Fraud detection platform

Every fraudulent operation comes from somewhere.

Ironchip scores every signup, login, and transfer based on location, device, and behavior, and holds the ones that don't fit. For banking and fintech, no extra step for the customer who operates from their usual place.

Talk to an expert See an evaluation

Operations scored right now

Login · Bilbao · 08:52Usual place, known device · risk 6Allowed

Transfer 2,400 EUR · Madrid · 09:15Customer's home signature · risk 18Allowed

Beneficiary signup · 11:03Commercial VPN for the first time · risk 61Extra factor

Transfer 9,800 EUR · 11:07SIM from another country and impossible travel · risk 94Held

The legitimate operation repeats in the same places.

Every customer operation leaves a dot. Our technology learns their usual places and scores each new operation against them: the dot that does not fit is the one that gets held.

A rules engine that speaks your fraud team's language.

Each operation gets a score based on where it comes from, what device it uses, and how it behaves. The rules belong to the bank: you create and adjust them from the console without waiting for a deployment.

Operation originated in a FATF-listed country.
Anonymous network: TOR, commercial VPN, or residential proxy.
Discrepancy between radio signature, GPS, and SIM country.
Spoofed GPS or impossible travel between two operations.
High-risk access provider or blacklisted IP address.
Place where previous attacks were already confirmed.

Known malicious apps on the device.
A debugger attached to the app while operating.
Modified system: root, jailbreak, or emulator.
Device on blacklist or model typical in fraud campaigns.
Operating system without recent security patches.
Roaming that doesn't match the customer's travels.

Virtual eSIM activated just before operating.
System language changes without the device or location changing.
Transfer ordered while a call is in progress or call forwarding is active.
One device operating for more than three customers.
Bursts of connections in windows of just a few minutes.
Sequences that replicate already-identified campaigns.

Sign-ups, logins, KYC, each transfer, and any change to data or account settings are scored.

Anatomy of an evaluation, from signal to decision.

Every operation goes through three phases in milliseconds. This is a real engine report, with identifiers changed.

01
Gather
The SDK reads the device environment at the moment of operation: GPS position, network, carrier, model and system, language, and app status.
02
Understand
The engine contrasts GPS position with the radio signature and IP, and puts it alongside the customer's history: how many times they have operated, from where, with which device, and which network.
03
Intercept
Each fraud family adds its score, the result is explained in a sentence, and your system decides: allow, request another factor, or hold.

TransferMobile banking · 10:42:18

Gather

TerminalAndroid 14 · Samsung
Network4G · IP 203.0.113.45
GPS± 12 m

Understand

Radio signatureCustomer's usual area
GPSMatches
IPMadrid · Hosting VPN
Customer312 operations · seen yesterday
TerminalNew for this customer
Call in progressYes
App installedKnown remote control

Intercept

Account takeover70
Tampering110
Money laundering0
New account fraud0

Held · 180

"Vishing with new device: the customer is on a call and is operating from a device they have never used before, with a remote control app installed".

Each type of fraud, with its own score.

The engine doesn't give an opaque number: it separates risk by families so your team knows what's happening and can act accordingly.

Account takeover

Someone who is not the customer operates with their session or convinces them to operate themselves.

Vishing: operation during a call, with a new device or context.
Phishing: a known customer uses a new device that others have already used.
Impossible travel and country or device never seen before.

How to prevent account takeover

New account fraud

Accounts opened to defraud from day one.

Synthetic identities: a new user on a device or place already known.
New accounts on a device already used by other customers.

Money laundering and money mules

Accounts that move money that is not theirs.

Customers operating from places or contexts associated with money mules.
New users who appear in those same places.
Places associated with tax evasion.

Tampering

The device or network lie about who and where.

Root, emulator, automated browser, debugged app, or malware.
Spoofed GPS, TOR, VPN, proxy, hosting, relay, and masked SIM.

Lists and repeat offending

What is already known, applied without delay.

Countries on FATF black and gray lists.
Entity's own blocklists.
When your team confirms fraud, their device, network, and location are marked.

Operate only from where it should

For operations that should only be done from an office, a branch, or an agency.

Operation outside the assigned office.
User not on the agency's list.
Position that cannot be confirmed with the data received.

Active defense during the session.

Detect compromise indicators while validating identity, not just before. And track the campaigns impersonating the bank.

Real-time antimalware

What malware does when the customer is already inside.

Overlays: Spoofed overlays to steal credentials and 2FA.
RATs: Hidden AnyDesk or TeamViewer operating on behalf of the user.
Keyloggers: Capture of PINs, cards, and private keys.
SIM swapping and confirmation SMS sniffers.
Injection and hooking: Change of destination IBAN at the last second.

Antiphishing and smishing

Continuous internet scanning to locate sites impersonating the bank.

Vulnerability analysis of the attacker's infrastructure.
Real-time capture of credentials being stolen.
Immediate notification to block access and reset credentials.
Detection of compromised cards.
Tracking of channels where stolen information is centralized.

Built for the daily work of the fraud team.

Less time decoding alerts, more time resolving cases.

Case manager and forensicsEach case with its device, location, and timeline, kept for up to 24 months and exportable as evidence.

The why, in one sentenceEach flagged operation arrives explained in natural language, without having to read rules or scores.

Fewer false positivesThe platform reviews history in batches and proposes adjustments to the rules that generate the most noise.

Rules proposed, never imposedWhen a new pattern appears, the platform proposes the rule and the analyst accepts it, edits it, or discards it.

It integrates into your app and your decision engine without changing either.

1
Datasource SDK in your app
Library for iOS, Android, and JavaScript. Reads signals when the customer operates, without new screens or extra permissions your customers need to explain.
2
Fraud Detection API from your backend
With the operation identifier you request the report over HTTP, or receive it via webhook or WebSocket as soon as it's ready.
3
Your engine decides
The score and fraud family enter the BPM, SIEM, or case manager you already use, with the rules you already have.

Fraud Detection API response (extract)

"intercept": {
  "score": 180,
  "account_takeover": {
    "score": 70,
    "kind": "Vishing: New device"
  },
  "tampering": {
    "score": 110,
    "kind": "Network: VPN"
  },
  "money_laundering": { "score": 0 },
  "explanation": "The user is on call and trying to make a transaction with a new device"
}

Customer story · Abanca

Abanca detects money mules and SIM swaps without adding a single step for the customer.

The entity integrated the Datasource SDK in its app and the Fraud Detection API in its decision engine. The customer notices nothing; the fraud team finally sees where each person operates from.

Read the full case

Frequently asked questions about fraud detection

How do you prevent account takeover?

By checking, at every login, new payee and transfer, that the operation comes from the customer's usual places, with their device and their usual way of operating. A device or a country never seen before, impossible travel or an operation during a phone call raise the account takeover score, and the operation asks for another factor or is held. Full account takeover guide.

How is a money mule account detected?

By the place and context from which it operates. The engine flags customers operating from places or contexts already associated with money mules, and new users appearing in those same places, even if each operation seems normal on its own.

How are vishing and authorized push payment fraud stopped?

By detecting the conditions in which it occurs: a transfer ordered during an ongoing call, from a new terminal or context, or with a remote control application installed. With those signals, the operation is held before the money leaves.

How is SIM swapping detected?

By comparing the SIM and operator with the terminal's actual location. A change of operator or SIM country that does not match the place's radio signature, or that coincides with a network change, triggers as a risk signal.

Does it add steps or friction to the end customer?

No. The SDK reads signals in the background while the customer operates, without new screens. Only risky operations receive an additional factor or are held; the rest proceeds as always.

How does it integrate with our decision engine?

The Datasource SDK integrates into the iOS, Android or web app, and your backend requests the report for each operation from the Fraud Detection API via HTTP, or receives it via webhook or WebSocket. The score and fraud type enter your current rules.

Let's analyze your fraud cases with real data.

A specialist reviews your scenarios before the call and we show you the platform using your own operations.

Talk to an expert SDK documentation

What we need for the pilot

A test environment for your mobile or web app
Anonymized historical operations to calibrate
The fraud rules you apply today
An analyst to validate the first cases