Stop the fraud. Keep the customer. Explain both.
Use Nyx to approve, review or decline any payment, login or account change before the money moves, with the reason attached. Built and ready to pilot on your data.
- Rail
- UPI, push
- Payee
- First seen
- Account
- Many new senders
- Channel
- Card not present
- Route
- Mumbai → Singapore
- Device
- First seen today
- Device
- First seen
- Location
- Pune, new
- Channel
- Mobile app
New payee and mule-pattern inflow
- Payee rule
upi_new_payee_velocityTriggered - Model
muleCBM@v30.88
Velocity and geographic mismatch
- Velocity rule
cnp_velocityTriggered - Model
txnCBM@v140.91
New device and new location together
- Takeover rule
ato_new_device_geoTriggered - Model
atoCBM@v50.84
- Actor
- Person · the account holder
- Principal
- Self · no delegation
- Shown
- Scam warning before paying
- Decision
- Review, then warn
- Actor
- Person · the cardholder
- Principal
- Self · no delegation
- Shown
- Step-up challenge
- Decision
- Review, then step up
- Actor
- Person · claims to be the holder
- Principal
- Self · no delegation
- Shown
- OTP step-up
- Decision
- Review, then step up
{
"action": "review",
"reason": "new payee + mule-pattern inflow",
"rule": "upi_new_payee_velocity",
"model": "muleCBM@v3",
"score": 0.88,
"severity_band": "high",
"audit_ref": "dec_EXAMPLE…",
"latency_ms": 84
}
{
"action": "review",
"reason": "velocity + geo mismatch",
"rule": "cnp_velocity",
"model": "txnCBM@v14",
"score": 0.91,
"severity_band": "high",
"audit_ref": "dec_EXAMPLE…",
"latency_ms": 87
}
{
"action": "review",
"reason": "new device + new location",
"rule": "ato_new_device_geo",
"model": "atoCBM@v5",
"score": 0.84,
"severity_band": "high",
"audit_ref": "dec_EXAMPLE…",
"latency_ms": 62
}
dec_EXAMPLE…REPRESENTATIVE · SAMPLE DATA · LATENCY TARGET <100MS†Six kinds of fraud, one engine.
Mandate-scope checks on UPI Reserve Pay, e-mandates and agentic tokens are the agent-trust pack, built with the first design partner. The agent-trust pack →
The verdict stays lean. The investigation runs beside it.
A verdict inside the authorization path.
A hard timeout budget and a fallback verdict when it is breached. Fail-open or fail-closed is your policy, set in configuration.
The case is assembled before an analyst opens it.
Related cases, device history, dispute context and policy evidence, gathered by a triage agent that recommends and never decides.
† Design targets to validate in the first pilot, not yet independently benchmarked. When we have pilot numbers, they replace these.
Shadow first, enforce second, on your own history.
- ReplayYour own decision history, replayed where it lives, with nothing leaving your perimeter.false declines you could recovermule accounts you missedagent-originated traffic sharedisputes you could have defended
- ShadowNyx scores beside your existing checks, acting on nothing, so you can compare its calls with your team’s.
- EnforceNarrowly, on a scoped segment, with your fallback verdict and your rollback.
Deployment is your choice in every case: managed by us, in your cloud, or in your data center.
Before a first pilot.
What the pack decides, and what is still a target.
Is Nyx a fraud detection system?
Fraud detection and prevention is one of the decisions Nyx makes, and the one ready today. The fraud management pack scores each payment or account event in real time, before the money moves, and returns approve, review or decline with the reason attached. The same engine also decides agent payments through the agent trust pack, which is in build, and credit, disputes and AML, which are partner-led: engine primitives in place, each pack scoped with the first partner who needs it. Nyx is pre-launch: the fraud pack is built and ready to pilot, and its performance figures are design targets until a pilot measures them.
What does the pack decide today?
Card-not-present risk-based authentication, account takeover, mule detection, onboarding fraud, transaction scoring before completion, and scam and social-engineering patterns, across card, UPI and account rails.
What about the RBI deadline?
RBI's Authentication Directions 2025 require risk-based authentication on cross-border card-not-present transactions from 1 October 2026. That is a decision in the authorization path with a reason attached to it, which is what this pack does.
How do we try it without touching production?
With a shadow replay of your own decision history, run in the deployment model you choose with nothing leaving your perimeter. It produces four numbers: false declines recoverable, mule accounts missed, agent-originated traffic share, and dispute cases defensible with evidence.
Are the numbers benchmarked?
No. Scoring under 100ms, 30 to 50 percent fewer false positives, 45-second investigations and 3 to 5 times analyst throughput are design targets to validate in a first pilot. When pilot numbers exist, they replace the targets.
What comes back on every call?
The action, the score, the severity band, the policies and rules that fired, the model version and an audit reference. The canonical evidence record the reference points to is in build.