Fraud in your admin sidebar holds three entries in the standard design. The Review queue is where flags wait for a decision. Detectors holds every detector with its level and thresholds, and under General what each level actually does. Trader overrides holds the exceptions for single traders.
Propper - OG and Tactical split the same settings over eight entries. The queue is called Fraud overview there. IP & Network, Location, Devices, Account linking and Affiliates each hold the detectors of one kind, Trader overrides holds the exceptions, and Enforcement decides what each level actually does.
You need the view_fraud permission to open these screens and manage_fraud
to change anything on them, review a flag or lift a restriction.
These screens are about who is behind an account. What a trader does with it, such as scalping or martingale sizing, lives on Trading rules. Its flags still land in the review queue, so there is one place to review.
The five levels
Every detector has its own level. A firm that blocks Tor, flags VPNs and only watches datacenter IPs sets exactly that.
| Level | What happens when the detector fires |
|---|---|
| Off | The detector does not run. |
| Monitor | It is recorded silently. Nobody is asked to look, and the record stays out of the queue unless you filter for it. |
| Flag | A flag goes into the review queue, and your team is notified when that is switched on. The trader notices nothing. |
| Restrict | Flags, and takes away what Enforcement says Restrict takes, until the flag is reviewed. |
| Block | An access check refuses the session. Any other detector suspends the accounts involved. |
The access checks are VPN, Tor, residential proxy, datacenter IP, the country policy and a missing fingerprint. On Block they refuse the session at login and on every request while the condition holds, and they suspend nobody. Every other detector on Block suspends the account, or every account in the group for a group detector. A suspended account stays suspended until someone reactivates it on the trader page.
The detector screens
In the standard design every detector sits in one list, grouped by kind, with its level beside its name and how many flags it has open. Pick one and the rest of the screen is that detector: the five levels with what each one does for this detector, its thresholds, and beside them its open flags and the traders who have an exception. J and K walk the list, and the address follows what you pick, so a link opens one detector. A dot marks a detector you changed and have not saved, and one save covers everything you changed, on any detector and under General.
On Propper - OG and Tactical each kind has a screen of its own, with every detector as a card and a panel that sets them all to one level at once.
Both warn about settings that will not do what you expect, such as Restrict while Restrict takes nothing, or an allowlist with no countries on it.
Where we have the data, the screen also says how many of your traders a detector would have caught over the last 30 days. Turning VPN up to Block shows how many traders were on a VPN this month before you save. On the country policy and the country limit, that number recounts while you edit the list or the threshold.
| Screen | Detectors and their thresholds |
|---|---|
| IP & Network | VPN, Tor, residential proxy and datacenter IP. Shared IP and shared subnet, each with the number of accounts allowed, and the subnet size (/16 to /28). Concurrent sessions, with the addresses allowed at once and the window that counts as the same moment. |
| Location | Country policy as a blocklist or an allowlist. Impossible travel, with a top speed, a minimum distance and how far back to look. New country. Registration mismatch. Too many countries, with the countries allowed and the window they are counted over. |
| Devices | Shared device, with the accounts allowed per device. Emulator. Headless browser. Missing fingerprint, with a grace period before the fingerprint has to have arrived. |
| Account linking | Group hedging, with the window for opposite trades. Copy trading, with the similarity, the minimum number of matching trades, the match window and how far back to look. Shared payment method and shared identity, each with the accounts allowed. |
| Affiliates | An affiliate sharing a device with their referrals, and sharing an IP with them, each with the referrals allowed before it fires. Signups from one IP, with the signups allowed per address and the window. Refunds after a discount, with the refunded share, the minimum number of discounted purchases and how far back to look. |
The Affiliates detectors judge the affiliate, not the referrals: the flag lands on the affiliate's account and names the referrals it found. Local and private addresses never count, so a household or an office network behind one router does not look like one person. Nothing on this screen touches commission. Put a detector on Restrict to hold the affiliate's payouts, and void a single commission on the affiliate's own page in Affiliates. Open signals show at the top of that page for anyone who may open Fraud.
Trader overrides
An override holds one trader to a different level, a different threshold, or both, on one detector. It carries a reason and, if you want, an end date, after which it stops by itself.
Only the thresholds marked as able to differ per trader can be overridden. The rest, such as the subnet size or how far back copy trading looks, belong to the firm as a whole.
On a group detector, each account in the group is judged against its own settings. If two traders share an IP and one of them has an override allowing it, the flag still names both, but only the other one is restricted or suspended. The exempt trader is marked as such in the flag.
In the standard design Trader overrides opens on a table of every override: the trader, the detector, what it changes, when it last changed and when it ends, sorted by either of those or by name. Nothing opens until you pick one. The table then folds to a column beside it, and Escape folds it back. The one you pick is the form itself: its level and every threshold that can differ, each next to what the firm has set, then the reason and the end date. An end date runs to the end of that day where you are. A new override starts there, from a flag in the review queue, or from a detector's exceptions on the Detectors screen, filled in with the trader and detector you came from. If that trader already has one on that detector, it opens instead.
On Propper - OG and Tactical a new override opens as a dialog on the overrides screen, also from the link on a detector card. In every design the trader page lists that trader's overrides and restrictions, with a button that starts a new override for them.
Enforcement
In the standard design these settings are General, at the top of the Detectors list.
What Restrict takes away is set once for every detector on Restrict:
| Restriction | What the trader notices |
|---|---|
| No new orders | Open positions keep running and can be closed. Pending orders that trigger are cancelled. |
| Payouts on hold | A payout request is refused with a message. |
| No challenge purchases | They cannot buy or claim a challenge. A challenge you grant still goes through. |
| Affiliate payouts on hold | Commission keeps building up, but cannot be withdrawn. |
A restricted trader sees a banner listing what is held. It does not name the detector, so it is not a guide to getting around it. A restriction ends when its flag is resolved or dismissed, or when you lift it in the review queue or on the trader page. Lifting clears the trader and leaves the flag in the queue.
Escalation is the safety net under the levels. A flag on a single account that scores at or above the escalation score suspends that account, even when its detector is on Flag. Group flags never escalate. Sensitivity multiplies every risk score, from lenient to lockdown, which moves how soon escalation is reached.
The master switch on this screen turns all of fraud detection off. Nothing runs and nothing is enforced while it is off.
Reviewing a flag
In the standard design the review queue opens on a table of flags, highest score first: who it is about, the detector type, the IP address, the level, the score and when it was raised. Nothing opens until you pick a flag, so nobody's details are on screen before you ask for them. Sort it by score, newest, oldest or most recently decided, search it by trader, IP address or detector, filter it by detector, level and status, or narrow it to the traders who are restricted right now. Deciding the open flag moves on to the next one in the table. The flag itself shows what the detector saw, every trader behind it with what was taken from them, their other flags, and the other traders of yours seen on the same address. Every flag has a link of its own, which is also what a notification opens.
Resolve a flag when it is handled, dismiss it when it was a false positive. Both lift the restrictions it placed. Reopening a decided flag puts it back in the queue as it was, without putting back the restrictions it lifted. A dismissed flag does not come back for the same situation for a while. Neither one lifts a suspension: reactivating a suspended account is a decision you make on the trader page.
Settings from before this screen
Firms that had fraud detection set up before these screens existed keep what they had. Their old switches were converted to levels, with one exception made on purpose: a detector that used to restrict or block anything other than access came over as Flag. Nobody gets restricted or suspended by an upgrade. Turn those up yourself once you have looked at what they would catch.