**Fraud** in your admin sidebar holds four entries in the standard design.
The **Review queue** is where traders with flags wait for a decision, one case
per person. **Detectors** holds
every detector with its level, score and thresholds, and under General what
each level actually does. **Trader overrides** holds the exceptions for single
traders, and the [Blocklist](/docs/platform/admin/fraud-blocklist) what your
firm refuses outright.

Propper - OG and Tactical split the same settings over eight entries. The queue
is called **Fraud overview** there. **IP & Network**, **Location**, **Devices**,
**Account linking** and **Affiliates** each hold the detectors of one kind,
**Trader overrides** holds the exceptions, and **Enforcement** decides what each
level actually does.

You need the `view_fraud` permission to open these screens and `manage_fraud`
to change anything on them. `manage_fraud` covers everything in the review
queue, including suspending a trader, closing their accounts and rejecting
their payouts.

These screens are about who is behind an account. What a trader does with it,
such as scalping or martingale sizing, lives on
[Trading rules](/docs/platform/admin/trading-rules). Its flags still land in the
review queue, so there is one place to review.

## The five levels

Every detector has its own level. A firm that blocks Tor, flags VPNs and only
watches datacenter IPs sets exactly that.

| Level    | What happens when the detector fires |
| -------- | ------------------------------------ |
| Off      | The detector does not run. |
| Monitor  | It is recorded silently. Nobody is asked to look, and the trader only shows in the queue's Monitor view. |
| Flag     | A flag goes into the review queue, and your team is notified when that is switched on. The trader notices nothing. |
| Restrict | Flags, and takes away what Enforcement says Restrict takes, until the flag is reviewed. |
| Block    | An access check refuses the session. Any other detector suspends the accounts involved. |

The access checks are VPN, Tor, residential proxy, datacenter IP, the country
policy and a missing fingerprint. On Block they refuse the session at login and
on every request while the condition holds, and they suspend nobody. Every
other detector on Block suspends the account, or every account in the group for
a group detector. A suspended account stays suspended until someone reactivates
it on the trader page.

## The risk score

Every trader has a risk score from 0 to 100. Each detector they have an active
flag from adds its own points, once per detector however many flags it raised:
VPN from five addresses is still the VPN score. The total stops at 100.

| Detector set to | What it adds |
| --------------- | ------------ |
| Off | Nothing. |
| Monitor, Flag | Its score. |
| Restrict, Block | Nothing. The level is already the consequence. |

Every detector comes with a score we set to what its signal is worth: 10 for a
VPN, 30 for Tor, 35 for a shared device, 50 for group hedging. In the standard
design you set your own under the level of each detector, from 0 to 100 in steps
of 5. The slider stays on screen, greyed, while the detector is on Off,
Restrict or Block, so you can see the option is there. A new score counts at
once for flags that are already open.

A flag counts for a trader until that trader has an outcome on it, and stops
counting a while after a detector last saw the situation: 30, 60, 90, 180 or 365 days, or never,
under General. The default is 90 days. A Monitor flag is never decided by
anybody, so without that window it would count for ever.

On a group flag every account in it gets the full score, except one an override
kept out of it. Flags from Trading rules never add points: they are about how
somebody trades, and carry their own consequence.

Wherever a trader's flags show, the score shows with where it comes from, line
by line: the trader page and its Fraud tab, the review queue, payouts, trading
accounts, tickets, live monitoring and affiliates. A line opens its flag. In a
list the score is a number with the lines on hover. The users list and the
review queue sort by it.

Each trader can have a score of their own on a detector, in a trader override.

Propper - OG and Tactical show no scores. On those designs every detector counts
with its score from the standard design, which is our default until somebody
changes it there.

## The detector screens

In the standard design every detector sits in one list, grouped by kind, with
its level beside its name and how many flags it has open. Pick one and the rest
of the screen is that detector: the five levels with what each one does for
this detector, its thresholds, and beside them its open flags and the traders
who have an exception. J and K walk the list, and the address follows what you
pick, so a link opens one detector. A dot marks a detector you changed and have
not saved, and one save covers everything you changed, on any detector and
under General.

On Propper - OG and Tactical each kind has a screen of its own, with every
detector as a card and a panel that sets them all to one level at once.

Both warn about settings that will not do what you expect, such as Restrict
while Restrict takes nothing, or an allowlist with no countries on it.

Where we have the data, the screen also says how many of your traders a
detector would have caught over the last 30 days. Turning VPN up to Block shows how many traders
were on a VPN this month before you save. On the country policy and the country
limit, that number recounts while you edit the list or the threshold.

| Screen | Detectors and their thresholds |
| ------ | ------------------------------ |
| IP & Network | VPN, Tor, residential proxy and datacenter IP. Shared IP and shared subnet, each with the number of accounts allowed, and the subnet size (/16 to /28). Concurrent sessions, with the addresses allowed at once and the window that counts as the same moment. |
| Location | Country policy as a blocklist or an allowlist. Impossible travel, with a top speed, a minimum distance and how far back to look. New country. Registration mismatch. Too many countries, with the countries allowed and the window they are counted over. |
| Devices | Shared device, with the accounts allowed per device. Emulator. Headless browser. Missing fingerprint, with a grace period before the fingerprint has to have arrived. |
| Account linking | Group hedging, with the window for opposite trades. Copy trading, with the similarity, the minimum number of matching trades, the match window and how far back to look. Shared payment method and shared identity, each with the accounts allowed. |
| Affiliates | An affiliate sharing a device with their referrals, and sharing an IP with them, each with the referrals allowed before it fires. Signups from one IP, with the signups allowed per address and the window. Refunds after a discount, with the refunded share, the minimum number of discounted purchases and how far back to look. |

The Affiliates detectors judge the affiliate, not the referrals: the flag lands
on the affiliate's account and names the referrals it found. Local and private
addresses never count, so a household or an office network behind one router
does not look like one person. Nothing on this screen touches commission. Put a
detector on Restrict to hold the affiliate's payouts, and void a single
commission on the affiliate's own page in Affiliates. Open signals show at the
top of that page for anyone who may open Fraud.

## Trader overrides

An override holds one trader to a different level, a different score, a
different threshold, or any of those together, on one detector. It carries a reason and, if you want, an end date, after
which it stops by itself.

Only the thresholds marked as able to differ per trader can be overridden.
The rest, such as the subnet size or how far back copy trading looks, belong to
the firm as a whole.

On a group detector, each account in the group is judged against its own
settings. If two traders share an IP and one of them has an override allowing
it, the flag still names both, but only the other one is restricted or
suspended. The exempt trader is marked as such in the flag.

In the standard design **Trader overrides** opens on a table of every override:
the trader, the detector, what it changes, when it last changed and when it
ends, sorted by either of those or by name. Nothing opens until you pick one.
The table then folds to a column beside it, and Escape folds it back. The one you
pick is the form itself: its level, its score and every
threshold that can differ, each next to what the firm has set, then the reason
and the end date. An end date runs to the end of that day where you are. A new
override starts there, from a flag in the review queue, or from a detector's
exceptions on the Detectors screen, filled in with the trader and detector you
came from. If that trader already has one on that detector, it opens instead.

On Propper - OG and Tactical a new override opens as a dialog on the overrides
screen, also from the link on a detector card. In every design the trader page
lists that trader's overrides and restrictions, with a button that starts a new
override for them.

## Enforcement

In the standard design these settings are **General**, at the top of the
Detectors list.

**What Restrict takes away** is set once for every detector on Restrict:

| Restriction | What the trader notices |
| ----------- | ----------------------- |
| No new orders | Open positions keep running and can be closed. Pending orders that trigger are cancelled. |
| Payouts on hold | A payout request is refused with a message. |
| No challenge purchases | They cannot buy or claim a challenge. A challenge you grant still goes through. |
| Affiliate payouts on hold | Commission keeps building up, but cannot be withdrawn. |

A restricted trader sees a banner listing what is held. It does not name the
detector, so it is not a guide to getting around it. A restriction ends when
the trader gets False alarm or Allowed on its flag, when its end date passes,
or when you lift it in the review queue or on the trader page. Lifting clears
the trader and leaves the flag in the queue. Confirmed fraud keeps it.

**Escalation** is the safety net under the levels. When a new flag takes a
trader's risk score to the escalation score or higher, that trader is
suspended, even when every detector involved is on Monitor or Flag. A group
flag can do that for each account in it. Only a new flag, or an account newly
added to a group flag, suspends: raising a detector's score, or a detector
seeing the same situation again, never suspends anybody by itself. The flag that
crossed the line is marked as the one that suspended the trader.

The master switch on this screen turns all of fraud detection off. Nothing runs
and nothing is enforced while it is off.

## The review queue

In the standard design the review queue holds one case per trader, not one row
per flag. Five flags about the same person are one case with five pieces of
evidence. It opens on a table of the traders waiting for a decision, highest
risk score first: who it is, why they are there, their risk score, whether
something is restricted or held, who the case is assigned to, its tags and when
the last flag came in. Nothing opens until you pick a trader, so nobody's
details are on screen before you ask for them.

The views above the table split the work:

| View | Who is in it |
| --- | --- |
| To review | Traders with a flag that has no outcome for them yet, unless their case is waiting. The default. |
| Mine | Every open case assigned to you, waiting or not. |
| Waiting | Cases put on hold until a date or until the trader answers. |
| Restricted | Traders something is taken from right now, whose payouts are held, or who are suspended, whatever their flags say. |
| Monitor | Traders whose only undecided flags come from detectors on Monitor. |
| Decided | Traders whose every flag has an outcome, most recently decided first. |
| All | Everybody with a flag. |

Search by name, email address or public id, filter by detector type, level,
assignee and tag, and sort by risk score, newest, oldest, most recently decided
or name. Every case has a link of its own, and an old link to a single flag,
such as the one in a notification, opens the case of the trader it is about on
that flag.

### One case

The case shows the person: their risk score line by line, what is restricted
and why, a payout hold, the money they spent and were paid out, their accounts,
the team's pinned notes and their tags. Under it three tabs. **Flags** lists
their open flags first and the decided ones under them, with one flag in full:
what the detector saw, every trader behind it, and the other traders of yours
seen on the same address. **Timeline** puts every flag and everything the team
did on this case in one list, newest first. **Notes** holds the team's notes on
this trader, the same notes as on the Users screen.

### Deciding a flag

Every flag gets an outcome for each trader in it. On a group flag one person
can be a housemate and the other the fraud, so each gets their own. The flag is
done once everybody in it has one.

| Outcome | What it does |
| --- | --- |
| Confirmed fraud | It was fraud. What the flag took from this trader stays taken until somebody lifts it. A dialog offers the consequences: suspend the trader, close every account that still trades (open positions at the market price, status Breached), and reject their waiting payouts. Each is optional. |
| False alarm | It was not fraud. The flag gives back what it took from this trader, stops counting toward their score, and the same situation does not flag them again for 30 days. |
| Allowed | True, but fine for this trader, such as a VPN they always use. Gives back what was taken and switches that detector off for them with a trader override, until a date or for good. Not offered for a flag from Trading rules or one raised by hand, since there is no detector to make an exception on. |

You can add a note to any outcome. Picking another outcome replaces the first,
and **Reopen** takes it back, so the flag asks again and counts toward the
score. Reopening does not put back what deciding gave back. A trader leaves
To review by themselves once every flag has an outcome for them, and a new flag
puts them back. Somebody confirmed as fraud whose restriction you keep stays in
the Restricted view, so they do not get lost. Deciding the open case moves on
to the next one in the table.

### Acting on the person

Besides the outcomes, the case has the actions a reviewer needs on the trader
themselves:

- **Raise a flag** by hand, with a reason and the level Flag, Restrict or Block.
  Restrict takes what Enforcement says Restrict takes, Block suspends. It shows
  as its own flag in the case and adds no points to the score.
- **Hold payouts**: new requests are refused, and a waiting request cannot be
  approved or marked paid until somebody releases the hold. It covers their
  affiliate payouts too, carries a reason and an optional end date, and shows
  on Payouts.
- **Lift a restriction**, one at a time.
- **Suspend** or **reactivate** the trader. Suspending signs them out
  everywhere.
- **Close accounts** and **reject payouts**, the same as the consequences of
  Confirmed fraud, with a reason the trader reads.
- **Contact** them in a new ticket or a mail from your mail client.
- **Wait** until a date or until they answer. An answer in a ticket or a mail
  from their address ends the wait, and a date ends at the end of that day in
  your firm's timezone.
- **Assign** the case to somebody on your team. They are notified when a new
  flag comes in or the trader answers.
- **Tags**, which your team makes and colours itself.
- **Add to the blocklist**, which opens the [Blocklist](/docs/platform/admin/fraud-blocklist)
  filled in with their address, domain or the IP address of a flag.
- **An exception** on a detector, which opens Trader overrides for them.

With a hand raised restriction or a payout hold you can write a text for the
trader, separate from the reason your team reads. Without one they see the
standard banner.

Select several cases in the table to give them the same outcome on all their
open flags, assign them, tag them or put them on hold in one go.

None of this lifts a suspension by itself: reactivating a suspended trader is
always its own decision.

### In the older designs

Propper - OG and Tactical keep the queue per flag, with **Resolve** for a flag
that was handled and **Dismiss** for a false positive. Both decide the flag for
everybody in it and give back what it took. A dismissed flag does not come back
for the same situation for 30 days. Reopening puts a flag back in the queue
without putting back what deciding gave back. The decisions you make in either
design show in the other: resolved reads as Confirmed fraud, dismissed as False
alarm.

## Settings from before this screen

Firms that had fraud detection set up before these screens existed keep what
they had. Their old switches were converted to levels, with one exception made
on purpose: a detector that used to restrict or block anything other than
access came over as Flag. Nobody gets restricted or suspended by an upgrade.
Turn those up yourself once you have looked at what they would catch.