Deduce Identity Graph and Insights
Stop Stolen and Synthetic Identity Fraud
How Well Does Your Fraud Detection Stack Really Work?
Synthetic and stolen identity fraud cost billions each year. Fraudsters can easily get and exploit personal data, while businesses and their customers pay the price.
Legacy fraud solutions lack the quantity and quality of data required to keep up with identity fraud’s rapid evolution. They also generate false positives that damage real customer relationships.
Deduce has the insights you need.
We’ve seen 89% of your new customers before you do—43% within hours before their arrival at your site or app.
Insights Powered by the Deduce Identity Graph
The Deduce Identity Graph—the largest of its kind—constantly captures and analyzes the digital activities of the majority of U.S. online identities: more than 660 million identity profiles, engaged in more than 1.5 billion daily events, across more than 150,000 sites and apps.
Components of a Deduce User Identity
Network
- IPs
- Network Types and ISPs
- VPN Affinity
Device
- Device IDs
- Device Types
(Mobile / Desktop) - OS and App Versions
Geography
- Cities Visited
- States Visited
- Countries Visited
Activity
- Time of Activity
- User Activity Types
(auth/reg/etc) - User Activity Outcomes
- First Party Fraud Feedback
Authentic, Stolen, or Synthetic Identity?
Deduce Gives You the Insights to Flag Risks in Real Time
Our 660M profiles include your future customers’ activity and location insights as they browse, comment, bookmark, play games, log in, check out, reset passwords, and more—often right before they first engage with your site or app.
The frequency and geography of our insights create dynamic, detailed profiles unlike anything else in the identity fraud space.
Our customizable risk and trust signals allow us to separate trusted users from fraud in a fraction of a second, from one lightning-fast API query—no JavaScript required, no excess NAO costs.
More Identity Signals =
More Accurate Risk Assessment
Deduce analyzes more than 200 signals to build a complete, granular picture of identity profiles in the Deduce Identity Network. We’re always adding new signals, and we can customize signals for your unique risk and trust scenarios.
Incremental Fraud Capture, Easy Implementation, Clear ROI
We correlate physical and digital identities at scale over time, to close the gaps in legacy fraud prevention stacks.
We integrate with your existing fraud stack via API, no waiting, no JavaScript. Just better fraud detection and ROI.
We can reduce identity fraud by up to 350% and generate 2X fewer false positives, so you can safely skip secondary review and authentication on trusted new users, save time, and reduce customer churn.
USE CASES
Deduce for New Account Fraud Prevention
Deduce lets you move new customers through the account approval funnel faster by separating fraud attempts from legitimate applications where the customer has recently moved and/or hasn’t updated their official documents yet.
With Deduce for NAF, you can:
- Securely approve more new account openings faster.
- Reduce the need for secondary IDV calls and manual reviews.
- Reduce account-creation churn with faster time to approval for trusted users.
- Augment your existing fraud stack to capture incremental stolen identity and synthetic fraud attempts.
Capture incremental fraud with Deduce real-time, recent, frequent mapping of physical and digital identities to a wide range of online activities.
Deduce for Checkout Fraud Prevention
Deduce helps you avoid chargebacks caused by fraud while reducing checkout friction, even when customers are traveling or shipping to a third-party address.
With Deduce for checkout fraud prevention, you can:
- Approve more orders from good customers.
- Reduce manual reviews and false positives.
- Reduce customer churn by minimizing authentication steps for trusted users.
- Prevent more fraud-related chargebacks.
Deduce’s activity and geospatial analysis separates trusted customers from synthetic and stolen identity fraud.
Case Study
Top 3 Credit Card Issuer – Marquee Application(U.S. Credit Card Originations)
Trusted Transactions
The same digital identity was seen on Deduce’s network, transacting many times, with activity diversity. Established profile matches details of the incoming connection.
Risky Transactions
Digital identity does not match established profile, or attacks from this source were seen on the Deduce network in real-time, or incoming traffic is marked as malicious.
46% of identities seen on Deduce network 24h before application
Ready to Get Started?
See what Deduce can do for your account creation
and checkout workflows.
Trust Signals
|
ACTIVITY_FAMILIAR_IP
|
Is this a familiar IP for this user?
|
|
ACTIVITY_FAMILIAR_NETWORK
|
Is this a familiar carrier for this user?
|
|
ACTIVITY_FAMILIAR_DEVICE
|
Is this a familiar device for this user?
|
|
ACTIVITY_FAMILIAR_GEO_COUNTRY
|
Is this a familiar country for this user?
|
|
ACTIVITY_FAMILIAR_GEO_STATE
|
Is this a familiar state for this user?
|
|
ACTIVITY_FAMILIAR_GEO_CITY
|
Is this a familiar city for this user?
|
|
ACTIVITY_FAMILIAR_GEO_TIMEZONE
|
Is this a familiar time zone for this user?
|
|
ACTIVITY_FAMILIAR_TIMEOFDAY
|
Is this a familiar time of day for when the user typically interacts?
|
|
NETWORK_FAMILIAR_SUBNET
|
Clusters activity across subnets and detects network persistence across quickly changing IPs
|
Risk Signals
|
ACTIVITY_NEW_IP
|
Is this IP new to this identity?
|
|
ACTIVITY_NEW_SUBNET
|
Is this a new subnet for this identity?
|
|
ACTIVITY_NEW_NETWORK
|
Is this a new network for this identity?
|
|
RISK_IMPOSSIBLE_TRAVEL
|
Would it be impossible for user to travel to new location from last known location in the given timeframe?
|
|
RISK_IP_ACCOUNT_CYCLING
|
Has this IP frequently cycled over many different accounts
|
|
RISK_IP_HIGH_FAIL_RATIO
|
High recent fail ratio observed for this IP
|
|
RISK_IP_MALICIOUS_ACTIVITY
|
Malicious activity observed for this IP across our network
|
|
ACTIVITY_NEW_GEO_CITY
|
Is this a new city for this identity?
|
|
ACTIVITY_NEW_GEO_STATE
|
Is this a new state for this identity?
|
|
ACTIVITY_NEW_GEO_COUNTRY
|
Is this a new country for this identity?
|
|
ACTIVITY_NEW_GEO_TIMEZONE
|
Is this a new timezone for this identity?
|
|
RISK_ANOMALY_GEO_CITY
|
Anomalous city usage pattern observed
|
|
RISK_ANOMALY_GEO_STATE
|
Anomalous state usage pattern observed
|
|
RISK_ANOMALY_GEO_COUNTRY
|
Anomalous country usage pattern observed
|
|
ACTIVITY_SUSPICIOUS_TIMEOFDAY
|
Is this time of day not normal or suspicious for this identity?
|
|
NETWORK_VPN_CONFIRMED
|
Is this identity on a confirmed VPN?
|
|
NETWORK_VPN_SUSPECT
|
Is this identity suspected to be using a VPN?
|
|
NETWORK_PROXY
|
Is this identity using a known proxy?
|
|
NETWORK_CRAWLER
|
Is this identity using a crawler?
|
|
NETWORK_MALWARE
|
Is this identity using malware?
|
|
NETWORK_HOSTING
|
Is this identity using a hosted network?
|
|
NETWORK_INVALID
|
Network is unregistered on invalid
|
|
NETWORK_NON_US
|
Is this identity using a non-US network?
|
|
NETWORK_SUSPICIOUS_ISP
|
Network does not report a valid ISP
|
|
RISK_ANOMALY_SUBNET
|
Anomalous subnet usage pattern observed
|
|
RISK_ANOMALY_NETWORK_USAGE
|
Anomalous network usage pattern observed
|
|
ACTIVITY_NEW_DEVICE
|
Is this a new device for this identity?
|
|
DEVICE_CRAWLER
|
Is this likely a crawler?
|
|
DEVICE_DOWNGRADE
|
Is this an older version of a device we haven’t seen in a while?
|
|
RISK_ANOMALY_DEVICE_USAGE
|
Anomalous device usage pattern observed
|
|
RISK_DEVICE_CYCLING
|
Detects devices which cycle over multiple accounts
|
Info Signals
|
NEW_ACCOUNT
|
Is this account identified as less than 14 days old?
|
|
DEVICE_MOBILE
|
Is this a mobile device?
|
|
DEVICE_UPGRADE
|
Is this device newer?
|
|
ACTIVITY_INFREQUENT_DEVICE
|
Is this device infrequently seen for this identity?
|
|
NETWORK_MOBILE
|
Is the user on a mobile network?
|
|
NETWORK_CORPORATE
|
Is the user on a corporate network?
|
|
NETWORK_EDUCATION
|
Is the user on an education/school network?
|
|
NETWORK_VPN_CAPABLE
|
Is there a device running a background VPN service on this IP
|
|
ACTIVITY_INFREQUENT_GEO_CITY
|
Is this city infrequently seen for this identity?
|
|
ACTIVITY_INFREQUENT_GEO_STATE
|
Is this state infrequently seen for this identity?
|
|
ACTIVITY_INFREQUENT_GEO_COUNTRY
|
Is this country infrequently seen for this identity?
|
|
ACTIVITY_INFREQUENT_GEO_TIMEZONE
|
Is this timezone infrequently seen for this identity?
|
|
ACTIVITY_INFREQUENT_EMAIL
|
Is this email infrequently seen for this identity?
|
|
ACTIVITY_INFREQUENT_IP
|
Is this IP infrequently seen for this identity?
|
|
ACTIVITY_INFREQUENT_NETWORK
|
Is this network infrequently seen for this identity?
|
|
ACTIVITY_INFREQUENT_SUBNET
|
Is this subnet infrequently seen for this identity across quickly changing IPs?
|
Insights Signals
|
LAST SEEN EMAIL
|
When was the EMAIL last seen on the Deduce network?
|
|
FREQUENCY EMAIL
|
Number of times we’ve seen this email
|
|
IP_COUNT
|
Number of IPs associated with this email
|
|
MATCH
|
Have we seen this Email and IP together before?
|
|
LAST SEEN IP
|
When was this IP match last seen on the Deduce Network?
|
|
FREQUENCY IP-EMAIL
|
Number of times we’ve seen this match
|
|
RANK_IP/RANK_EMAIL
|
Ranking of IP against email & vice versa *
|
|
UA_BRAND
|
What is the device’s brand?
|
|
UA_NAME
|
What is the device’s name?
|
|
UA_OS
|
What operating system is the device running?
|
|
UA_BROWSER
|
What browser is the device using?
|
|
UA_VERSION
|
What is the browser version?
|
|
UA_TYPE
|
What is the browser type?
|
|
UA_DEVICE_TYPE
|
What is the device type?
|
|
COUNTRY
|
User’s detected country
|
|
STATE
|
User’s detected state
|
|
CITY
|
User’s detected city
|
|
LAT
|
User’s detected latitude
|
|
LONG
|
User’s detected longitude
|
|
ISP_ASN
|
ASN of ISP that owns this IP
|
|
ISP_NAME
|
Internet Service Provider that owns this IP
|
|
COMPANY_NAME
|
Company registered to this IP
|
|
CRAWLER_NAME
|
Name of the crawler if the IP belongs to one
|
|
VPN_NAME
|
Name of VPN service if user is detected to be using one
|
|
IS_VPN_CONFIRMED
|
Is this IP confirmed to be a part of a VPN?
|
|
IS_VPN_SUSPECT
|
Is this IP suspected to be a part of a VPN?
|
|
IS_VPN_CAPABLE
|
Is this IP capable of being a part of a VPN?
|
|
IS_TOR
|
Is this user using a TOR browser?
|
|
IS_HOSTING
|
Is this IP on a hosted network?
|
|
IS_CORPORATE
|
Is this IP on a corporate network?
|
|
IS_EDUCATION
|
Is this IP on an Education network?
|
|
IS_MOBILE
|
Is this IP on a mobile network?
|
|
IS_PROXY
|
Is this a proxy IP?
|
GeoSpatial Signals
|
ADDRESS_GEOIP_DISTANCE_NEAR
|
|
|
ADDRESS_GEOIP_DISTANCE_100_250
|
|
|
ADDRESS_GEOIP_DISTANCE_250_500
|
|
|
ADDRESS_GEOIP_DISTANCE_500_1000
|
|
|
ADDRESS_GEOIP_DISTANCE_1000+
|
|
|
BILL_ADDRESS_GEOIP_DISTANCE_NEAR
|
|
|
BILL_ADDRESS_GEOIP_DISTANCE_100_250
|
|
|
BILL_ADDRESS_GEOIP_DISTANCE_250_500
|
|
|
BILL_ADDRESS_GEOIP_DISTANCE_500_1000
|
|
|
BILL_ADDRESS_GEOIP_DISTANCE_1000+
|
|
|
SHIP_ADDRESS_GEOIP_DISTANCE_NEAR
|
|
|
SHIP_ADDRESS_GEOIP_DISTANCE_100_250
|
|
|
SHIP_ADDRESS_GEOIP_DISTANCE_250_500
|
|
|
SHIP_ADDRESS_GEOIP_DISTANCE_500_1000
|
|
|
SHIP_ADDRESS_GEOIP_DISTANCE_1000+
|
|
|
PROF_ADDRESS_GEOIP_DISTANCE_NEAR
|
|
|
PROF_ADDRESS_GEOIP_DISTANCE_100_25
|
|
|
PROF_ADDRESS_GEOIP_DISTANCE_250_500
|
|
|
PROF_ADDRESS_GEOIP_DISTANCE_500_1000
|
|
|
PROF_ADDRESS_GEOIP_DISTANCE_1000+
|
|
|
ADD_BILL_ADDRESS_DISTANCE_NEAR
|
|
|
ADD_BILL_ADDRESS_DISTANCE_100_250
|
|
|
ADD_BILL_ADDRESS_DISTANCE_250_500
|
|
|
ADD_BILL_ADDRESS_DISTANCE_500_1000
|
|
|
ADD_BILL_ADDRESS_DISTANCE_1000+
|
|
|
ADD_SHIP_ADDRESS_DISTANCE_NEAR
|
|
|
ADD_SHIP_ADDRESS_DISTANCE_100_250
|
|
|
ADD_SHIP_ADDRESS_DISTANCE_250_500
|
|
|
ADD_SHIP_ADDRESS_DISTANCE_500_1000
|
|
|
ADD_SHIP_ADDRESS_DISTANCE_1000+
|
|
|
ADD_PROF_ADDRESS_DISTANCE_NEAR
|
|
|
ADD_PROF_ADDRESS_DISTANCE_100_250
|
|
|
ADD_PROF_ADDRESS_DISTANCE_250_500
|
|
|
ADD_PROF_ADDRESS_DISTANCE_500_1000
|
|
|
ADD_PROF_ADDRESS_DISTANCE_1000+
|
|
|
BILL_SHIP_ADDRESS_DISTANCE_NEAR
|
|
|
BILL_SHIP_ADDRESS_DISTANCE_100_250
|
|
|
BILL_SHIP_ADDRESS_DISTANCE_250_500
|
|
|
BILL_SHIP_ADDRESS_DISTANCE_500_1000
|
|
|
BILL_SHIP_ADDRESS_DISTANCE_1000+
|
|
|
ADDRESS_ACTIVITY_DISTANCE_NEAR
|
|
|
ADDRESS_ACTIVITY_DISTANCE_100_250
|
|
|
ADDRESS_ACTIVITY_DISTANCE_250_500
|
|
|
ADDRESS_ACTIVITY_DISTANCE_500_1000
|
|
|
ADDRESS_ACTIVITY_DISTANCE_1000+
|
|