Fraud prevention
Turned away once. Recognized everywhere.
Fraudsters do not stop after one refusal. They try another shipment, another vendor, a copied document, or help from the inside. Omnareth remembers who each refusal implicated, opens a case when a pattern appears, and once your analyst confirms it, refuses that identity everywhere: at every gate, every berth, every payment run.
| # | Event | Decision |
|---|---|---|
| 1 | Impostor quotes shipment A's real release order | DENY FICTITIOUS_PICKUP |
| 2 | Same driver and truck try shipment B ▲ Repeat offender opened for driver and truck; both watched |
DENY FICTITIOUS_PICKUP |
| 3 | Impostor presents A's release order for shipment C ▲ Release-order reuse and driver hopping opened |
DENY INVALID_RELEASE_ORDER · FICTITIOUS_PICKUP · RELEASE_ORDER_REUSE · WATCHLIST_MATCH · REPEAT_OFFENDER · DRIVER_HOPPING |
| – | Analyst confirms the repeat-offender case (3 shipments, 3 denials) ▲ Driver blocked |
analyst · state |
| – | An insider adds the impostor to shipment C's dispatch list | analyst · state |
| 4 | Impostor returns with C's real order, a clean truck and a request claiming fraud.blocked = false ▲ Audit record shows blocked = true |
DENY WATCHLIST_BLOCK |
| 5 | Dispatched driver collects shipment C | ALLOW |
How it works
A memory across shipments, built into every decision
Custody rules judge one event against one shipment. Fraud prevention adds what earlier events revealed, without slowing the gate: a fully fraud-checked, stored and audited decision takes 75 ms at the median in our lab test.
Hold the right party responsible
Each rule names who it implicates when it fires. A fictitious pickup implicates the driver and truck, never the consignee the impostor quoted; a payment to a fraud account implicates the account, never the vendor.
Know who is involved
Before rules run, Omnareth adds watchlist matches and each identity's recent history to the event. Fraud rules decide on it like any other field.
Open a case when a pattern appears
After each decision, detectors look for repeat offenders, reused documents (a release order, a police report, a return label), actors working several records (a driver across shipments, a device across policies, a gift card across orders) and bursts of denials at one place.
Your analysts confirm or clear
Confirming fraud blocks the identity on every shipment, vendor or record. Marking a false positive lifts the watch and clears its record.
Fraud rules
Rules over what Omnareth has learned
These are the fraud rules of the cargo reference set, running alongside its 29 custody rules. The payments, insurance, refunds, lending, healthcare, telecom, benefits, cybersecurity and identity verification sets have the same checks for their own identifiers: bank accounts, devices, gift cards, phones, providers, store agents, mailing addresses, IP addresses, documents and faces. DENY blocks the action; FLAG lets it proceed and tells an operator why it needs a look.
| Threat | What Omnareth checks | Rule code | Decision |
|---|---|---|---|
| Known fraudster returns | A driver, truck or party in the event is blocked on the fraud watchlist | WATCHLIST_BLOCK | DENY |
| Watched identity | An identity is under watch, added by an analyst or automatically | WATCHLIST_MATCH | FLAG |
| Repeat offender | An identity was implicated in 2 or more denied events in the last 30 days | REPEAT_OFFENDER | FLAG |
| Compromised release document | The release order or bill of lading has also been presented for another shipment | REFERENCE_REUSE | FLAG |
| Driver hopping | The driver was implicated in denied pickups on 2 or more other shipments in 24 hours | DRIVER_HOPPING | FLAG |
Detectors and cases
One case per pattern, kept up to date
Each pattern opens one case per subject, with the shipments and decisions behind it. Later attempts update the case rather than opening duplicates, so an analyst sees one story, not a stream of alerts.
| Pattern | Trigger | What happens |
|---|---|---|
| Repeat offender | Any identity (driver, vessel, party, bank account…) implicated in 2 denied events within 30 days | Case opened (high); the identity is watched for 90 days |
| Reference reuse | A single-use reference (release order, bill of lading) presented for 2 or more entities | Case opened (critical); every further use is flagged |
| Actor hopping | An actor (a driver, a bank account) implicated in denials on 3 or more entities within 24 hours | Case opened (high) |
| Burst | 3 or more denied events at one place within 60 minutes | Case opened (high) |
// Sealed in the audit record of a denied pickup "context": { "fraud": { "blocked": true, "matches": [{ "type": "DRIVER", "level": "BLOCK", "reason": "Confirmed fraud (case …)" }], "priorImplicatedDenials": 3, "releaseOrderOtherShipments": 0, "driverDeniedShipments24h": 2 } }
Built to be fair
Strict with fraudsters, careful with everyone else
A fraud system that flags your customers and your own drivers gets switched off. These safeguards are part of the product, and each is covered by automated tests.
Named is not guilty
The consignee and release order an impostor quotes are not held against anyone. Only the identities a rule implicates are counted.
Not your driver's fault
A dispatched driver turned away because customs has not cleared is not implicated, and legitimate drivers making many pickups a day are never flagged for it.
False positives undone
Clearing a case lifts the automatic watch and removes the identity's part in the denials behind it, so they stop counting against it.
Analysts outrank detectors
A detector never downgrades a block or overrides an entry your team made. Automatic watches expire after 90 days.
Clients cannot vouch for themselves
Omnareth computes the fraud context on the server. A request claiming a driver is not blocked is ignored, and the record shows what was actually known.
Cases are for analysts
The fraud API requires an analyst or administrator account. Gate systems send events and receive decisions; they cannot read or change the watchlist.
Any process
Tell Omnareth who matters. It does the rest.
Fraud prevention is not built for one industry. When you define an entity type, you declare which event fields identify people, accounts and references. The same detectors and watchlist then work for it, whether it is a shipment, a vendor, a policy, an order or a loan application.
- Subject or context. A driver or bank account can be held responsible; a port or gate cannot.
- Single-use. A release order, bill of lading or similar reference belongs to one record only.
- Hopping. An actor whose denials across many records reveal a scheme.
// POST /v1/entity-types: the Vendor type "fraud": { "identifiers": [ { "path": "payment.bankAccount", "type": "BANK_ACCOUNT", "role": "SUBJECT", "hopping": true }, { "path": "change.senderDomain", "type": "EMAIL_DOMAIN", "role": "SUBJECT", "hopping": true }, { "path": "payment.requestedBy", "type": "EMPLOYEE", "role": "SUBJECT" } ] }
The insider case
Every other check passes. The answer is still no.
In the reference scenario, after the analyst confirms the case, someone adds the impostor to the shipment's dispatch list. The impostor returns with the shipment's genuine release order, a truck never seen before, and a request claiming the driver is not blocked. Each custody rule passes. Omnareth denies the release on the watchlist, and the audit record, anchored on chain, shows the block it acted on. The payments, insurance, refunds, lending, healthcare, telecom, benefits, cybersecurity and identity verification scenarios end the same way: an insider marks the fraudster as approved, and Omnareth still refuses.
Memory is per deployment
Omnareth recognizes repeat fraud across the records it sees. It does not share watchlists with other organizations.
Identifiers must be stable
A fraudster with a new driver ID or bank account each time is still refused by the rules, but is not recognized as the same person.
Pilot program
Put fraud prevention to work on your own lane
One lane, facility or process, in shadow mode, with results measured against criteria we agree with you. Qualified companies and organizations can apply.