Decide who gets through, in milliseconds
FraudZero is an anti-fraud rules engine. You describe the data you receive, write the rules that score the risk — in plain language, with words instead of symbols — and on every request the platform answers with a score from 0 to 100, the risk band and the signals behind it.
One rule, two ways to write it
Write the script or draw the flowchart. One of them is the source of truth — the other is generated — and you decide which, rule by rule.
let score = input.risco + input.velocidade
if input.pais is not "BR" and score > 80 {
Score(80, msg_pt="risco no exterior")
} else if score > 5 {
Score(40, msg_pt="risco elevado")
}In words: it adds the risk score to the velocity count. A score above 80 coming from outside Brazil adds 80 points for risk abroad; otherwise, a score above 5 adds 40 for elevated risk. Reaching the end without scoring is zero.
Words, not symbols
and, or, is, between, in. A rule speaks through Score, with the points and the reason; reaching the end without one is zero — there is no "approve" or "deny" to write.
The editor knows your input
After input. it offers the fields you declared, and only those. A syntax error is underlined on the right column, before you save.
One truth at a time
In drawing mode the server compiles the blocks into a script on save. In text mode the drawing is ignored and never even stored.
The detection tree, drawn
Each shape is a step of the script, and the number inside it is the step number. The drawing is not an illustration of what the rule does: it is the rule.
Shapes
The number in each shape is the matching step in the script.
How a unit evaluates
Every rule bound to the input runs, by priority and, on a tie, by order.
Every rule that scores adds its points; the score is the sum, capped at 100.
Reaching the end without a single Score scores zero. The response carries the score and the band; your system decides.
Rules from those who already solved it
One company publishes a rule; another acquires the one that fits its input. As an editable copy or as use-only — and the script never leaves whoever wrote it.
Blacklisted card
Antifraude BR
Velocity by document
Rede Pagamentos
Restricted MCC range
Acquirer Norte
No card shows the expression. It is not a missing permission — the listing simply does not carry it.
The script never leaves
The listing says what the rule detects and which fields it consumes. Expression, structure and references show up for no account, under no role.
The field mapping is mandatory
The author's rule speaks their vocabulary; your input has another. The acquisition wires one to the other and is refused if any field is left unmapped — finding that out in production would cost dearly.
With reference, every new version reaches you
A copy is yours to edit and does not receive the author's changes. A reference is execution only: you run the published version, and when the author publishes a new one the acquirer's units start using it.
Every evaluated request becomes a record
The unit reports every evaluation back to the console in batches, over a port that only exists on loopback. The aggregate is kept hourly, so "how many high-risk today" never scans the table.
Evaluations per hour
Evaluations in 24h
12,480
High risk
3.1%
Average latency
0.015 ms
Alert configuration
Telemetry never slows the response
The unit does not wait for the console: it drops the event on a roomy channel and keeps answering. If the channel fills up, the event is discarded with a log warning — this is diagnostics and statistics, not bookkeeping.
Who can do what — and what was recorded
Roles per operation, bundled into IAM-style policies. Plus an append-only trail that the console itself neither edits nor deletes.
Roles bundled into policies
The role is the permission atom, one per operation. The policy is the bundle, IAM-style — and the policy is what you grant a person.
Seeing the code is a separate right
Without RuleScriptRead the response omits the expression and flags script_hidden. You can distribute the rule without distributing the intelligence.
Mandatory second factor
TOTP for every account, with no way to turn it off. Sign-in has two stages, and the password-stage token opens no route at all.
A hierarchy that only goes down
The parent reaches the branches and their own children. A branch never reaches the parent — except for what the parent shares, explicitly.
Audit trail
ana.souza updated the rule risco-cartao-exterior
2 min agocarlos.lima published on the marketplace velocidade-documento
18 min agoana.souza rotated the unit's token transacao
1 h agomarina.alves approved the registration Acme Pagamentos Ltda
yesterdayWritten by a middleware after the response, on every request that changes something. Append-only: no route edits or deletes a line of the trail.
Rules in plain language
Write the risk the way you write a sentence: if, else, and, or, between, and a Score with the points and the reason. No developer in the middle.
Visual builder
The same rule drawn as a flowchart, with a decision diamond and Yes and No paths. Drawing and script are one and the same.
Scores in milliseconds
Each input has its own processing unit, always up, answering with score, risk band and signals — clients reach it over HTTPS, through the edge.
Data from where you already keep it
Plug in a CSV or your own database and query it from inside the rule, without exporting anything anywhere.
History and numbers
Every evaluated request becomes a record: the score, the rules that scored and the payload. Volume, risk bands and latency on one dashboard.
Rules marketplace
Publish a rule for other companies or acquire someone else's — as an editable copy or as use-only, without exposing the script.
Accounts in a hierarchy
A parent company and its branches, each with its own rules. The parent reaches the children; a child never reaches the parent.
Fine-grained permissions and MFA
Roles per operation, bundled into policies. Mandatory second factor. Seeing a rule's code is a permission of its own.
Audit trail
Who changed what, and when. Append-only: the console neither edits nor deletes its own trail.
How to get started
Send your company registration with your contact details. You get a protocol number right away; our team reviews it and, once approved, the administrator you named receives the invitation by e-mail.
Register my company