Fraud Detection

What every risk level, score, flag, and field in the Fraud Detection panel means, and how to read them when reviewing a candidate.

Fraud Detection checks the contact details and online presence a candidate gives you against a global fraud-prevention network, and combines the results into one risk level. This page explains every element of the panel: how the risk level is calculated, what each field and flag means, and how to interpret them.

What you unlock

• Identify fraudulent candidates early, which is especially valuable for remote and high-volume hiring
• Coverage across email, phone, IP and location, LinkedIn, and digital footprint signals
• A clear overall risk level and a consolidated report that’s easy to share internally

---

When verification runs

1. When the candidate is invited

   Alex checks the candidate’s email address, phone number, and digital footprint. No interview data is needed, so results are available before the candidate starts.

2. When the interview is completed

   Alex adds the IP address the candidate connected from, along with their LinkedIn profile and resume when available, and recalculates the risk level. It also reads the interview transcript to check whether the candidate confirmed they can work at a specific office location while connecting from a different country or state.

Each category runs only when Alex has the input it needs:

Category	Requires	Source
Email	The candidate’s email address	SEON fraud-prevention network
Phone	The candidate’s phone number	SEON (carrier and caller-ID lookup)
Location	An interview completed in the browser (provides the IP address)	SEON IP intelligence
LinkedIn	A LinkedIn profile URL on the candidate record. Resume comparison also requires a resume	Public LinkedIn profile data, compared against the resume by AI
Footprint	The candidate’s email address	SEON fraud-prevention network

When a category can’t run, for example because the candidate has no LinkedIn URL or interviewed by phone, it is left out of the panel and the score is calculated from the remaining categories. It doesn’t count against the candidate.

---

Reading the panel

Element	What it shows
Risk Score	The overall risk level: Low, Medium, or High. It comes from the 0–100 verification score (see How the risk level is calculated).
Analysis Summary	A one- to two-sentence AI-written summary of the most important signals. It describes the findings below it and doesn’t change the score.
Signal Overview	Counts of every signal found across all categories: Positive (green), Warning (amber), and Negative (red).
Category	One row each for Email, Phone, LinkedIn, Location, and Footprint.
Details	The key facts Alex found for that category. Hover over underlined items for more detail.
Flags	The warning and negative signals raised in that category, by name. Hover over a flag for its description. None means no concerns were found.
Risk (per category)	High if the category has any negative flag, Medium if it has warning flags only, otherwise Low. It summarizes that row’s flags and is separate from the overall risk level.

---

How the risk level is calculated

Risk levels

The overall risk level comes from a single verification score from 0 to 100, where higher is safer:

Score	Risk level	What it means
71–100	Low	Contact details and online presence look consistent with a real, established person. No meaningful fraud history.
41–70	Medium	One or more concerns worth a closer look. These are often fraud-network history, a VoIP number, or a thin online presence alongside otherwise normal results.
0–40	High	Several strong concerns, or one decisive one such as a VoIP number registered in a different country from the candidate’s IP location. Review carefully before proceeding.

Step 1: Category scores

Each category gets its own 0–100 score (higher is safer). How each one is scored is explained in the data dictionary below. The category scores are then combined using these weights:

Category	Weight
LinkedIn	35%
Footprint	20%
Email	15%
Phone	15%
Location	15%

Only the categories that ran are included, and their weights are rescaled so they add up to 100%. For example, a candidate with only Email, Phone, and Footprint results gets 30% Email, 30% Phone, and 40% Footprint.

Step 2: Deductions

Some findings are too serious to be diluted by an average. They are deducted from the combined score:

Finding	Deduction
Fraud-network history: 1–2 fraudulent transactions	−15
Fraud-network history: 3–15 fraudulent transactions	−30
Fraud-network history: 16 or more fraudulent transactions	−40
Fraud-network history and fewer than 5 accounts found	additional −5
VoIP number registered to a different person (caller-ID mismatch)	−8, or −15 when fewer than 5 accounts were found
VoIP number registered in a different country from the IP location	−40
Resume matches LinkedIn by less than 20%	−30
Resume matches LinkedIn by 20–49%	−15

The deductions in the first five rows are capped at a combined −50. The resume deduction applies on top of that.

Step 3: Overrides

A VoIP number registered in a different country from the candidate’s IP location always produces a High risk level. The score is capped at 40, whatever the other results are.

Worked example

A candidate’s email scores 85, phone scores 100 (mobile number), and footprint scores 95 (17 accounts). They interviewed by phone, so there is no Location result, and they have no LinkedIn URL. Their email has 24 fraudulent transactions in the fraud network.

1. Weighted average across Email (30%), Phone (30%), and Footprint (40%): 25.5 + 30 + 38 = 93.5
2. Deduction for 16 or more fraudulent transactions: 93.5 − 40 = 53.5
3. Rounded score 54, which is Medium risk.

The email, phone, and online presence all look legitimate, but the email address has a history of being declined for fraud elsewhere. The Medium level reflects that tension: it isn’t proof of fraud, and it needs a closer look.

---

Data dictionary

Flags appear in the Flags column under the names shown below. Negative flags are red and Warning flags are amber. Positive signals don’t appear as flags, but they are counted in the Signal Overview and can be mentioned in the Analysis Summary.

Email

Details

Field	Meaning
Age	How long the email address has existed, estimated from the earliest activity the network has seen for it.
Disposable	Yes if the address belongs to a temporary or throwaway email service.
Deliverable	Whether the mailbox can receive mail: deliverable, undeliverable, or unknown.

Category score: starts at 70. A disposable address scores 5 and an undeliverable one scores 15, with no other adjustments. Otherwise: +15 if confirmed deliverable, +5 for a valid format, +10 for a non-free (for example, company) email domain, +10 if the address is 2 years or older, and −10 if it is under 1 year old.

Flags

Flag	Type	Raised when	How to read it
Disposable Email	Negative	The address belongs to a temporary or throwaway email service	Real applicants rarely use throwaway addresses. This is a strong signal.
Undeliverable	Negative	The mailbox can’t receive mail	The address may be mistyped or invented. Confirm the candidate’s contact details.
New Email	Warning	The address is less than 1 year old	Common for people who recently changed email. It matters more alongside other flags.
Deliverable	Positive	The mailbox can receive mail
Not Disposable	Positive	The address isn’t from a throwaway service
Established Email	Positive	The address is at least 1 year old

Phone

Details

Field	Meaning
Type / VOIP	Whether the number is a mobile line or a VoIP (internet-based) number such as Google Voice or TextNow.
Country	The country the number is registered in.
CNAM: Match / Mismatch	Compares the caller-ID name registered to the number (CNAM) with the candidate’s name. Hover to see the registered name. It only appears when a personal name is on file. Generic carrier labels (such as “WIRELESS CALLER”) and business names aren’t compared.

Category score: 100 for a valid mobile or landline number, 80 for a VoIP number, and 0 for an invalid number.

Flags

Flag	Type	Raised when	How to read it
Voip Country Mismatch	Negative	The number is VoIP and its country differs from the country of the candidate’s IP address	This is the strongest phone signal. It’s a common pattern when someone uses a foreign-registered internet number to appear local. It always produces High risk.
Voip	Warning	The number is a VoIP line	VoIP numbers are easy to create and discard, but many legitimate people use them. On its own it has only a small effect.
Cnam Mismatch	Warning	The caller-ID name is a different person’s name	A number registered to a spouse or parent, or a recycled number, produces this innocently. It only lowers the score when the number is also VoIP.
Valid Phone	Positive	The number is valid
Mobile Phone	Positive	The number is a mobile line
CNAM Match	Positive	The caller-ID name matches the candidate

Location

Details

Field	Meaning
Location	The city and region of the IP address the candidate interviewed from.
IP Type	Residential (ordinary home or mobile connection), VPN, Public Proxy, Datacenter (hosting or cloud server), or Tor (anonymity network). When several apply, the most specific one is shown in that order: Tor, VPN, Public Proxy, Datacenter.

Category score: starts at 100. −40 for Tor, −30 for a VPN, −25 for a web or public proxy, −20 for a datacenter IP, and −15 for a residential proxy.

Flags

Flag	Type	Raised when	How to read it
Location Mismatch	Negative	In the interview, the candidate confirmed they can work at a specific office location, but their IP address is in a different country or state	Hover to see what the candidate said and where the IP is. Nearby cities in the same metro area, remote roles, and candidates who mentioned relocating aren’t flagged. A VPN can produce a false result, so check the IP Type. This flag is for review only and doesn’t change the score.
Tor Detected	Negative	The connection came through the Tor anonymity network	Deliberate anonymization. This is rare for genuine candidates.
Data Center Ip	Negative	The IP belongs to a hosting or cloud provider, not a home or mobile network	Typical of remote desktops and proxy services used to hide the real location or person.
Public Proxy	Negative	The connection came through a public or web proxy	The candidate’s true location is hidden.
Vpn Detected	Warning	The connection came through a VPN	Many people use VPNs for privacy or work, so on its own this is a weak signal. The location shown is the VPN’s, not the candidate’s.
No Vpn	Positive	No VPN detected
No Proxy	Positive	No proxy detected
Residential Ip	Positive	An ordinary home or mobile connection

LinkedIn

Details

Field	Meaning
Connections	The number of LinkedIn connections on the profile.
Age	The year the LinkedIn profile was created.
Resume: Match / No Match	AI comparison of the candidate’s resume with the work history on their LinkedIn profile. Match is shown at 60/100 or higher. Hover to see the match score and the reasons behind it.

Category score: the profile starts at 100. −30 if the profile is less than 1 year old, −20 for fewer than 50 connections (−10 for 50–99), −25 if the connection count is hidden, −10 with no headline, −15 with no work experience, and −5 with no education. +5 for a Premium account and +10 for received recommendations. When a resume is available, the LinkedIn score is 40% profile score plus 60% resume match score. If the LinkedIn work history isn’t publicly visible, the resume match counts as 50.

Flags

Flag	Type	Raised when	How to read it
Resume Mismatch	Negative	The resume matches the LinkedIn work history by less than 40%	Different employers, titles, or dates between the two. Compare them directly, and consider asking the candidate about the gaps.
New Profile	Warning	The profile is less than 1 year old	Recently created profiles are common in fabricated identities, but they’re also normal for early-career candidates.
Low Connections	Warning	Fewer than 50 connections	A thin network. Weigh it against the candidate’s seniority.
Incomplete Profile	Warning	The profile’s work history isn’t publicly visible, so it couldn’t be compared with the resume	The comparison couldn’t run. This isn’t evidence either way.
Verified Profile	Positive	The profile is over 1 year old, has more than 50 connections, and has a headline
Strong Connections	Positive	500 or more connections
Established Profile	Positive	The profile is at least 1 year old
Resume Match	Positive	The resume matches LinkedIn by 70% or more

Footprint

The digital footprint shows how established the candidate’s email address is across the internet, and whether it has a history of fraud in the network.

Details

Field	Meaning
Platform icons	LinkedIn, GitHub, Google, Microsoft, Apple, Facebook, Instagram, and X. A highlighted icon means an account linked to the email address was found on that platform.
+N	The number of other online services where an account linked to this email was found. Together with the highlighted icons, this makes up the total account count.
Oldest Account	The year of the earliest online activity linked to the email address.
Fraud History	Shown in red (amber for 1–2) when the email has fraudulent transactions in the fraud network. Hover to see the count, for example “24 fraudulent transaction(s) detected”. No fraud history (green) means none were found.

What “fraudulent transactions” means. The fraud network is shared by thousands of businesses, including online retailers, payment providers, banks, and marketplaces. When one of them declines a transaction, sign-up, or application involving an email address and marks it as fraud, that decline is recorded against the address. The number in the Fraud History tooltip is how many of those declines the network holds for this email.

• It counts events, not businesses. Ten declines can come from a single business on a single day.
• It is about the email address, not proven conduct by the person. Addresses exposed in data breaches can be used by fraudsters without the owner knowing.
• It isn’t related to employment. It shows how this address has been used elsewhere online.

A high count on an otherwise thin or new identity is a strong fraud signal. A high count on a long-established address with a large footprint is more often a sign that the address was compromised at some point.

Category score: starts at 75. A disposable email scores 10, with no other adjustments. −20 if the email is undeliverable. Account count adjusts the score by −10 for none, −5 for 1–5, +10 for 6–15, +20 for 16–30, and +25 for more than 30. +5 for appearing in 1–5 known data breaches (evidence the address has existed for a while) and −5 for more than 10. The network’s own risk rating for the email adds +10 when very low and −10 when high.

Flags

Flag	Type	Raised when	How to read it
Fraudulent Declines	Negative	3 or more fraudulent transactions recorded against the email	See the note above. It lowers the score by 30 (3–15) or 40 (16+).
Minor Fraudulent Declines	Warning	1–2 fraudulent transactions recorded against the email	Small counts are often false positives such as a disputed payment. It lowers the score by 15.
No Digital Presence	Warning	No accounts linked to the email were found anywhere	Typical of newly created addresses. Genuine people almost always leave some footprint.
Few Accounts	Warning	Fewer than 5 accounts found	A thin footprint. It matters most alongside fraud history or a VoIP number.
New Digital Presence	Warning	The earliest online activity for the email is less than 1 year old	The address, or at least its use online, is recent.
Elevated Risk	Warning	The fraud network rates the email as high risk, without specific fraud declines	The network’s own models consider the address risky based on its usage patterns.
Strong Presence	Positive	10 or more accounts found
Has Github	Positive	An account was found on a developer or technology platform
Has Linkedin	Positive	An account was found on a professional or jobs platform
Established History	Positive	The earliest online activity is at least 5 years old
No Fraud History	Positive	No fraudulent transactions recorded against the email

---

Reviewing a flagged candidate

Fraud Detection identifies candidates who need a closer look. It doesn’t make hiring decisions. When a candidate is Medium or High risk:

1. Find the driver. Look at the Flags column. The deduction tables above show which flags move the score most: fraud-network history and a VoIP number registered in a different country than the IP location outweigh everything else.
2. Look for corroboration. One flag with strong positives elsewhere, such as fraud history on a 10-year-old address with 30+ accounts and a matching resume, is a different picture from several flags that point the same way, such as fraud history plus a new email, few accounts, and a VoIP number.
3. Verify directly. Confirm identity through a live video call, a callback to the number on file, or Identity Verification, which checks a government ID against a live selfie.

---

Get access

Fraud Detection is available to existing Fraud Detection customers. Reach out to [e-mail] to learn more.