> ## Documentation Index > Fetch the complete documentation index at: https://docs.orbit.devotel.io/llms.txt > Use this file to discover all available pages before exploring further. # Fraud Shield — Tenant Triage & Chargeback Evidence > See the fraud alerts Orbit raises on your own account, acknowledge or dismiss them, tune which signals count as actionable, and export a CSV evidence pack for a carrier chargeback dispute. # Fraud Shield — Tenant Triage & Chargeback Evidence Orbit's detectors continuously screen your account for fraud and abuse signals — SIM-swap, IRSF / toll-fraud, SMS pumping / artificial traffic inflation (AIT), Wangiri one-ring callbacks, spend-velocity anomalies, API-key geo-anomalies, voice-deepfake scores, and suspicious campaign send velocity. Until recently only Orbit's operators could see those alerts. Fraud Shield puts the same ledger in your hands: you can list the alerts raised against your own account, triage each one (acknowledge or dismiss), set which severities and categories count as actionable in your view, and export a CSV evidence pack suitable for a carrier chargeback dispute. All endpoints below are rooted at `https://api.orbit.devotel.io/api/v1/compliance/fraud-reviews`. Reads are open to any authenticated member of your organization; writes (acknowledge, dismiss, and settings changes) are restricted to owners and admins. *** ## Categories and severities Categories detected by the platform: | Category | What it signals | | --------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- | | `irsf_blocked` | International-revenue-share / toll-fraud destination blocked (includes SMS pumping / AIT messaging blocks and Wangiri voice blocks) | | `suspicious_campaign_send` | Campaign send velocity outside your historical envelope | | `sim_swap_detected` | Subscriber identity changed between request and delivery | | `voice_deepfake_high_score` | Voice biometric deepfake score above the threshold bound | | `api_key_geo_anomaly` | API key used from an unexpected location | | `spend_velocity_anomaly` | Wallet spend rate outside your historical envelope | Severities are `low`, `medium`, `high`, and `critical`, ranked in that order. Review statuses are `open` (unattended), `triaged` (acknowledged), `dismissed` (closed by you as a false positive or accepted risk), and `escalated` (closed by Orbit's operators). *** ## List and inspect alerts `GET /compliance/fraud-reviews` returns your organization's alerts, sorted critical-first and newest-first. Each row carries an `actionable` flag derived from your configured thresholds (see below). Any PII in the alert details is scrubbed on the way out. Query parameters: | Parameter | Type | Notes | | ------------- | -------- | ----------------------------------------------- | | `status` | enum | `open`, `triaged`, `dismissed`, or `escalated`. | | `severity` | enum | `low`, `medium`, `high`, or `critical`. | | `category` | string | One of the category keys above. | | `from` / `to` | datetime | Bound `detected_at` (ISO-8601). | | `limit` | integer | Rows to return (1–500, default 100). | ```bash theme={null} curl "https://api.orbit.devotel.io/api/v1/compliance/fraud-reviews?status=open&severity=high" \ -H "Authorization: Bearer $ORBIT_API_KEY" ``` `GET /compliance/fraud-reviews/:id` returns one alert. Because every read is scoped to your organization, an id that belongs to another organization returns 404 — you never see cross-tenant data, and a guessable id leaks nothing. ```bash theme={null} curl "https://api.orbit.devotel.io/api/v1/compliance/fraud-reviews/frv_01H..." \ -H "Authorization: Bearer $ORBIT_API_KEY" ``` *** ## Triage: acknowledge and dismiss Acknowledging an alert means "we have seen this and are investigating." Dismissing it means "reviewed and closed as a false positive or an accepted risk." Both are owner/admin-only and recorded in your audit log. ```bash theme={null} curl -X POST "https://api.orbit.devotel.io/api/v1/compliance/fraud-reviews/frv_01H.../acknowledge" \ -H "Authorization: Bearer $ORBIT_API_KEY" ``` Rules to know: * Acknowledging an already-triaged alert is a no-op (idempotent). * Dismissing an already-dismissed alert is a no-op. * A `dismissed` or `escalated` alert cannot be acknowledged; an `escalated` alert cannot be dismissed either way — you get a 409 explaining why. The internal operator id of whoever triaged the alert is not exposed through these endpoints. *** ## Triage thresholds shape your view — never the alert webhook `GET` and `PUT /compliance/fraud-reviews/settings` read and update two fields: | Field | Type | Notes | | --------------------- | ---------------- | ------------------------------------------------------------------------------------------ | | `notify_min_severity` | enum | Minimum severity flagged `actionable` in your list. Default `low` (everything actionable). | | `muted_categories` | array of strings | Categories you want flagged `actionable: false`. Maximum 12 entries. | ```bash theme={null} curl -X PUT "https://api.orbit.devotel.io/api/v1/compliance/fraud-reviews/settings" \ -H "Authorization: Bearer $ORBIT_API_KEY" \ -H "Content-Type: application/json" \ -d '{"notify_min_severity": "high", "muted_categories": ["api_key_geo_anomaly"]}' ``` The important contract: these thresholds are a **read/triage control only**. They change which alerts are flagged `actionable` in your list and on the dashboard — they do **not** silence the `account.fraud.alert` webhook or the in-app notification. That fan-out stays always-on so an attacker draining your wallet can never mute the warning. `critical` alerts are always actionable regardless of your `notify_min_severity` floor. The webhook catalog entry is documented in the [webhooks events reference](/webhooks/events). *** ## Chargeback evidence pack (CSV) When a vendor bills you for SMS pumping / AIT or Wangiri / toll-fraud traffic, disputing the charge takes evidence. Export the blocks Orbit raised on your account as an RFC-4180 CSV that a carrier can consume: ```bash theme={null} curl "https://api.orbit.devotel.io/api/v1/compliance/fraud-reviews/chargeback-evidence.csv?window_days=30" \ -H "Authorization: Bearer $ORBIT_API_KEY" \ -OJ ``` `window_days` is the look-back window (1–90, default 30). The file includes one row per eligible block — SMS pumping / AIT over messaging and Wangiri / toll-fraud over voice — with a stable set of columns (`review_id`, `detected_at`, `source`, `category`, `severity`, `status`, `phone_prefix`, `channel`, `rule`, `block_category`, `risk_score`, `summary`, `report_generated_at`). If no eligible blocks exist over the window, you get a header-only file. Every export is written to your audit log with the window and eligible row count, so the export itself is part of the evidence trail. Verify (OTP) traffic has its own dedicated export — `GET /verify/conversion-anomaly/evidence-export.csv`. *** ## Dashboard The same triage surface is available in the dashboard under **Settings → Compliance → Fraud Shield**: the alert list with acknowledge / dismiss actions, the threshold controls above, and the chargeback evidence download. Owners and admins see the write actions; read-only members see the list and settings. *** ## A tenant-owned posture note These controls are **yours**. Orbit raises the alerts and keeps the webhook fan-out always-on, but acknowledging, dismissing, and deciding which signals need a human can be tuned to your own incident-response workflow. The ledger is scoped so no tenant can ever see another tenant's alerts, and the internal operator ids behind triage decisions are never exposed to your side.