| high_device_risk | Device | High | Device likely emulator, VM |
| proxy_detected | Network | Moderate | Session on a proxy IP |
| vpn_detected | Network | Moderate | Session on a VPN |
| datacenter_detected | Network | Moderate | Session on a datacenter IP |
| recent_fraud_ip | Network | Low | IP recently reported as fraud |
| impossible_travel_detected | Impersonation | High | Referring session geolocation is far from session geolocation relative to timespan |
| repeat_face | Multi-Accounting | High | Face has been seen in your application under a different account |
| repeat_device | Multi-Accounting | High | Device has been used for multiple sessions |
| different_device_type_same_category | Impersonation | Moderate | Referring session and verification session are same device category (e.g., mobile), but are different types (iPhone, Android) |
| same_device_type_different_ip | Impersonation | Moderate | Referring session and verification session are same device type (e.g., iPhone), but are different IPs |
| potential_link_sharing | Impersonation | Low | Referring session is likely sharing the verification link |
| location_spoofing | Impersonation | High | The user is actively trying to obfuscate their current location |
| referring_ip_mismatch | Impersonation | Low | Referring session IP different than verification session IP |
| referring_user_agent_mismatch | Impersonation | Low | Referring session user agent different than verification user agent |
| referring_device_timezone_mismatch | Impersonation | Moderate | Referring session device timezone is a meaningfully different region than verification timezone |
| referring_ip_timezone_mismatch | Impersonation | Moderate | Referring session ip timezone is a meaningfully different region than verification timezone |