Alert Actions

You can set up Alert Actions to trigger once a Fraud Alert is generated.

An Alert Action allows you to:

• Automatically create a country block for the country that caused the Fraud Alert, or a network block for SMS Network Volume alerts.
• Send a notification (email and/or webhook) once a Fraud Alert is generated.

It’s important to note that a Fraud Alert can trigger just a single Alert Action: it is not possible to trigger multiple alert actions for the same Fraud Alert. Check out the Alert Actions evaluation section for further details.

As an example, you can set up Alert Actions for Volumetric Changes alerts:

• To receive a notification as soon as a volumetric changes alert is generated for any country.
• To receive a notification and automatically block traffic once a volumetric changes alert with a volume greater than 2000 SMS in the last 12 hours is generated for Belize (see screenshot below).

Creating an Alert Action

Go to the Alert Actions section and click on the "Add alert action" button.

Set up your Alert Action using the following fields:

• Fraud Alert: Select the Fraud Alert type for the Alert Action you want to set up.
• Product: Select the product (voice or SMS). The alert action will trigger only when such product generates a Fraud Alert of the type you selected.
• Action Threshold: You can choose to trigger the Alert Action for any alert regardless of its volume, or you can choose a Fraud Alert volume. For example, you can choose to trigger the Alert Action only when there is a Volumetric Changes alert showing a traffic volume greater than or equal to 1500 SMS in the last 12 hours.
• Time Interval: The time interval allows you to suppress triggering an Alert Action for consecutive alerts for the same country. Once a certain Alert Action triggers it won’t trigger again unless the time interval has passed. The time interval is considered on a per-country basis: actions won’t trigger only if the consecutive alerts happen for the same country.
• Actions:
  • If you choose the "Block" option, as soon as the Alert Action triggers, a country block will automatically be created for the country that generated the alert (unless a country block already exists for that country). For SMS Network Volume alerts, a network block will be created instead of a country block.
  • The "Review" option allows you to create a country block (or a network block for SMS Network Volume alerts) with a single click from the Fraud Alerts section or decide not to block (if the alert was caused by legitimate activity).
• Send Fraud Alert Notification: When marking the checkbox, a notification will be sent to you (email and/or webhook).
• Country: You can choose to trigger the Alert Action regardless of the country that generated the Fraud Alert, or you can choose to trigger only when the fraud alerts are generated by specific country(ies).

Alert Actions Evaluation

A given Fraud Alert can trigger only a single Alert Action; it is not possible to trigger multiple alert actions for the same Fraud Alert. Check the decision logic below for when a Fraud Alert potentially matches multiple Alert Actions.

Country-specific vs. All Countries

When there is an alert action set up for a specific country, alert actions with value “All countries” are ignored. In the example below, the first alert action will never trigger for Poland.

Multiple Action Thresholds for the Same Fraud Alert

The Alert Action with the highest volume will be triggered as long as the Fraud Alert reaches that volume. In the example below:

• Volumetric Changes Fraud Alerts (VCFA) for Poland with volume 5000 or greater would trigger the second Alert Action.
• VCFA for Poland with volume greater than 2500 and lower than 5000 would trigger the first Alert Action.
• VCFA for Poland with volume lower than 2500 won’t trigger any alert action.
• VCFA for any country except Poland with volume 1000 or greater will trigger the third Alert Action.