at which a new flag suspends the trader, unless you change it
80
case per trader, however many flags they have
1
days a false alarm keeps the same situation quiet
30
Feature by feature

What fraud detection does, one part at a time.

01

Detectors in five areas

Fraud detection answers who is behind an account, a different question from how they trade. Detectors watch the network a trader comes from, where they are, the device they use, the accounts their trades line up with, and the referrals of your affiliates. Each one comes with a level and a score we chose, and every one of them is yours to change.

  • IP and network: VPN, Tor, residential proxies, datacenter addresses, shared addresses and subnets, concurrent sessions
  • Location: a country policy, impossible travel, a new country, a mismatch with registration, too many countries
  • Devices and linking: shared devices, emulators, headless browsers, group hedging, copy trading, a shared phone number
  • Affiliates: referrals on their own device or address, bursts of sign-ups, refunds after a discount
IP & Network
VPNTorResidential proxyDatacenter IPShared IPShared subnetConcurrent sessions
Location
Country policyImpossible travelNew countryRegistration mismatchToo many countries
Devices
Shared deviceEmulatorHeadless browserMissing fingerprint
Account linking
Group hedgingCopy tradingShared identity
Affiliates
Shares a device with referralsShares an IP with referralsSign-ups from one IPRefunds after a discount
VPNOut of the box: Flag, 10 points
02

Five levels, set per detector

Every detector has a level of its own, so a firm that blocks Tor, flags VPNs and only watches datacenter addresses sets exactly that. Block means something different for the checks that guard access: they refuse the session and suspend nobody, while every other detector on Block suspends the accounts it found.

  • Off does not run, Monitor writes it down without asking anybody
  • Flag puts it in the review queue and tells your team, the trader notices nothing
  • Restrict takes away what you decided Restrict takes, until somebody reviews it
  • Block refuses the session for an access check and suspends for every other detector
VPN, an access check
×

The session is refused at sign-in and on every request while the VPN is on. Nobody is suspended.

Adds nothing to the risk score
Shared device, two accounts
MBIP

Both accounts are suspended until somebody reactivates them.

Adds nothing to the risk score
03

A risk score that explains itself

Every trader has a risk score from 0 to 100, made of the points of the detectors they have an open flag from. Each line says where its points come from, so a score of 45 reads as 35 for a shared device and 10 for a VPN. You set the points per detector in steps of 5, and a change counts at once for flags that are already open.

  • A detector counts once, however many flags it raised
  • Only Monitor and Flag add points, at Restrict and Block the level is the consequence
  • A flag stops counting at an outcome, or 90 days after it was last seen unless you pick another window
  • Shown wherever the trader is: the queue, Users, payouts, accounts, tickets, monitoring and affiliates
Ivo PetrovRisk scoreMedium45
Shared device+35
VPNseen on 5 addresses, counted once+10
Impossible travelRestrict, no points
Trading rule: minimum hold timehow somebody trades, no points
04

A safety net under the levels

Detectors on Monitor and Flag never act by themselves, but their points add up. When a new flag takes a trader to the escalation score or past it, 80 unless you change it, that trader is suspended, and the flag that crossed the line says so. On a group flag every account is judged on its own total.

  • Only a new flag suspends, or an account newly added to a group flag
  • Raising a detector's points or seeing the same thing again never suspends anybody
  • A trader you reactivated stays active until something new comes in
  • One switch turns escalation off, another turns all of fraud detection off
Marco Bianchi0
Escalation at 80
Day 1Shared device+3535
Day 3VPN+1045
Day 4Group hedging+5095
Watched, nothing taken away
05

Accounts that trade together

Some fraud only shows across accounts. Group hedging finds two traders taking opposite sides of the same instrument within seconds, the classic way to pass a challenge on one account with the loss on the other. Copy trading finds two traders whose trades line up. Each account in a group is held to its own level and threshold, so an exception for one does not let the other through.

  • Hedging: opposite sides, same instrument, within 10 seconds, checked every five minutes
  • Copying: same instrument and direction within 60 seconds, from 85 percent of the trades alike
  • Copies your traders make between their own accounts are left out
  • A shared device or a shared phone number links accounts too
Window 10 s
Marco
Ivo
4 s apartOpposite sides of NQ, inside the window
06

Every sign-in, read three ways

A sign-in, and a new address in the middle of a session, are read for the network they come from, the place they put the trader and the device behind them. An address that hides where somebody is, such as a VPN, is judged as an address and never as a location, so a VPN exit in another country is not impossible travel.

  • VPN, Tor, residential proxies and datacenter addresses, each its own detector
  • Impossible travel at a top speed you set, 900 km/h unless you change it, over 300 km or more
  • A country policy as a blocklist or an allowlist, with how many of your traders it would have caught
  • A device fingerprint from every signed-in browser, which also gives away emulators and headless browsers
Sign-in · Yuki Tanaka198.51.100.23
Lisbon 09:10 AMSingapore 11:10 AM
NetworkHome broadbandNothing to flag
LocationSingapore, 2 hours after Lisbon5,950 km/h, the limit is 900Impossible travel
DeviceFingerprint a91f…3cAlso behind 1 other accountShared device
07

Affiliates who refer themselves

An affiliate who signs up their own second account, or a friend who buys with the discount and asks for a refund, costs you commission for nothing. These detectors judge the affiliate: the flag lands on the affiliate's account and names the referrals it found, and open signals show on the affiliate's own page.

  • A referral on the affiliate's own device, or on the same public address
  • More sign-ups from one address than you allow, within a window
  • Referrals who buy with a discount and get refunded, above a share you set
  • On Restrict their affiliate payouts are held, when Restrict takes those, and a single commission can be voided by hand
Affiliate
Shares a device with 2 referrals, 0 allowed
4 of 6 discounted purchases refunded, 67%Limit 50%
08

An outcome per person

The review queue holds one case per trader, riskiest first, so five flags about one person are one case with five pieces of evidence. Every flag gets an outcome for each trader in it, because on a shared device one can be a housemate and the other the fraud. Each outcome says what it does before you pick it.

  • Confirmed fraud keeps what the flag took, and offers to suspend, close the accounts and reject waiting payouts
  • False alarm gives it back, and the same situation does not flag them again for 30 days
  • Allowed gives it back and switches that detector off for this trader, until a date or for good
  • Assign a case, tag it, wait for a date or a reply, contact the trader, or decide many at once
Shared deviceOne fingerprint, two accountsRestrict
Marco BianchiRestriction kept
Ivo PetrovRestriction given back, quiet for 30 days
Settled: everybody in the flag has an outcome
09

Restrict means what you say it means

You decide once what Restrict takes away, and every detector on Restrict uses that. A restricted trader sees a banner listing what is held, without naming the detector, so it is no guide to getting around it. Closing a position is never blocked: a restriction that traps somebody in a losing trade is a dispute, not a safeguard.

  • No new orders, payouts on hold, no challenge purchases, affiliate payouts on hold
  • A restriction ends at False alarm or Allowed, at its end date, or when your team lifts it
  • Hold one trader's payouts by hand, with a reason and an end date, affiliate payouts included
  • A held payout cannot be approved or marked paid until the hold is released
Restrict takes
No new orders
Payouts on hold
No challenge purchases
Affiliate payouts on hold
What the trader sees
Your account is under review
  • Opening new positions is paused. You can still close the ones you have.
  • Payout requests are on hold.
10

Exceptions, and a list of what you refuse

A trader override holds one person to another level, score or threshold on one detector, with a reason and an end date, for the trader who really does travel for work. The blocklist is the opposite: an email address, a domain, an IP address or range, a device or a phone number your firm refuses outright, whatever any detector thinks.

  • An override starts from a flag, from a detector or from the trader page, and can end by itself
  • The blocklist checks sign-up, sign-in and a changed email address, and signs out a blocked device
  • An existing account it catches lands in the review queue with the entry that caught it
  • Your team is never held to it, and each entry shows who it reaches today
Nadia HaddadToo many countries
Your firm33 countries in 30 days
This trader88 countries in 30 days
ReasonTravels for work, asked in a ticket
EndsDecember 31, 2026Stops by itself at the end of that day
Questions

Questions about fraud detection

Not on Monitor or Flag: those only reach your team. On Restrict the trader sees a banner listing what is held, without naming the detector. On Block an access check refuses the session with a short reason, and any other detector suspends the account.

No. Out of the box VPN, residential proxies and datacenter addresses are on Flag, Tor is on Block, and the country policy and the missing fingerprint check are off. Every one of them is yours to move, and the anonymiser and country detectors show how many of your traders they would have caught in the last 30 days before you save.

The risk engine judges what a trader does with an account: loss limits, sizes and trading patterns such as scalping. Fraud detection judges who is behind it. A trading rule can still raise a flag in the same review queue, so your team has one place to look, but it never adds points to the risk score.

Shared IP allows two accounts on one address before it fires, and you can raise that for the whole firm or for one trader. When a group flag does come in, each person gets their own outcome, and Allowed switches that detector off for the one it is fine for.

No. Trades copied between a trader's own linked accounts are left out of it. The detector looks for different traders placing the same trades, which is a different thing.

Yes. Put it on Monitor: it writes down what it sees and adds its points, but asks nobody and takes nothing away. When the flags look right, move it up to Flag, Restrict or Block.

Works with

Nothing to connect. These parts already share the same traders, accounts and rules.

Your name on the door.
Our engine behind it.

Book a demo and we'll reach out with a migration plan built for your stack. No setup fees on monthly plans, no hidden costs.

Book a demo[email protected]