Device & Network Risk
LexisNexis ThreatMetrix device and network risk signals — four variants: Device + Network Risk, Session Risk, Session Risk (Precise Location), and Trusted Device.
Checker Category: Risk — Device & Network
Used In Steps: Session Risk (all workflows), SMS Link (as add-on)
Used In Workflows: All workflows — runs at session start
Supported Countries: Global
Overview
LexisNexis ThreatMetrix provides passive device and session risk signals for every verification session. A JavaScript profiling tag loads on page and silently collects device fingerprint, IP address, browser and OS characteristics, and network signals — no user interaction required.
Four checker variants are available, differing in signal depth and location precision. The variant configured for your deployment is determined at setup time.
End User Requirements
None — passive JavaScript tag. User needs a web browser or mobile device.
Role in Layered Verification
Foundational risk layer. Catches device spoofing, bots, VPN/proxy, impossible travel, and velocity abuse — signals that PII matching cannot detect. Runs silently before any identity factor is collected. High-risk outcomes (TOR, OFAC, flagged IPs, velocity violations) deny the session immediately.
Overview
Full ThreatMetrix Advanced assessment. Comprehensive device fingerprinting, IP reputation, proxy/TOR/VPN detection, behavioral signals, velocity checks, and persona trust scoring. The standard variant used in the Session Risk step.
Acquired Attributes
| Attribute Name | Attribute Code | Fields | Description |
|---|---|---|---|
| Local Whitelist Detected Reason Codes | LocalWhitelistDetectedReasonCodes | Exact ID Whitelisted, Smart ID Whitelisted, Input IP Whitelisted, Input IP Org Whitelisted, True IP Whitelisted, True IP Org Whitelisted | Whitelist match reason codes. |
| Local Blacklist Detected Reason Codes | LocalBlacklistDetectedReasonCodes | Exact ID Blacklisted, Smart ID Blacklisted, Strong ID Blacklisted, Input IP Blacklisted, True IP Blacklisted, True IP Geo Blacklisted, True IP Org Blacklisted, Input IP Geo Blacklisted, Input IP Org Blacklisted, Email Domain Blacklisted | Blacklist match reason codes. |
| Local Watchlist Detected Reason Codes | LocalWatchlistDetectedReasonCodes | True IP Watchlisted, Proxy IP Watchlisted, DNS IP Watchlisted, Input IP Watchlisted | Watchlist match reason codes. |
| Browser Anomaly Checks Reason Codes | BrowserAnomalyChecksReasonCodes | SessionID Dup 5x, Session Cloaking, Browser Lang Anomaly, Screen Res Anomaly, Screen Color Depth Low, Browser Anomaly, and others | Browser anomaly signal reason codes. |
| Entity Reputation Checks Reason Codes | EntityReputationChecksReasonCodes | True IP Neg Reputation, Input IP Neg Reputation, Smart ID Neg Reputation, Exact ID Neg Reputation | Entity reputation reason codes. |
| Email Behavior Checks Reason Codes | EmailBehaviorChecksReasonCodes | Email Age >3 Months, New Email <1HR, New Email <1DY, Potential Machine Generated Email, Risky Email Domain, and others | Email behavioral signal reason codes. |
| Trust Tags Behavior Checks Reason Codes | TrustTagsBehaviorChecksReasonCodes | TT Check ExactID Login Passed 3x/Month, Device/IP Tagged Risky 2x/7Days, Device/IP Tagged Risky 5x/90Days, Device/IP Tagged Potential Bot 3x | Trust tag behavior reason codes. |
| Session Cloaking Checks Reason Codes | SessionCloakingChecksReasonCodes | Images Not Loaded, TrueIP WebRTC ExtIP Mismatch, TrueIP InputIP Mismatch, Remote Desktop, Cookies Disabled, Private Browsing, and others | Session cloaking signal reason codes. |
| Proxy/Tor/VPN Checks Reason Codes | ProxyTorVPNChecksReasonCodes | TOR Detected, VPN Detected, Potential VM, Hidden Proxy | Proxy, TOR, and VPN detection reason codes. |
| Proxy Type Match Checks Reason Codes | ProxyTypeMatchChecksReasonCodes | Anonymous Proxy, Open Proxy, Transparent Proxy | Proxy type classification reason codes. |
| Attribute Anomaly Checks Reason Codes | AttributeAnomalyChecksReasonCodes | StrongID w/ At Least 3 Emails, 5 Emails per SmartID/Month, New Email for User, New TrueIP Geo for User, Linked to Confirmed Fraud, and others | Attribute anomaly reason codes. |
| Proxy Geo/True Geo Mismatch Reason Codes | ProxyGeoTrueGeoMismatchReasonCodes | Device Proxy Geo Mismatch, Proxy Geo/True Geo Mismatch, True IP Proxy Geo Mismatch, and others | Geolocation mismatch reason codes. |
| Proximity Checks Reason Codes | ProximityChecksReasonCodes | Time Zone/True Geo Mismatch, Geo Language Mismatch, GPS WPS Mismatch, DNS Resolver 1000mi TrueIP, and others | Proximity consistency reason codes. |
| Distance Traveled Checks Reason Codes | DistanceTraveledChecksReasonCodes | ExactID True IP 500mi/hr, ExactID Input IP 500mi/hr, SmartID True IP 500mi/hr, Email True IP 500mi/hr, and others | Impossible travel detection reason codes. |
| Trusted Persona 1/2/3 Month Checks Reason Codes | TrustedPersona1MthChecksReasonCodes, TrustedPersona2MthChecksReasonCodes, TrustedPersona3MthChecksReasonCodes | 1/2/3 Month Trusted Exact/Smart/IP Persona | Trusted persona signal reason codes. |
| Persona Anomalies Reason Codes | PersonaAnomalies3MthReasonCodes, PersonaVariationsChecksReasonCodes | CC 3/5/10 Persona Variations/3 Months, New Email Since Last Login, 3 Local Persona Variations/DY, and others | Persona variation and anomaly reason codes. |
| Good Local Persona Checks Reason Codes | FiveDimGoodLclPersonaChecksReasonCodes, FourDimGoodLclPersonaChecksReasonCodes, ThreeDimGoodLclPersonaChecksReasonCodes | 3/4/5Dim Good Local Persona variants | Positive persona match reason codes. |
| Entity Velocity Checks Reason Codes | EntityVelocityChecksReasonCodes | Input IP 75x/HR, ExactID 10x/HR, 4 ExactID per Email/WK, and others | Velocity check reason codes. |
| ATO Checks Reason Codes | ATOChecksReasonCodes | Possible Bot Initiated ATO | Account takeover detection reason codes. |
| Malware / Bot / Jailbreak Reason Codes | MalwareChecksReasonCodes, BotDetectedReasonCodes, JailbreakOrRootDetectedReasonCodes, AndroidRootCloakDetectedReasonCodes | Malware Detection, Bot, Jailbreak or Root Detected, Android Root Cloaking | Malware, bot, and device integrity reason codes. |
| Global Blacklist/Whitelist Reason Codes | EntityDetectedInGlobalBlocklistReasonCodes, EntityDetectedInGlobalWhitelistReasonCodes | Device in Global List, SmartID Global Blacklist, Proxy IP in Global Blacklist/Whitelist, True IP in Global Blacklist/Whitelist | Global list match reason codes. |
| Aggregator Detected Reason Codes | AggregatorDetectedReasonCodes | Aggregator Detection | Aggregator service detection reason codes. |
| Device and Network Risk Score | TMXScore | — | Composite device and network risk score. |
| True IP | TrueIP | — | Device's true IP address. |
| True IP Geo Country Code | TrueIPGeoCountry | True IP Geo Country | Country code from true IP geolocation. |
| True IP Geo Postal Code | TrueIPPostalCode | True IP Postal Code | Postal code from true IP geolocation. |
| Fuzzy Device ID | FuzzyDeviceID | — | Fuzzy device identifier. |
| Fuzzy Device ID Confidence | FuzzyDeviceIDConfidence | — | Confidence score for fuzzy device ID. |
| Digital ID | DigitalID | — | Digital identity identifier. |
| Digital ID Confidence | DigitalIDConfidence | — | Confidence score for digital ID. |
| NEAT Persona Age (Months) | NEATPersonaAgeMonths | NEAT Persona Age | Age of the NEAT persona in months. |
| Exact ID & IP Persona Age (Months) | ExactIDIPPersonaAgeMonths | Exact ID + IP Persona Age | Age of the Exact ID + IP persona in months. |
| SmartID & Browserstring Persona Age (Months) | SmartIDBrowserstringPersonaAgeMonths | Smart ID Browser String Persona Age | Age of the SmartID + browser string persona in months. |
| Device Type | Platform | — | Device platform type. |
| True IP Latitude / Longitude | TrueIPLatitude, TrueIPLongitude | — | Latitude and longitude from true IP. |
| True IP City / State / Country | TrueIPCity, TrueIPStateOrRegion | — | City and state from true IP geolocation. |
| True IP Connection / Line Speed / Routing / Hosting | TrueIPConnectionType, TrueIPLineSpeed, TrueIPRoutingType, TrueIPHostingFacility | — | Network characteristics of the true IP. |
| Browser Language | BrowserLanguage | — | Browser language setting. |
| Time Zone Code / Name | TimeZoneCode, TimeZoneName | — | Device time zone. |
| Proxy Score | ProxyScore | — | Proxy likelihood score. |
| WebRTC External IP | WebRTCExternalIP | — | External IP exposed via WebRTC. |
| Session Verdict | SessionVerdict | — | ThreatMetrix session verdict. |
| Session Processing Verdict | SessionProcessingVerdict | — | Processing-level verdict. |
| Session Risk Rating Verdict | SessionRiskRatingVerdict | — | Risk rating verdict for the session. |
Assertions
| Assertion Name | Assertion Key | Description |
|---|---|---|
| Multi-Attribute Local Watchlist Check | Watchlist.localCheckDetected | Indicates whether any entity (IP, device, email, or identity) matches an entry on the local watchlist. Passes if no match is found; fails if a match is detected. |
| Multi-Attribute Local Blacklist Check | blacklist.localCheckDetected | Indicates whether any entity (IP, device, email, or identity) matches an entry on the local blacklist. Passes if no match is found; fails if a match is detected. |
| 3-Attribute Good Local Persona Check | detect.3DIMGoodLCLPersonaCheck | Assesses whether the session matches a known good local persona across 3 identity attributes. Passes if a match is found; fails if no good local persona match is established. |
| 4-Attribute Good Local Persona Check | detect.4DIMGoodLCLPersonaCheck | Assesses whether the session matches a known good local persona across 4 identity attributes. Passes if a match is found; fails if no good local persona match is established. |
| 5-Attribute Good Local Persona Check | detect.5DIMGoodLCLPersonaCheck | Assesses whether the session matches a known good local persona across 5 identity attributes. Passes if a match is found; fails if no good local persona match is established. |
| Account Takeover Check | detect.ATOCheck | Assesses the session for signals indicative of an account takeover (ATO) attempt. Passes if no ATO signals are detected; fails if suspicious signals are present. |
| Device Root Cloaking Check | detect.androidRootCloak | Indicates whether the device is using root-cloaking techniques to hide root access. Passes if no cloaking is detected; fails if cloaking is identified. |
| Session ID Replay Check | detect.apSessionIDNotReplay | Confirms that the session ID has not been replayed from a prior session. Passes if the session ID is unique; fails if a replay is detected. |
| Identity Suspicious Behavior Check | detect.attributeAnomaly | Assesses identity attributes for suspicious patterns such as unusual velocity or cross-entity associations. Passes if no suspicious patterns are detected; fails if suspicious signals are present. |
| Session Bot Check | detect.bot | Indicates whether the session exhibits automated bot behavior. Passes if no bot behavior is detected; fails if bot activity is identified. |
| Browser Anomaly Check | detect.browserAnomalyCheck | Assesses the session for browser-related anomalies that may indicate automation or fraud. Passes if no anomalies are detected; fails if suspicious signals are present. |
| Email Suspicious Behavior Check | detect.emailBehaviorCheck | Assesses the provided email address for suspicious behavioral patterns such as recent creation, machine generation, or risky domain usage. Passes if no suspicious patterns are detected; fails if risky signals are present. |
| Multi-Attribute Global Blacklist Check | detect.entityINGlobalBlocklist | Indicates whether any entity (device, IP, or identity) matches an entry on the global blacklist. Passes if no match is found; fails if a match is detected. |
| Identity and IP Address Global Whitelist Check | detect.entityINGlobalWhitelist | Indicates whether any identity or IP address matches an entry on the global whitelist. Passes if a match is found; fails if no whitelist entry is matched. |
| Device and IP Address Reputation Check | detect.entityReputationCheck | Assesses the reputation of the device and IP address based on historical behavior across the network. Passes if reputation is within acceptable thresholds; fails if reputation falls below acceptable thresholds. |
| Jailbreak Check | detect.jailbreakORRoot | Indicates whether the mobile device has been jailbroken (iOS) or rooted (Android). Passes if neither condition is detected; fails if either is identified. |
| Persona Change Velocity Check (3 Months) | detect.personaAnomalies3MTH | Assesses persona-level changes over a rolling 3-month window for signs of excessive or abnormal variation. Passes if changes are within expected thresholds; fails if anomalous patterns are detected. |
| Persona Suspicious Behavior Check | detect.personaVariationsCheck | Assesses persona attributes for unusual variations that deviate from established behavioral norms. Passes if no suspicious variations are detected; fails if anomalous patterns are present. |
| Geolocation Proximity Consistency Check | detect.proximityCheck | Assesses geographic consistency by evaluating whether access locations align with expected proximity patterns. Passes if locations are consistent; fails if significant inconsistencies are detected. |
| Proxy Geolocation Matches Device Geolocation | detect.proxyGEO/TRUEGEOMismatch | Compares the proxy server's geolocation to the device's geolocation. Passes if they match; fails if a geographic mismatch is detected. |
| Proxy, Tor, and VPN Check | detect.proxyTorVPN | Indicates whether the device is connecting through a proxy, Tor network, or VPN. Passes if none are detected; fails if any are identified. |
| Proxy Type Consistency Check | detect.proxyTypeMatch | Assesses whether the observed proxy characteristics are consistent with the expected proxy type. Passes if characteristics are consistent; fails if an inconsistency is detected. |
| Session Cloaking Check | detect.sessionCloaking | Assesses the session for cloaking techniques such as disabled cookies, remote desktop usage, device spoofing, or private browsing. Passes if no cloaking is detected; fails if cloaking signals are present. |
| Device and User Suspicious Behavior Check | detect.trustTagBehavior | Assesses behavioral signals for the device and user, including login frequency and risky tagging history. Passes if signals are within acceptable patterns; fails if risky signals are detected. |
| Device Impossible Travel Check | test.distanceTraveledCheck | Assesses whether the device's detected location has changed at an implausibly rapid rate within a session. Passes if location changes are within expected limits; fails if an impossible or suspicious location shift is detected. |
| Multi-Attribute Suspicious Activity Check | test.entityVelocityCheck | Assesses multiple entity types (IP, device, identity) for suspicious activity velocity such as excessive requests within a time window. Passes if velocity is within acceptable limits; fails if thresholds are exceeded. |
| Impossible Travel Check (>= 200 mi/hr) | test.impossibletravel_200mi1hr | Assesses whether the device's True IP geolocation has exceeded 200 miles of travel within 1 hour, indicating impossible travel. Passes if travel is within this limit; fails if it is exceeded. |
| Good Local Persona Check (1 Month) | test.trustedPersona1MTH | Assesses whether the persona has established a trusted pattern over a 1-month window. Passes if a trusted pattern is confirmed; fails if one is not. |
| Good Local Persona Check (2 Months) | test.trustedPersona2MTH | Assesses whether the persona has established a trusted pattern over a 2-month window. Passes if a trusted pattern is confirmed; fails if one is not. |
| Good Local Persona Check (3 Months) | test.trustedPersona3MTH | Assesses whether the persona has established a trusted pattern over a 3-month window. Passes if a trusted pattern is confirmed; fails if one is not. |
| Local Whitelist Check | whitelist.localCheckDetected | Indicates whether any entity (IP, device, or identity) matches an entry on the local whitelist. Passes if a match is found; fails if no whitelist entry is matched. |
Notes and Limitations
Requires JavaScript profiling tag on verification page — profiling completes in 3–5 seconds.
Recommend disabling submit button until profiling completes.
This is the standard variant — ThreatMetrix Advanced. The original ThreatMetrix integration is deprecated; reference Advanced assertion keys.
Overview
ThreatMetrix Session Query variant. Lighter-weight passive risk check using session history, device reputation, and behavioral signals. Lower location precision than Device + Network Risk but fully passive and fast. Used when a lighter session check is preferred.
Acquired Attributes
| Attribute Name | Attribute Code | Fields | Description |
|---|---|---|---|
| Device and Network Risk Score | TMXScore | — | Composite risk score for the session. |
| True IP | TrueIP | — | Device's true IP address. |
| True IP Geo Country Code | TrueIPGeoCountry | True IP Geo Country | Country from true IP geolocation. |
| True IP Geo Postal Code | TrueIPPostalCode | True IP Postal Code | Postal code from true IP geolocation. |
| Fuzzy Device ID | FuzzyDeviceID | — | Fuzzy device identifier. |
| Fuzzy Device ID Confidence | FuzzyDeviceIDConfidence | — | Confidence score for fuzzy device ID. |
| Digital ID | DigitalID | — | Digital identity identifier. |
| Digital ID Confidence | DigitalIDConfidence | — | Confidence score for digital ID. |
| NEAT Persona Age (Months) | NEATPersonaAgeMonths | NEAT Persona Age | Age of the NEAT persona in months. |
| Exact ID & IP Persona Age (Months) | ExactIDIPPersonaAgeMonths | Exact ID + IP Persona Age | Age of the Exact ID + IP persona in months. |
| SmartID & Browserstring Persona Age (Months) | SmartIDBrowserstringPersonaAgeMonths | Smart ID Browser String Persona Age | Age of the SmartID + browser string persona in months. |
| Device Type | Platform | — | Device platform type. |
| True IP Latitude / Longitude | TrueIPLatitude, TrueIPLongitude | — | Latitude and longitude from true IP. |
| True IP City | TrueIPCity | — | City from true IP geolocation. |
| True IP Connection Type | TrueIPConnectionType | — | Network connection type. |
| True IP Line Speed | TrueIPLineSpeed | — | Network line speed. |
Assertions
| Assertion Name | Assertion Key | Description |
|---|---|---|
| Device Local Blacklist Check | blacklist.device | Confirms that the device ID does not match any entry on the locally managed blacklist. Passes if no match is found; fails if the device is blacklisted. |
| Email Local Blacklist Check | blacklist.email | Confirms that the provided email address does not match any entry on the local blacklist. Passes if no match is found; fails if the email is blacklisted. |
| IP Address Local Blacklist Check | blacklist.ip | Confirms that the provided IP address does not match any entry on the locally managed blacklist. Passes if no match is found; fails if the IP is blacklisted. (Not currently in use) |
| IP Address OFAC Check | blacklist.ofacIP | Confirms that the provided IP, DNS IP, Proxy IP, or True IP does not originate from an OFAC-sanctioned country. Passes if the IP country is not sanctioned; fails if it is. |
| Email Domain Russian Blacklist Check | blacklist.ru | Confirms that the provided email domain is not Russia-specific or flagged by the Russia blacklist. Passes if the domain is not flagged; fails if it is. |
| Phone Number Local Blacklist Check | blacklist.telephone | Confirms that the provided phone number does not match any entry on the locally managed blacklist. Passes if no match is found; fails if the number is blacklisted. |
| Aggregator Presence Check | detect.aggregator | Indicates whether the session is originating from an aggregator service acting on behalf of the user. Passes if no aggregator is detected; fails if one is identified. |
| Browser Anomaly Check | detect.browserAnomaly | Indicates browser-level anomalies such as unusual screen resolution changes, low color depth, or mismatched browser language. Passes if no anomalies are detected; fails if suspicious signals are present. |
| Jailbreak Check | detect.jailbreak | Indicates whether the mobile device has been jailbroken or rooted. Passes if neither condition is detected; fails if either is identified. |
| IP Address VPN Check | detect.knownVPNISP | Indicates whether the device's IP address is registered to a known VPN provider. Passes if the IP is not registered to a VPN provider; fails if it is. |
| Malware Check | detect.malware | Indicates whether malware is present on the device, assessed via honeypot injection detection, page fingerprinting, and active monitoring. Passes if no malware is detected; fails if malware is identified. |
| Mobile Tethering Check | detect.mobileTethering | Indicates whether the device's connection is being shared via mobile tethering. Passes if tethering is not detected; fails if it is identified. |
| VPN and Tunnel Check | detect.possibleVPNOrTunnel | Indicates whether the device connection is routed through a VPN or tunnel. Passes if neither is detected; fails if either is identified. |
| Anonymous Proxy Check | detect.proxyAnonymous | Indicates whether the device is using an anonymous proxy that conceals the user's real IP address. Passes if no anonymous proxy is detected; fails if one is identified. |
| Hidden Proxy Check | detect.proxyHidden | Indicates whether the device is using a hidden proxy, the highest-risk proxy type. Passes if no hidden proxy is detected; fails if one is identified. |
| Open or Transparent Proxy Check | detect.proxyOpenTransparent | Indicates whether the device is using an open or transparent proxy. Passes if no such proxy is detected; fails if one is identified. |
| Tor Network Check | detect.tor | Indicates whether the device connection is routed through the Tor network. Passes if no Tor usage is detected; fails if Tor routing is identified. |
| Tor Exit Node Check (90 Days) | detect.torExitNode90d | Indicates whether the IP address has been identified as a Tor exit node within the last 90 days. Passes if no recent Tor exit node history is found; fails if the IP has been flagged. |
| Tor Exit Node Check | detect.torNode | Indicates whether the device's IP address is a known Tor exit node. Passes if the IP is not a known exit node; fails if it is. |
| Session Unusual Activity Check | detect.unusualActivity | Assesses the session for unusual behavioral signals, including extremely short page time (< 0.2 seconds) and frequent system state changes. Passes if signals remain below suspicious thresholds; fails if a sufficient combination of anomalous signals is detected. |
| VPN Check | detect.vpn | Indicates whether the device is connecting through a VPN. Passes if no VPN is detected; fails if one is identified. |
| Provided Country Matches Geolocation Country | link.addressCountry_TrueGeoCountry | Compares the provided country to the device's geolocation country. Passes if they match; fails if they do not. |
| Proxy Geolocation Matches Device Geolocation | link.proxyGeo_TrueGeo | Compares the proxy server's geolocation to the device's geolocation. Passes if they match; fails if a mismatch is detected. |
| Proxy IP Address Matches Device IP Address | link.proxyISP_TrueISP | Compares the proxy IP address to the device's true IP address. Passes if they match; fails if they do not. |
| Proxy Organization Matches ISP Organization | link.proxyOrg_TrueOrg | Compares the network organization of the proxy IP to the network organization of the device's true IP. Passes if they match; fails if they do not. |
| Device Time Zone Matches Device Geolocation Time Zone | link.timeZone_TrueGeo | Compares the device's time zone to the expected time zone for the device's geolocation. Passes if they match; fails if they do not. |
| Session ID Replay Attack Check | test.apSessionIDNotReplay | Confirms that the session ID has not been reused from a prior session. Passes if the session ID is unique and has not been seen before; fails if a replay attack is detected. |
| Device Impossible Travel Check (> 500 mi/h) | test.credentialLTE500mi1hr | Assesses whether the device's detected location has changed at a rate of > 500 mi/h within a session. Passes if location changes are within expected limits; fails if an impossible or suspicious location shift is detected. |
| Device Impossible Travel Check (> 50 mi/h) | test.credentialLTE50mi1hr | Assesses whether the device's detected location has changed at a rate of > 50 mi/h within a session. Passes if location changes are within expected limits; fails if an impossible or suspicious location shift is detected. |
| Device Age Check (>= 7 Days) | test.exactIDAgeGTE7d | Confirms that the Exact ID (persistent device identifier) has existed for at least 7 days. Passes if the age meets this threshold; fails if it does not. |
| Browser Language Matches Geolocation Language | test.expectedLanguage | Compares the browser's language setting to the expected language for the device's geolocation. Passes if they are consistent; fails if they are not. |
| Credential Device Pair Velocity Check (>= 2 Attempts in 24 Hours) | test.gte2Credential1d | Assesses whether the same credential and device combination has been seen 2 or more times in 24 hours. Passes if below this threshold; fails if the threshold is met or exceeded. |
| Credential Device Pair Velocity Check (>= 3 Attempts in 24 Hours) | test.gte3Credential1d | Assesses whether the same credential and device combination has been seen 3 or more times in 24 hours. Passes if below this threshold; fails if the threshold is met or exceeded. |
| Credential Velocity Check (>= 5 Attempts in 24 Hours) | test.gte5Credential1d | Assesses whether the same credential has been seen 5 or more times in 24 hours. Passes if below this threshold; fails if the threshold is met or exceeded. |
| Credential Smart ID Pair Velocity Check (>= 5 Attempts in 24 Hours) | test.gte5CredentialDevice1d | Assesses whether the same credential and Smart ID combination has been seen 5 or more times in 24 hours. Passes if below this threshold; fails if the threshold is met or exceeded. |
| Smart ID Velocity Check (>= 5 Attempts in 24 Hours) | test.gte5Device1d | Assesses whether the same Smart ID has been seen 5 or more times in 24 hours. Passes if below this threshold; fails if the threshold is met or exceeded. |
| Credential Device Pair Velocity Check (>= 10 Attempts in 24 Hours) | test.gte10Credential1d | Assesses whether the same credential and device combination has been seen 10 or more times in 24 hours. Passes if below this threshold; fails if the threshold is met or exceeded. |
| Credential Device Pair Velocity Check (>= 20 Attempts in 24 Hours) | test.gte20Credential1d | Assesses whether the same credential and device combination has been seen 20 or more times in 24 hours. Passes if below this threshold; fails if the threshold is met or exceeded. |
| Device Credential Login Velocity Check (<= 3 in 7 days) | test.lte3CredentialsDevice7d | Assesses whether the number of distinct credential logins from the device over the past 7 days is within the acceptable limit. Passes if 3 or fewer credentials have been used on this device in the last 7 days; fails if the limit is exceeded. |
| Device Proxy Change Velocity Check (<= 3 times in 1 day) | test.lte3ProxyToday | Assesses whether the number of proxy changes detected on the device within a single day is within the acceptable limit. Passes if 3 or fewer proxy changes are detected in the past day; fails if the limit is exceeded. |
| Smart ID Age Check (>= 7 Days) | test.smartIDAgeGTE7d | Confirms that the Smart ID (device identifier based on device attributes) has existed for at least 7 days. Passes if the age meets this threshold; fails if it does not. |
| Device Local Whitelist Check | test.trustedDevice | Confirms that the device is present on the local whitelist. Passes if a trusted device tag is found; fails if none is present. |
| Device Local Whitelist Check (1 Day) | test.trustedDevice1day | Confirms that the device was present on the local whitelist within the last 1 day. Passes if a recent trusted tag exists; fails if none is found within this window. |
| Device Local Whitelist Check (28 days) | test.trustedDevice28days | Confirms that the device was present on the local whitelist within the last 28 days. Passes if a trusted tag exists within this window; fails if none is found. |
| Device Local Whitelist Check (6 months) | test.trustedDevice6mo | Confirms that the device was present on the local whitelist within the last 6 months. Passes if a trusted tag exists within this window; fails if none is found. |
Overview
Session Risk variant with HTML5 geolocation. Includes GPS/WPS-based latitude and longitude from the browser in addition to IP-based location signals. Requires browser geolocation permission from the user.
Acquired Attributes
Includes all Session Risk attributes, plus:
| Attribute Name | Attribute Code | Fields | Description |
|---|---|---|---|
| HTML Location Accuracy | HTMLLocationAccuracy | — | Accuracy of the HTML5 geolocation reading (in meters). |
| HTML Location Latitude | HTMLLocationLatitude | — | Latitude from HTML5 browser geolocation. |
| HTML Location Longitude | HTMLLocationLongitude | — | Longitude from HTML5 browser geolocation. |
All other acquired attributes are the same as the Session Risk tab.
Assertions
Content coming soon.
Notes and Limitations
Requires browser geolocation permission — user will see a browser prompt.
Higher location precision than IP-based geolocation; useful for detecting GPS/IP discrepancies.
Mobile browser recommended for most accurate geolocation results.
Overview
Marks a device as trusted after successful verification. On subsequent sessions, trusted device tags reduce friction or flag risk if an untrusted device is detected.
Acquired Attributes
Content coming soon.
Assertions
Content coming soon.
Notes and Limitations
Trust is set at device level — tied to the device fingerprint established during the session.
Trusted device lookback windows: 1 day, 28 days, 6 months (see test.trustedDevice* assertions in the Session Risk tab).
Trusted Device is an add-on to the Session Risk step — contact your ID Dataweb team to enable.
Testing & Expected Results
| Scenario | Input | Expected Result |
|---|---|---|
| Standard session — low risk | Standard browser, clean network | Session proceeds — low risk score |
| High risk — TOR | TOR browser | High risk signal — session denied |
| High risk — flagged IP | Known flagged IP | High risk signal — session denied |
| Trusted device | Previously verified device | test.trustedDevice passes |
Related Resources
→ Session Risk Step | → Identity Verification | → Continuous Re-Authentication | → NIST IAL2
Updated 2 months ago