Score every incoming transaction in real time. Operators get an allow / review / block decision back instantly, letting them stop fraud at the point of sale before money moves.

The real fraud-rule evaluation engine is live, replacing the Phase 7 stub behind the exact same score contract. Rules are authored in a JSON policy language, validated, dry-run against past traffic, staged in shadow mode where they score every live event without affecting the verdict, then promoted to active — with the change reaching the scoring path within minutes. The full 41-rule pack from the pilot's incumbent vendor ships as the default policy every new client inherits, and the labelled-dataset import and golden-replay harness run through the production scoring path. The pilot's confirmed-case dataset (150 fraud + 145 legitimate accounts) has been imported and replayed against the engine, and rule scores were calibrated against it: decisions agree with the incumbent vendor on 93% of events, 100% of confirmed fraud is caught, and false blocks on legitimate users dropped from 28 to 3 — the remainder now routes to analyst review instead of being rejected.

The manual-review loop fraud analysts live on: every "review" decision automatically opens a case, analysts resolve it (allow / block / escalate / snooze), and the final verdict is delivered back to the operator instantly. Closes the workflow the pilot's team uses daily to keep false positives down.

Identify the device and location behind every visitor — even when fraudsters hide behind VPNs, proxies, or emulators. Spots repeat offenders trying to come back under new identities and adds a strong second signal beyond account data. The collector, server-side identity resolver, and enrichment layer (disposable-email, MX, sanctioned-names, emulator detection, geo/timezone-mismatch) are live end-to-end on both the sync and async scoring paths, with the device–account link now written server-side for the next phase's cross-account linking to build on. Bundle size (16.4 KB gzip, well under the 30 KB budget) and synthetic device-stability numbers are proven; real-traffic VPN/bot detection recall and production latency validation remain open, pending the IPQualityScore licence (E9) and the Phase 2b staging environment.

Automatically connects accounts that share an email, phone, device, card, or IP address — surfacing the multi-accounting and bonus abuse that a single-account view misses. Live end-to-end: the link read-model is served straight off the device/account-signal graph (no extra storage, sub-millisecond rule lookups from a hot cache), and every scored event feeds it on both the sync and async paths. The public GET /v1/accounts/{id}/links endpoint returns linked accounts grouped by signal type with first/last-seen facts, and the GDPR right-to-erasure flow removes and audits a customer's personal data on request — a contractual requirement for regulated operators. Latency proven on the live stack (linkage readable in ~5–9 ms vs. the 5 s budget; rule lookups ~0.4 ms vs. the 5 ms budget).

Several detection rules rely on 30-day behavioural history — its production feed is not switched on yet, so those rules contribute nothing today. This phase turns the feed on, stores the reasoning behind every decision so analysts see exactly why an event was scored, raises an alert the moment scoring degrades, verifies every shipped rule has a live signal source, and enables IP intelligence. The closing step: a control measurement of detection quality on the live environment, ahead of the pilot integration. Fingerprint match quality and drift metrics are exposed along the way.

A documented, versioned integration interface for operators' engineering teams, with authentication and per-key access control. This is the contract external systems integrate against to send events and read scores.

The customer console becomes usable end-to-end: team members are invited by email and set their own passwords, analysts live in the case review queue, admins author and backtest rules, and the integration essentials are self-serve — API keys and project settings (webhook, decision thresholds) — plus a first traffic overview. Built on a professional design system produced inside this phase; the pilot's team starts working in the product months before the full console is finished.

Everything between working software and a service an operator relies on: production-hardened images, CI that refuses to ship unverified code, UAT and production environments provisioned as code, rehearsed backups and disaster recovery, alerting that reaches a human, and a 1,000-events-per-second certification of the real-time SLA. Runs in parallel with the feature queue (DevOps-owned) — the test environment and all seven background workers are already live in the cloud.

The remaining customer console screens on top of the v1 foundation: device fingerprint inspector, linked-accounts explorer, verification status, the metrics dashboard, team & roles management, billing view and key-rotation flows — completing the day-to-day workspace for risk and compliance teams. The device views go deep: match quality, confidence / stability and drift metrics per fingerprint, visit and unique-IP counters, and a per-project cluster graph of linked accounts with typed nodes (device, account, email, phone, IP, card).

First-party tooling for the platform team itself: a separate operator login, client account management (create, suspend, provision the default rule pack in one click), a cross-client overview of projects and API keys, platform health metrics and a full audit-trail viewer. Deliberately sequenced ahead of the pilot shadow-run — these are the tools the shadow-run is operated with.

Catch chargebacks before they hit. Connects to major card-network dispute programmes so fraudulent purchases are blocked or refunded automatically — cutting chargeback losses and protecting the operator's merchant standing. Gated on external agreements (early-warning partner contract, card-network enrollment) — paperwork already tracked on the dependencies board below.

End-to-end identity verification at five levels — from phone confirmation to document checks, liveness, sanctions screening, and politically-exposed-person checks — keeping the operator compliant with KYC and AML regulations.

The platform earns the pilot's sign-off on evidence: detection quality is validated against the labelled dataset, then live traffic runs in shadow mode alongside the incumbent vendor — every decision compared, every divergence triaged with the pilot's analysts — before 100 % of traffic cuts over. Sign-off marks AntiFrod as a complete, production-grade replacement.

Scheduled right after pilot cutover — the pilot is onboarded hands-on, so this serves clients №2 and beyond: new operators sign up, provision a sandbox, and start integrating without a sales call, shortening the path from interest to first live event.