Fraud / risk ops · linked identity · defensible
Unmask ID ties device, payment instrument, and velocity into one identity graph, scores the live session, and writes the reason a chargeback analyst can defend to a bank. We will not sell "find anyone." We sell "this session is the same actor as case #1182, and here is the code that proves it."
POST /v1/session → { risk: 83, decision: "hold", reasons: ["DEV-02","VEL-01","INS-03"], linked_case: 1182 }
Live case: session s_9f21c on a $1,240 electronics order. Score 83. Held. Same device family as two charged-back orders in the last 30 days.
Hold, don't decline. Analyst reviews with the graph, not a coin flip.
OSINT is capped at a thin corroboration layer, never the driver.
Analysts close 76% of unmask tickets inside 15 minutes with the graph attached.
74% auto-approve clean, 17% hold for review, 9% auto-decline. The desk only touches the middle.
The spike is a card-testing burst at 03:10: 41 attempts, 6 instruments, 1 device. The graph collapsed it to one actor.
What the graph does
A single order is a point. Fraud is a shape. Unmask ID connects the points a fraud ring reuses — the device, the card BIN, the shipping node, the timing — and returns the smallest explanation that a chargeback analyst can stand behind in a dispute.
Device, instrument, address node, and session join into one entity. When the same actor comes back under a new email, the graph already knows.
A privacy-safe fingerprint that survives a cleared cookie and an incognito window, without storing raw hardware IDs. Families, not just exact matches.
BIN, network token, and issuer behavior tie cards to the same wallet even across processors — the way a ring rotates plastic behind one buyer.
Card-testing bursts, impossible-travel logins, and 3 a.m. order storms surface as velocity codes with the exact window that tripped them.
Every score decomposes into named codes — DEV-02, VEL-01 — each with a plain-English line an analyst can paste into a chargeback response.
Access is scoped to a permissible risk purpose and logged. There is no "search a person" box. If your use looks like consumer surveillance, we say no.
Reason codes
A score you cannot explain loses the chargeback. Every Unmask ID decision returns the codes that drove it, ranked, so the analyst defends a reason — not a number.
DEV-02Device reuse across cases. This session's device family matches two prior charged-back orders in the last 30 days.VEL-01Card-testing velocity. Six distinct instruments attempted from one device inside a nine-minute window.INS-03Instrument cluster. The card shares a network token and issuer pattern with an instrument already on a known ring.GEO-02Impossible travel. Login geolocation moved faster than physically possible since the prior authenticated session.NODE-01Shipping node reuse. Ship-to resolves to a freight-forward node linked to three unrelated buyer identities.OSINT-01Thin corroboration. A single public-record signal weakly supports the linkage. Capped low; never the driver of a decline.CLEAN-00No linkage found. The session stands alone with good history. Approve — and we say why, so approvals are auditable too.A reason code you cannot read to a bank is a liability, not a feature. That is why OSINT-01 is capped and CLEAN-00 exists: we document why we cleared a session as carefully as why we held one. Approvals get audited too.
Session flow
41 attempts, 6 instruments, one device fingerprint. VEL-01 fired.
Device family matched two charged-back orders from prior weeks. DEV-02 added.
Auto-hold, routed to the overnight desk with the full graph attached.
Ruiz reviewed, confirmed the ring, declined and blocked the device family.
One order slipped through earlier; representment packet with codes won the chargeback.
The representment packet
A chargeback is won on evidence, not vibes. The packet exists so the analyst who held the session at 3 a.m. does not have to reconstruct their reasoning three weeks later — the graph already wrote it down.
Case log
| Case | Score | Top codes | Decision | Linked | Outcome |
|---|---|---|---|---|---|
| #1182 | 83 | DEV-02 · VEL-01 | Hold → decline | 6 instr | Ring blocked, dispute won |
| #1183 | 12 | CLEAN-00 | Approve | 0 | Good order, no touch |
| #1188 | 67 | GEO-02 · INS-03 | Hold | 2 dev | Analyst approved after step-up |
| #1191 | 91 | NODE-01 · DEV-02 | Decline | 3 buyers | Freight-forward ring |
| #1195 | 44 | VEL-01 · OSINT-01 | Hold | 1 instr | False alarm, released, labeled |
| #1199 | 78 | INS-03 · DEV-02 | Hold → decline | 4 instr | Same wallet, new email |
Case #1195 was a false alarm — a legitimate reseller buying in bursts. The analyst released it, labeled it, and the graph learned the pattern. We count released cases as a win, not a miss. A fraud tool that never clears anyone is just a decline button.
One mid-market merchant, first quarter on the Desk plan.
The bright cell at 03:00 is card-testing hour. The graph is busiest when the store is quiet.
Only holds hit the queue. Clean sessions never touch a human.
Graph vs. checkbox
| Capability | Single-order score | Unmask ID graph |
|---|---|---|
| Sees one order | Yes | Yes |
| Links the same actor across orders | No | Yes |
| Explains the decision | Opaque score | Named reason codes |
| Defends a chargeback | You write it | Packet exports itself |
| Documents approvals | Rarely | CLEAN-00 on record |
| Consumer look-up box | Sometimes | Never |
03:10. The quiet hour for the store is the loud hour for the graph. A single-order score sees 41 small approvals; the graph sees one ring.
A single-order score answers "is this order risky?" The graph answers "is this actor risky, and can I prove it?" The second question is the one that wins disputes.
Proof & boundaries
“My analysts stopped arguing about gut calls. Every hold comes with codes they can defend, and our representment win rate went up because the packet writes itself.”
— Head of risk, marketplace (Desk plan)“We evaluated four vendors. Unmask was the only one that told us where it wouldn’t help and refused to build a ‘look up a customer’ screen. That’s exactly why compliance signed off.”
— VP fraud, payments (Bank, on-prem)SOC 2 Type II — audit in progress, report expected next quarter. We will show you the current controls and the auditor, not a badge we did not earn.
Pricing
No, and it never will be. There is no box to look up a person. Unmask ID scores sessions and links identities for a permissible payment or account-risk purpose, and every query is logged against that purpose.
SOC 2 Type II is in progress — the audit is underway and the report is expected next quarter. We will share our current controls and the auditor. We will not claim a certification we do not hold.
Every decision returns ranked, named codes with a plain-English line each. The Desk plan bundles those codes, the graph snapshot, and the session timeline into a representment packet your analyst can submit as evidence.
Watch and Desk run hosted with US or EU residency. Bank runs entirely inside your VPC — the graph never leaves your environment, and access is scoped by role and purpose.
Payment fraud, account takeover, and chargeback representment. Not hiring, not dating, not “who is this person.” Every query is logged against the purpose you selected.
Inquire
Tell us your chargeback rate and what your desk fights with today. Business risk use only — not consumer lookup.