Geospatial and Context
Definition: physical distance, travel, or boundary. Use it for anything location based.
Construction: Double geospatial extensions directly on Payload coordinates for a single comparison, aggregated
through an Abstraction Rule when comparing against a longer term pattern. See the Rule Taxonomy.
| Question an analyst asks | Rule Taxonomy type that answers it |
|---|---|
| Is this payment within 5 km of the customer’s home? | Geospatial: IsWithinRadiusKm |
| Could the customer physically have travelled between the two events? | Geospatial: ImpliedTravelSpeedKmh |
| How many different countries in 24 hours? | Not this type: Cardinality |
| Is the transaction at an unusual time of day? | Context (below): DateTime extensions |
Geospatial: Single Comparison Between Two Points
Coordinates are Double payload values, so the geospatial steps are available on them directly. The value the pipeline
starts on is the first latitude, and the arguments are the first longitude, the second latitude, the second longitude,
then the limit, in that order. See the Rule Pipeline Reference. Further than 500 km
from a fixed point, such as a branch:
Matched = Payload.Latitude.MatchDistanceKmAbove(Payload.Longitude, 51.5074, -0.1278, 500)
A boundary test against a radius, using OutsideRadiusKm(longitude1, latitude2, longitude2, radiusKm):
Matched = Payload.Latitude.MatchOutsideRadiusKm(Payload.Longitude, Payload.HomeLatitude, Payload.HomeLongitude, 50)
WithinRadiusKm and DistanceKmBelow are the inverses. Each step has a miles form (WithinRadiusMiles,
OutsideRadiusMiles, DistanceMilesAbove, DistanceMilesBelow) taking the same arguments. The distance is great
circle, and is not a road distance.
Geospatial: Impossible Travel
Travel between two events needs the earlier event’s coordinates and the elapsed time.
ImpliedSpeedAbove(longitude1, latitude2, longitude2, hoursElapsed, kilometersPerHour) tests whether the implied speed
exceeds a plausible ceiling:
Matched = Payload.Latitude.MatchImpliedSpeedAbove(Payload.Longitude, Payload.PreviousLatitude, Payload.PreviousLongitude, Payload.ElapsedHours, 900)
The previous coordinates and elapsed time must be in the payload, either supplied by the sender, produced by an Inline
Function, or retrieved from history by an Abstraction Rule using the Actual Value Function Type with an Offset of
Last. The Abstraction route is the aggregated form described above: it compares the current event with a longer term
pattern held in the cache, at the cost of a cache retrieval per Search Key. See
Abstraction Rules. Zero elapsed hours is treated as infinite
speed, so two events at different places at the same instant match. ImpliedSpeedBelow is the inverse.
Context: Time and Calendar
Context rules use DateTime steps on payload dates, for example whether an event is at a weekend, outside business
hours, the end of a month, or older than a number of days. These are cheap, need no cache, and are best consumed as an
input to another type, for example a large transfer combined with an out of hours event:
Matched = Payload.TransactionDate.RequireIsWeekendInZone(Payload.CustomerZoneId).Against(Payload.CurrencyAmount).MatchGreater(10000)
The steps are IsWeekday, IsWeekend, IsMorning, IsAfternoon, WithinBusinessHours(startHour, endHour),
OutsideBusinessHours, IsToday, IsPast, IsFuture, OlderThanDays, YoungerThanDays, WithinDaysOf,
DayOfWeekIn,
IsStartOfMonth and IsEndOfMonth, with HourOfDay() and AgeInDays() as transformers. The plain extension methods
have different names (for example IsWeekendDay).
A customer in another timezone experiences a different hour, so a business hours or weekend test should be made in the
customer’s timezone. The InZone forms read the value as UTC, convert it to the named time zone (an IANA or Windows
identifier such as America/New_York), and then test, and an unknown zone fails the test:
Matched = Payload.TransactionDate.MatchOutsideWeekdayBusinessHoursInZone(Payload.CustomerZoneId, 8, 18)
The InZone steps are WithinBusinessHoursInZone, OutsideBusinessHoursInZone, WithinWeekdayBusinessHoursInZone,
OutsideWeekdayBusinessHoursInZone, IsWeekdayInZone and IsWeekendInZone, and the Weekday forms without a zone use
the value’s own clock, so a weekend counts as outside hours. ToZone(zoneId) converts the value and continues the
pipeline, so that any other DateTime test can be made in local time:
Matched = Payload.TransactionDate.ToZone(Payload.CustomerZoneId).MatchIsMorning()
The value is read as UTC, so the payload date must be UTC. Without an InZone form or ToZone, the test reasons in the
clock of the value as supplied. Age and tenure derived this way are the cross cutting Identity and Demographic variables
described in the Rule Taxonomy.
Geospatial and Context: Common Faults
Symptoms of a misbuilt Geospatial or Context rule, with the likely cause.
| Symptom in a Geospatial or Context rule | Likely cause |
|---|---|
| Distances are wildly wrong | Latitude and longitude arguments are swapped, or the coordinates are in a projection other than decimal degrees. |
| The impossible travel rule fires constantly | Elapsed time is in the wrong unit (hours are required), or the previous location is stale. |
| The business hours rule is wrong for customers | The test is not an InZone form or ToZone, so it reasons in the supplied clock; or the payload date is not UTC; or the zone identifier is unknown, which fails the test. |
| The rule does not match on missing coordinates | A null or NaN coordinate fails the test, so the rule does not match. Decide whether that is the outcome wanted. |
Examples by Sub-Class
Validated. Every fragment in this section is compiled individually through the Jube Parser, with its payload fields and its TTL Counter, Abstraction, Calculation, List and Sanction tokens declared, so each extension method and argument type is checked against the engine. Compilation does not validate a rule’s logic or its thresholds, which are illustrative placeholders to be tuned on data.
8.1 Impossible travel and distance
| # | Example | Description | Jube construction | Fragment | Notes |
|---|---|---|---|---|---|
| 8.1-01 | Impossible travel between consecutive transactions | Distance divided by elapsed time exceeds plausible speed. | Two Abstraction Rules keyed on Card, with Function Type Actual Value and Offset Type Last, return the previous latitude and longitude, and an Activation Rule holds the pipeline. HoursSincePrev is an Abstraction Rule with Function Type Since in Hours over the same Card key, giving the elapsed hours back to the prior event, and a minimum-gap Require step should be added so that same-instant pairs do not match. | Matched = Payload.Latitude.MatchImpliedSpeedAbove(Payload.Longitude, Abstraction.PrevLatitude, Abstraction.PrevLongitude, Abstraction.HoursSincePrev, 900) |
Check: 900 km/h is an analyst plausibility threshold, not a regulatory figure; calibrate against airline speeds and the false-positive rate. Tag: Geo · Fraud · Card/Account · consecutive events, speed ≥ 900 km/h |
| 8.1-02 | Impossible travel between consecutive logins | Same for login geolocations. | The same construction as 8.1-01, keyed on Account over login events, with Abstraction Rules returning the previous login coordinates. LoginLatitude and LoginLongitude are placeholder fields for the login payload, and HoursSincePrevLogin is an Abstraction Rule with Function Type Since in Hours keyed on Account. | Matched = Payload.LoginLatitude.MatchImpliedSpeedAbove(Payload.LoginLongitude, Abstraction.PrevLoginLatitude, Abstraction.PrevLoginLongitude, Abstraction.HoursSincePrevLogin, 900) |
Check: 900 km/h as 8.1-01. Tag: Geo · Fraud · Account · consecutive logins |
| 8.1-03 | Card-present transactions in two countries within hours | Physical presence conflict. | One Abstraction Rule with Search Key Card, Search Interval of 6 Hours and Function Type Distinct Count over CountryAlpha2 (a placeholder field), limited by its own match condition to card-present events, and an Activation Rule reads the count with the greater-than step. The threshold of 1 is an illustrative placeholder. | Matched = Abstraction.CpCountries6h.MatchGreater(1) |
Tag: Geo · Fraud · Card · 6h |
| 8.1-04 | Card-present and CNP in distant locations simultaneously | CP in one place; CNP from another. | Two Abstraction Rules keyed on Card with a 1 Hour Search Interval, Offset Type Last and Function Type Actual Value, limited to card-present events, return the last card-present coordinates. A Require step makes the card-not-present test a gate, and the 50 km distance is an illustrative placeholder; CNP events often carry no coordinates, so the rule is silent without them. | Matched = Payload.IsCardPresent.RequireIsFalse().Against(Payload.Latitude).MatchDistanceKmAbove(Payload.Longitude, Abstraction.LastCpLatitude, Abstraction.LastCpLongitude, 50) |
Check: None; window and distance are analyst choices. Tag: Geo · Fraud · Card · 1h |
| 8.1-05 | ATM withdrawal far from home | Distance to home location large. | Two Abstraction Rules keyed on Card with a 90 Day Search Interval and Function Type Median, over Latitude and over Longitude, give a crude home centroid, and a Require step on TxnType gates the test to ATM withdrawals. The median misplaces accounts with bimodal travel, the window should exclude the current withdrawal, and the 500 km distance is an illustrative placeholder. | Matched = Payload.TxnType.RequireEqual("ATM").Against(Payload.Latitude).MatchDistanceKmAbove(Payload.Longitude, Abstraction.HomeLatitude, Abstraction.HomeLongitude, 500) |
Tag: Geo · Fraud · Card · single event |
| 8.1-06 | Transaction far from last transaction | Distance to previous location. | The rolling form of 8.1-01: Abstraction Rules keyed on Card with Offset Type Last and Function Type Actual Value return the immediately prior coordinates, so there is no window beyond the lookback. The 50 km distance is an illustrative placeholder. | Matched = Payload.Latitude.MatchDistanceKmAbove(Payload.Longitude, Abstraction.PrevLatitude, Abstraction.PrevLongitude, 50) |
Tag: Geo · Fraud · Card · rolling |
| 8.1-07 | Transaction far from device location | Mobile GPS versus transaction location. | A single Activation Rule compares the device GPS pair with the transaction pair, with DeviceLatitude and DeviceLongitude as placeholder fields that the payload contract does not yet carry. The 1 km distance is an illustrative placeholder, and mobile GPS can itself be spoofed (see 8.3-14). | Matched = Payload.DeviceLatitude.MatchDistanceKmAbove(Payload.DeviceLongitude, Payload.Latitude, Payload.Longitude, 1) |
Tag: Geo · Fraud · Account · single event |
| 8.1-08 | Merchant distance from billing address | Spend far from home with no prior travel. | Distance of the merchant from the billing address. Upstream fields: Payload.MerchantLatitude, Payload.MerchantLongitude, Payload.BillingLatitude and Payload.BillingLongitude, supplied before Jube or by an inline-script hook. Distance 500 km is an illustrative placeholder. | Matched = Payload.MerchantLatitude.MatchDistanceKmAbove(Payload.MerchantLongitude, Payload.BillingLatitude, Payload.BillingLongitude, 500) |
Tag: Geo · Fraud · Card · single event |
| 8.1-09 | IP location far from billing/home address | IP geolocation mismatch. | Distance of the IP location from the account home centroid. Upstream fields: Payload.IpLatitude, Payload.IpLongitude, Payload.HomeCentroidLatitude and Payload.HomeCentroidLongitude (the home centroid is the 8.1-05 value, supplied as placeholder fields), supplied before Jube or by an inline-script hook. Distance 500 km is an illustrative placeholder. | Matched = Payload.IpLatitude.MatchDistanceKmAbove(Payload.IpLongitude, Payload.HomeCentroidLatitude, Payload.HomeCentroidLongitude, 500) |
Tag: Geo · Fraud · Session · single event |
| 8.1-10 | IP location differs from device GPS | Spoofed GPS or proxy. | Distance between the IP location and the device GPS location. Upstream fields: Payload.IpLatitude, Payload.IpLongitude, Payload.DeviceLatitude and Payload.DeviceLongitude, supplied before Jube or by an inline-script hook. Distance 100 km is an illustrative placeholder. | Matched = Payload.IpLatitude.MatchDistanceKmAbove(Payload.IpLongitude, Payload.DeviceLatitude, Payload.DeviceLongitude, 100) |
Tag: Geo · Fraud · Session · single event |
| 8.1-11 | IP country differs from SIM country | SIM-network versus IP country. | IP country differs from the SIM country already carried in the payload. Upstream field: Payload.IpCountryAlpha2, supplied before Jube or by an inline-script hook. Payload.SimCountryAlpha2 is already on the payload. | Matched = Payload.IpCountryAlpha2.MatchNotEqual(Payload.SimCountryAlpha2) |
Tag: Geo · Fraud · Session · single event |
| 8.1-12 | Time-zone mismatch between device and IP | Device clock vs IP region. | Difference between the device UTC offset and the IP UTC offset, in hours. Upstream fields: Payload.DeviceUtcOffsetHours and Payload.IpUtcOffsetHours (the IP offset is derived upstream from the IP time zone), supplied before Jube or by an inline-script hook. Tolerance 2 hours is an illustrative placeholder. | Matched = Payload.DeviceUtcOffsetHours.MatchDifferenceFromAbove(Payload.IpUtcOffsetHours, 2) |
Tag: Geo · Fraud · Session · single event |
| 8.1-13 | Language/locale mismatch with geography | Device language vs IP location. | IP country and device locale are not an expected pair. Upstream field: Payload.LocaleIpCountryKey, built by the hook as the device locale and IP country joined with the String.ConcatWith method, supplied before Jube or by an inline-script hook. List: List.ExpectedLocaleCountryPairs, the allowed locale and country keys. | Matched = Payload.LocaleIpCountryKey.MatchNotInList(List.ExpectedLocaleCountryPairs) |
Tag: Geo · Fraud · Session · single event |
| 8.1-14 | Pattern of consecutive “teleporting” ATM withdrawals | Multiple ATMs too far apart. | An Activation Rule holds this pipeline and ticks Increment TTL Counter on AtmTeleports, a Card-keyed counter over a 12 Hours interval with Sum off; a second Activation Rule with Matched = TTLCounter.AtmTeleports.MatchGreater(1) reads it, and the incrementing rule must have the higher Priority. The Abstraction Rules return the latest prior ATM coordinates, the same-instant guard from 8.1-01 applies, and the counter counts flagged ATM pairs rather than transactions. | Matched = Payload.TxnType.RequireEqual("ATM").Against(Payload.Latitude).MatchImpliedSpeedAbove(Payload.Longitude, Abstraction.PrevAtmLatitude, Abstraction.PrevAtmLongitude, Abstraction.AtmHoursSincePrev, 900) |
Check: 12h and the speed threshold are analyst parameters; the speed threshold has no regulatory basis. Tag: Geo · Fraud · Card · 12h |
8.2 Boundaries and geofences
| # | Example | Description | Jube construction | Fragment | Notes |
|---|---|---|---|---|---|
| 8.2-01 | Transaction inside high-risk geofence | Within polygons around conflict zones, border crossings, or flagged areas. | A List holds each geofence’s vertices as lat,lon strings, and the step is a bounded point-in-polygon test on the transaction coordinates. Circles are covered by the existing radius steps, but a polygon loops over its vertices, so it needs the new method. | Matched = Payload.Latitude.MatchIsInsidePolygon(Payload.Longitude, List.HighRiskGeofenceVertices) |
Check: Geofence boundaries are policy and intelligence data; verify source polygons against an authoritative dataset before use. Tag: Geo · AML · Transaction · single event |
| 8.2-02 | Transaction near sanctioned-territory border | Proximity to sanctioned regions (diversion risk). | Single event. The distance to the nearest border is computed by a geospatial enrichment upstream and supplied as BorderDistanceKm (placeholder). The 50 km cut-off is illustrative. | Matched = Payload.BorderDistanceKm.MatchLess(50) |
Check: Border geometry source and proximity distance are policy choices; verify the border dataset. Tag: Geo · AML · Transaction · single event |
| 8.2-03 | Activity at known ATM skimming hotspots | Cluster of compromised ATMs. | A List holds the hotspot centres as lat,lon strings, and the step is true when the point is within the radius of any centre. The single-centre step IsWithinRadiusKm does not cover a set, so the new method loops over the bounded list, and the 1 km radius is an illustrative placeholder. | Matched = Payload.Latitude.MatchIsWithinAnyRadiusKm(Payload.Longitude, List.SkimmingHotspotCentres, 1) |
Check: Hotspot coordinates come from fraud intelligence; verify their currency. Tag: Geo · Fraud · Card · single event |
| 8.2-04 | Activity at known fraud merchant location cluster | Geographic cluster of fraud. | An Activation Rule matching Payload.FraudLabelled.MatchIsTrue() ticks Increment TTL Counter on FraudCell, keyed on the geohash-6 cell from Payload.Latitude.ToGeohash(Payload.Longitude, 6) over a 30 Day interval with Sum off. A second Activation Rule reads the counter with the greater-than step, and the threshold of 3 is a placeholder; the counter must accept the derived key, or a Geohash6 payload field must be added. | Matched = TTLCounter.FraudCell.MatchGreater(3) |
Check: None; the 30d window and threshold are analyst choices. Tag: Geo · Fraud · Merchant · single event |
| 8.2-05 | Transaction in border town used for cross-border cash smuggling | Border locations and cash. | A List holds the border towns, the fuzzy similarity step absorbs spelling variation, and a Require step restricts the test to cash transactions. The 0.9 similarity is an illustrative placeholder, and TownName is a placeholder field. | Matched = Payload.TxnType.RequireEqual("CASH").Against(Payload.TownName).MatchSimilarityAtLeastAnyInList(List.BorderTowns, 0.9) |
Check: Border-town list is an intelligence list; verify its source and currency. Tag: Geo · AML · Transaction · single event |
| 8.2-06 | Transaction at port or free-trade-zone | FTZ-located counterparties for trade. | A single Activation Rule tests the counterparty location code against a List of port and free-zone codes, with UN/LOCODE as the usual key. CounterpartyLocationCode is a placeholder field. | Matched = Payload.CounterpartyLocationCode.MatchInList(List.PortAndFreeZoneCodes) |
Check: Verify the UN/LOCODE port and free-zone codes against the current UNECE table. Tag: Geo · AML · Trade · single event |
| 8.2-07 | Airport and duty-free spend without travel profile | Location inconsistent with history. | A List holds the airline and duty-free MCCs, and an Abstraction Rule with Search Key Card, a 365 Day Search Interval, Function Type Count and a home-country exclusion on its own match stands in for a travel profile. The Require step gates on the MCC and the Match step requires no prior foreign activity; MerchantCategoryCode is a placeholder field. | Matched = Payload.MerchantCategoryCode.RequireInList(List.AirportAndDutyFreeMccs).Against(Abstraction.ForeignCount365d).MatchEqual(0) |
Check: Verify MCC codes for airlines (4511 and related) and duty-free stores (5309) against the card-scheme MCC table. Tag: Geo · Fraud · Card · single event |
| 8.2-08 | Branch geofence mismatch | Branch transaction far from account home branch. | Two Dictionary definitions, HomeBranchLatitude and HomeBranchLongitude, are both keyed on the account’s HomeBranchCode, since a Dictionary holds one number per key. A Require step restricts the test to branch channel events, and the 1 km distance is an illustrative placeholder; TransactionChannel and HomeBranchCode are placeholder fields. | Matched = Payload.TransactionChannel.RequireEqual("BRANCH").Against(Dictionary.HomeBranchLatitude).MatchDistanceKmAbove(Dictionary.HomeBranchLongitude, Payload.Latitude, Payload.Longitude, 1) |
Tag: Geo · Both · Account · single event |
| 8.2-09 | Outside licensed jurisdiction | Activity from a state/country where the product is not licensed. | A List holds the licensed country codes, and a single Activation Rule matches sessions outside it. The session country from the channel is the field tested, not the card country, so CountryAlpha2 here is a placeholder for the session country. | Matched = Payload.CountryAlpha2.MatchNotInList(List.LicensedJurisdictions) |
Check: Licence scope is regulatory; verify against the current licence schedule. Tag: Geo · Both · Session · single event |
| 8.2-10 | Gambling from restricted region | Player location in a prohibited jurisdiction. | A List holds the prohibited region codes in ISO 3166-2 form, and a single Activation Rule matches players located in one. The operator must supply PlayerRegionCode, a placeholder field, and a geo-IP-derived region needs the external lookup described in 8.1-09. | Matched = Payload.PlayerRegionCode.MatchInList(List.ProhibitedRegions) |
Check: Prohibited-region lists are set by each gambling regulator; verify per jurisdiction. Tag: Geo · Both · Session · single event |
| 8.2-11 | Self-exclusion location conflicts | Venue/location near player’s exclusion. | The same method as 8.2-03, with the player’s excluded venues as centres and a 0.5 km radius as an illustrative placeholder. The fragment tests one shared List, so selecting the List by player id before the call is not expressed here. | Matched = Payload.Latitude.MatchIsWithinAnyRadiusKm(Payload.Longitude, List.PlayerExclusionVenueCentres, 0.5) |
Check: Exclusion radius is a policy parameter; verify against the operator’s self-exclusion rules. Tag: Geo · Both · Player · single event |
8.3 Location profile and context
| # | Example | Description | Jube construction | Fragment | Notes |
|---|---|---|---|---|---|
| 8.3-01 | First transaction in a new country | New country (also in class 2). | An Abstraction Rule keyed on Account over a Search Interval wide enough to cover the account’s history, with Function Type Same Count over CountryAlpha2, returns how many prior events share the current country. The test needs the rule to exclude the current event, otherwise the lowest value is one. | Matched = Abstraction.SameCountryLifetime.MatchEqual(0) |
Tag: Geo · Fraud · Account · lifetime |
| 8.3-02 | First transaction in a new city/region | New region for the customer. | As 8.3-01 on City, using a Same Count over City with an Account key. City names need normalisation or a stable city code, and City is a placeholder field. | Matched = Abstraction.SameCityLifetime.MatchEqual(0) |
Tag: Geo · Fraud · Account · lifetime |
| 8.3-03 | Unusual region for customer segment | Region atypical for the segment. | Two Abstraction Rules keyed on the customer segment rather than an entity, over a 90 Day Search Interval: a Same Count of RegionCode and a Count, whose ratio is tested. The rule must accept a non-entity Search Key, or the test is keyed on the customer against the segment baseline, and the 0.01 ratio is an illustrative placeholder. | Matched = Abstraction.SegmentSameRegion90d.MatchRatioOfBelow(Abstraction.SegmentTotal90d, 0.01) |
Check: 1% is an analyst threshold, not a regulatory figure. Tag: Geo · Fraud · Customer · 90d |
| 8.3-04 | Travel notification absent | Foreign spend without a travel notice. | A single Activation Rule with a Require step for an absent travel notice, followed by a not-equal test of the transaction country against the home country. HomeCountryAlpha2 and IsTravelNoticeActive are placeholder account-state fields supplied in the payload. | Matched = Payload.IsTravelNoticeActive.RequireIsFalse().Against(Payload.CountryAlpha2).MatchNotEqual(Payload.HomeCountryAlpha2) |
Tag: Geo · Fraud · Card · single event |
| 8.3-06 | Public holiday/weekend at merchant location | Merchant closed yet transaction approved. | A List holds public holiday dates in yyyy-MM-dd form, and MerchantLocalDayKey is a placeholder enrichment field carrying the merchant’s local date as a string, since DateTime has no list-membership step. The weekend half is a separate Activation Rule with Matched = Payload.TransactionDate.MatchIsWeekendInZone(Payload.MerchantTimeZoneId), which counts Saturday and Sunday. | Matched = Payload.MerchantLocalDayKey.MatchInList(List.PublicHolidayDates) |
Check: Weekend and public-holiday calendars differ by country. Flow.DateTime.MatchIsWeekendInZone uses Saturday-Sunday, so verify per merchant jurisdiction; confirm current holiday calendars. Tag: Geo · Fraud · Merchant · single event |
| 8.3-07 | Merchant outside opening hours | Transaction at closed business location. | Two Dictionary definitions, MerchantOpenHour and MerchantCloseHour, are keyed on MerchantId because a Dictionary holds one number per key. MerchantLocalHourAmount is a placeholder enrichment field holding the local hour as a decimal, and the test does not handle opening hours that run past midnight. | Matched = Payload.MerchantLocalHourAmount.MatchOutsideRange(Dictionary.MerchantOpenHour, Dictionary.MerchantCloseHour) |
Tag: Geo · Fraud · Merchant · single event |
| 8.3-08 | Merchant location versus declared business location mismatch | Terminal geolocation differs from registered address. | Two Dictionary definitions keyed on MerchantId hold the registered business location, which is geocoded at onboarding, and the terminal’s reported coordinates are the transaction payload. The 1 km distance is an illustrative placeholder. | Matched = Dictionary.MerchantDeclaredLatitude.MatchDistanceKmAbove(Dictionary.MerchantDeclaredLongitude, Payload.Latitude, Payload.Longitude, 1) |
Tag: Geo · Fraud · Merchant · single event |
| 8.3-09 | POS terminal relocation | Terminal appears in a new country/region. | Abstraction Rules keyed on TerminalId over a 30 Day Search Interval with Offset Type Last and Function Type Actual Value return the terminal’s prior coordinates, and the 5 km distance is an illustrative placeholder. The first event of a terminal has no prior location, so the rule is silent until the second, and the country-change check needs the prior country stored as a numeric code or a TTL Counter flag, since an Abstraction Rule returns numbers. | Matched = Payload.Latitude.MatchDistanceKmAbove(Payload.Longitude, Abstraction.TerminalPrevLatitude, Abstraction.TerminalPrevLongitude, 5) |
Check: Relocation distance is an analyst parameter. Tag: Geo · Fraud · Terminal · 30d |
| 8.3-10 | Distance between sender and beneficiary | Cross-continent small payments (scam indicator). | Four Dictionary definitions hold country centroids: sender latitude and longitude keyed on SenderCountryAlpha2, and beneficiary latitude and longitude keyed on BeneficiaryCountryAlpha2. A Require step gates the test on a small amount, the distance is coarse for large countries so it is a corridor signal only, and the 500 amount and 3,000 km distance are illustrative placeholders. | Matched = Payload.Amount.RequireLess(500).Against(Dictionary.SenderLatitude).MatchDistanceKmAbove(Dictionary.SenderLongitude, Dictionary.BeneficiaryLatitude, Dictionary.BeneficiaryLongitude, 3000) |
Check: Small-payment and distance thresholds are analyst parameters; the scam-indicator link is a typology claim, not a regulatory fact. Tag: Geo · Fraud · Payment · single event |
| 8.3-11 | Distance between home and branch cash deposit | Large deposits far away. | An Abstraction Rule keyed on Account over a 90 Day Search Interval with Function Type Median over Latitude and over Longitude gives the home centroid, as in 8.1-05, and two Dictionary definitions keyed on BranchCode give the branch coordinates. A Require step gates the test on the cash deposit transaction type, and the 50 km distance is an illustrative placeholder. | Matched = Payload.TxnType.RequireEqual("CASH_DEPOSIT").Against(Abstraction.HomeLatitude).MatchDistanceKmAbove(Abstraction.HomeLongitude, Dictionary.BranchLatitude, Dictionary.BranchLongitude, 50) |
Tag: Geo · AML · Account · single event |
| 8.3-12 | Many different cities in a day (movement radius) | Radius of gyration too large. | An Abstraction Rule keyed on Card over a 24 Hour Search Interval with Function Type Distinct Count over City counts distinct cities as a proxy for the movement radius, with the threshold of 3 as an illustrative placeholder. A true radius of gyration needs coordinate geometry, which would be a new method. | Matched = Abstraction.Cities24h.MatchGreater(3) |
Check: cityThreshold is an analyst parameter. Tag: Geo · Fraud · Card · 24h |
| 8.3-13 | Stationary device but moving transactions | Device reports a fixed location while spend moves. | Two Abstraction Rules keyed on Account over 24 Hours with Function Type Standard Deviation, one over DeviceLatitude and one over Latitude. The Require step is the near-zero spread test with the epsilon as a placeholder, and the rule should also use the longitude pair, since latitude alone misses east-west movement. | Matched = Abstraction.DeviceLatSd24h.RequireLess(0.0001).Against(Abstraction.TxnLatSd24h).MatchGreater(0.5) |
Tag: Geo · Fraud · Account · 24h |
| 8.3-14 | GPS spoofing / mock-location flag | Mock location provider enabled. | A single Activation Rule on a Boolean payload field supplied by the device SDK. IsMockLocation is a placeholder field name. | Matched = Payload.IsMockLocation.MatchIsTrue() |
Tag: Geo · Fraud · Device · per event |
| 8.3-15 | Altitude/speed implausible (device sensors) | Sensor inconsistency. | A single Activation Rule with a range check on the device altitude, with the bounds as placeholders. The sibling speed test, DeviceSpeedKmh greater than a maximum, has the same shape, and a terrain-aware altitude check needs an external elevation lookup, which would make it a C. | Matched = Payload.DeviceAltitudeAmount.MatchOutsideRange(-500, 9000) |
Check: The Dead Sea shore is about -430 m and Everest is 8,849 m (2019 survey); the speed maximum is an analyst choice. Verify the bounds. Tag: Geo · Fraud · Device · per event |
| 8.3-16 | Wi-Fi/cell-tower location mismatches IP geolocation | Network mismatch. | Distance between the cell-tower position and the IP position. Upstream fields: Payload.CellLatitude, Payload.CellLongitude, Payload.IpLatitude and Payload.IpLongitude, supplied before Jube or by an inline-script hook. Distance 200 km is an illustrative placeholder. | Matched = Payload.CellLatitude.MatchDistanceKmAbove(Payload.CellLongitude, Payload.IpLatitude, Payload.IpLongitude, 200) |
Tag: Geo · Fraud · Device · per event |
8.4 Cross-border and corridor geography
| # | Example | Description | Jube construction | Fragment | Notes |
|---|---|---|---|---|---|
| 8.4-01 | Payment corridor distance anomalies | Unusually distant corridor for a small remitter. | The per-event corridor distance must be a payload field, supplied by enrichment from country centroids in a Dictionary pair, because a fragment cannot compute and aggregate in one step. An Abstraction Rule keyed on Remitter over 90 Days with Function Type Median over CorridorDistanceAmount supplies the baseline, which the deviation step takes in place of a mean, and the 300 percent is an illustrative placeholder. | Matched = Payload.CorridorDistanceAmount.PercentDeviationFromMean(Abstraction.CorridorMedianKm).MatchGreater(300) |
Tag: Geo · AML · Payment · single event |
| 8.4-02 | Transit-country routing | Payments routed via third countries with no business reason. | A single Activation Rule tests the transit country against a List of watched countries. The no-business-reason part needs a purpose field (TransitPurposeCode, a placeholder), since free-text reasons are NLP and outside the fragment. | Matched = Payload.TransitCountryAlpha2.MatchInList(List.TransitWatchList) |
Check: Verify the transit watch list against current FATF public statements and internal risk policy. Tag: Geo · AML · Payment · single event |
| 8.4-03 | Funds returning to origin country via third country | Triangular geography. | Single-event form: beneficiary country equals origin country while the transit country differs from origin. Upstream fields: Payload.OriginCountryAlpha2, Payload.BeneficiaryCountryAlpha2 and Payload.TransitCountryAlpha2, supplied before Jube or by an inline-script hook. The multi-hop return path across transactions is not covered and stays with the graph route. | If (Payload.BeneficiaryCountryAlpha2 = Payload.OriginCountryAlpha2 And Payload.TransitCountryAlpha2 <> Payload.OriginCountryAlpha2) Then Return True |
Tag: Geo · AML · Account · 30d |
| 8.4-04 | Goods origin versus payment origin mismatch | Goods shipped from country A, paid from country B. | A single Activation Rule compares the trade-document origin with the payment origin, both ISO 3166 alpha-2 payload fields that are placeholder names here. | Matched = Payload.GoodsOriginCountryAlpha2.MatchNotEqual(Payload.PaymentOriginCountryAlpha2) |
Tag: Geo · AML · Trade · single event |
| 8.4-05 | Port-of-call versus declared route mismatch | Deviation from the shipment route. | A Dictionary holds one number per key, so it cannot return the allowed port list for a route. Enrichment instead builds DeclaredRoutePortKey from the declared route code and the port of call, a placeholder field, and one List holds the allowed route and port pairs, so a match means the port is not allowed on that route. | Matched = Payload.DeclaredRoutePortKey.MatchNotInList(List.AllowedRoutePortPairs) |
Tag: Geo · AML · Trade · single event |
| 8.4-06 | Cross-border cash declaration thresholds | Cash across borders around limits. | An Abstraction Rule keyed on Customer over a 24 Hour Search Interval with Function Type Sum over CashAmountReportingCcy, after enrichment converts to one reporting currency, is the aggregate test. The per-event just-below-limit test is the structuring form and is a separate Activation Rule, and the 10000 limit and 10 percent margin are illustrative placeholders. | Matched = Abstraction.CashSum24h.MatchGreater(10000) |
Check: Reporting and declaration thresholds vary by jurisdiction and direction. Verify, e.g., EU Regulation 2018/1672 (EUR 10,000 cash declaration) and US CMIR (USD 10,000); confirm currency and whether the test is per event or aggregate. The 10 percent margin is an analyst choice. Tag: Geo · AML · Customer · event |
| 8.4-07 | Multiple border-region ATMs in short sequence | Cash taken across the border. | An Activation Rule holds this pipeline and ticks Increment TTL Counter on BorderAtm, a Card-keyed counter over a 24 Hours interval with Sum off. A second Activation Rule with Matched = TTLCounter.BorderAtm.MatchGreater(3) reads it, the incrementing rule must have the higher Priority, and the border-region List is reference data. | Matched = Payload.TxnType.RequireEqual("ATM").Against(Payload.RegionCode).MatchInList(List.BorderRegions) |
Check: The 24h window is an analyst parameter. Tag: Geo · AML · Card · 24h |
8.5 Sector-specific geospatial rules
| # | Example | Description | Jube construction | Fragment | Notes |
|---|---|---|---|---|---|
| 8.5-01 | Accident location far from both parties’ addresses (insurance) | Staged accident far from home. | Four Dictionary definitions keyed on the policy and claimant ids hold the insured and claimant coordinates, each as one number. The Require step tests the distance from the insured address and the Match step tests the distance from the claimant’s address, so both must exceed the threshold, and the 50 km distance is an illustrative placeholder. | Matched = Payload.Latitude.RequireDistanceKmAbove(Payload.Longitude, Dictionary.InsuredLatitude, Dictionary.InsuredLongitude, 50).MatchDistanceKmAbove(Payload.Longitude, Dictionary.ClaimantLatitude, Dictionary.ClaimantLongitude, 50) |
Check: Distance threshold is an analyst parameter. Tag: Geo · Fraud · Claim · single event |
| 8.5-02 | Repeated claims at the same location | Location hotspot. | An Abstraction Rule keyed on the geohash-6 cell from Payload.Latitude.ToGeohash(Payload.Longitude, 6), with a 730 Day Search Interval and Function Type Count, counts claims at the location, using the same key derivation as 8.2-04. The threshold of 3 is a placeholder. | Matched = Abstraction.ClaimsAtCell730d.MatchGreater(3) |
Check: Read as 24 months, approximated as 730 days; confirm the intended unit. Tag: Geo · Fraud · Location · 24m |
| 8.5-03 | Claimant GPS/telematics contradicts claim narrative | Vehicle not at scene. | A single Activation Rule compares the telematics position with the accident coordinates. Only the location part of a contradiction is expressible, since the narrative is text and a free-text contradiction is outside the fragment, and the 1 km distance is an illustrative placeholder. | Matched = Payload.TelematicsLatitude.MatchDistanceKmAbove(Payload.TelematicsLongitude, Payload.AccidentLatitude, Payload.AccidentLongitude, 1) |
Tag: Geo · Fraud · Claim · single event |
| 8.5-04 | Property insured far from policyholder’s residence cluster | Geographic implausibility. | Two Dictionary definitions keyed on the policyholder hold the residence coordinates, geocoded at onboarding. A residence cluster with several addresses needs one entry per address and a nearest-address approximation, and the 50 km distance is an illustrative placeholder. | Matched = Payload.PropertyLatitude.MatchDistanceKmAbove(Payload.PropertyLongitude, Dictionary.ResidenceLatitude, Dictionary.ResidenceLongitude, 50) |
Tag: Geo · Fraud · Policy · onboarding |
| 8.5-05 | Player location jumps between restricted and allowed regions (gaming) | Geo-spoofing to play. | Two Abstraction Rules keyed on Player over a 24 Hour Search Interval with Function Type Count: one limited to RegionCode values in a List of restricted regions and one to values outside it. The Require step needs a restricted visit and the Match step an allowed one, which detects both sides within 24 Hours but not their order, so the jump is an approximation and the region must come from the operator (see 8.2-10). | Matched = Abstraction.RestrictedRegionCount24h.RequireGreater(0).Against(Abstraction.AllowedRegionCount24h).MatchGreater(0) |
Check: The 24h window is an analyst parameter. Tag: Geo · Both · Player · 24h |
| 8.5-06 | Multiple players at identical coordinates | Same physical location (multi-accounting). | An Abstraction Rule keyed on the geohash-9 cell from Payload.Latitude.ToGeohash(Payload.Longitude, 9), over a 24 Hour Search Interval with Function Type Distinct Count over PlayerId, counts distinct players at one place. GPS jitter means identical coordinates appear as the same cell, and the threshold of 5 is a placeholder. | Matched = Abstraction.PlayersAtCell24h.MatchGreater(5) |
Check: Geohash-9 cell size (about 5 m) should be verified against the geohash cell table. Tag: Geo · Fraud · Location · 24h |
| 8.5-07 | Exchange login countries exceed declared residency (crypto) | Residency evasion. | The per-login residency test is the Match step. An Abstraction Rule keyed on Account over a 30 Day Search Interval with Function Type Distinct Count over LoginCountryAlpha2 catches roaming across countries and is a separate Activation Rule that matches when the count is greater than one. | Matched = Payload.LoginCountryAlpha2.MatchNotEqual(Payload.DeclaredResidencyAlpha2) |
Check: Residency regimes for crypto exchanges are jurisdictional; verify the declared-residency field and the applicable regime. Tag: Geo · AML · Account · 30d |
| 8.5-08 | Trading from sanctioned geography despite declared address | Geo-IP in sanctioned territory. | A List holds the sanctioned CIDR blocks, and the step is true when the IPv4 address falls in any of them. The declared-address half is a separate test of the declared country against a List of sanctioned countries, and IPv6 needs a separate check. | Matched = Payload.IP.MatchIsInAnyCidr(List.SanctionedCidrBlocks) |
Check: Sanctioned-territory lists change frequently; verify against current OFAC, EU and UK designations at build time. Geo-IP block lists go stale quickly. Tag: Geo · AML · Account · per event |
| 8.5-09 | Remittance receiver pick-up location far from stated address | Collector pattern. | Two Dictionary definitions keyed on ReceiverId hold the stated receiver address, geocoded at onboarding, and the pick-up coordinates come from the agent terminal in the payload. The 10 km distance is illustrative, and PickupLatitude and PickupLongitude are placeholder fields. | Matched = Payload.PickupLatitude.MatchDistanceKmAbove(Payload.PickupLongitude, Dictionary.ReceiverLatitude, Dictionary.ReceiverLongitude, 10) |
Tag: Geo · AML · Receiver · 30d |
| 8.5-10 | Agent transactions geolocated away from agent’s registered site | Mobile-money agent roaming. | Two Dictionary definitions keyed on AgentId hold the registered site from agent master data, and the transaction location is the terminal’s reported position. The 1 km distance is an illustrative placeholder. | Matched = Payload.Latitude.MatchDistanceKmAbove(Payload.Longitude, Dictionary.RegisteredLatitude, Dictionary.RegisteredLongitude, 1) |
Tag: Geo · AML · Agent · 24h |
| 8.5-11 | Cash-in and cash-out at agents on either side of a border | Cross-border via mobile money. | An Abstraction Rule keyed on Wallet over a 24 Hour Search Interval with Offset Type Last and Function Type Actual Value returns the prior agent coordinates, and the short distance is the border-side approximation. The country-change gate cannot be expressed here because an Abstraction Rule returns numbers, so it needs the prior country stored as a numeric code or a TTL Counter flag, and the 5 km distance is a placeholder. | Matched = Payload.Latitude.MatchDistanceKmBelow(Payload.Longitude, Abstraction.PrevAgentLatitude, Abstraction.PrevAgentLongitude, 5) |
Check: The short-distance threshold is an analyst parameter. Tag: Geo · AML · Wallet · 24h |
| 8.5-12 | Delivery address distance from IP location (e-commerce) | Shipping far from buyer. | Distance between the delivery address and the IP location. Upstream fields: Payload.DeliveryLatitude, Payload.DeliveryLongitude, Payload.IpLatitude and Payload.IpLongitude, supplied before Jube or by an inline-script hook. Distance 300 km is an illustrative placeholder. | Matched = Payload.DeliveryLatitude.MatchDistanceKmAbove(Payload.DeliveryLongitude, Payload.IpLatitude, Payload.IpLongitude, 300) |
Tag: Geo · Fraud · Order · single event |
| 8.5-13 | Driver GPS trace inconsistent with trip (gig platforms) | Fake trips. | A Require step tests that the trace start is near the pick-up point, and the Match step tests that the trace distance is below the trip distance, on the assumption that the platform sends trace summary fields. The tolerance multiplier is not expressed, so the comparison is against the trip distance directly, and full trace replay is outside a single fragment. | Matched = Payload.TraceStartLatitude.RequireDistanceKmAbove(Payload.TraceStartLongitude, Payload.PickupLatitude, Payload.PickupLongitude, 1).Against(Payload.TraceDistanceAmount).MatchLess(Payload.TripDistanceAmount) |
Check: The tolerance is an analyst parameter. Tag: Geo · Fraud · Trip · single event |
| 8.5-14 | Branch cash deposit location far from account’s usual cluster | Deposit location outlier. | Two Abstraction Rules keyed on Account over a 365 Day Search Interval with Function Type Median over the Latitude and Longitude of prior cash deposits give the usual deposit location, as in 8.1-05. The Require step gates the test on a cash deposit, the window must exclude the current deposit, and the 50 km distance is a placeholder. | Matched = Payload.TxnType.RequireEqual("CASH_DEPOSIT").Against(Abstraction.DepositMedianLatitude).MatchDistanceKmAbove(Abstraction.DepositMedianLongitude, Payload.Latitude, Payload.Longitude, 50) |
Tag: Geo · AML · Account · single event |
| 8.5-15 | Corporate user approving payments from unexpected country | Approver abroad without notice. | An Abstraction Rule keyed on User over a 90 Day Search Interval with Function Type Same Count over CountryAlpha2 applies the first-in-country test per approver, and the Require step gates it on no travel notice. IsTravelNoticeActive is a placeholder field. | Matched = Payload.IsTravelNoticeActive.RequireIsFalse().Against(Abstraction.ApproverSameCountry90d).MatchEqual(0) |
Tag: Geo · Fraud · User · per event |
| 8.5-16 | Vendor address geocodes to residential or vacant lot | Fake vendor. | Vendor address type is residential or vacant. Upstream field: Payload.VendorAddressType, supplied before Jube or by an inline-script hook. List: List.ResidentialOrVacantAddressTypes, containing RESIDENTIAL and VACANT. | Matched = Payload.VendorAddressType.MatchInList(List.ResidentialOrVacantAddressTypes) |
Tag: Geo · Fraud · Vendor · onboarding |
| 8.5-17 | Many vendors geocoded to one location | Vendor cluster. | An Abstraction Rule keyed on the geohash-7 cell from Payload.VendorLatitude.ToGeohash(Payload.VendorLongitude, 7), over a lifetime window with Function Type Distinct Count over VendorId, counts distinct vendors at one place, and the threshold of 5 is a placeholder. | Matched = Abstraction.VendorsAtCell.MatchGreater(5) |
Check: Geohash-7 cell size (about 150 m) should be verified against the geohash cell table. Tag: Geo · Fraud · Location · lifetime |
| 8.5-18 | Charity payments to conflict zones (NPO) | Conflict-area proximity. | A Require step gates the test on the NPO flag, and a List holds the conflict-zone countries, so the Match step tests the beneficiary country against it. The conflict-zone membership is policy reference data. | Matched = Payload.IsNpo.RequireIsTrue().Against(Payload.BeneficiaryCountryAlpha2).MatchInList(List.ConflictZoneCountries) |
Check: Conflict-zone lists are policy and change; verify the source (e.g., UN, FATF or internal risk policy). Tag: Geo · AML · NPO · per transaction |
| 8.5-19 | Vessel AIS gap near sanctioned ports (trade) | Dark activity. | A List holds the sanctioned port codes, and the nearest port code comes from the AIS provider, so near means a port match rather than a coordinate test. An Abstraction Rule keyed on Vessel with Function Type Since in Hours gives the hours since the prior AIS report, and the 24 hour gap is an illustrative placeholder. | Matched = Payload.NearestPortCode.RequireInList(List.SanctionedPorts).Against(Abstraction.AisHoursSincePrev).MatchGreater(24) |
Check: The gap length is an analyst parameter; verify the sanctioned port list against current designations. Tag: Geo · AML · Vessel · voyage |
| 8.5-20 | Shipment route deviation through high-risk ports | Route anomaly. | A List holds the high-risk ports and a Require step gates on them. Deviation is a not-in-list test against a List of allowed route and transit port pairs, since a Dictionary holds only one number per key, and RouteTransitPortKey is a placeholder enrichment field combining the declared route code and the transit port. | Matched = Payload.TransitPortCode.RequireInList(List.HighRiskPorts).Against(Payload.RouteTransitPortKey).MatchNotInList(List.DeclaredRouteTransitPairs) |
Check: Verify the high-risk port list against current policy and sanctions sources. Tag: Geo · AML · Shipment · voyage |
8.6 Device and environment context rules
| # | Example | Description | Jube construction | Fragment | Notes |
|---|---|---|---|---|---|
| 8.6-01 | Device battery/charging state implausible for session count | Emulator indicator. | An Abstraction Rule keyed on DeviceId over 24 Hours with Function Type Standard Deviation over BatteryLevel gates the test on near-constant battery, and a second Abstraction Rule with Function Type Count over the same key counts sessions. Constant battery across many sessions suggests an emulator, and the epsilon and session count are placeholders. | Matched = Abstraction.BatterySd24h.RequireLess(0.01).Against(Abstraction.Sessions24h).MatchGreater(20) |
Tag: Context · Fraud · Device · per event |
| 8.6-02 | Device uptime and app install age mismatch | Freshly installed app on long-running device patterns. | A single Activation Rule compares uptime with app install age. As worded it is weak because uptime resets on reboot, so it should be used only with a reboot count or dropped, and DeviceUptimeSeconds and AppInstallAgeSeconds are placeholder fields. | Matched = Payload.DeviceUptimeSeconds.MatchLess(Payload.AppInstallAgeSeconds) |
Check: The implied impossibility in the example is not sound: device uptime resets on reboot, so uptime below install age is ordinary. Tag: Context · Fraud · Device · per event |
| 8.6-03 | Screen resolution/user agent inconsistency | Spoofed browser. | A Dictionary cannot return a set of resolutions, so enrichment combines the user-agent family and the screen resolution into UserAgentResolutionKey, a placeholder field, and one List holds the plausible pairs. The List needs a maintained reference table, since stale tables cause false positives on new devices. | Matched = Payload.UserAgentResolutionKey.MatchNotInList(List.PlausibleUserAgentResolutions) |
Tag: Context · Fraud · Session · per event |
| 8.6-04 | Accessibility services enabled during payment (overlay risk) | Malware abuse vector. | A single Activation Rule on a Boolean payload field supplied by the device SDK. The field name is a placeholder. | Matched = Payload.AccessibilityServiceEnabled.MatchIsTrue() |
Tag: Context · Fraud · Device · per event |
| 8.6-05 | Developer mode/USB debugging enabled | Compromised device environment. | A single Activation Rule on the developer mode Boolean from the device SDK. The USB debugging flag is the sibling Boolean and would be a second Activation Rule, and both field names are placeholders. | Matched = Payload.DeveloperModeEnabled.MatchIsTrue() |
Tag: Context · Fraud · Device · per event |
| 8.6-06 | Clipboard contains wallet address at payment time | Clipper malware or scam instructions. | The method recognises well-formed Bitcoin and Ethereum addresses by format and checksum, which is stateless and bounded. Clipboard contents are sensitive device data, so collecting them is a privacy decision as well as a detection choice, and ClipboardText is a placeholder field. | Matched = Payload.ClipboardText.MatchIsCryptoWalletAddress() |
Check: Verify the validator against each chain’s address specification (Bitcoin base58check and bech32; Ethereum EIP-55 checksum). Tag: Context · Fraud · Device · per event |
| 8.6-07 | Phone call in progress during banking session | Call-while-paying (vishing). | A single Activation Rule on a Boolean from the device SDK. On Android it needs the phone-state permission. | Matched = Payload.IsCallInProgress.MatchIsTrue() |
Tag: Context · Fraud · Session · per event |
| 8.6-08 | Screen-sharing/screen-recording active | RAT or coached session. | A single Activation Rule on a Boolean payload field supplied by the device SDK. The field name is a placeholder. | Matched = Payload.IsScreenCaptureActive.MatchIsTrue() |
Tag: Context · Fraud · Session · per event |
| 8.6-09 | Keyboard type is remote/virtual input | Automation. | A single Activation Rule on an enum field from the device SDK. The value set depends on the SDK and must be verified, and InputMethodType is a placeholder field name. | Matched = Payload.InputMethodType.MatchIn("REMOTE", "VIRTUAL") |
Tag: Context · Fraud · Session · per event |
| 8.6-10 | Multiple sessions from same device within seconds across accounts | Mule farm. | An Abstraction Rule keyed on DeviceId over a one-minute Search Interval with Function Type Distinct Count over AccountId counts accounts sharing the device. The one-minute interval must be supported by the rule, otherwise a TTL Counter with the shortest interval is the fallback. | Matched = Abstraction.AccountsPerDevice1m.MatchGreater(1) |
Tag: Context · Fraud · Device · 1m |