Fifty-five fraud signals. One decision engine. Zero tickets in the morning. Paybyrd Antifraud scores every payment before it reaches your acquirer — blocks the attackers, passes the shoppers, and explains every call your analysts need to review.
The monitor below is synthetic — but every signal, score, and rule you'll see is the real engine. Plug in a sandbox key and your own traffic flows through this exact pipeline.
Every transaction passes through Pre-Auth Screening, Issuer Authorization, and Final Decision — each stage scored, each score visible, each reason logged. This is the actual detail view your analysts will see in the console.
Velocity, device reputation, and IP intelligence checked before the card is even sent to the issuer. Fast-path for trusted sessions — no friction added.
Transaction sent to the issuer through the acquirer most likely to approve this BIN. Response captured, rate applied.
Post-issuer analysis fires our review rules — velocity surge, device risk, BIN country mismatch. Human-in-the-loop for the €420 threshold your team set.
Every online payment originates from an IP address. Our IP Intelligence module answers two questions instantly: where is this person and is this person hiding.
Buyer location to the city level
Legit consumer ISP or suspicious provider
Kilometres from the card's issuing country
Anonymisers masking real location
Fraud rings routing through real homes
Bots running from AWS, GCP, Azure, OVH
IPs flagged in global threat intelligence
Automated card-testing attacks
Aggregate IP risk in a single metric
Has this IP touched our platform before?
If ThreatScore > 70 AND GeoDistance > 4000 → Review Stops fraud before it costs money — no chargebacks, no scheme fines. Instead of scoring a single payment in isolation, Device Intelligence builds a persistent profile of every browser and phone that touches your checkout — and follows that profile across every merchant on the platform.
A device brand-new to the entire platform carries different risk than one seen 200 times over 6 months. Context beats context-free scores every time.
A device trusted by Merchant A might be brand-new to Merchant B. The rule engine lets you weigh both — cross-merchant reputation AND your own history.
A device that's used 15 different cards is almost certainly a fraud tool. Reputation aggregates historical signal into one number your rules can pivot on.
A shopper with DevTools open and incognito on is inspecting your checkout — not buying. These signals separate real visitors from reconnaissance.
Bots type instantly. Humans don't. Bots paste whole card numbers. Humans usually type them. This is the layer that catches the sophisticated attack no static rule will.
Professional fraud rings buy antidetect browsers to look like clean devices. We detect the forgery itself — the browser is lying and we know it.
Your rules don't need to fire on 40 signals. The Device Risk Score rolls them all into a single 0–100 metric — and every component stays visible on the review page when your analyst needs to drill in.
The same checkout, filled by a human and a bot. Same card number. Same IP even. Behavioral biometrics separate them in under two seconds — here's how.
If HasPasteOnSensitiveField = true AND FormFillDurationMs < 3000 → Review Visual rule builder. Drag signals, pick operators, choose an action. No SQL, no code, no support ticket to change a threshold. Below are the exact seven rules most risk teams deploy in their first week.
Every flagged transaction lands in Alerts with SLA countdown, assignee, triggering rule and one-click Approve / Decline. No spreadsheet exports, no CSV joins, no "let me check with the acquirer".
| Alert ID | Opened | Status | Trigger rule | Amount | Merchant | SLA | Assigned |
|---|---|---|---|---|---|---|---|
| bcbf6e8a... | 20 Apr 2026, 11:42 | Investigating | High-Value Fraud Risk | €3,780 | Acme Travel | 2m left | l luiz |
| fa92e3d1... | 20 Apr 2026, 11:38 | Open | Card Testing Attack | €62 | Nova Hotels Group | OVERDUE | — |
| 4f2a8b71... | 20 Apr 2026, 11:31 | Open | Velocity · 12 BIN/22s | €140 | Quinta Bistro | 14m left | a ana |
| c8d45520... | 20 Apr 2026, 11:22 | Escalated | Geo-mismatch · 4,814 km | €897.10 | Acme Travel | OVERDUE | l luiz |
| e1748f9a... | 20 Apr 2026, 11:08 | Open | Residential Proxy | €1,420 | Nova Hotels Group | 31m left | — |
| a33c02fe... | 20 Apr 2026, 10:54 | Investigating | ThreatScore > 85 | €240 | Beltone Retail | OVERDUE | a ana |
Every metric live-updating, every chart breathing, every anomaly highlighted before the coffee is made. Configurable widgets — add a shadow-pass-rate line, swap the world map for a merchant ladder, drop in a rule-firing heatmap.
Here's your fraud operations overview · 04h 22m since last login.
Hour-by-hour approve rate · click a cell to drill in
Pulsing dots scaled by volume · trailing 7 days
Run a new rule set in shadow — it scores every live transaction in parallel but doesn't affect the decision. Compare shadow vs. production side-by-side in the dashboard, then promote the rules that moved approvals up without moving false positives.
Built for agencies, hotel groups, franchises, and marketplaces. Shared rules cascade down. Each workspace stays fully isolated. Overrides at any level when one brand needs a tighter policy than the rest.
Use Antifraud standalone (inline API), fully orchestrated with our gateway + acquirer mesh, or subscribe to webhooks and keep your own stack. Sandbox in 24 hours · first real decision by end of week one.
Single REST call. Fires on your checkout, gets a decision in <50ms, you route accordingly. Zero change to your acquirer integration.
POST /v2/antifraud/score
{
"amount": 89710,
"currency": "EUR",
"ip": "102.212.56.255",
"device_fingerprint": "a8f3...",
"card_bin": "454832",
"shopper_email": "..."
}
→ 200 OK
{
"decision": "REVIEW",
"score": 420,
"rules_fired": ["geo-mismatch", "new-device"],
"request_id": "ffd5b23c..."
} Paybyrd handles both — antifraud decision + acquirer routing. One integration covers fraud, acquiring, tokenisation, 3DS2. Most popular for new merchants.
// Just configure in dashboard: // Checkout → Paybyrd Gateway // → Antifraud (score + decide) // → Acquirer Mesh (route) // → 3DS2 if needed // → Settlement // → Webhook back to you // Merchant code is unchanged. // Toggle antifraud on/off per channel.
Get fired-rule events, SLA breaches, shadow-mode diffs delivered to your endpoint in real-time. Drop into Slack, PagerDuty, your own risk engine.
POST /your-webhook-endpoint
{
"event": "antifraud.decision.review",
"transaction": "ffd5b23c...",
"score": 420,
"rules_fired": [
{"id": "geo-mismatch", "weight": 180},
{"id": "new-device", "weight": 120},
{"id": "velocity-6h", "weight": 80},
{"id": "bin-country", "weight": 40}
],
"ip_intel": { "threat_score": 78, ... },
"device_intel": { "composite_score": 72, ... }
} Every objection we've fielded in the last two years, answered honestly. If something's missing, the team replies in under 4 working hours.
55+ per transaction — 10 from IP Intelligence (country/city/ISP/geo-distance + VPN/proxy/Tor/residential/datacenter/known-attacker/bot + threat score), 45+ from Device Intelligence across 7 categories (global history, workspace history, reputation, environment, behavioral biometrics, spoofing, composite score). Plus the transaction-level signals your rules access directly: amount, BIN country, shopper email domain, velocity windows, currency, etc.
Both — rules run first because they're explainable and fast, ML runs in parallel and contributes weighted scores into the composite. Every ML signal is still visible on the review page so your analysts can see exactly why the score moved. Black-box "trust us" scoring is explicitly out of scope.
Yes. Pass any field from your checkout (loyalty tier, internal risk score, cohort ID, CRM segment) into the scoring call — it becomes available in the rule engine as a first-class signal. Custom ML features can be trained on your data in a dedicated workspace for merchants on Custom plans.
Sandbox access in 24 hours. First real scoring call by end of week one. Production cutover typically in 2–3 weeks with shadow mode running in parallel first — your team sees impact on their existing traffic before any decision changes. A full multi-property rollout can close inside 30 days with the standard runbook.
No. Use Antifraud inline via one REST call, fire it before you authorise. Your existing acquirer integration is untouched. The orchestrated mode (Paybyrd gateway + acquirer mesh + antifraud together) is available if you want the full stack, but it's never required.
Yes — many merchants do this for 2-3 months during evaluation. Paybyrd runs in shadow mode, scoring every transaction but deferring the final decision to your incumbent. You compare outcomes daily. When the numbers justify the switch, you promote Paybyrd to live and the incumbent goes silent. Zero traffic blown up.
Scoring, rule builder, case review, shadow mode, dashboard, API access, webhooks, SLA tracking, 15+ condition types, composite scores, behavioral biometrics, device + IP intelligence, multi-tenant hierarchy — all included. No per-signal pricing, no ML-feature upsell, no "enterprise edition" paywall. Priority support and named TAM are included on Custom plans.
99.999% platform uptime, contractually backed with credits. p95 decision time 47ms. Sub-200ms automatic failover to a hot-standby region. Named technical account manager and SRE Slack channel for Custom plans — you talk to the engineer who built the thing, not a script reader.
Yes. Every signal we collect on your transactions stays yours — you can export the full history at any time, revoke access, or require us to delete everything within the retention period your plan specifies. Shared threat intelligence (the cross-merchant denylist) is anonymised — only the device/IP identifier is shared, never your merchant context.
Yes. The decisioning engine, vault and gateway modules can deploy in your cloud or behind your VPC for jurisdictions where data residency or regulator policy demands it. We've deployed in Brazilian, Angolan and EU markets with local data-processor requirements. Same APIs, same dashboards, your infrastructure, your audit trail.
Fifteen minutes with a risk engineer — no SDRs, no slide decks. We'll map your current chargeback pattern to the rules that would have caught them, run a live benchmark against your existing tool, and have your sandbox provisioned by tomorrow.
Our analytics are cookieless and stay on always. Marketing cookies (for ads and retargeting) only run if you accept. You can change your mind anytime in our Privacy Policy.