Analytics
8 Fraud & anomaly alerts
Hashentic watches the stream of scans and raises an alert when a pattern looks like counterfeiting or diversion. The menu badge shows how many alerts are still New.
本章节暂未提供中文版本，您正在阅读英文版本。
What triggers an alert#
| Signal | Raised when… | Weight |
|---|---|---|
| Cloned chip (counter) | A secure NFC tag reports a read counter that is not higher than one already seen: two physical tags share the same identity. | 50 |
| Impossible travel | Two consecutive scans of the same tag are more than 100 km apart and would need more than 900 km/h to travel. | 40 |
| Gray market | At least 3 genuine scans of an asset within 24 hours come from a country outside the asset's Authorized regions. | 35 |
| Velocity spike | The same tag or code is scanned at least 10 times within 10 minutes. | 30 |
| Invalid-scan burst | A product collects at least 5 failed scans within 30 minutes. | 25 |
| Risky IP | Added to another signal when a triggering scan came from a VPN, proxy, Tor or threat network. | 15 |
The score is the sum of the weights (at most 100). From 75 an alert is Critical, from 45 High, from 25 Medium. The High and Critical cutoffs and the travel, velocity, gray-market and burst-window values can be tuned in Settings → Fraud & anomaly detection; the burst count uses Invalid verification anomaly threshold under Verification alerts. High and Critical alerts also send a notification and can start a workflow ("On fraud detected").
Working an alert#
- Acknowledge: you have seen it and are looking into it.
- Confirm fraud: it is a real case.
- Dismiss: a false alarm.
A status only records who decided and when. Confirming does not block anything by itself: block the product or tag on its page, or let a workflow do it.
Filter with Add filter by Severity, Status, Signals, Detected date, Asset and Country.