Fraud vectors
A shared library of detectors — deterministic rule signals and embedding-based similarity search. Vectors surface applications for review; they never decide outcomes.
Shared Address + IP Reuse
ruleFlags rental assistance applications when the same service address and submission IP appear repeatedly within a review window.
- Logic
- AND
- Conditions
- 2
Organized Fraud Similarity Cluster
similarityCompares normalized rental assistance application fingerprints against a confirmed fraud corpus of template reuse and payment-risk cases.
- Threshold
- 0.83
- Corpus
- multi-household-ring
Digital Gift Card + Tax Return
ruleHigh-confidence vector derived from audit findings: digital gift card payment combined with tax return documentation.
- Logic
- AND
- Conditions
- 2
Go2Bank / Green Dot + Utility Template
ruleEscalates applications using high-risk routing numbers paired with utility-bill documentation or duplicated utility templates.
- Logic
- AND
- Conditions
- 2
Builder
Compose new detectors and preview how they behave before saving them to the library.
Rule builder
Compose AND/OR logic for deterministic signals. Front-end only in the scaffold — persist via POST /api/vectors.
{
"logic": "AND",
"conditions": [
{
"id": "cond-1",
"column": "signal:street_address",
"operator": "contains",
"value": "juniper"
},
{
"id": "cond-2",
"column": "signal:ip_address",
"operator": "equals",
"value": "66.41.14.22"
}
]
}Similarity search
Similarity vectors reference a corpus tag and a score threshold, then use pgvector search to find historical analogs.
- Type
- Similarity
- Corpus tag
- multi-household-ring
- Threshold
- 0.83
Thresholds above 0.80 are a reasonable starting point for sparse corpora. Lower them only with a review workflow that can absorb more false positives — protecting legitimate applicants comes first.