Trust Graph Reason Codes

When a TrustGraph reason category returns AT_RISK on a session, the response includes a list of matches, each carrying a reason field that explains why the category fired. This page lists every reason code emitted by each of the five categories, with its meaning.

Reason codes are an open set. New codes may be added over time as categories evolve. Branch on the codes you know and default anything unrecognized to review rather than assuming a fixed enum.

Suspected Repeat Fraudster

Category identifier: SUSPECTED_REPEAT_FRAUDSTER

Reason code	Meaning
`PHYSICAL_LIVENESS_ATTACK`	Physical liveness attack (printed photo, mask, screen replay).
`DIGITAL_LIVENESS_ATTACK`	Digital liveness attack (injected or synthetic video).
`EVASION_LIVENESS_ATTACK`	Attempt to evade the liveness check.
`FACE_RECOGNITION_ATTACK`	Attack targeting face recognition.
`DOCUMENT_TAMPERING`	Document was tampered with or forged.
`GOVERNMENT_VALIDATION_FAILED`	Identity failed validation against a government source.
`LIVENESS`	General liveness-related fraud signal.

First-Party Fraud

Category identifier: FIRST_PARTY_FRAUD

The First-Party Fraud reason codes are also the list a reporter chooses from when contributing a fraud report back to the network.

Reason code	Meaning
`DECEPTIVE_PERSONAL_INFO`	User submitted deceptive personal information.
`DOCUMENT_TAMPERING_1ST_PARTY`	Document tampering performed by the user themselves.
`REWARDS_BASED_ABUSE`	Abuse of rewards, promotions, or incentives.
`SERVICE_ACCESS_ABUSE`	Abuse of service access.
`ACCOUNT_SELLING`	Selling or transferring an account.
`CIRCULAR_TRADING`	Circular-trading pattern.
`FALSE_INVOICING`	False invoicing.
`OTHER`	Other first-party fraud reason.

Unusual Activity

Category identifier: UNUSUAL_ACTIVITY

Reason code	Meaning
`SELFIES_MATCHED_DOCUMENTS_DIFFERENT`	Selfies matched, but the associated documents differ.
`FACES_ON_IDS_MATCHED_DOCUMENTS_DIFFERENT`	Faces on IDs matched, but the documents differ.
`DOCUMENTS_MATCHED_FACES_DIFFERENT`	Documents matched, but the faces differ.
`DOCUMENTS_MATCHED_NAMES_DIFFERENT`	Documents matched, but the names differ.
`DEVICES_MATCHED_NAMES_DIFFERENT`	Same device, different names.
`DEVICES_MATCHED_DOCUMENTS_DIFFERENT`	Same device, different documents.

Velocity

Category identifier: VELOCITY_CHECKS

Each Velocity reason code corresponds to one tracked attribute reaching the count threshold configured for it within the configured time window.

Reason code	Meaning
`FACE_THRESHOLD_REACHED`	The same face exceeded its velocity threshold in the window.
`FACE_ON_ID_THRESHOLD_REACHED`	The same face-on-ID exceeded its threshold.
`DOCUMENT_NUMBER_THRESHOLD_REACHED`	The same document number exceeded its threshold.
`PERSONAL_NUMBER_THRESHOLD_REACHED`	The same personal number exceeded its threshold.
`VOTER_NUMBER_THRESHOLD_REACHED`	The same voter number exceeded its threshold.
`DEVICE_HASH_THRESHOLD_REACHED`	The same device hash exceeded its threshold.

Fraud Rings

Category identifier:

Reason code	Meaning
`SAME_FACE_MANY_CLAIMED_IDENTITIES`	Same face across many identities.
`SAME_CLAIMED_IDENTITY_MANY_FACES`	Same identity used with many faces.
`SAME_FACE_MANY_DOCUMENTS`	Same face across many documents.
`SHARED_DEVICE_MANY_APPLICANTS`	One device shared by many applicants.
`SAME_ADDRESS_MANY_APPLICANTS`	One address shared by many applicants.
`RETRY_ADAPTATION`	Repeated retries adapting to the checks.
`SAME_DOCUMENT_MANY_APPLICATIONS`	Same document in many applications.

TrustGraph (Feature Deep Dive): What TrustGraph is, its categories, deployment scopes, and privacy architecture.
TrustGraph module configuration: How to configure TrustGraph in the Flow or Workflow Builder.