Cardinality Scenarios

Cardinality

Same Value Transactions

Generate an alert if a user or business is making a number of transactions of the same value in a given time period (either consecutively or non-consecutively).

Best for:

  • User is making thousands of very small transactions

General Example:

For example, an entity might be suspicious if it transacts $20 from an ATM machine 10 times in a single day.

How It Works:

Select from the dropdown menu to complete the logic.

1260

Simple Count Relative

Generate an alert if X occurs in Y percent of the user/business transactions.

Best for:

  • Business has too many failed transactions

General Example:

For example, an entity might be suspicious if more than 70% of their transactions in 1 week have status == FAILED (the check bounced, account funds are too low, the credit card # didn't match, etc...).

How It Works:

Select from the dropdown menu to complete the logic.

1260

Simple Entity Count

Generate an alert if a user or business has X

  • transactions
  • instruments
  • sent currency
  • city
  • IP address
  • ...

Best for:

  • Business makes large amounts of transactions
  • Alert for a count of actions, transactions, or fields for an entity

General Example:

For example, an entity might be suspicious if it has over 500 transactions in a 1 hour period.

How It Works:

Select from the dropdown menu to complete the logic.

1262

Simple Object Count (Entities/Instruments)

Generate an alert if X

  • address
  • email address
  • ip address
  • ...
    is used by a unique instrument, user or business Y times.

Best for:

  • Fields (address, phone number, IP address...) used too many times by an entity or an instrument

General Example:

For example, an entity might be suspicious if its phone number is already used by another entity.

How It Works:

Select from the dropdown menu to complete the logic.

1262

Simple Object Count (Transactions)

Generate an alert if X

  • address
  • instrument
  • ip address
  • ...
    is used in a transaction Y times (with each transaction having the same Z (instrument/address...)).

Best for:

  • A transactional field (instrument, ip address, address...) being used too many times in transactions

General Example:

For example, three different entities with no relation using the same IP address could be suspicious.

How It Works:

Select from the dropdown menu to complete the logic.

1259