Transaction Risk Scoring

What Is Transaction Risk Scoring?

Diliguard’s Transaction Risk Scoring evaluates a single transaction, purchase, transfer, or account signup, by combining IP intelligence, email profiling, dark web breach exposure, illicit crypto wallet checks, and IBAN validation into one result. It surfaces the specific signal that raised risk, rather than a single opaque score.

How Transaction Risk Scoring Works

• IP Geo Intelligence: Flags proxy or VPN usage and geolocates the connection tied to the transaction.
• Email Profiling: Checks whether the email is deliverable, flags disposable email providers, and reports domain age via WHOIS.
• Dark Web Leak Exposure: Checks whether the transaction email has appeared in a known credential dump or breach.
• Illicit Crypto Screening: Where a wallet address is involved, checks it against sanctioned and criminal wallet databases.
• IBAN Validation: Validates the checksum of any bank account number involved and flags FATF or European Commission high-risk jurisdictions.

What Diliguard Returns

Each module in the transaction score returns its own result card: IP Geo Intel shows location, ASN, and proxy/VPN flags; Email Footprint shows deliverability, disposable-provider status, and domain age; Dark Web Leaks shows leak title, source, and a snippet where a breach is found; IBAN Check shows checksum validity, country code, and a “Low Risk” or “High Risk” status with an amber warning banner if the country is FATF or EU flagged.

Data Sources and Coverage

IP and domain checks query public network and WHOIS infrastructure globally. Dark web leak detection scans public text-paste sites and known dump indexes, which does not guarantee full coverage of every breach in existence, only what is publicly indexed on the sites checked. IBAN country-risk flagging is based on FATF and European Commission published high-risk jurisdiction lists. Crypto wallet screening, where used, follows the same sanctioned/illicit wallet database scope as the standalone Crypto Investigation module.

Frequently Asked Questions

Does a clean dark web check mean the email has never been breached?

No. It means the email was not found on the public text-paste sites and dump indexes this scan checks. It is a good sign, not a guarantee, since not every breach is indexed on a publicly searchable site.

What does a “High Risk” IBAN flag actually mean?

It means the account’s country code appears on a FATF or European Commission list of jurisdictions flagged for AML concerns. It does not mean the specific account is fraudulent, only that additional scrutiny is warranted before proceeding.

Can Transaction Risk Scoring run without an IBAN or crypto wallet?

Yes. Amount, IP address, and email are the only required fields. IBAN is optional and only evaluated when provided.

How fast is a transaction score compared to running each check manually?

All five signals run in parallel in a single request rather than as sequential manual lookups, which is the difference between a real-time decision and a delayed one at the point of transaction.

Where This Fits

Transaction Risk Scoring is the real-time decision layer for Gambling Service Providers scoring deposits and payouts, Estate Agents scoring large property wire transfers, and Crowdfunding Platforms & Credit Intermediaries scoring funding inflow patterns.

Architecture and Integration

This capability is available as the standalone Transaction Fraud Scoring workflow in the portal, or integrated directly at the point of transaction via the Developer API at api.diliguard.com, authenticated with an API key created from the portal’s Settings page. It is also callable through the @sluxia/diliguard-mcp MCP server for agent-driven fraud checks.