Fraud & Risk

Every card payment scored. Your rules decide.

A risk score on every card payment, rules you write and reorder without a deploy, and a review queue for the payments in between. Built and run on PayMongo's own card volume.

Talk to an expert
Scored before the payment completesA risk score from 0 to 1,000, then allow, review or block
Rules in readable codeOpen Policy Agent rules, in your order, first match wins
Run on PayMongo's own card volumeOpen to clients in early access
Who signs off

Three people decide. Each gets a straight answer.

Fraud tooling is bought by a committee. The risk officer needs an audit trail, the fraud lead needs speed, and engineering needs one integration.

Chief risk officerControls the regulator can audit, decisions you can explain.

Every verdict names the rule that fired and the inputs it read.

Head of fraudChange a rule without waiting for a release.

Write, reorder or switch off a rule. The next payment uses it.

CTOOne call per payment returns the score, the verdict and the rule.

No model to host and no second vendor in the payment path.

Early access

Rules you own. Rules run in the order you set and the first match wins. Change a threshold or move a rule up, and the next payment is decided by the new list.

fraud.rule · illustrative

first match wins
POST /v1/fraud/rules
1{2  "data": {3    "id": "frl_2v7p9k",4    "type": "fraud.rule",5    "enabled": true,6    "name": "High-risk card countries",7    "operator": "AND",8    "rules": [9      {10        "rule_attribute": "risk_score_gte",11        "rule_value": "800"12      },13      {14        "rule_attribute": "card_country_id",15        "rule_value": [16          "NG",17          "US"18        ]19      }20    ],21    "action": "block",22    "rule_order": 223  }24}
Your rules, in order
  1. 1JA4 fingerprint on block list
  2. 2High-risk card countries≥ 800
  3. 3Customers on your allow list
Roman Roy842 · NG · Rule 2Block
Connor Roy310 · PH · Rule 1Block
Stewy Hosseini734 · US · No match · risk levelReview
Willa Ferreyra120 · PH · Rule 3Allow

Roman Roy: Block. Connor Roy: Block. Stewy Hosseini: Review. Willa Ferreyra: Allow.

First match wins

Rules run top to bottom. The first one that matches decides allow, review or block.

Conditions you already track

Risk score, card and billing country, amount, IP address and billing email.

Every verdict names its rule

An analyst or an auditor can trace why a payment was held or declined.

Signals that see bots. Device and TLS fingerprints sit beside IP, card and billing country as rule inputs, so a script that keeps changing IP addresses still matches a rule.

Device fingerprint

The device behind the payment, available to every rule.

JA3 and JA4 TLS fingerprints

The client software behind the connection, which flags automated traffic.

IP, card and billing country

Mismatches between where the card, the bill and the request come from.

One desk for the payments in between. Payments a rule holds land in a review queue your team works. Approve or decline each one, and keep the allow and block lists that the rules read.

Review queue

Held payments, each with its score, inputs and the rule that held it.

Early access
Allow and block lists

Cards, emails and fingerprints your rules check before the score decides.

Early access
AML alerts and cases

Transaction monitoring that turns alerts into cases on the same desk.

Next

Controls are mapped to BSP Circular 1213, the MAS Shared Responsibility Framework and POJK 12/2024. Mapping is not compliance: your obligations under each stay with you. Sanctions screening is Next. QR and e-wallet payments are not scored.

Who does what

You set the policy. TNKR runs it on every payment.

Your team keeps the decisions. The engine, the signals and the record are ours to run.

Run it in your market

Availability by market, not a country count.

Fraud & Risk is built and run by PayMongo in the Philippines. Elsewhere, it runs through a licensed partner in your market.

  • PhilippinesEarly access
    How it runsRun by PayMongo, on card payments
  • SingaporeScoping
    How it runsThrough a licensed partner, scoped per engagement
  • CambodiaScoping
    How it runsThrough a licensed partner, scoped per engagement
  • IndonesiaScoping
    How it runsPartner and model in scoping
FAQ

Frequently asked questions

What risk, fraud and engineering teams ask before they switch.

Ask us directly
Does TNKR help meet AFASA and BSP Circular 1213?

TNKR maps its controls to BSP Circular 1213, the BSP's rules under the Anti-Financial Account Scamming Act (AFASA), the MAS Shared Responsibility Framework and POJK 12/2024. A mapping shows which requirement each control serves and which it does not yet cover. Mapping is not compliance: your obligations under each rule stay with you.

Which payments does TNKR score?

TNKR scores card payments. Each one gets a risk score and a verdict, allow, review or block, before the payment completes. TNKR does not score QR Ph, QRIS or e-wallet payments. If most of your fraud runs through QR or wallets, raise it early, and our team will set out what TNKR covers for your payment mix.

How does TNKR decide on a payment?

TNKR scores each card payment, then runs your rules in the order you set. The first rule that matches decides the verdict: allow, review or block. When no rule matches, the score's risk level decides. Every verdict names the rule that fired, so an analyst or an auditor can trace why a payment was held. Rules run on Open Policy Agent and are written in Rego, a readable policy language.

Can my fraud team change rules without a release?

Rules are objects in the API. Your team writes, reorders and switches them off with a call, and the next payment uses the new list, with no deploy on either side. Each rule compares a payment's inputs against the values you set: a score threshold, a list of card countries, an amount.

What signals does TNKR use to spot bots?

TNKR reads device fingerprints, JA3 and JA4 TLS fingerprints, IP geolocation, and card and billing country, alongside the payment amount and billing email. Each is a rule input. A TLS fingerprint identifies the client software behind a connection, which helps flag automated traffic that keeps changing IP addresses. Your rules decide what each signal triggers.

How does TNKR fit into our payment flow?

TNKR takes one API call per card payment and returns the score, the verdict and the rule that fired, before you complete the payment. Your flow acts on the verdict: approve, hold for review or decline. There is no model for you to host.

Does TNKR cover AML monitoring and sanctions screening?

Not for clients yet. AML transaction monitoring, with alerts that become cases on the same desk as the fraud review queue, is Next. Screening against sanctions lists, politically exposed persons and adverse media is Next too. The review queue and the allow and block lists are in early access today.

Who runs TNKR, and is it regulated?

TNKR is a product of PayMongo. PayMongo Payments, Inc. is regulated by the Bangko Sentral ng Pilipinas as an Operator of Payment Systems and an Electronic Money Issuer. The fraud controls TNKR sells were built for and run on PayMongo's own card volume.

How a pilot starts

Start with one checkout.

Pick the flow you worry about most. We set your rules on it, your team works the queue, and you widen scope when the verdicts match the calls you would have made.

Talk to an expert

Early access: card payment scoring, rules, review queue, allow and block lists. Next: AML alerts and cases, sanctions screening. Card payments only. Sample data throughout.