> ## Documentation Index > Fetch the complete documentation index at: https://docs.mention-me.com/llms.txt > Use this file to discover all available pages before exploring further. # Fraud Signals Reference > Every automatic fraud signal the platform can fire on a referral, with what it means and which bucket it falls into. Fraud signals are automatic checks the platform runs on every referral. When one fires, it contributes to the customer's **fraud score** and lights up a corresponding bucket on the [Fraud Review queue](/knowledge-v2/customers/fraud-review) and the [Assessment hover card](/knowledge-v2/customers/fraud-review#the-assessment-cell). Signals are grouped into six **buckets**. Buckets drive the verdict ("Likely fraud" / "Possible fraud" / etc.) and the headline shown in the Assessment cell. ## Buckets | Bucket | What it groups | Severity | | ------------------------------- | ---------------------------------------------------------------------------------------------------------------------------- | -------- | | **On block / suspect list** | The referrer's IP, cookie, or email is on a manual block / suspect list. | High | | **Looks like the same person** | Identity overlap between referrer and referee: same IP, cookie, name, surname, postcode, or similar enough to look the same. | Medium | | **Red-flag email** | Email looks disposable, the referrer and referee emails are unusual or near-synonyms. | Medium | | **Suspicious timing** | The referee acted suspiciously fast after the share, or registered just before referring. | Medium | | **Unusual purchase value** | The referred purchase is unusually low or unusually high (5×, 10×, 20× average). | Low | | **Hit referral velocity limit** | A volume cap fired: too many referrals / referees in 24h, month, or year, or value caps hit. | Low | Any signal that doesn't fit a bucket appears under **Other** in the hover card. ## Signal Catalogue The exact set of signals the platform can fire today. Each signal maps to one bucket: ### On block / suspect list | Signal | What it means | | ------------------------------------------- | ------------------------------------------------- | | IP address on suspicious list | The referrer's IP address is on the suspect list. | | Cookie or device belongs to suspected gamer | The referrer's cookie ID is on the suspect list. | | User marked as suspected of gaming | The referrer's email is on the suspect list. | ### Looks like the same person | Signal | What it means | | ----------------------------------------------- | ---------------------------------------------------------------------------------- | | Both use same IP address | Referrer and referee used the same IP address. | | Both have same cookie or browser identifier | Referrer and referee share a cookie. | | Both use same name | Identical first name. | | Both use same surname | Identical surname. | | Both use similar or identical postcodes | Identical postcode. | | Both have similar full names | Names are similar (Levenshtein / phonetic). | | Both have similar first names | First names are similar. | | Both have similar surnames | Surnames are similar. | | Referee could be same person as another referee | Referee record is suspiciously similar to another referee under the same referrer. | ### Red-flag email | Signal | What it means | | ------------------------------------------------ | ------------------------------------------------------------------------------- | | Email from a throwaway service | Email domain is on a disposable / temporary email list. | | Referrer and referee have similar emails | Emails are close enough to look like the same person. | | Referrer and referee use synonym email addresses | Emails are functionally synonymous (e.g. `foo+1@gmail.com` vs `foo@gmail.com`). | | Both email addresses look unusual | Both look unusual (low-trust domains, odd patterns). | | One of the email addresses looks unusual | At least one of the two looks unusual. | ### Suspicious timing | Signal | What it means | | ------------------------------------------------- | ----------------------------------------------------------- | | Purchase within 10 minutes of referrer signup | Referee acted within ten minutes of the share. | | Purchase within 1 hour of referrer signup | Referee acted within an hour. | | Purchase within 24 hours of referrer signup | Referee acted within 24 hours. | | Registration within 10 minutes of referrer signup | Referrer registered within ten minutes of making the share. | | Registration within 1 hour of referrer signup | Referrer registered within an hour. | ### Unusual purchase value | Signal | What it means | | -------------------------------------- | --------------------------------------------------------- | | Purchase value below average threshold | Purchase value is unusually low relative to your average. | | Purchase value 5x above average | Purchase value is 5× your average. | | Purchase value 10x above average | 10× your average. | | Purchase value 20x above average | 20× your average. | ## Verdict Thresholds The verdict shown in the Assessment cell is a function of the fraud score and which buckets fired: | Verdict | Triggers | | ------------------ | -------------------------------------------------------------------------------------------------------------------------------- | | **Likely fraud** | Any "On block / suspect list" signal fired, OR fraud score ≥ 67. | | **Possible fraud** | A medium-severity bucket fired (Looks like the same person, Red-flag email, Suspicious timing), OR fraud score ≥ 34. | | **Worth checking** | A score exists, but no severe buckets fired, and the score is below 34. | | **Manual review** | The referral was held by an [approval rule](/knowledge-v2/customers/reference/approval-rules) without any fraud-score component. | ## See Also The queue where signals show up. The other half of why a referral lands in the queue.