Essay

Why fraud models should only propose. By Amir Shachar.

Read the essay
Skip to content
Riskernel

Fraud Surface OS

Fraud Surface OS

The engines Riskernel is building around the scoring API. One is live today. The rest are marked as not shipped.

Live today · One API call

Real-time fraud scoring Live

Send one event. Get back a risk score, the type of fraud, and the factors behind it. 47 ms median, Riskernel-reported. Single calls vary.

import requests

response = requests.post(
    "https://api.riskernel.com/v1/score",
    headers={"Authorization": "Bearer rk_live_..."},
    json={
        "amount": 4850.00,
        "currency": "USD",
        "event_type": "instant_payout",
        "ip_country": "NG",
        "user_id": "acct_9482"
    }
)

score = response.json()
# Returns in 47ms median

What You Get Back

Risk Score87/100 ยท HIGH EXPOSURE
Mule payouttype score: 0.89
First Time Payee Corridorweight: +0.35
Payout Velocity 5m Spikeweight: +0.28
IP Country Mismatchweight: +0.22
New Beneficiary Deviceweight: +0.15
Account Age 2yweight: -0.06

Every score includes SHAP-powered feature weights and a deterministic remediation recommendation. Ops analysts and compliance auditors see why a decision fired in plain language.

What comes with every score

Reasons ship with the score.

  • Explainable scoring Live

    Every score ships with its feature weights, as shown in the response above. See exactly why a transaction was flagged.

  • Audit-ready reasons Live

    Every score ships with its reasons, so your team can audit why the model decided what it did.

In development · Roadmap

Beyond transaction scoring.

Most fraud systems ask one question: “Is this transaction suspicious?” We think that is necessary, but not enough. Cybersecurity evolved from breach detection to external attack surface management years ago. Fraud has not made that leap yet. Riskernel is being designed to give fraud teams the infrastructure to map their exploitable surface, trap adversarial probing early, and respond with deterministic, regulator-grade actions.

The scoring API is the immediate wedge. Everything below is roadmap and design stage, not shipped.

  • Fraud Exposure Graph Not shipped

    Map every exploitable surface (impersonation domains, payout flows, refund loopholes, onboarding gaps) before attackers weaponize them.

  • Fraud Deception Mesh Not shipped

    Deploy synthetic decoy endpoints, honey IBANs, and canary promo codes to fingerprint botnets and mule rings.

  • Decision Provenance Not shipped

    Every fraud decision backed by supply-chain-grade evidence: input signals, feature weights, model version, policy version, and override history.

  • Remediation Language Not shipped

    Deterministic, auditable response actions (quarantine payee, step-up verification, hold settlement, callback): safe automation compliance teams trust.

  • Rare-fraud calibration Not shipped

    Tunes thresholds to your review-queue capacity, even when fraud is very rare.

  • Webhook alerts Not shipped

    Alerts the moment a high-risk transaction hits, sent to Slack, PagerDuty or any webhook your team already uses.

The checks that would sit in front of any automated action are described on the Algogens page. Want to start with a free shadow test?

See how this would run on your own flows.

Runs beside your current system. Nothing to rip out.

Get a Launch Fraud Review Talk to Amir