**Fraud** in your admin sidebar holds three entries in the standard design.
The **Review queue** is where flags wait for a decision. **Detectors** holds
every detector with its level and thresholds, and under General what each level
actually does. **Trader overrides** holds the exceptions for single traders.

Propper - OG and Tactical split the same settings over eight entries. The queue
is called **Fraud overview** there. **IP & Network**, **Location**, **Devices**,
**Account linking** and **Affiliates** each hold the detectors of one kind,
**Trader overrides** holds the exceptions, and **Enforcement** decides what each
level actually does.

You need the `view_fraud` permission to open these screens and `manage_fraud`
to change anything on them, review a flag or lift a restriction.

These screens are about who is behind an account. What a trader does with it,
such as scalping or martingale sizing, lives on
[Trading rules](/docs/platform/admin/trading-rules). Its flags still land in the
review queue, so there is one place to review.

## The five levels

Every detector has its own level. A firm that blocks Tor, flags VPNs and only
watches datacenter IPs sets exactly that.

| Level    | What happens when the detector fires |
| -------- | ------------------------------------ |
| Off      | The detector does not run. |
| Monitor  | It is recorded silently. Nobody is asked to look, and the record stays out of the queue unless you filter for it. |
| Flag     | A flag goes into the review queue, and your team is notified when that is switched on. The trader notices nothing. |
| Restrict | Flags, and takes away what Enforcement says Restrict takes, until the flag is reviewed. |
| Block    | An access check refuses the session. Any other detector suspends the accounts involved. |

The access checks are VPN, Tor, residential proxy, datacenter IP, the country
policy and a missing fingerprint. On Block they refuse the session at login and
on every request while the condition holds, and they suspend nobody. Every
other detector on Block suspends the account, or every account in the group for
a group detector. A suspended account stays suspended until someone reactivates
it on the trader page.

## The detector screens

In the standard design every detector sits in one list, grouped by kind, with
its level beside its name and how many flags it has open. Pick one and the rest
of the screen is that detector: the five levels with what each one does for
this detector, its thresholds, and beside them its open flags and the traders
who have an exception. J and K walk the list, and the address follows what you
pick, so a link opens one detector. A dot marks a detector you changed and have
not saved, and one save covers everything you changed, on any detector and
under General.

On Propper - OG and Tactical each kind has a screen of its own, with every
detector as a card and a panel that sets them all to one level at once.

Both warn about settings that will not do what you expect, such as Restrict
while Restrict takes nothing, or an allowlist with no countries on it.

Where we have the data, the screen also says how many of your traders a
detector would have caught over the last 30 days. Turning VPN up to Block shows how many traders
were on a VPN this month before you save. On the country policy and the country
limit, that number recounts while you edit the list or the threshold.

| Screen | Detectors and their thresholds |
| ------ | ------------------------------ |
| IP & Network | VPN, Tor, residential proxy and datacenter IP. Shared IP and shared subnet, each with the number of accounts allowed, and the subnet size (/16 to /28). Concurrent sessions, with the addresses allowed at once and the window that counts as the same moment. |
| Location | Country policy as a blocklist or an allowlist. Impossible travel, with a top speed, a minimum distance and how far back to look. New country. Registration mismatch. Too many countries, with the countries allowed and the window they are counted over. |
| Devices | Shared device, with the accounts allowed per device. Emulator. Headless browser. Missing fingerprint, with a grace period before the fingerprint has to have arrived. |
| Account linking | Group hedging, with the window for opposite trades. Copy trading, with the similarity, the minimum number of matching trades, the match window and how far back to look. Shared payment method and shared identity, each with the accounts allowed. |
| Affiliates | An affiliate sharing a device with their referrals, and sharing an IP with them, each with the referrals allowed before it fires. Signups from one IP, with the signups allowed per address and the window. Refunds after a discount, with the refunded share, the minimum number of discounted purchases and how far back to look. |

The Affiliates detectors judge the affiliate, not the referrals: the flag lands
on the affiliate's account and names the referrals it found. Local and private
addresses never count, so a household or an office network behind one router
does not look like one person. Nothing on this screen touches commission. Put a
detector on Restrict to hold the affiliate's payouts, and void a single
commission on the affiliate's own page in Affiliates. Open signals show at the
top of that page for anyone who may open Fraud.

## Trader overrides

An override holds one trader to a different level, a different threshold, or
both, on one detector. It carries a reason and, if you want, an end date, after
which it stops by itself.

Only the thresholds marked as able to differ per trader can be overridden.
The rest, such as the subnet size or how far back copy trading looks, belong to
the firm as a whole.

On a group detector, each account in the group is judged against its own
settings. If two traders share an IP and one of them has an override allowing
it, the flag still names both, but only the other one is restricted or
suspended. The exempt trader is marked as such in the flag.

In the standard design **Trader overrides** opens on a table of every override:
the trader, the detector, what it changes, when it last changed and when it
ends, sorted by either of those or by name. Nothing opens until you pick one.
The table then folds to a column beside it, and Escape folds it back. The one you
pick is the form itself: its level and every
threshold that can differ, each next to what the firm has set, then the reason
and the end date. An end date runs to the end of that day where you are. A new
override starts there, from a flag in the review queue, or from a detector's
exceptions on the Detectors screen, filled in with the trader and detector you
came from. If that trader already has one on that detector, it opens instead.

On Propper - OG and Tactical a new override opens as a dialog on the overrides
screen, also from the link on a detector card. In every design the trader page
lists that trader's overrides and restrictions, with a button that starts a new
override for them.

## Enforcement

In the standard design these settings are **General**, at the top of the
Detectors list.

**What Restrict takes away** is set once for every detector on Restrict:

| Restriction | What the trader notices |
| ----------- | ----------------------- |
| No new orders | Open positions keep running and can be closed. Pending orders that trigger are cancelled. |
| Payouts on hold | A payout request is refused with a message. |
| No challenge purchases | They cannot buy or claim a challenge. A challenge you grant still goes through. |
| Affiliate payouts on hold | Commission keeps building up, but cannot be withdrawn. |

A restricted trader sees a banner listing what is held. It does not name the
detector, so it is not a guide to getting around it. A restriction ends when
its flag is resolved or dismissed, or when you lift it in the review queue or on
the trader page. Lifting clears the trader and leaves the flag in the queue.

**Escalation** is the safety net under the levels. A flag on a single account
that scores at or above the escalation score suspends that account, even when
its detector is on Flag. Group flags never escalate. **Sensitivity** multiplies
every risk score, from lenient to lockdown, which moves how soon escalation is
reached.

The master switch on this screen turns all of fraud detection off. Nothing runs
and nothing is enforced while it is off.

## Reviewing a flag

In the standard design the review queue opens on a table of flags, highest
score first: who it is about, the detector type, the IP address, the level, the
score and when it was raised. Nothing opens until you pick a flag, so nobody's
details are on screen before you ask for them. Sort it by score, newest, oldest
or most recently decided, search it by trader, IP address or detector, filter it
by detector, level and status, or narrow it to the traders who are restricted
right now. Deciding the open flag moves on to the next one in the table. The flag itself shows what the detector saw, every trader
behind it with what was taken from them, their other flags, and the other
traders of yours seen on the same address. Every flag has a link of its own,
which is also what a notification opens.

Resolve a flag when it is handled, dismiss it when it was a false positive.
Both lift the restrictions it placed. Reopening a decided flag puts it back in
the queue as it was, without putting back the restrictions it lifted. A dismissed flag does not come back for
the same situation for a while. Neither one lifts a suspension: reactivating a
suspended account is a decision you make on the trader page.

## Settings from before this screen

Firms that had fraud detection set up before these screens existed keep what
they had. Their old switches were converted to levels, with one exception made
on purpose: a detector that used to restrict or block anything other than
access came over as Flag. Nobody gets restricted or suspended by an upgrade.
Turn those up yourself once you have looked at what they would catch.