Loyalty Fraud

<script type="module">
  const mod = await import(
    'https://cdn.shieldlabs.ai/snippet.js?publicKey=YOUR_PUBLIC_KEY'
  );
  // Pass the hashed account id, never a raw email or user id.
  // `ip` is the client IP the server saw, not a score — the DeviceID and
  // Risk Score are read server-side via webhook. requestID correlates them.
  mod.checkAuthenticatedUser('8a9f-hashed-account-id', (ip, requestID) => {
    document.getElementById('shieldlabs-request-id').value = requestID;
  });
</script>

<form method="POST" action="/api/loyalty/redeem">
  <input type="hidden" id="shieldlabs-request-id" name="shieldlabsRequestId" />
  <input type="text" name="rewardId" placeholder="Reward" />
  <button type="submit">Redeem points</button>
</form>

curl "https://account.shieldlabs.ai/api/v1/history/device_id/5eb7fd5c-2a1b-4c3d-9e8f-7a6b5c4d3e2f?limit=100" \
  -H "Authorization: Bearer sec_your_private_api_key"

app.post('/api/loyalty/redeem', async (req, res) => {
  const { accountId, rewardId, shieldlabsRequestId } = req.body;

  // 1. Your normal program checks first (member owns the points, perk is
  //    eligible, within the campaign window).
  if (!(await rewardIsRedeemable(rewardId, accountId))) {
    return res.status(409).json({ error: 'reward_not_redeemable' });
  }

  // 2. Read the scored result for this session (snake_case webhook body).
  const risk   = await waitForScore(shieldlabsRequestId, 2000);
  const score    = risk?.risk_score ?? 0;        // 0-100, default to 0 if not yet in
  const deviceId = risk?.device_id;
  const flags    = risk?.detection_flags ?? {};

  // 3. The all-zero DeviceID is "no device" (JS disabled or blocked), not a
  //    new one. Skip the account count and decide on the score alone.
  const NIL = '00000000-0000-0000-0000-000000000000';
  const usableDevice = deviceId && deviceId !== NIL;

  // 4. Count distinct accounts behind this one durable device.
  let accountsOnDevice = 1;
  if (usableDevice) {
    const rows = await shieldlabsHistory('device_id', deviceId, 100);
    accountsOnDevice = new Set(rows.map((r) => r.user_hid).filter(Boolean)).size;
  }

  // 5. YOUR code owns the verdict. Branch on the band, the count, and the
  //    IP-mismatch flag, never on a signal label string. ip_mismatch on a
  //    reused device is the masked-farm tell.
  const maskedFarm = flags.ip_mismatch && accountsOnDevice > 1;
  if (accountsOnDevice >= YOUR_ACCOUNT_LIMIT || score >= 60 || maskedFarm) {
    return res.json({
      requireVerification: true,
      reason: accountsOnDevice >= YOUR_ACCOUNT_LIMIT ? 'accounts_linked_to_device' : 'anonymity',
    });
  }
  if (score >= 30) {
    await flagForReview(accountId, deviceId, risk);   // Medium: grant, but watch
  }

  // Clean / Low, one account on the device: award the reward.
  return grantReward(req, res);
});