Skip to main content

​
What is Suspect Score

Suspect Score is a single risk score that helps you quickly identify suspicious activity using Smart Signals. Instead of analyzing each signal individually, Suspect Score combines them into one value—making it easier to make fraud decisions in real time. Each Smart Signal contributes to the score with a predefined weight. The more suspicious signals are triggered, the higher the final score. It’s part of the Smart Signals payload available in Server API, Webhooks and Sealed Client Results.
How new signals affect your scoreWhen new Smart Signals are introduced: New customers automatically receive default weights Existing customers start with a weight of 0 to avoid impacting existing logic. You can enable and configure these weights at any time in the Custom Weights Configuration section.

​
Suspect Score Weights

Each Smart Signal has its own weight, contributing to the final score. The weights are currently based on the probability that the selected Smart Signal is triggered on a global scale. Smart Signals that are less likely to be triggered have stronger weights, and vice versa. Weights might have slightly different values based on the request’s originating platform (web, Android and iOS). This is caused by different representation of average traffic for each platform.
N/A in the table below means that the signal is not reflected in the Suspect Score. This might happen for two reasons - either the signal is not available on that particular platform (see our Smart Signals introduction page for signal availability) or the signal had low incidence rate and would skew the computation too much (the weight would be extremely high).

​
Weights Table

Smart SignalWeb/BrowserAndroidiOS
Bot Detection (bot.type == bad)7N/AN/A
Incognito Detection (incognito)4N/AN/A
VPN Detection (timezone_mismatch)344
VPN Detection (public_vpn)455
VPN Detection (os_mismatch)N/AN/AN/A
VPN Detection (auxiliary_mobile)N/A66
VPN Detection (relay)444
Tampering Detection (AnomalyScore > 0.5)8N/AN/A
Tampering Detection (Anti-detect Browser)8N/AN/A
Virtual Machine Detection (virtual_machine)14N/AN/A
Developer Tools Detection (developer_tools)8N/AN/A
Velocity Signals (velocity)N/AN/AN/A
Privacy-Focused Settings (privacy_settings)6N/AN/A
IP Blocklist (email_spam)141213
IP Blocklist (attack_source)131313
Tor Exit Node (tor)141617
Data Center Proxy (proxy_details.proxy_type == data_center)141215
Residential proxy (proxy_details.proxy_type == residential)666
Android Emulator Detection (emulator)N/A9N/A
Rooted Device Detection (root_apps)N/A12N/A
Cloned App Detection (cloned_app)N/A9N/A
Jailbroken Device Detection (jailbreak)N/AN/A10
Frida Detection (frida)N/A14N/A
MitM Attack Detection (mitm_attack)N/A1414
High-Activity Device (high_activity)656
iOS Simulator Detection (simulator)N/AN/A16

​
How to Use Suspect Score

Suspect Score can be used to flag and review possible suspicious activity. It can be used to quickly integrate Smart Signals into your fraud protection workflow without the need to explore fraud correlations of individual Smart Signals. 
{
  // ...
  "suspect_score": 10
}

​
Custom Weights Configuration

Fingerprint allows you to customize Suspect Score weights in two ways:
  • Automatic weight generation using fraud-labeled data
  • Manual adjustment of signal weights
Automatic weight generation allows you to train Suspect Score weights using your own fraud data, making the score better reflect fraud patterns in your environment.

​
Automatic Weight Generation Using Fraud-Labeled Data

You can train Suspect Score using your own fraud-labeled data to better reflect your specific risk patterns. Fingerprint analyzes your dataset and recommends optimized weights based on how each Smart Signal correlates with fraud. Based on this analysis, the system generates recommended weights for each signal. These recommendations help tune the Suspect Score so it better reflects the fraud patterns specific to your traffic.

​
Preparing Your Dataset

Your dataset must meet the following requirements: Format
  • CSV file
  • Minimum count of events to upload is 1,000
  • Maximum file size: 10 MB
You can download an example template to see the expected format. Required fields Your dataset should include:
  • Request ID: the Fingerprint request identifier
  • Fraud label: indicates whether the visitor was fraudulent
The system uses these fields to analyze which Smart Signals appear most frequently in fraudulent activity.

​
Uploading Your Dataset

Follow these steps to generate Suspect Score weights using fraud-labeled data.
  1. Navigate to Suspect Score Analytics
Open the Dashboard and go to: Smart Signals → Suspect Score → Analysis
  1. Upload Your File
You can upload your dataset in two ways:
  • Drag and drop a CSV file into the upload area
  • Click Choose to select a file from your computer
  1. Start the Training Process
After the file is uploaded, Fingerprint will begin analyzing the dataset. During this step the system:
  • Evaluates each Smart Signal
  • Measures how strongly it correlates with fraudulent activity
  • Generates optimized weights for the Suspect Score
The analysis process may take up to 30 minutes depending on the dataset size.
  1. Review Generated Weights
After the analysis completes, Fingerprint generates recommended weights for the Smart Signals. These recommendations appear in the Processed Data section where you can review and decide whether to apply them.

​
Reviewing Processed Fraud Data

All analyzed datasets appear in the Processed Data section. This section acts as a history log for fraud analysis runs and allows you to:
  • Track uploaded datasets
  • Monitor analysis results
  • Review recommended weight changes
  • Apply or reject updates to your Suspect Score configuration

​
Dataset Status

Processed datasets are organized into three categories. Needs Review Files listed under Needs review contain recommendations that have not yet been applied. These datasets require review before any changes are applied. Accepted The Accepted section contains datasets whose recommendations were approved and applied. Once accepted:
  • The recommended weights are applied to your Suspect Score configuration
  • Future requests will be scored using the updated weights
Rejected Datasets listed under Rejected were reviewed but not applied. Rejected datasets remain visible for reference but do not affect the Suspect Score configuration. When you click a dataset in the Needs review section, a review panel opens that displays both signal-level changes and a suggested overall threshold. This threshold represents the score above which a request is likely to be considered suspicious, based on your uploaded fraud data. The interface groups Smart Signals into two categories. Changed Signals listed under Changed have updated weights based on the fraud patterns detected in your dataset. These adjustments increase or decrease the influence of the signal in the Suspect Score calculation. Unchanged Signals listed under Unchanged were analyzed but did not show a strong correlation with fraud in the uploaded dataset. Their weights remain the same.

​
Manual adjustment of signal weights

You can manually adjust weights to match your use case. Open the Dashboard and go to:
  1. Smart Signals → Suspect Score
  2. Select the correct tab based on the platform for which you would like to configure the weights (Web, iOS SDK or Android SDK)
  1. Input your preferred weights as integers between 0 and 10000 on the right
  2. Click on Save Changes
The changes will propagate in a matter of minutes and you will start receiving the Suspect Score based on your custom weights.

​
Disabling a Weight Completely

Some scenarios like the one mentioned above with the high VPN incidence rate might result in the need to disable a particular Smart Signal. In those cases it’s possible to set the weight to zero through a dedicated button in the user interface.
The changes have to be saved at the bottom of the page to propagate.

​
Restoring Defaults

We will always provide a set of default values based on our internal understanding of Smart Signal incidence rates (the statistical analysis mentioned in a previous section). Individual Suspect Score weights can be restored to those defaults by clicking on the restore default weight value button.
The changes have to be saved at the bottom of the page to propagate.
What’s Next Want to know the detail about each individual Smart Signal? Visit our Smart Signals Overview page to get more information.