Review individual cases or automate actions from your Customer Area after Score identifies potential fraudulent behavior or other unusual activity.
Requirements
Before you begin, take into account the following requirements and limitations.
| Requirement | Description |
|---|---|
| Customer Area roles | To review cases and take direct action, you require the following role:
|
| Webhooks | You can configure webhooks for risk signals. |
| Limitations | Score is included by default if you created your marketplace after October 2024. Starting October 31, 2026, Adyen will enable Score for all merchants who have integrated Adyen for Platforms. |
Set up automated actions
You can set up automated actions to act immediately when a risk rule triggers because a risk signal was detected. Use the automated actions log to review which actions were taken, to unblock users or keep them blocked.
To set up automated actions in your Customer Area:
- Go to Account holders > Account holder risk > Risk rules.
- Select the rule you want to edit, or select Create custom risk rule.
- Enter a rule name and description, and select the rule type.
- Select the rule conditions.
-
Configure the automated actions that you want to take when the risk rule triggers because the risk signal is detected:
Impact on risk score:
- If you want to influence the risk score, leave the default selection. Continue with Level of impact.
- If you do not want to influence the risk score, toggle the switch to turn off the risk score impact. Continue with Automated action.
Level of impact:
Select the level of impact: None, Low, Medium, High or Max.Automated action:
Select the automated action you want to take: None, Bump KYC tier or Disable payouts. - Select Create rule.
The new rule will appear as a custom rule on the Account holders > Account holder risk > Risk rules page in the applicable rule category. You can see a summary of all Adyen and custom risk rules, including the parameters, the impact on the risk score, and the configured action for each category.
To ensure that the rules function in the best way for your business, you can review the log of the automated actions that have been taken. To open the log in your Customer Area, go to Account holders > Account holder risk > Automated actions.
Review and filter cases
When one of your users triggers a risk rule and gets flagged with a risk signal, this appears as an open case in the Case management dashboard in your Customer Area.
To open the case management dashboard in your Customer Area, go to Account holders > Account holder risk > Case management.
You can find all open, reviewed, and suspicious cases on this dashboard, and take action if needed. The dashboard shows a list of users in your balance platform and all risk-related information about them, such as risk signals, processed volume, and overall risk score.
You can configure how the case management dashboard shows information by personalizing and saving sorted and filtered views. For example, you can divide cases between teams by assigning team members to review a subset of your users by saving sorted and filtered views.
When a new risk signal is detected and flagged, the case appears in the Open tab. You can then review the case and decide if you want to take action on the case.
Take action
After you review an open case, you can:
Take direct action
To take a specific action on a user in your Customer Area:
- Go to Account holders > Account holder list, or select the account holder from the case management dashboard.
- In the account holder details, select Score > Take action.
You can:
- Mark the case as Reviewed, moving it out of the Open queue.
- Mark the case as Suspicious, adding it to a separate high risk queue.
- Block or re-enable payouts.
- Suspend the account.
- Add KYC values to the high risk list. Only add KYC values from confirmed fraudulent users.
- Trust linked accounts. You can use this to prevent a known and trusted account from appearing in case management.
- Close the account.
If you Suspend or Close an account, you need to provide a reason for the action.
Mute risk signals
If a risk signal triggers that does not represent a risk for that user, you can flag these signals as false positives and prevent them triggering risk rules again for a certain period of time.
To mute a signal in your Customer Area:
- Go to Account holders > Account holder list and select the account holder.
Alternatively, you can select the account holder on the case management dashboard. - Select the Score tab.
- In the Risk signals section, find and expand the signal, and then select Mute signal.
- Select the period for which you want to mute the signal.
You can mute the signal for a week, a month, a year or indefinitely, and add a note. - Select Mute signal.
Exclude values from linked accounts
Score may identify and link accounts sharing information that is not relevant for detecting fraud. When you know that a certain KYC value is not relevant, you can exclude that KYC value from being used to create links between your marketplace's users. This can be useful, for example, when you know that a phone number or a registration address is used for several different users.
To exclude an identifier in your Customer Area:
- Go to Account holders > Account holder list and select the account holder.
Alternatively, you can select the account holder on the case management dashboard. - Select the Score tab.
- In the Linked accounts section, you see a list of all the linked identifiers, and the number of times that specific identifier is present.
- Select Exclude KYC details.
This action cannot be undone and is permanent. You will be asked to confirm this action.
Manage high risk lists
You can use the high risk lists to add KYC values or attributes from fraudulent users. You can manage high risk lists for the following attributes:
- Account holder email
- Phone number
- Personal data
- Bank account
- Account holder address
- Tax ID
Add a single KYC value to a high risk list
To add an item to a high risk list in your Customer Area:
- Go to Account holders > Account holder risk > High risk list.
- Select the high risk list to which you want to add the item.
- Select Add item(s) > Add items manually.
- Enter the details and select Add to list.
Bulk upload KYC values to a high risk list
To add known malicious KYC attributes in bulk, upload a CSV file to the high risk list.
To upload a CSV file in your Customer Area:
- Go to Account holders > Account holder risk > High risk list.
- Select the high risk list to which you want to bulk upload items.
- Select Add item(s) > Upload CSV.
- Upload one or more values using the specified CSV format.
Provide a reason for taking action on an account
When you take an action to suspend or close an account, you must provide a reason for the action. The following tables show descriptions of the available reasons for suspending or closing an account:
Account & Access Integrity (ATO)
| Selection | Description |
|---|---|
| Account Takeover (ATO) | The unauthorized access and control of a victim's financial account by an illicit actor, enabling the illicit actor to initiate financial transactions and/or access personal information. |
Administrative closure
| Selection | Description |
|---|---|
| Administrative closure | Account closure due to a change of ownership of the business; closure initiated by the customer without any suspicion of illicit activity; closure due to the death of the customer through a formal notification, triggering specific account freezing and probate procedures; or closure for a customer who, due to their personal circumstances, is especially susceptible to detriment, requiring specialized handling and care. |
Application & ID Fraud
| Selection | Description |
|---|---|
| Complex corporate structure | A structure created to intentionally mislead regarding the ownership of a business through developing a complex web of businesses, director, geographies, etc. |
| Corporate impersonation | Illicitly adopting the identity of a legitimate business to conduct fraudulent activities. |
| Fraudulent document (Non-ID) | A forged, altered, or counterfeit document (such as a bank statement or utility bill) used to deceive. |
| Fraudulent identity document | A fake, altered, or stolen physical or digital identification document used to misrepresent one's identity. |
| Ghost director(s) | An individual who acts as a company director on paper but is not operating the business, or a fictitious person listed as a director. |
| Shell company | An inactive company used as a vehicle for various financial maneuvers or kept dormant for future use in some capacity. |
| Stolen ID | The unauthorized use of a real person's personal identification information to commit fraud. |
| Suspended: Alternative KYC required | The account is temporarily frozen pending the provision of different or additional documentation, as requested. |
| Synthetic ID | A fabricated identity created by combining real and fake information to open fraudulent accounts. |
Financial Risk & Capital
| Selection | Description |
|---|---|
| Financial Risk & Capital | The user became insolvent or bankrupt, committed credit application fraud, intentionally defaulted on Capital financing, stacked multiple Capital financing disbursements, or any abuse or violation of Adyen’s Capital user agreement. |
Money Laundering
| Selection | Description |
|---|---|
| Money Laundering | Collusion between the platform's user and shoppers, collusion with shopper networks, transaction laundering, or complex structuring to funnel money. |
Payment Fraud
| Selection | Description |
|---|---|
| Card not present fraud | Unauthorized transactions made without the physical card being seen or swiped, typical in ecommerce or MOTO purchases. |
| Card present fraud | Unauthorized transactions conducted in person, often using a counterfeit, stolen, or cloned physical card. |
| Counterfeit goods (sale of) | The unauthorized production and sale of goods that mimic genuine branded products, violating intellectual property rights. |
| Direct Debit fraud | The unauthorized setup or manipulation of direct debit mandates to unlawfully withdraw funds from a victim's bank account. |
| MOTO | Fraud risks specifically associated with Mail Order/Telephone Order transactions, where standard verification methods are difficult to apply. |
| Refund fraud | Exploiting a merchant's return policy to obtain refunds for goods not purchased, or refunding money to a different card than the one used for the purchase. |
| Sale of stolen cards | The illicit trade and distribution of compromised credit or debit card details, often on the dark web. |
| Stolen goods (sale of) | Funds acquired for the suspected or proven sale of items illicitly obtained, for example by theft. |
Scams
| Selection | Description |
|---|---|
| Advanced fee | A scam where victims are persuaded to pay an upfront fee to secure a larger promised sum of money, which never materializes. |
| CEO | A type of Business Email Compromise where fraudsters impersonate a senior executive to trick employees into transferring funds. |
| Fake job offer | A scam that deceives victims with fraudulent employment opportunities, often requiring them to pay upfront for training or act as a money mule. |
| Holiday | Fraudulent schemes involving the sale of non-existent vacations, flights, or accommodation to unsuspecting victims. |
| Impersonation - Financial institution | Criminal entities pretending to be a bank or financial service provider to steal login credentials or authorize transfers through socially engineered consent. |
| Impersonation - Law enforcement | Criminal entities posing as police or government officials to intimidate victims into handing over money or sensitive information. |
| Impersonation - Other | Deceptive activities where criminal entities pretend to be a trusted individual or entity not covered by specific categories (Financial institution, Law enforcement, or Utility provider). |
| Impersonation - Utility provider | Criminal entities posing as representatives of water, electricity, or telecom companies to steal payment details or demand fake overdue payments. |
| Investment | Investment schemes that promise high or guaranteed returns with little to no risk, ultimately defrauding investors of their capital. Noting investments may never actually exist. |
| Invoice | Criminal entities intercepting legitimate supplier invoices and altering the payment details to redirect funds to their own accounts. |
| Online auction | Fraud occurring on auction platforms where buyers pay for goods that never arrive, or sellers send goods but are never paid. |
| Purchase | Scams where consumers pay for goods online that are counterfeit, misrepresented, or never delivered. |
| Romance | Scams where criminal entities feign romantic interest to build trust and eventually manipulate the victim into sending money. |
| Virtual currencies | Fraud or money laundering activities specifically utilizing cryptocurrencies or digital assets to obscure the flow of funds. |
Receive notifications when risk signals are triggered
When a new risk signal triggers for an account holder, Adyen can send webhooks to your server. If you want to get notified of these events, you can subscribe to the webhook.
To keep track of risk signal-related events in your marketplace, make sure that:
- Your server can receive and accept webhooks.
- You subscribed to the Configuration webhooks in your Customer Area.
After you have completed your setup, reach out to your Adyen contact, so we can enable sending the webhook type balancePlatform.score.triggered.
Example webhook
The following is an example request body for a configuration webhook of the type balancePlatform.score.triggered.
In the example, the risk signals listed in the scoreSignalsTriggered array triggered the webhook to be sent.
The value of the data.id field represents an ID that is connected to this specific score calculation. This ID changes for every score calculation and recalculation, and does not appear in your Customer Area.