Risk FlagCategoryRisk LevelExplanation
high_device_riskDeviceHighDevice likely emulator, VM
proxy_detectedNetworkModerateID Check on a proxy IP
vpn_detectedNetworkModerateID Check on a VPN
datacenter_detectedNetworkModerateID Check on a datacenter IP
recent_fraud_ipNetworkLowIP recently reported as fraud
impossible_travel_detectedID SellingHighReferring session geolocation is far from ID Check geolocation relative to timespan
moderate_ip_velocityFraud FarmModerateNumber of ID Checks from this IP in the last 7 days is >2
high_ip_velocityFraud FarmHighNumber of ID Checks from this IP in the last 7 days is >5
ip_document_country_mismatchID SellingModerateCurrent IP geolocation country does not match document geolocation
cannot_confirm_id_is_authenticID FraudModerateID may be spoofed or digital media (image)
likely_fake_idID FraudHighID very likely fake
id_expiredID FraudLowID Expiration date is past
id_age_below_16COPPAHighDOB on ID indicates user is below 16 years old
low_id_face_match_scoreID FraudHighFace does not match ID Photo
moderate_id_face_match_scoreID FraudModerateFace may not match ID photo
repeat_faceMulti-AccountingHighFace has been seen in your application under a different account
repeat_idMulti-AccountingHighID has been seen in your application under a different account
repeat_deviceMulti-AccountingHighDevice has been used for multiple ID Checks
known_fraud_faceFraud FarmModerateFace is associated with fraud
known_fraud_idFraud FarmModerateID is associated with fraud
different_device_type_same_categoryID SellingModerateReferring session and ID Check session are same device category (e.g., mobile), but are different types (iPhone, Android)
same_device_type_different_ipID SellingModerateReferring session and ID Check session are same device type (e.g., iPhone), but are different IPs
referring_ip_mismatchID SellingLowReferring session IP different than ID Check session IP
referring_user_agent_mismatchID SellingLowReferring session user agent different than ID Check user agent