Fraud signals reference - Mention Me Docs

Fraud signals are automatic checks the platform runs on every referral. When one fires, it contributes to the customer’s fraud score and lights up a corresponding bucket on the Fraud Review queue and the Assessment hover card. Signals are grouped into six buckets. Buckets drive the verdict (“Likely fraud” / “Possible fraud” / etc.) and the headline shown in the Assessment cell.

Buckets

Bucket	What it groups	Severity
On block / suspect list	The referrer’s IP, cookie, or email is on a manual block / suspect list.	High
Looks like the same person	Identity overlap between referrer and referee: same IP, cookie, name, surname, postcode, or similar enough to look the same.	Medium
Red-flag email	Email looks disposable, the referrer and referee emails are unusual or near-synonyms.	Medium
Suspicious timing	The referee acted suspiciously fast after the share, or registered just before referring.	Medium
Unusual purchase value	The referred purchase is unusually low or unusually high (5×, 10×, 20× average).	Low
Hit referral velocity limit	A volume cap fired: too many referrals / referees in 24h, month, or year, or value caps hit.	Low

Any signal that doesn’t fit a bucket appears under Other in the hover card.

Signal catalogue

The exact set of signals the platform can fire today. Each signal maps to one bucket:

On block / suspect list

Signal	What it means
IP address on suspicious list	The referrer’s IP address is on the suspect list.
Cookie or device belongs to suspected gamer	The referrer’s cookie ID is on the suspect list.
User marked as suspected of gaming	The referrer’s email is on the suspect list.

Looks like the same person

Signal	What it means
Both use same IP address	Referrer and referee used the same IP address.
Both have same cookie or browser identifier	Referrer and referee share a cookie.
Both use same name	Identical first name.
Both use same surname	Identical surname.
Both use similar or identical postcodes	Identical postcode.
Both have similar full names	Names are similar (Levenshtein / phonetic).
Both have similar first names	First names are similar.
Both have similar surnames	Surnames are similar.
Referee could be same person as another referee	Referee record is suspiciously similar to another referee under the same referrer.

Red-flag email

Signal	What it means
Email from a throwaway service	Email domain is on a disposable / temporary email list.
Referrer and referee have similar emails	Emails are close enough to look like the same person.
Referrer and referee use synonym email addresses	Emails are functionally synonymous (e.g. `foo+1@gmail.com` vs `foo@gmail.com`).
Both email addresses look unusual	Both look unusual (low-trust domains, odd patterns).
One of the email addresses looks unusual	At least one of the two looks unusual.

Suspicious timing

Signal	What it means
Purchase within 10 minutes of referrer signup	Referee acted within ten minutes of the share.
Purchase within 1 hour of referrer signup	Referee acted within an hour.
Purchase within 24 hours of referrer signup	Referee acted within 24 hours.
Registration within 10 minutes of referrer signup	Referrer registered within ten minutes of making the share.
Registration within 1 hour of referrer signup	Referrer registered within an hour.

Unusual purchase value

Signal	What it means
Purchase value below average threshold	Purchase value is unusually low relative to your average.
Purchase value 5x above average	Purchase value is 5× your average.
Purchase value 10x above average	10× your average.
Purchase value 20x above average	20× your average.

Verdict thresholds

The verdict shown in the Assessment cell is a function of the fraud score and which buckets fired:

Verdict	Triggers
Likely fraud	Any “On block / suspect list” signal fired, OR fraud score ≥ 67.
Possible fraud	A medium-severity bucket fired (Looks like the same person, Red-flag email, Suspicious timing), OR fraud score ≥ 34.
Worth checking	A score exists, but no severe buckets fired, and the score is below 34.
Manual review	The referral was held by an approval rule without any fraud-score component.

​Buckets

​Signal catalogue

​On block / suspect list

​Looks like the same person

​Red-flag email

​Suspicious timing

​Unusual purchase value

​Verdict thresholds

​See also