Pre‑onboarding risk intelligence: detect loan stacking, block device farms & emulators, score application metadata, and enrich with OSINT – all in milliseconds.
Catch cross‑application bursts, marketplace shoppers, and broker shotgun patterns.
Copy‑paste spikes, ultra‑fast fill, suspicious referrers, domain age risk.
Signals from phones/emails across lead portals – no competitor data sharing.
Link devices → identities, spot emulators/VPNs, and stop repeaters.
POST /risk/shield/check
{
"phone_hash": "sha256(+91xxxxxxxxxx)",
"email_hash": "sha256(u@example.com)",
"device_id": "fp_abc123",
"ip": "1.2.3.4",
"referrer": "https://loan-compare.example/campaign",
"utm": {"source":"aff_x","medium":"cpc"},
"session": {"ttf_ms": 84000, "paste_rate": 0.62, "revisits": 19}
}
200 OK
{
"risk_score": 0.87,
"tier": "high",
"reasons": [
"Device used for 6 identities in 36h",
"Recent SIM swap (12h)",
"Referrer=loan marketplace",
"High-risk ASN"
],
"actions": ["HOLD", "STEP_UP_KYC", "SELFIE_LIVENESS"],
"model_version": "shield_v1.3.2"
} Shield focuses on non‑bureau signals: device, behaviour, IP/ASN, and OSINT. Optionally, a privacy‑preserving exchange (PSI/Bloom) provides cross‑lender velocity counts without sharing raw PII.
API is stateless and horizontally scalable. Typical p95 < 200ms with enrichment caching and adaptive timeouts for third‑party lookups.
LLMs generate compliance‑ready narratives; agents run OSINT lookups; ML/GNN powers velocity/device graphs. All outputs include reason codes.
Yes. Many lenders begin with DeviceID + MetaRisk, then add LoanStack and SignalOSINT as volumes grow.
We’ll tailor a walkthrough to your risk stack and portfolio.