Investigate a risky user

​

What you will learn

• How to find risky users and users with a High-Risk Event for any period.
• How to read a user card: its band, its High-Risk Events and the devices, visitors and IP addresses linked to it.
• How to read the same account through the History API and act on it at its next sensitive action.

​

Before you start

• The authenticated snippet on your signed-in pages. Pass a hashed User HID with checkAuthenticatedUser on every signed-in page. Users, account-level risk and all four High-Risk Events are built on it. See Identify signed-in users.
• Access to the analytics dashboard, and your domain’s Private API Key for Step 5 (API keys). No account yet? Start Free with 5,000 identifications, one time, no credit card.

​

Step 1: Find risky users

• Users splits the accounts active in the period into Trusted, Risky users and High-Risk Event users.
• High-Risk Events shows how many users have each of the four events, Multi-accounting, Account sharing, Impossible travel and Account takeover, at Medium confidence and at High confidence, counted for the users active in the selected period.

​

Step 2: Narrow the list

1. By event. Open Filters, pick High-Risk Events, tick Multi-accounting and select Done. The table keeps the users with that event.
2. By band. Select the Dangerous band pill to keep the users with at least one Dangerous identification in the period.

​

Step 3: Open the user card

1. The band: the worst band of the user’s identifications in the period. The band split under it shows how many identifications fell in each band, so one Dangerous identification among ten Trusted ones stands out.
2. The High-Risk Event: the pill names the event, and its colour gives the confidence, red for High and orange for Medium. These are the colours of the Dangerous and Suspicious bands, but the pill is an event, separate from the band.
3. Linked devices: open the counter to list every device the account used, each with the band of the account’s identifications on it. Open a device to see every other account on it under Linked accounts.

​

Step 4: Check what drove the band

​

Step 5: Act in your backend

curl "https://account.shieldlabs.ai/api/v1/history/user_hid/a91f3c7e5b2d4086?limit=100&offset=0" \
  -H "Authorization: Bearer sec_your_private_api_key"

const account = await accountView('a91f3c7e5b2d4086');
// { identifications, worstBand, devices, visitors, publicIps, countries }

const sharedDevices = [];
for (const deviceId of account.devices) {
  const accounts = await accountsBehindDevice(deviceId); // distinct accounts on this device
  if (accounts > 1) sharedDevices.push({ deviceId, accounts });
}

// watchlist: a table in your datastore, keyed by User HID and Device ID
await watchlist.add({
  userHid: 'a91f3c7e5b2d4086',
  reason: 'Multi-accounting, High confidence',
  worstBand: account.worstBand,
  devices: [...account.devices],
});

app.post('/api/payout', async (req, res) => {
  const userHid = req.user.hashedId;
  const risk = await waitForScore(req.body.shieldlabsRequestId, 2000);
  if (!risk) return res.status(202).json({ status: 'review' });
  if (risk.user_hid !== userHid) return res.status(202).json({ status: 'review' });
  if (risk.risk_score > 100) return res.status(202).json({ status: 'review' }); // 999 rate-limit marker

  const flags = risk.detection_flags ?? {};
  const signals = risk.signals ?? []; // null on the History fallback

  if (await watchlist.matches(userHid, risk.device_id)) {
    return res.status(202).json({ status: 'review' }); // you choose the action for each case
  }
  if (
    band(risk.risk_score) === 'Dangerous' ||
    flags.anti_detect_browser ||
    signals.some((s) => s.name === 'browser_automation')
  ) {
    return res.status(202).json({ status: 'review' });
  }
  return res.json({ status: 'approved' });
});

​

Summary

• The Overview’s Users and High-Risk Events panels show how many accounts need a look in the period.
• Analytics narrows them by event or by band, and the user card shows the account’s band, its High-Risk Events and every device, visitor and IP linked to it.
• The identification card shows the risk signals and weights behind the band.
• In your backend, read the account by user_hid, record your decision, and check it at the account’s next sensitive action.

​

Next steps