Fraud, risk, security and digital identity teams

Stop an account takeover before the transfer, and let the fraud system decide

A password reset, a SIM change and a wallet transfer arrive on one account within an hour. Each is ordinary on its own.

Request a working session The product that runs it: Fraud, Identity & Customer Protection

Read the journey; a working session shows it running.

Seen by the customer · SMS

From the record, not a run: what would reach them, on SMS, App, Call.

The case

Annotated from the record

What happened

A password reset, a SIM change and a wallet transfer arrive on one account within an hour.

A password reset, a SIM change and a wallet transfer arrive on one account within an hour. Each is ordinary on its own.

What it reads

The event sequence and its timing
Device, SIM and identity verification signals
Consent and customer verification history
The control system's own policy

Checks before anything is sent

Signal quality, consent, customer verification and the control system's own policy checks pass.

Every option considered, including doing nothing

Pass a high-risk signal with its reasons to the transaction-control systemConsidered
Refer the account for human follow-upConsidered
Suppress the signal, where the customer verified through a held channelConsidered
No action, where the sequence has a known causeConsidered

Doing nothing is one of the outcomes, and it is recorded with its reason. The options are the record's own; a run decides between them.

Evidence record

Preview

Reference: The reference of the saved run.
Decision: One of the options, including no action, with the reason.
Checks: Signal quality, consent, customer verification and the control system's own policy checks pass.
Evidence kept: Event sequence
score
reasons
signal passed
control system's decision
customer notification
outcome
The measures: Takeovers stopped before a loss, against legitimate customers wrongly held.
Connection: Written on every record: the systems the run read, and the sample it ran on.

The shape of the record, with no values. A reference appears only after a run is saved.

The improvement, and how it is measured

Hypothesis

A takeover stopped before the transfer costs a verification; one found afterwards costs the money and the customer.

Modelled

The mechanism that could produce the result, stated; the figure is measured in the pilot.

Observed

Measured in a pilot’s validate stage, on your systems, against a comparison agreed first.

The result, the mechanism, the measurement, and the record’s five answers

Desired result

Incremental revenue or retention; lower contact waste; improved conversion with margin guardrails

Mechanism

Ingest → qualify → score → apply limits/consent → assign control → execute approved action → capture delivery and business outcome → monitor/retrain

Measurement

Randomised holdout where feasible; intent-to-treat primary view; pre-declared denominator; guardrails for complaints, margin and opt-out

Measured on: Eligible population; treatment rate; conversion; incremental revenue; ARPU; churn; contact rate; margin; opt-out; decision latency

01
Desired result
The result wanted.
Incremental revenue or retention; lower contact waste; improved conversion with margin guardrails
02
Mechanism
The mechanism that could produce it.
Ingest → qualify → score → apply limits/consent → assign control → execute approved action → capture delivery and business outcome → monitor/retrain
03
Evidence required
The records kept to show it.
Decision log; eligibility snapshot; price/order response; delivery receipt; control assignment; revenue/outcome ledger
04
Costs and risks
The cost, and the ways it can go wrong.
Costs: Setup fee + annual product subscription; optional managed execution fee; optional verified-outcome fee with agreed baseline
If it fails: Fail closed on eligibility/consent/price; queue retryable events; do not duplicate orders; route exception to campaign operations
05
Measurement approach
The measure that shows it helped.
Randomised holdout where feasible; intent-to-treat primary view; pre-declared denominator; guardrails for complaints, margin and opt-out
Measured on: Eligible population; treatment rate; conversion; incremental revenue; ARPU; churn; contact rate; margin; opt-out; decision latency

Measured in the pilot's validate stage, on your systems, with the comparison agreed first. Every line above is the record's own design intent.

The business side

The change: Takeovers stopped before a loss, against legitimate customers wrongly held.
Running cost: Setup fee + annual product subscription; optional managed execution fee; optional verified-outcome fee with agreed baseline
What evidence supports it: Event sequence, score and reasons, signal passed, control system's decision, customer notification and outcome.

The journey in detail

Step by step, from both sides

Step	What the customer experiences	What the operator does
The momentThe moment that started it.	A password reset, a SIM change and a wallet transfer arrive on one account within an hour.	Reads the event sequence and its timing, device, sim and identity verification signals, consent and customer verification history, the control system's own policy.
The decisionThe decision to be made.	The customer's screen is unchanged.	Scores the sequence as a takeover risk with its reasons, and passes the signal to the fraud or transaction-control system.
The safeguardsThe conditions that stop it.	Still unchanged: the action waits until every check has passed.	Signal quality, consent, customer verification and the control system's own policy checks pass.
The actionThe action that reaches the customer.	The control system steps up, pauses or rejects; the customer is told through a channel the attacker does not hold. Reaches them on SMS, App, Call.	Recommends. The system that holds the right confirms, charges or provisions.
When it goes wrongThe failure, and the recovery.	A customer who replaced a lost phone and moved money the same day is held, and cannot be reached because the notification goes to the new SIM.	The notification goes to a channel the customer held before the change, the hold is lifted on verification, and the case is kept so the score learns the pattern.
The resultThe change it made.	What changed for them is what is counted; nothing else is claimed.	Takeovers stopped before a loss, against legitimate customers wrongly held.
The proofThe proof anyone can check.	Can be answered for, later, from the record.	Event sequence, score and reasons, signal passed, control system's decision, customer notification and outcome.

Operator systems remain authoritative. HeuriTel reads these to propose an action; it does not decide on their behalf.

The failure, and the recovery

What goes wrong

A customer who replaced a lost phone and moved money the same day is held, and cannot be reached because the notification goes to the new SIM.

What happens then

The notification goes to a channel the customer held before the change, the hold is lifted on verification, and the case is kept so the score learns the pattern.

The products in this journey

Runs the decision
Fraud, Identity & Customer Protection
Bounded rules and models score SIM, subscription, account-takeover, payment, traffic and roaming fraud, and pass the signal to the authorised fraud or transaction-control system with its reasons.
Contributes
CAMARA & GSMA Open Gateway APIs
the network's own SIM-change and device signals the score reads
Contributes
Mobile Money, Credit & Financial Services
the wallet the transfer would leave
The definition it demonstratesHeuriTel Account Takeover Prevention
Results it movesReduce fraud and identity risk

Available to see today

Read the journey; a working session shows it running.

Request a working session