This rule is designed to detect users whose transaction volume in a recent time period is significantly higher than in a prior comparison period. Specifically, the rule triggers when the total number of transactions in time period 1 is greater than or equal to a configured multiplier times the total number of transactions in time period 2. This rule helps identify unusual spikes in activity that may indicate fraud or other anomalous behaviour — for example, a user who processes 200 transactions in one month but only 20 in the following month.
Parameters
Time period 1 The more recent time window used to measure current transaction activity. You configure this using a number of time units and a time granularity (e.g., "7" and "Day" for a 7-day window).
Rolling basis (optional): If rolling basis is disabled, the time window starts at exactly 00:00 of the selected unit. If enabled, the window looks back from the exact time the rule is triggered.
Time period 2 The earlier comparison time window. This must be larger than time period 1, and time period 1 is excluded from it. Configure it in the same way using a number of time units and a time granularity.
Rolling basis (optional): Same behaviour as described for time period 1 above.
Multiplier threshold The rule triggers when the number of transactions in time period 1 exceeds the number of transactions in time period 2 multiplied by this value. For example, a multiplier of 3 means the rule fires if recent activity is more than three times the comparison period's activity.
Minimum number of transactions in time period 1 — Optional Sets a floor on the number of transactions that must occur in time period 1 before the rule can trigger. This helps avoid false positives from users with very low absolute volumes.
Minimum number of transactions in time period 2 — Optional Sets a floor on the number of transactions that must occur in time period 2 (with time period 1 excluded) before the rule can trigger.
Initial transactions count threshold — Optional The rule will only execute once a user's cumulative past transaction count is greater than or equal to this threshold. This ensures the rule applies only to users with sufficient transaction history.
Sender transaction direction to check — Optional This option determines which transactions are considered when the user is the sender (origin user). It offers the following options:
Sending: Only includes transactions where the user acted as the sender. It filters and analyses the user's past transactions specifically when they initiated the transfer of funds.
All: Considers all transactions associated with the user, regardless of their role. It includes both transactions where the user initiated the transfer and those where they received funds.
None: Excludes all transactions associated with the user in the sender role, allowing you to monitor only the destination parties in the transactions.
Receiver transaction direction to check — Optional This option determines which transactions are considered when the user is the receiver (destination user). It provides the following options:
Receiving: Only includes transactions where the user acted as the receiver. It filters and analyses the user's past transactions specifically when they received funds from other parties.
All: Considers all transactions associated with the user, regardless of their role. It includes both transactions where the user initiated the transfer and those where they received funds.
None: Excludes all transactions associated with the user in the receiver role, allowing you to monitor only the origin parties in the transactions.
Rule actions
Here you can select what action you want to take based on the risk level of the user. For example, you may choose to Flag a low-risk customer to provide them flexibility, or Block the transaction for a very high-risk customer.
Apply to other risk levels
If you want the thresholds as well as the rule actions to be the same for multiple risk levels, you can select the risk levels in the input box and click Apply. This will apply all your parameter settings to the selected risk levels, reducing manual effort.
