Rules
Merchant volume spike — throttle
"If a merchant processes 100 or more card transactions within 60 seconds, throttle the merchant's API tier."
draft
v1
Geo jump then large withdrawal
"If a device emits a high-severity geo_jump signal and that user attempts a card withdrawal of $1,000 or more within 15 minutes, force a 3DS challenge."
shadow
v1
Failed login velocity: 5 in 5 minutes
"If a user fails to log in 5 or more times within 5 minutes, send a liveness check via SMS."
shadow
v1
Large ACH then crypto withdrawal
"If a user deposits $5,000 via ACH and attempts to withdraw it to an external crypto wallet within a 10-minute window, freeze the payout for manual review."
shadow
v1