Help Center / Uploads & Scoring / How fraud scores are calculated

How fraud scores are calculated

What the 0–100 score means and which detection rules are live today.

Every lead gets a score from 0 to 100 and a risk level derived from it: 0–29 is low, 30–64 is medium, 65 and above is high. The score is a weighted average of every detection rule that had enough data to run on that lead.

Rules that run today

Time-to-convert outlier — flags conversions that happen implausibly fast after the click (or with a negative time-to-convert, which shouldn't be possible).
Duplicate detection — flags leads that share an email or phone number with another lead, in the same upload or in any earlier upload on your account. The more times a value has appeared in total, the higher it scores.
Gibberish/disposable email — flags known disposable-email domains and local parts that look auto-generated rather than typed by a person.
Blacklist match — if you checked one or more of your blacklists on that upload, any lead whose email, phone, IP address, or name matches an entry on it is flagged.
Allowlist match — the opposite: if you checked an allowlist and a lead matches an entry on it, that lead is scored Low.

Blacklist match works differently from the other three: it's opt-in per upload (see Managing blacklists), and a match overrides the score outright to High risk rather than being blended into the weighted average — a value you've personally confirmed as bad is a stronger signal than any heuristic. An allowlist match overrides it the other way, to Low. If a lead matches both, the blacklist wins.

Rules still being built

IP reputation (datacenter/VPN/proxy detection), conversion-velocity-spike detection, and relative affiliate benchmarking are on the roadmap but don't run yet — they show as "Not yet available" on a lead's detail view rather than silently affecting the score. We'd rather ship a rule when it's accurate than pad the score with a placeholder.

Because those rules are skipped rather than scored as zero, they don't drag scores down artificially — but it also means today's automated score reflects timing, duplication, and email-quality signals only (plus whatever you've caught yourself via your blacklists and allowlists), not IP or velocity patterns yet.