Fraud & Attack Protection
Note
Fraud & Attack Protection is available only when you use Descope Flows.
Descope has built-in capabilities that detect fraud and risk signals, such as bots, VPNs, and impossible travel. Your flows can check these signals in conditions, so you add friction, such as MFA, only when the risk is high.
A flow that asks every user for MFA on every sign-in slows down legitimate users. A flow that never asks lets bots and attackers through. Risk signals let one flow treat a returning user on a known device differently from a scripted sign-up from a VPN.
For signals that Descope doesn't detect out of the box, you can bring your own connector.
To add risk signals to your flows, see the Implementing Fraud & Risk Signals guide.
How It Works: Built-In Risk Signals
The following riskInfo signals are built into Descope:
| Signal | Description | Requirements |
|---|---|---|
| riskInfo.botDetected | Detects bot-like behavior based on Cloudflare's network-level analysis. | Fingerprint Assess action after a screen, or a fraud connector that detects bots |
| riskInfo.riskScore | A risk score from 0 to 1. See About the Risk Score. | Fingerprint Assess action after a screen |
| riskInfo.vpnDetected | Flags requests from known VPN IP addresses, based on Cloudflare's managed VPN IP list. | None |
| riskInfo.impossibleTravel | Flags sign-in attempts that are geographically implausible compared to previous sign-ins, based on time and distance. | None |
| riskInfo.trustedDevice | Indicates whether the current device was previously marked as trusted. See Trusted Devices in Flows. | None. If you manage tokens in cookies, your project needs a custom domain, which is available on the Pro tier and higher. |
For the full list of riskInfo keys, including keys that fraud connectors set, see RiskInfo.
Fingerprint Assess Action
The built-in Fingerprint Assess action sets riskInfo.botDetected and riskInfo.riskScore from Cloudflare's bot verdict for the request. No third-party account is needed.
Note
Fingerprint Assess is separate from the Fingerprint connector, which uses your own Fingerprint.com account.
About the Risk Score
Higher scores mean more risk. Fingerprint Assess maps each Cloudflare verdict to a fixed score:
| Cloudflare verdict | riskInfo.riskScore |
|---|---|
| Not a bot | 0.1 |
| No verdict available | 0.2 |
| Verified good bot, such as a search engine crawler | 0.8 |
| Likely a bad bot | 0.9 |
| Bad bot | 1.0 |
riskInfo.botDetected is true for any bot verdict, including verified good bots.
Don't use riskInfo.riskScore with fraud connectors
riskInfo.riskScore is reliable only when the Fingerprint Assess action is the only risk source in your flow. When your flow uses a fraud and risk connector, such as reCAPTCHA, riskInfo.riskScore doesn't give a meaningful score. Check the connector's own output instead.
Bring Your Own Connector
Fraud connectors add signals such as device fingerprinting, IP reputation, and phone number risk. You can combine fraud connectors with the built-in riskInfo keys in the same flow, except riskInfo.riskScore. When your flow uses a connector, check the connector's own output instead of riskInfo.riskScore. For the available connectors, see Fraud Connectors.
Note
Fraud connectors require an account with the provider. Connectors that run a script in the browser, such as reCAPTCHA, Turnstile, hCaptcha, Arkose, and Fingerprint, must be added after a Screen in your flow.
Additional Protections
Two more protections work alongside risk signals:
- Bot Trap: Bot Trap adds an invisible field to your screens. Basic bots try to fill in the field, and Descope flags those bots automatically. Bot Trap is free and needs no connector. Learn more about Bot Trap.
- SMS pumping and IRSF protection: Combining
riskInfosignals with country restrictions and rate limiting protects SMS sign-in from toll fraud. See Preventing IRSF and SMS Pumping.
Example Use Cases
The following flow templates use risk signals. Select a template to open it in the Descope Console.
| Use Case | Flow Template | How It Works |
|---|---|---|
| Bot Prevention at Sign-Up | Sign up with bot trap spam protection | Stops the sign-up when a bot fills in the Bot Trap field. |
| Sign up or in with reCAPTCHA Enterprise | Runs the reCAPTCHA Enterprise assessment and checks the connector's own score, not riskInfo.riskScore. Requires email OTP when the score is 0.5 or lower. | |
| Risk-Based MFA | Sign in - passkeys or social with OTP MFA | Runs the Fingerprint Assess action, then requires OTP MFA when riskInfo.riskScore is above 0.5. |
| Impossible Travel | Adaptive MFA with impossible traveler | Requires MFA when riskInfo.impossibleTravel is true. |
| Trusted Devices | Adaptive MFA with trusted device | Skips MFA when riskInfo.trustedDevice is true. After MFA, the user can mark the device as trusted. |
| Multiple Risk Signals | Adaptive MFA with multiple risk inputs | Skips MFA only when the device is trusted and riskInfo.impossibleTravel is false. |