Identity Fraud Protection

ReachFive’s Identity Fraud Protection (IFP) module analyzes events to determine if a particular IP is exhibiting suspicious behaviour. In particular, the Identity Fraud Protection module consumes login and signup attempts where it determines if the IP is suspicious or not. If the Identity Fraud Protection module determines that the IP is suspicious, the IP is flagged and siloed into a separate database where its access is immediately blocked.

If automatic suspension is enabled on your ReachFive Console and the IFP module detects that malicious IPs have successfully accessed an account, the account is automatically suspended.

Administrators can view and manually suspend user accounts that have been compromised by these suspicious IPs directly from the ReachFive Console.

You can also whitelist the IPs you may want to bypass the attack protection policy.

ifp overview with whitelist
Why use Identity Fraud Protection?

Enabling the Identity Fraud Protection module on your ReachFive account allows you to:

  • Substantially reduce the impact of a credential stuffing attack.

  • Provide reports for GDPR purposes.

  • Immediately block suspicious IPs.

  • Prevent bots from bulk signup requests.

  • Whitelist IPs that you want to bypass the attack protection policy.

  • Easily view compromised user profiles. Premium feature

  • Quickly suspend compromised user profiles from the ReachFive Console. Premium feature

  • Automatically suspend accounts associated with suspicious IPs. Premium feature

Suspicious signup requests

In some cases, you might have bots attempting to perform bulk signup requests on your site. This happens sometimes in an attempt to purchase items rapidly or overwhelm your system. Luckily, we’ve got you covered here.

Our Identity Fraud Protection detects suspicious IPs and assigns a signup_compromised user event type for any signup attempt from a blocked IP. The profile is automatically suspended and all tokens are invalidated including access and refresh tokens. Any subsequent requests from the flagged IP will fail.

View compromised profiles

To use the Identity Fraud Protection module, you must have it enabled on your ReachFive Console by a ReachFive administrator.

If the feature is not activated on your account and you’re interested in using it, please contact your ReachFive Professional Service or CSM contact.

Prerequisites

  • You must have access to the ReachFive Console.

  • You must have a CRM, Manager, or Administrator role.

  • You must have the IP Blocking feature enabled.

  • You must have the Compromised profiles feature enabled.

Instructions

  1. Log in to your ReachFive Console.

  2. Go to Analytics.

  3. Select Compromised profiles.

    compromised profiles


The Compromised profiles section
  • lists all compromised profiles by ReachFive ID, Identifier (like email or mobile), their Suspension status, and when the suspicious behaviour was detected.

  • allows you to search by ReachFive ID and/or Identifier.

Suspend compromised profiles

To use the Identity Fraud Protection module, you must have it enabled on your ReachFive Console by a ReachFive administrator.

If the feature is not activated on your account and you’re interested in using it, please contact your ReachFive Professional Service or CSM contact.

Prerequisites

  • You must have access to the ReachFive Console.

  • You must have a CRM, Manager, or Administrator role.

  • You must have the IP Blocking feature enabled.

  • You must have the Compromised profiles feature enabled.

Instructions

  1. Log in to your ReachFive Console.

  2. Go to Analytics.

  3. Select Compromised profiles.

    compromised profiles

  4. Select the compromised profiles you wish to suspend.

  5. Click Suspend.

  6. Confirm the profiles to suspend in the pop-up.

    suspend compromised profiles from console

Enable Automatic suspension with IFP

You can enable the IFP module the right to automatically suspend accounts associated with a malicious IP.

If the feature is not activated on your account and you’re interested in using it, please contact your ReachFive Professional Service or CSM contact.

Prerequisites

  • You must have access to the ReachFive Console.

  • You must have a CRM, Manager, or Administrator role.

  • You must have the IP Blocking feature enabled.

  • You must have the Compromised profiles feature enabled.

Instructions

  1. Log in to your ReachFive Console.

  2. Go to Settings  Security  Attack protection policy.

  3. Enable the Automatic suspension option by toggling the slider to green.

  4. Don’t forget to Save your input.

ifp auto suspend

Whitelist IPs

You can whitelist certain IP addresses with the IFP module directly from the ReachFive Console.

Whitelisted IP addresses will bypass the attack protection policy.

Prerequisites

  • You must have access to the ReachFive Console.

  • You must have a CRM, Manager, or Administrator role.

  • You must have the IP Blocking feature enabled.

  • You must have the Compromised profiles feature enabled.

Instructions

  1. Log in to your ReachFive Console.

  2. Go to Settings  Security  Attack protection policy.

  3. Add the IP addresses allowed to bypass attack protection.

  4. Don’t forget to Save your input.

ip inspector whitelist

API operations

Use the Management API to: