Device used differs from the user’s historical device.

Device previously flagged for fraudulent activity.

Cookies were cleared within a short time before the transaction.

Transaction initiated from a device not seen in the last 90 days.

IP address does not match the user’s historical location.

Transaction initiated via a VPN or proxy server.

Device is identified as an emulator or virtual machine.

Device is rooted or jailbroken.

IP address is flagged in the global fraud database.

User’s timezone does not match the transaction location.

Card is flagged in the negative database.

Card used is expired.

More than 2 cards used on the same device within 2 hours.

Card issued from a non-FATF or sanctioned country.

Card used for more than 5 transactions in 24 hours.

Card BIN does not match the issuing country.

UPI ID does not match the user’s historical records.

UPI ID used for the first time in the last 30 days.

Bank account does not match the user’s historical records.

Bank account is flagged in the negative database.

Email does not match the user’s historical records.

Email is flagged in the global fraud database.

Phone number does not match the user’s historical records.

Phone number is flagged in the global fraud database.

Email format is invalid or disposable.

Phone number format is invalid or VOIP-based.

Billing/shipping address does not match historical records.

Address is flagged in the global fraud database.

Shipping address is a PO Box.

Email used for more than 5 transactions in 24 hours.

Transaction value exceeds INR 500 for a new customer.

Multiple high-value transactions within a short time.

Booking from a high-risk country or IP address.

Loan application from a high-risk device or IP.

Payout to a high-risk country or bank account.

Payout amount exceeds INR 10,000 in 24 hours.

Booking from a high-risk email or phone number.

Multiple accounts created from the same device.

High-value transaction from a new shipping address.

Frequent changes in travel booking details.

More than 3 failed payment attempts within 10 minutes.

More than 10 transactions in 1 hour from the same user.

Transaction occurs outside the user’s usual activity hours.

User exhibits behavior inconsistent with historical patterns.

High-value transaction after multiple abandoned carts.

User selects expedited shipping for a high-value order.

High-value transaction from a first-time customer.

User has a history of disputed transactions.

Transaction involves high-risk products (e.g., gift cards).

Transaction amount is significantly higher than the user’s average.

Transaction involves a country on the sanction list.

Transaction involves a non-FATF member country.

User is a Politically Exposed Person (PEP).

Transaction violates Anti-Money Laundering guidelines.

Transaction matches patterns for Suspicious Transaction Reports (STR).

User details match entries in the negative database.

Transaction involves a high-risk industry (e.g., gambling).

Transaction exceeds regulatory limits for payouts.

Payouts to multiple accounts in a short time.

Merchant is flagged in the global fraud database.