Build Custom Fraud Detection Rules in AntifraudAI Engine

AntifraudAI’s machine-learning engine is powerful out of the box, but every business has unique risk tolerances and edge cases that a general model cannot anticipate. Custom rules let you encode your own business logic on top of ML scoring: explicitly block transactions from specific regions, bypass scoring for known-trusted users, or adjust scores when certain conditions are met. Rules are evaluated at screening time alongside the ML model and can override or modify the final decision.

Types of Rules

Action	Description
`block`	Always return `decision=block` when the condition matches, regardless of ML score
`allow`	Always return `decision=allow`, bypassing ML scoring entirely, when the condition matches
`score_adjust`	Add a positive or negative integer to the raw ML risk score
`flag`	Append a custom string to the `signals` array without changing the decision

Creating a Rule in the Dashboard

Open the Rules editor

In the AntifraudAI dashboard, go to Settings → Rules and click New Rule.

Choose a rule type

Select one of the four rule types: block, allow, score_adjust, or flag. The form will update to show the relevant configuration fields for your chosen type.

Set the condition

Define when the rule should fire by specifying:

Field — the transaction attribute to evaluate (e.g. billing_address.country, amount, user_id)
Operator — the comparison to apply (see the condition reference below)
Value — the target value or list of values to match against

You can add multiple conditions to a single rule; all conditions must match for the rule to fire (logical AND).

Set the action

Configure what happens when the rule fires:

For block or allow: no additional configuration is needed.
For score_adjust: enter a positive integer to increase the score or a negative integer to decrease it.
For flag: enter the custom signal string to append (e.g. high_value_new_user).

Set the priority

Enter a priority integer. Rules are evaluated in ascending order — a rule with priority 1 runs before a rule with priority 100. Lower numbers win conflicts.

Save and activate

Click Save. The rule is immediately active in the environment you are currently viewing (sandbox or production). You can toggle a rule on or off at any time from the Rules list.

Rule Condition Reference

Operator	Description	Example
`equals`	Exact match	`currency` equals `USD`
`not_equals`	Does not exactly match	`payment_method` not_equals `card`
`in`	Value is in a provided list	`billing_address.country` in `["RU","KP","IR"]`
`not_in`	Value is not in a provided list	`billing_address.country` not_in `["US","CA","GB"]`
`greater_than`	Numeric greater-than comparison	`amount` greater_than `1000`
`less_than`	Numeric less-than comparison	`amount` less_than `1`
`contains`	String contains a substring	`email` contains `@tempmail.`
`regex_match`	Value matches a regular expression	`ip_address` regex_match `^10\.`

Example Rules

The following examples show rules in the JSON format accepted by the Rules API. You can create and manage the same rules through the dashboard UI described above.

1. Block transactions from high-risk countries

{
  "name": "Block high-risk countries",
  "type": "block",
  "priority": 10,
  "conditions": [
    {
      "field": "billing_address.country",
      "operator": "in",
      "value": ["KP", "IR", "CU"]
    }
  ]
}

2. Allow transactions from VIP users

{
  "name": "VIP user allowlist",
  "type": "allow",
  "priority": 5,
  "conditions": [
    {
      "field": "user_id",
      "operator": "in",
      "value": ["usr_vip_001", "usr_vip_002", "usr_vip_003"]
    }
  ]
}

For large VIP lists, use an in condition with a generous list or combine multiple allow rules to keep your rules maintainable.

3. Boost score for large amounts

{
  "name": "Large transaction score boost",
  "type": "score_adjust",
  "priority": 50,
  "adjustment": 20,
  "conditions": [
    {
      "field": "amount",
      "operator": "greater_than",
      "value": 1000
    }
  ]
}

Rule Ordering

Rules run in ascending priority order — the lowest priority number fires first. An early allow rule (e.g. priority 5) will cause AntifraudAI to short-circuit and return decision=allow immediately, preventing any subsequent block rules (e.g. priority 10) from ever being evaluated for that transaction. Review your priority assignments carefully when mixing allow and block rules.

If two rules share the same priority number, their relative order is non-deterministic. Always assign unique priority values to rules that could conflict.

Test all new rules in the sandbox environment before enabling them in production. Use the sandbox trigger values to confirm your rule fires under the expected conditions and does not inadvertently suppress legitimate block decisions.

Get Started

Core Concepts

Guides

Configuration

Help

Build Custom Fraud Detection Rules in AntifraudAI Engine

Types of Rules

Creating a Rule in the Dashboard

Rule Condition Reference

Example Rules

1. Block transactions from high-risk countries

2. Allow transactions from VIP users

3. Boost score for large amounts

Rule Ordering

​Types of Rules

​Creating a Rule in the Dashboard

​Rule Condition Reference

​Example Rules

​1. Block transactions from high-risk countries

​2. Allow transactions from VIP users

​3. Boost score for large amounts

​Rule Ordering

Types of Rules

Creating a Rule in the Dashboard

Rule Condition Reference

Example Rules

1. Block transactions from high-risk countries

2. Allow transactions from VIP users

3. Boost score for large amounts

Rule Ordering