Advisor [Alpha]

Identity Insights returns telecom signals that can be difficult to translate into decisions. The challenge surfaces across the following areas:

• Relevant Insights: Which insights matter for your use case?
• Interpreting Data: How are insights interpreted into meaningful signals applicable to your use case?
• Decision Making: What decision should you make based on available signals?

What is Advisor?

Advisor is a capability within the Identity Insights API that evaluates raw telecom data (Insights), transforms it into model-specific signals, and produces an overall assessment with actionable advice. This removes the need to interpret individual signals or build decision logic from scratch. Advisor also exposes the signals and metrics used in each evaluation, allowing you to validate the result against your business context.

Advisor has three interconnected components:

• Models: Each model includes recommended Insights, signal definitions based on attribute values and ranges, and evaluation logic. Predefined models address common fraud and risk use cases and provide a practical reference for identifying relevant signals, establishing thresholds, and refining decision criteria over time.
• Signals: Raw data from Insights is transformed into signals based on model-defined conditions. Each triggered signal includes a risk classification and a natural-language description tailored for business and operations teams.
• Evaluation: Advisor evaluates the triggered signals for a model and returns an assessment, static advice associated with that assessment, and metrics describing how the result was calculated.

Models

Advisor supports models that align with specific risk or business objectives:

• Account Takeover (ATO): Assesses the risk of an unauthorized party gaining access to or taking control of an existing account. Common scenarios include authentication attempts, password resets, and high-risk transactions such as bank transfers to a new beneficiary.
• Synthetic Identity: Analyzes the likelihood that an identity has been synthetically constructed by combining real and fabricated data. Such identities are commonly exploited by fraudsters to open accounts, claim promotions, evade taxes, or establish mule accounts.
• Impersonation: Evaluates whether a user is posing as a real person without legitimate access to that individual's devices or accounts. The goal is to convince systems or people that the attacker is someone else, typically leveraging stolen personal data and social engineering. Common scenarios include user onboarding, account recovery, and authorized push payments.
• Mobile Number Validity: Determines whether a phone number is a valid, carrier-assigned mobile number capable of receiving mobile communications such as SMS. Numbers like landlines, virtual, or toll-free lines are unreliable for mobile channels and cannot be confidently associated with a genuine individual, increasing failed delivery rates and adding friction to authentication flows.
• Authorized Push Payment: Assesses the risk that a user is being manipulated into authorizing a payment to a fraudster. This model helps identify telecom-derived warning signs relevant to payment journeys in which the legitimate account holder initiates the transaction under deception or social engineering.

Signals

For each model, Advisor reads the attributes returned by Identity Insights, compares their values against the latest model-specific definitions and thresholds, and produces a structured interpretation for each triggered signal. This interpretation includes a classification, a categorical judgment such as LOW_RISK, MEDIUM_RISK, or HIGH_RISK, and a description, which explains why the signal was triggered in the context of the model. Signal definitions may evolve as models are refined, additional Insights become available, and real-world patterns change.

{  
  "name": "sim_swap_detected",  
  "attribute": "sim_swap.is_swapped",  
  "classification": "HIGH_RISK",  
  "description": "A SIM swap has been detected for this number within the requested period. The number has been transferred to a different SIM, meaning control over any authentication method tied to the number may have been compromised, including SMS-based codes, Silent Authentication, and other OTP delivery channels, enabling unauthorized access to accounts."  
}

Evaluation

After Advisor evaluates the relevant signals, it returns a model-level assessment that summarizes the overall risk classification for the evaluated use case. The assessment can be LOW_RISK, MEDIUM_RISK, or HIGH_RISK. Advisor also returns an advice field containing a static, human-readable recommendation associated with the assessment, together with metrics that describe the completeness and composition of the evaluation.

"evaluation": {
  "metrics": {
    "evaluated_signals_count": 6,
    "triggered_signals_count": 3,
    "high_risk_signals_count": 1,
    "medium_risk_signals_count": 1,
    "low_risk_signals_count": 1
  },
  "assessment": "HIGH_RISK",
  "advice": "The triggered signals indicate a high likelihood of risk for this model. It is strongly recommended to apply additional security steps before proceeding with the action."
}

The evaluation algorithm applies a conservative weighting strategy in which higher-risk triggered signals carry more weight than lower-risk signals. As a result, multiple LOW_RISK signals do not offset a HIGH_RISK signal. You should use the assessment, advice, signal details, and metrics together rather than relying on a single field in isolation.

You can use Advisor models as-is or as a reference for building your own. This is especially relevant when recommended insights are unavailable in your region, or when certain signals are not applicable to your specific use case or industry — avoiding unnecessary penalties to model performance.

Related Resources

• Advisor implementation guide
• Identity Insights API Reference