Capability · Detect

Fraud moves across events. Follow the pattern.

One account looks ordinary. The connected activity tells a different story. SENTR combines event-scoped rules, customer-specific anomaly detection and linked history to help your team investigate increasingly complex fraud.

Mapped context across providers and event types
Rules, anomaly and policy as complementary layers
Monitor evaluates without influencing score

Inspect Decisions & Rules → Book a Session

The payment is not always where the attack begins.

Point scores catch obvious declines. Rings, synthetic journeys and cross-event probes slip between systems that never share policy. Analysts spot the pattern late—after loss, after a partner escalation, or after a queue nobody owns.

The commercial question is not “another model.” It is whether detection, decision, investigation and improvement share the same event and entity context.

One instrument. Eight accounts. A better question.

Read the diagram

Eight illustrative accounts link to one payment instrument. Inspect timing, merchant context and prior outcomes to distinguish coordinated attempts from legitimate shared use. The links require the identifiers you supply; they do not assume automatic cross-provider card matching.

Connect the signals. Shape the response.

Rule scores and customer-model anomaly scores stay distinct. Decision policies determine the response; action policies trigger the next workflow.

Layered detection anatomy

Mapped events & history Registration, login, payment, payout and related events you supply—with the fields and history you can join.
Rules & lists Rules can contribute scores or return direct decisions. Lists have customer-set influence scores; a match is not automatically a block.
Anomaly & scoring profiles Customer-specific anomaly detection learns normal activity on a separate score axis. Scoring profiles adjust numeric thresholds inside rules.
Decision & action policy Decision policies set review/block cutoffs; action policies trigger cases, notifications and webhooks. Your integrated system enforces the response.

What this looks like in practice

Linked payout after a quiet account week

A payout event arrives with a clean payment history—but linked devices and beneficiaries reveal recent accounts worth investigating. Rules identify velocity and beneficiary reuse while the customer model assesses abnormal activity on its separate score axis.

Quiet payment week
Payout event
Linked devices / beneficiaries
Review with attribution

Response: Configured policy returns review
Evidence: Rule contribution, customer-model score and linked context available to the reviewer

The reviewer does not rebuild the story from three tools. The decision record already shows contribution and connections.

Configurable detection

Configure rules, scoring profiles, lists and decision policies around the events and fields you map. Detection quality depends on that context. For qualified SENTR.Citadel evaluations, free Shadow Mode lets you compare decisions alongside your existing controls before changing live enforcement.

Connected intelligence

Open the network behind the event.

An event can look ordinary until you see the same device, session or instrument in other activity. Rebuilding those relationships manually slows every investigation.

SENTR resolves five profile families: users/accounts, devices, sessions, IPs and payment methods. Each brings together activity, risk indicators, alerts, open cases and linked profiles from the identifiers you supply.

SENTR Connection Ring linking a payment-attempt event to a device and payment method, with a selected-node detail panel. — **Follow the connection, not another spreadsheet**
A payment event and its linked device and instrument in Connection Ring. A connection is an investigation lead, not a verdict.

Inspect the relationship and keep the underlying event in view.

Go deeper: Connected intelligence

Move from account to context: Overview, Activities, Linked Profiles, Cases and Connections give analysts a consistent way to explore each entity. Linked profiles expose risk, activity counts and first/last activity.
Follow the Connection Ring: Inspect direct and inferred relationships in an interactive graph. Focus a node, inspect connections, rearrange and zoom to trace related accounts, devices and instruments.
Start from the report, not only the alert: Create a case directly from a profile when a customer reports takeover or another concern. You do not need to wait for a new flagged payment to begin investigating.

Turn a suspicious connection into an investigation with context. Shared identifiers are leads—not proof of collusion or guilt.

Make the pattern visible before the next decision.

Show us the fraud pattern you need to understand. We will map the signals, controls and investigation workflow that could help.

Map your fraud pattern with us → Explore payment fraud and chargebacks

Or Book a Session