Onboard with confidence

During onboarding, our anti Fraud Engine runs thorough validation checks to verify key details such as:

• Identity verification
• Bank account ownership
• Blacklist screening
• Duplicate signature detection
• Credit checks
• Account utilization monitoring

This ensures you onboard only legitimate customers, giving you total peace of mind from the start.

Mandate checks for added security

Once a mandate is signed, additional checks can be performed to ensure everything is in order. Based on these checks, a mandate can be:

• Automatically refused
• Flagged for manual intervention
• Approved after verification

This keeps your business secure every step of the way.

Global protection across industries

From e-commerce and energy to mobility and beyond, our anti Fraud Engine can be configured to adapt to your industry and keeps you protected at every step.

Partnered with global security tools like:

• itsme (Belgium identity verification)
• iDIN (Netherlands bank verification)
• Mastercard and Visa (card verification)
• IBAN-Name Check providers
• VAT Check services
• Credit Check companies

We ensure seamless and secure validations worldwide.

How fraud rules work

Fraud rules use an if-then logic to automatically detect suspicious activity and take action.

Setting up fraud rules

Fraud rules are organized into two categories: Twikey-specific checks on your documents and customer data, and Open Banking Checks based on bank account information.

Condition combination

When you set up a rule, you choose how conditions are evaluated:

• Any — The rule triggers if at least one condition is true (OR logic)
• All — The rule triggers only if all conditions are true simultaneously (AND logic)

Condition operators

All conditions support the following operators:

• is equal to — Exact match
• is not equal to — Does not match
• is less than — Below a threshold value
• is more than — Above a threshold value
• is between — Within a range (requires lower and upper bounds)

Twikey-specific fraud rules

These rules analyze documents, signatures, and IBANs processed through Twikey:

• Number of documents with the same signature — Detects when multiple documents have been signed by the same person. Use this to flag suspicious patterns of reuse. Threshold operators apply.
• Number of documents with the same IBAN — Identifies when multiple documents reference the same bank account. Useful for detecting coordinated fraud. Threshold operators apply.
• Number of customers with the same signature — Flags when the same signature appears across multiple customer accounts. Threshold operators apply.
• Number of customers with the same IBAN — Detects when different customers share a bank account. Threshold operators apply.
• Signature is on the blacklist — Checks if the signature matches a known fraudulent signature in your blacklist.
• IBAN is registered on the blacklist — Checks if the IBAN matches a known fraudulent account in your blacklist.

Open Banking Checks

Open Banking Check provides real-time access to your customer's bank account data via PSD2-compliant providers. This includes transaction history, account balance, and account status. Twikey uses Open Banking Check to verify customer legitimacy and detect risky patterns automatically.

Your customer gives one-time consent in their own banking environment, which means no banking credentials are ever shared with you or with Twikey. The check runs at the moment of signing, so Open Banking Checks only apply when the agreement is signed with the Open Banking Check signing method on a CORE profile.

How the check works

Twikey performs the Open Banking Check through a licensed and regulated European account information service provider. This provider holds the permissions needed to read bank details securely, so neither you nor Twikey ever handles your customer's banking credentials.

1. You create an agreement invitation for your customer, either by sending a Twikey email or by redirecting your customer to the Twikey signing screen from your own application.
2. Your customer sees the consent text for the Open Banking Check together with a list of banks.
3. Your customer selects their bank and is sent to their own banking app or online banking environment.
4. Your customer logs in and gives one-time consent for the check.
5. Your customer returns to Twikey, where your fraud rules are applied to the data received from the bank.
6. Twikey shows a result screen and redirects your customer to your Thank-you page, including the outcome of the signature.

These rules monitor the customer's bank account behavior and financial activity:

• Number of transactions on the account — Monitors transaction volume. Use threshold operators to flag accounts with unusual activity patterns. Threshold operators apply.
• Number of Direct Debit transactions linked to the account — Counts successful Direct Debit transactions. Threshold operators apply.
• Number of failed Direct Debit transactions linked to the account — Monitors payment failures. High failure rates may indicate risk. Threshold operators apply.
• Account balance — Checks the account's available balance at the moment of signing, not an average over time.

What you can and cannot see

You never see the underlying bank data. The balance, the transactions and the transaction history are used to evaluate your rules and are not shown in your Twikey environment, exported or sent in a webhook. What you do see is whether the signature was accepted, and which rule was triggered when it was not.

Actions when fraud is detected

When a rule is triggered, you can automatically:

• Cancel agreement — Immediately reject the agreement
• Mark as awaiting approval — Flag for manual review
• Send email to the document agent — Notify the responsible team member
• Mark as fraud — Tag the agreement as fraudulent
• Send webhook — Trigger external system notification

What your customer sees

The screen your customer sees, and the status passed to your Thank-you page, depend on the outcome:

• Signed, no fraud rule triggered — Your customer sees the Twikey success screen. Your Thank-you page receives the status ok.
• Signed, but a fraud rule triggered — Your customer sees the Twikey pending screen. Your Thank-you page receives the status pending. The action you configured on the rule is then applied to the agreement.
• Signature not completed — Your customer cancelled in their banking environment or the authentication failed. Your Thank-you page receives the status cancel or fail.

This is deliberate: informing a possible fraudster that a check was hit makes it easier for them to work around your rules. If you want to show your own message instead of the neutral pending screen, combine the two:

1. Enable the Send webhook action on the rule.
2. Use the webhook in your own application to recognise the agreement that was flagged.
3. Handle the redirect from the pending status on your own screens, with the wording you prefer.

What to prepare before activation

Open Banking Checks are activated by us on your CORE profile. Have the following ready:

• Consent text — The text your customer reads before selecting their bank, maximum 1000 characters per language. We provide legally validated example texts you can reuse.
• Application name — Usually your company name. Your customer sees this name during the check.
• Data protection email address — A mailbox your customers can use for data protection questions.
• Privacy policy URL — A link to your own privacy policy.
• Terms of service URL — A link to your own terms. This must be a different page than your privacy policy.

Best practices

• Combine multiple conditions for more accurate fraud detection
• Start with "Mark as awaiting approval" to avoid false positives
• Use webhooks to integrate with your existing fraud management systems
• Regularly review flagged agreements to fine-tune your rules
• Set threshold operators carefully — too strict rules may block legitimate customers, too loose rules may miss fraud

Need help? Contact Twikey Support to configure fraud rules for your specific industry and risk profile.