Risk & Fraud Rules

Risk Rules Engine

Fast growing financial technology companies use LogicLoop to monitor abusive behavior on their platforms. LogicLoop empowers fraud & risk managers to quickly set up rules on top of company data to raise alerts for their team to review. Without LogicLoop, analysts are often stuck waiting for engineers to implement alerts directly in the codebase, inhibiting their ability to iterate quickly and experiment.

To get started with monitoring bad actors on your platform on LogicLoop, you'll first want to connect your company's data sources. This could be production databases like Postgres or MySQL, warehouses like Snowflake, Redshift or Big Query, or APIs like Socure or Sentilink. Once connected, you can use sample industry templates below as guidance to bootstrap your program. The following templates have been simplified and specific details have been omitted due to the sensitive nature of the content. Contact us at [e-mail] to access our fully detailed suite of fraud & risk monitoring formulas.

Large transactions

Query your data to select transactions with large dollar amounts.

View SQL Query

SELECT 
    *
FROM
    transaction
WHERE
    amount > 10000

For each transaction flagged, create a ticket for your analysts to review. You can automatically generate a ticket in LogicLoop's Case Management System.

Excessive failed transfers

Query your database to flag users with excessive failed external fund transfers.

View SQL Query

SELECT
  company_name,
  merchant_id,
  transfers.status,
  count(*) AS num_failed_transfers
FROM
  transfers
  JOIN merchant ON merchant.id = merchant_id
WHERE
  created_on > current_date - interval '30 days'
  AND transfers.status = 'FAILED'
GROUP BY
  merchant_id,
  company_name,
  transfers.status
HAVING
  count(*) >= 3

For each user flagged, generate a Slack alert for your team to review.

High velocity transactions for new users

Query your data to flag users who signed up recently with high total transaction volumes.

View SQL Query

SELECT
  sum(amount) AS total,
  merchant_id
FROM
  transaction
  join merchant ON merchant_id = merchant.id
WHERE
  transaction.created_at > current_date - interval '30 days'
  AND merchant.created_at > current_date - interval '30 days'
GROUP BY
  merchant_id
HAVING
  sum(amount) > 200000

For each user flagged, trigger a webhook to create a ticket in your own internal system or another ticket management system like Salesforce, Zendesk, JIRA, or Asana for an analyst to review.

Missing address information

Select users who signed up recently without address information

View SQL Query

SELECT
  *
FROM
  users
WHERE
 address is NULL
 AND created_at < current_date - interval '7 days'

Then, send each user an email reminding them to fill out their address.

Failed identity verification

Flag users who failed identity verification checks. You can pull in information from third party APIs using our API (JSON) data source and write a rule on top of Query Results to join data from multiple sources.

View SQL Query

SELECT
  *
FROM
  socure_identity_verification_checks_api
WHERE
 status = 'Failed'

For each user flagged, create a ticket for an analyst to review and follow up.

Transactions in high-risk geographies

Alert on transactions conducted from high-risk geographies. If you have a pre-defined list of countries that are deemed high-risk, you can pull in this list of values by parameterizing it and populating it with a list derived from another query.

View SQL Query

SELECT
  *
FROM
  transaction
WHERE
  country in {{ list_of_banned_countries }}

Then, call an internal webhook endpoint to automatically ban the transaction in your system.

Amount outstanding exceeds account balance

Alert if a user's outstanding balance exceeds the funds that are available in their account.

View SQL Query

SELECT
  *
FROM
  users
WHERE
 account_balance < outstanding_balance

Send an account manager a Slack notification to reach out to the user to fund their account.

Device intelligence: suspicious IPs

Flag users whose IP correspond with users who have already been identified as fraudulent.

View SQL Query

SELECT
  *
FROM
  users
WHERE
  ip_address in (
    SELECT
      ip_address
    from
      users
    where
      status = 'fraud'
  )

Loan payments late

Alert on payments that are more than 30 days past due.

View SQL Query

SELECT
  *
FROM
  payments
WHERE
  due_date < current_date - interval '30 days'

Borrowers with excessive delinquent payments

Flag users who have been late on over 10 loan payments by more than 30 days.

View SQL Query

SELECT
  user_id, count(*)
FROM
  payments
WHERE
  paid_date > due_date + interval '30 days' OR paid_date is NULL
GROUP BY
 user_id
HAVING
  count(*) > 10

Structured transactions

Alert if a transaction amount is close to a regulatory threshold.

View SQL Query

SELECT
  *
FROM
  transaction
WHERE
  amount > 9000 and amount < 10000

Withdrawals to multiple bank accounts

Flag if a user has withdrawn funds to over 3 different bank accounts.

View SQL Query

SELECT
  bank_account_id, count(*)
FROM
  withdrawals
WHERE
  created_at > current_date - interval '30 days'
GROUP BY
 bank_account_id
HAVING
  count(*) > 3

Too many peer to peer transfers

Flag if a user has made peer to peer transfers to over 10 different accounts in a month.

View SQL Query

SELECT
  receiver_user_id, count(*)
FROM
  transfers
WHERE
  created_at > current_date - interval '30 days'
GROUP BY
 receiver_user_id
HAVING
  count(*) > 10

Too many transactions

Alert if a user has greater than 5 transactions in the past month.

View SQL Query

SELECT
  user_id, count(*)
FROM
  transaction
WHERE
  created_at > current_date - interval '30 days'
GROUP BY
  user_id
HAVING
  count(*) > 5

Excessive deposits

Flag users who've deposited more than $20,000 in their account in the past month.

View SQL Query

SELECT
  sum(amount) AS total,
  user_id
FROM
  deposit
WHERE
  created_at > current_date - interval '30 days'
GROUP BY
  user_id
HAVING
  sum(amount) > 20000

Excessive withdrawals

Flag users who've withdrawn more than $20,000 from their account in the past month.

View SQL Query

SELECT
  sum(amount) AS total,
  user_id
FROM
  withdrawals
WHERE
  created_at > current_date - interval '30 days'
GROUP BY
  user_id
HAVING
  sum(amount) > 20000

Excessive buy or sell orders

Flag users who've bought or sold orders in excess of $20,000 in the past month

View SQL Query

SELECT
  sum(amount) AS total,
  user_id
FROM
  orders
WHERE
  created_at > current_date - interval '30 days'
GROUP BY
  user_id
HAVING
  sum(amount) > 20000