> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fingerprint.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Suspect Score
> Suspect Score is an easy way to integrate Smart Signals into your fraud protection work flow. It is a weighted representation of all Smart Signals present in the payload that helps identify suspicious activity.
# What is Suspect Score
**Suspect Score** is a single risk score that helps you quickly identify suspicious activity using Smart Signals.
Instead of analyzing each signal individually, Suspect Score combines them into one value—making it easier to make fraud decisions in real time.
Each Smart Signal contributes to the score with a predefined weight.
The more suspicious signals are triggered, the higher the final score.
It's part of the Smart Signals payload available in Server API, Webhooks and Sealed Client Results.
**How new signals affect your score**
When new Smart Signals are introduced:
**New customers** automatically receive default weights
**Existing customers** start with a weight of 0 to avoid impacting existing logic.
You can enable and configure these weights at any time in the *[Custom Weights Configuration](/docs/suspect-score#custom-weights-configuration)* section.
## Suspect Score Weights
Each Smart Signal has its own **weight**, contributing to the final **score**. The weights are currently based on the probability that the selected Smart Signal is triggered on a global scale. Smart Signals that are less likely to be triggered have stronger weights, and vice versa.
Weights might have slightly different values based on the request's originating platform (web, Android and iOS). This is caused by different representation of average traffic for each platform.
**N/A** in the table below means that the signal is not reflected in the *Suspect Score*. This
might happen for two reasons - either the signal is not available on that particular platform (see
our [Smart Signals introduction page](/docs/smart-signals-introduction) for signal availability)
**or** the signal had low incidence rate and would skew the computation too much (the weight would
be extremely high).
### Weights Table
| Smart Signal | Web/Browser | Android | iOS |
| :------------------------------------------------------------------------------------------------------------- | :---------- | :------ | :-- |
| [Bot Detection](/docs/smart-signals-reference#browser-bot-detection) (`bot.type == bad`) | 7 | N/A | N/A |
| [Incognito Detection](/docs/smart-signals-reference#browser-incognito-detection) (`incognito`) | 4 | N/A | N/A |
| [VPN Detection](/docs/smart-signals-reference#vpn_methods) (`timezone_mismatch`) | 3 | 4 | 4 |
| [VPN Detection](/docs/smart-signals-reference#vpn_methods) (`public_vpn`) | 4 | 5 | 5 |
| [VPN Detection](/docs/smart-signals-reference#vpn_methods) (`os_mismatch`) | N/A | N/A | N/A |
| [VPN Detection](/docs/smart-signals-reference#vpn_methods) (`auxiliary_mobile`) | N/A | 6 | 6 |
| [VPN Detection](/docs/smart-signals-reference#vpn_methods) (`relay`) | 4 | 4 | 4 |
| [Tampering Detection](/docs/smart-signals-reference#browser-tamper-detection) (`AnomalyScore > 0.5`) | 8 | N/A | N/A |
| [Tampering Detection](/docs/smart-signals-reference#browser-tamper-detection) (`Anti-detect Browser`) | 8 | N/A | N/A |
| [Virtual Machine Detection](/docs/smart-signals-reference#virtual-machine-detection) (`virtual_machine`) | 14 | N/A | N/A |
| [Developer Tools Detection](/docs/smart-signals-reference#developer-tools-detection) (`developer_tools`) | 8 | 8 | 16 |
| [Velocity Signals](/docs/smart-signals-reference#velocity-signals) (`velocity`) | N/A | N/A | N/A |
| [Privacy-Focused Settings](/docs/smart-signals-reference#privacy-focused-settings) (`privacy_settings`) | 6 | N/A | N/A |
| [IP Blocklist](/docs/smart-signals-reference#ip-blocklist-matching) (`email_spam`) | 14 | 12 | 13 |
| [IP Blocklist](/docs/smart-signals-reference#ip-blocklist-matching) (`attack_source`) | 13 | 13 | 13 |
| [Tor Exit Node](/docs/smart-signals-reference#ip-blocklist-matching) (`tor`) | 14 | 16 | 17 |
| [Data Center Proxy](/docs/smart-signals-reference#proxy-detection) (`proxy_details.proxy_type == data_center`) | 14 | 12 | 15 |
| [Residential proxy](/docs/smart-signals-reference#proxy-detection) (`proxy_details.proxy_type == residential`) | 6 | 6 | 6 |
| [Android Emulator Detection](/docs/smart-signals-reference#android-emulator-detection) (`emulator`) | N/A | 9 | N/A |
| [Rooted Device Detection](/docs/smart-signals-reference#rooted-device-detection) (`root_apps`) | N/A | 12 | N/A |
| [Cloned App Detection](/docs/smart-signals-reference#cloned-app-detection) (`cloned_app`) | N/A | 9 | N/A |
| [Jailbroken Device Detection](/docs/smart-signals-reference#jailbroken-device-detection) (`jailbreak`) | N/A | N/A | 10 |
| [Frida Detection](/docs/smart-signals-reference#frida-detection) (`frida`) | N/A | 14 | N/A |
| [MitM Attack Detection](/docs/smart-signals-reference#mitm-attack-detection) (`mitm_attack`) | N/A | 14 | 14 |
| [High-Activity Device](/docs/smart-signals-reference#high-activity-device) (`high_activity`) | 6 | 5 | 6 |
| [iOS Simulator Detection](/docs/smart-signals-reference#ios-simulator-detection) (`simulator`) | N/A | N/A | 16 |
# How to Use Suspect Score
Suspect Score can be used to flag and review possible suspicious activity. It can be used to **quickly integrate Smart Signals** into your fraud protection workflow without the need to explore fraud correlations of individual Smart Signals.
```json Suspect Score in /v4/events/:event_id and Webhooks theme={"theme":"github-dark-dimmed"}
{
// ...
"suspect_score": 10
}
```
# Custom Weights Configuration
Fingerprint allows you to customize Suspect Score weights in two ways:
* Automatic weight generation using fraud-labeled data
* Manual adjustment of signal weights
Automatic weight generation allows you to train Suspect Score weights using your own fraud data, making the score better reflect fraud patterns in your environment.
## Automatic Weight Generation Using Fraud-Labeled Data
You can train Suspect Score using your own fraud-labeled data to better reflect your specific risk patterns.
Fingerprint analyzes your dataset and recommends optimized weights based on how each Smart Signal correlates with fraud. Based on this analysis, the system generates recommended weights for each signal.
These recommendations help tune the Suspect Score so it better reflects the fraud patterns specific to your traffic.
### Preparing Your Dataset
Your dataset must meet the following requirements:
Format
* CSV file
* Minimum count of events to upload is 1,000
* Maximum file size: 10 MB
You can download an example template to see the expected format.
Required fields
Your dataset should include:
* Request ID: the Fingerprint request identifier
* Fraud label: indicates whether the visitor was fraudulent
The system uses these fields to analyze which Smart Signals appear most frequently in fraudulent activity.
### Uploading Your Dataset
Follow these steps to generate Suspect Score weights using fraud-labeled data.
1. **Navigate to Suspect Score Analytics**
Open the Dashboard and go to:
Smart Signals → Suspect Score → Analysis
2. **Upload Your File**
You can upload your dataset in two ways:
* Drag and drop a CSV file into the upload area
* Click Choose to select a file from your computer
3. **Start the Training Process**
After the file is uploaded, Fingerprint will begin analyzing the dataset. During this step the system:
* Evaluates each Smart Signal
* Measures how strongly it correlates with fraudulent activity
* Generates optimized weights for the Suspect Score
The analysis process may take up to 30 minutes depending on the dataset size.
4. **Review Generated Weights**
After the analysis completes, Fingerprint generates recommended weights for the Smart Signals.
These recommendations appear in the Processed Data section where you can review and decide whether to apply them.
### Reviewing Processed Fraud Data
All analyzed datasets appear in the Processed Data section.
This section acts as a history log for fraud analysis runs and allows you to:
* Track uploaded datasets
* Monitor analysis results
* Review recommended weight changes
* Apply or reject updates to your Suspect Score configuration
### Dataset Status
Processed datasets are organized into three categories.
**Needs Review**
Files listed under Needs review contain recommendations that have not yet been applied.
These datasets require review before any changes are applied.
**Accepted**
The Accepted section contains datasets whose recommendations were approved and applied.
Once accepted:
* The recommended weights are applied to your Suspect Score configuration
* Future requests will be scored using the updated weights
**Rejected**
Datasets listed under Rejected were reviewed but not applied.
Rejected datasets remain visible for reference but do not affect the Suspect Score configuration.
### Reviewing Recommended Changes
When you click a dataset in the Needs review section, a review panel opens that displays both signal-level changes and a suggested overall threshold.
This threshold represents the score above which a request is likely to be considered suspicious, based on your uploaded fraud data.
The interface groups Smart Signals into two categories.
**Changed**
Signals listed under Changed have updated weights based on the fraud patterns detected in your dataset.
These adjustments increase or decrease the influence of the signal in the Suspect Score calculation.
**Unchanged**
Signals listed under Unchanged were analyzed but did not show a strong correlation with fraud in the uploaded dataset.
Their weights remain the same.
## Manual adjustment of signal weights
You can manually adjust weights to match your use case.
Open the Dashboard and go to:
2. Smart Signals → Suspect Score
3. Select the correct tab based on the platform for which you would like to configure the weights (**Web**, **iOS** SDK or **Android** SDK)
4. Input your preferred weights as integers between 0 and 10000 on the right
5. Click on **Save Changes**
The changes will propagate in a matter of minutes and you will start receiving the Suspect Score based on your custom weights.
## Configuring Weights by Confidence Level
**VPN Detection** and **Residential Proxy Detection** support confidence-based weighting. Instead of a single weight per signal, you can assign separate weights to low, medium, and high confidence detections to better reflect your risk tolerance.
### VPN Detection
By default, VPN Detection uses **method-based weighting**, where each detection method (`publicVPN`, `timezoneMismatch`, and others) has its own configurable weight. You can switch to **confidence-based weighting** to assign a single weight per confidence level instead.
Only one mode can be active at a time. Switching modes preserves the other configuration but deactivates it until you switch back.
To switch VPN Detection to confidence-based weighting:
1. Open the Dashboard and go to **Smart Signals → Suspect Score**
2. Under **VPN Detection**, select **Confidence** from the weighting mode selector
3. Input your preferred weights for **Low confidence**, **Medium confidence**, and **High confidence**
4. Click **Save Changes**
The default confidence-based weights for VPN Detection are:
| Confidence Level | Web/Browser | Android | iOS |
| :--------------- | :---------- | :------ | :-- |
| Low | 2 | 2 | 2 |
| Medium | 4 | 5 | 5 |
| High | 6 | 7 | 7 |
### Residential Proxy Detection
Residential Proxy Detection uses a **flat-value weighting** by default. You can switch to confidence-based weighting, and the page then displays three separate weight inputs, one for each confidence level.
To switch Residential Proxy detection to confidence-based weighting:
1. Open the Dashboard and go to **Smart Signals → Suspect Score**
2. Under **Residential Proxy**, select **Confidence** from the weighting mode selector
3. Input your preferred weights for **Low confidence**, **Medium confidence**, and **High confidence**
4. Click **Save Changes**
The default confidence-based weights are:
| Confidence Level | Web/Browser | Android | iOS |
| :--------------- | :---------- | :------ | :-- |
| Low | 2 | 2 | 2 |
| Medium | 4 | 4 | 4 |
| High | 6 | 6 | 6 |
## Disabling a Weight Completely
Some scenarios like the one mentioned above with the high VPN incidence rate might result in the need to disable a particular Smart Signal. In those cases it's possible to set the weight to zero through a dedicated button in the user interface.
The changes have to be saved at the bottom of the page to propagate.
## Restoring Defaults
We will always provide a set of default values based on our internal understanding of Smart Signal incidence rates (the statistical analysis mentioned in a previous section). Individual Suspect Score weights can be restored to those defaults by clicking on the **restore default weight value** button.
The changes have to be saved at the bottom of the page to propagate.
***
What’s Next
Want to know the detail about each individual Smart Signal? Visit our Smart Signals Overview page to get more information.
* [Smart Signals Overview](/docs/smart-signals-overview)