Skip to main content
Every event you submit to AntifraudAI — whether a payment, a login attempt, or a custom action — passes through a multi-stage detection pipeline in real time. Within milliseconds, AntifraudAI enriches the event with contextual signals, scores it using machine learning models, applies your configured rules, and returns a clear decision: allow, review, or block. This page walks through each stage so you understand exactly what happens between your API call and the response.

​
The Detection Pipeline

1

Send an Event

Your application sends an event to the AntifraudAI API — a transaction, a user action, or a custom event you define. The event payload includes core fields like user_id, ip_address, device_fingerprint, and any business-specific metadata you choose to attach.
2

Signal Enrichment

AntifraudAI enriches the raw event with device intelligence, network context, and behavioral history. This produces a set of signals — observable risk indicators such as vpn_detected, new_device, or impossible_travel — that feed directly into scoring.
3

ML Model Scoring

One or more machine learning models evaluate the enriched event against patterns learned from fraud across the platform. Each model outputs a component score, which are combined into a single risk score between 0 and 100.
4

Rule Evaluation

Your customer-defined rules are applied on top of the ML score. Rules can nudge the score up or down by a fixed amount, or they can force a decision outright — for example, always blocking traffic from certain countries or always allowing trusted internal accounts.
5

Decision

A final decision is produced by mapping the resulting score against your configured thresholds. The API response contains the risk_score, the decision (allow, review, or block), and the list of signals that were detected.
6

Case Creation

When the decision is review, AntifraudAI automatically creates a Case in your dashboard. Your fraud operations team can then inspect the event details, view the signals, and manually mark the case as approved or rejected.
7

Webhook Delivery

If you have webhooks configured, AntifraudAI fires the relevant event notification asynchronously — for example, transaction.review or transaction.blocked. Webhooks are processed after the synchronous API response, so they do not affect latency.

​
Event Types

AntifraudAI supports three categories of events, giving you flexibility to screen any meaningful action in your product. Transaction events represent financial or payment actions — a card charge, a bank transfer, a withdrawal. They carry fields like amount, currency, payment_method, and billing address details. User events capture account-level actions such as logins, registrations, password changes, and address updates. These help AntifraudAI build a behavioral baseline for each user over time. Custom events are fully flexible and let you define your own event types — for example, promo code redemptions, API key generation, or content publishing. Custom events support arbitrary metadata so you can include whatever context is relevant to your business logic.

​
Response Anatomy

Every API call to /v1/events returns a JSON response with a consistent structure. Here is an example:

​
Latency

AntifraudAI is designed for real-time use. The synchronous API response — including enrichment, ML scoring, and rule evaluation — is typically returned in under 100 ms at the 99th percentile. This makes it suitable for inline checks at payment authorization time or during user authentication flows. Webhook delivery is handled asynchronously and is not subject to the same latency guarantee. Webhooks are dispatched after the synchronous response is sent and are subject to standard retry logic in the event of delivery failures.