Implementing Fraud & Risk Signals

Descope adds fraud and risk signals to the riskInfo context of every flow. You collect some signals with an action or a connector, and Descope sets the rest automatically. Your flow then checks each signal in a condition, so the flow adds friction only when the risk is high.

Using the Fingerprint Assess Action

The Fingerprint Assess action is Descope's built-in risk detection, powered by Cloudflare's network-level analysis. Fingerprint Assess needs no third-party account. To use the Fingerprint Assess action:

1. Add a Screen where the user interacts, for example a sign-in, sign-up, or MFA screen.
2. Add the Fingerprint Assess action immediately after the screen.
3. Check the risk signals in a condition after the Fingerprint Assess action.

What Sets Each Signal?

Checking a Risk Signal in a Flow Condition

Every risk signal is checked the same way, with a condition:

1. In the Flows tab of the Descope Console, open your flow and select the blue + button.

2. Select Condition, and place the condition after the step that collects the signal, such as the Fingerprint Assess action. The condition editor opens:

   

3. In the If section, enter the riskInfo key to check in Key, for example riskInfo.botDetected.

4. Select the Operator, and enter a Value if the operator requires one:

   • For true or false signals, such as riskInfo.botDetected and riskInfo.impossibleTravel, use Is True.
   • For scores, such as riskInfo.riskScore and riskInfo.smsRiskScore, use Greater Than with a threshold, for example 0.5.

5. Select Done.

6. Connect the If outcome to the stricter path, such as MFA, step-up, or a block.

7. Connect the Else outcome to the regular path.

The following sections describe each signal and give an example condition.

Risk Score (riskInfo.riskScore)

The Fingerprint Assess action sets riskInfo.riskScore to a score from 0 to 1, where higher values mean more risk. The score comes from Cloudflare's bot verdict for the request:

A threshold of 0.5 separates requests that Cloudflare treats as human from requests that Cloudflare treats as bots.

Example Condition

1. Add a Screen, for example a sign-in or sign-up screen.
2. Add the Fingerprint Assess action immediately after the screen.
3. Add a condition on riskInfo.riskScore with Greater Than and 0.5.
4. Send the matching outcome to step-up authentication.

Bot Detection (riskInfo.botDetected)

riskInfo.botDetected flags bot-like behavior during authentication attempts.

• Detection sources: Two kinds of sources can set riskInfo.botDetected:
  • The Fingerprint Assess action uses Cloudflare's network-level analysis. The Fingerprint Assess action does not fingerprint the browser or device.
  • Fraud connectors such as Fingerprint and reCAPTCHA Enterprise can add browser and device signals.
• Combining sources: riskInfo.botDetected is true when any source in the flow detects a bot, and stays true for the rest of the flow.
• Good bots: Verified good bots, such as search engine crawlers, also set riskInfo.botDetected to true.
• Requirement: Your flow needs the Fingerprint Assess action after a screen, or a fraud connector that detects bots.

Example Condition

1. Add the Fingerprint Assess action after the screen.
2. Add a condition on riskInfo.botDetected with Is True.
3. Send the matching outcome to a block or a stricter authentication path.

VPN Detection (riskInfo.vpnDetected)

riskInfo.vpnDetected flags requests that hide the user's real origin through a VPN.

• Detection source: Descope sets riskInfo.vpnDetected from Cloudflare's managed VPN IP list. Other risk connectors, such as the Fingerprint connector, can also set it.
• Requirement: Your flow needs no extra step. The Fingerprint Assess action is not needed.
• Coverage: Cloudflare's managed list covers known VPN services. For broader VPN and proxy detection, add the Fingerprint connector.

Example Condition

1. Add a condition on riskInfo.vpnDetected with Is True.
2. Send the matching outcome to a stricter authentication path.

Impossible Travel (riskInfo.impossibleTravel)

riskInfo.impossibleTravel flags sign-ins from geographically implausible locations.

• Detection source: Descope compares the location and time of the sign-in with the user's previous sign-ins.
• Requirement: Your flow needs no extra step. The Fingerprint Assess action is not needed.

Example Condition

1. Add a condition on riskInfo.impossibleTravel with Is True.
2. Send the matching outcome to re-authentication.

SMS Risk Score (riskInfo.smsRiskScore)

riskInfo.smsRiskScore measures the likelihood of SMS toll fraud, also known as SMS pumping, for the phone number in the flow.

• Detection source: The Assess action of the reCAPTCHA Enterprise connector sets the score, using Google's SMS Defense.
• Range: The score goes from 0.0 to 1.0. A score of 0.0 means low confidence of SMS toll fraud, and 1.0 means high confidence.
• Requirement: Your flow needs the reCAPTCHA Enterprise connector with SMS Defense. The Fingerprint Assess action is not needed.

Example Condition

1. Add the reCAPTCHA Enterprise Assess action after the screen where the user enters a phone number.
2. Add a condition on riskInfo.smsRiskScore with Greater Than and your threshold, for example 0.5.
3. Send the matching outcome to a method that does not send an SMS, such as email OTP, or block the request.

For a complete approach to SMS fraud, see Preventing IRSF and SMS Pumping.

Trusted Device (riskInfo.trustedDevice)

riskInfo.trustedDevice lets users skip MFA on devices the users already verified. For setup and examples, see Trusted Devices in Flows.

Connectors

With the built-in signals in place, you can also check signals from fraud connectors, such as:

• reCAPTCHA Enterprise (bot protection)
• Turnstile (alternative CAPTCHA)
• Telesign (phone number and risk intelligence)
• Fingerprint (device and browser fingerprinting, and VPN and proxy detection)
• Forter and Sardine (fraud and behavioral risk scoring)

For every available fraud and risk connector, see Fraud Connectors.

Using Connector Risk vs. Unified Risk Score

The Fingerprint Assess action provides riskInfo.riskScore without a fraud connector. When your flow uses any fraud connector, riskInfo.riskScore is no longer reliable, so check each connector's own output instead.

For more information about fraud and risk signals and connector options, visit the Fraud & Attack Protection documentation page.