Cardinality

Same Value Transactions

Generate an alert if a user or business is making a number of transactions of the same value in a given time period (either consecutively or non-consecutively).

Best for:

• User is making thousands of very small transactions

General Example:

For example, an entity might be suspicious if it transacts $20 from an ATM machine 10 times in a single day.

How It Works:

Select from the dropdown menu to complete the logic.

Simple Count Relative

Generate an alert if X occurs in Y percent of the user/business transactions.

Best for:

• Business has too many failed transactions

General Example:

For example, an entity might be suspicious if more than 70% of their transactions in 1 week have status == FAILED (the check bounced, account funds are too low, the credit card # didn't match, etc...).

How It Works:

Select from the dropdown menu to complete the logic.

Simple Entity Count

Generate an alert if a user or business has X

• transactions
• instruments
• sent currency
• city
• IP address
• ...

Best for:

• Business makes large amounts of transactions
• Alert for a count of actions, transactions, or fields for an entity

General Example:

For example, an entity might be suspicious if it has over 500 transactions in a 1 hour period.

How It Works:

Select from the dropdown menu to complete the logic.

Simple Object Count (Entities/Instruments)

Generate an alert if X

• address
• email address
• ip address
• ...
  is used by a unique instrument, user or business Y times.

Best for:

• Fields (address, phone number, IP address...) used too many times by an entity or an instrument

General Example:

For example, an entity might be suspicious if its phone number is already used by another entity.

How It Works:

Select from the dropdown menu to complete the logic.

Simple Object Count (Transactions)

Generate an alert if X

• address
• instrument
• ip address
• ...
  is used in a transaction Y times (with each transaction having the same Z (instrument/address...)).

Best for:

• A transactional field (instrument, ip address, address...) being used too many times in transactions

General Example:

For example, three different entities with no relation using the same IP address could be suspicious.

How It Works:

Select from the dropdown menu to complete the logic.