SignalBrain-OS combines account, device, payment, graph, and policy signals into signed fraud decisions. It catches attacks, explains the evidence, and creates case packets that analysts can act on.
Titan v2 combines account-recovery timing, device age and trust, wallet-token provenance, gift-card concentration, cross-store velocity, and decline probing. The same fixed 27-attempt synthetic cohort was replayed end-to-end through the shared Sentinel cross-domain runtime.
Success: four additional fraud patterns were stopped. Failure: one mature stolen wallet token remained undetected, and one legitimate post-recovery purchase was challenged. These results prove deterministic test behavior—not production efficacy or issuer/processor validation.
Read the method, failures, and reproducible proof →SQL Server Ledger and similar database features provide meaningful cryptographic tamper evidence inside a centrally administered database, including verification against published digests. If one database operator controls the complete workflow, that may satisfy much of the integrity requirement.
Titan's distinction is portable, signed decision evidence that can be checked outside the originating database across agent, organization, and system boundaries. Titan currently implements signed, tamper-evident receipts with offline public-key verification. Independent multi-party key custody and external anchoring remain operational validation work, not completed claims.
Titan's fraud path is not presented as a conventional high-parameter model trained solely on millions of historical transactions. The implemented path applies constrained, reviewable policy to structured transaction, device, wallet, velocity, evidence-freshness, and runtime-health inputs.
Deterministic repeatability does not establish predictive efficacy. Production claims require representative labeled outcomes measuring fraud recall, precision, false-positive or legitimate-friction rate, review outcomes, latency, and receipt integrity.
Fraud is not AML. It is account compromise, payment abuse, identity manipulation, and loss prevention under conversion pressure.
Detect new device, impossible travel, credential reset, phone change, and first high-value transaction in one timeline.
Identify rapid low-value attempts, issuer decline patterns, merchant concentration, and linked IP/device reuse.
Score refund velocity, repeat merchant disputes, policy exploitation, multi-account couponing, and suspicious fulfillment loops.
Trace funds through new beneficiaries, rapid cash-out, shared devices, shared addresses, and clustered counterparty risk.
Combine identity proofing, account age, behavioral inconsistency, phone/email risk, and payment instrument reuse.
Flag urgent narratives, new payees, unusual amounts, remote-access indicators, and sudden behavior change before transfer.
SignalBrain links accounts, cards, devices, IPs, addresses, beneficiaries, merchants, wallets, phone numbers, and payment instruments. A single transaction can inherit risk from its neighborhood.
Every fraud decision returns a compact proof packet: risk score, reason codes, linked entities, model version, policy version, and Merkle proof. It is built for analyst review, dispute handling, and control testing.
{
"decision": "HOLD",
"risk_score": 0.86,
"reason_codes": [
"DEVICE_FANOUT",
"NEW_BENEFICIARY",
"ATO_TIMING"
],
"linked_entities": 7,
"case_packet": "case_31a...",
"certificate_id": "cert_b92...",
"merkle_proof": "proof_6db..."
}{
"domain": "fraud",
"event": {
"type": "payment_attempt",
"customer_id": "cus_8847",
"amount": 1250.00,
"currency": "USD",
"merchant_id": "m_48291",
"device_id": "dev_91a",
"beneficiary_id": "ben_42"
},
"signals": {
"password_reset_minutes_ago": 18,
"new_device": true,
"new_beneficiary": true,
"device_account_count_24h": 18,
"velocity_1h": 5
}
}{
"decision": "HOLD",
"recommended_action": "MANUAL_REVIEW",
"risk_score": 0.86,
"reason_codes": [
"RECENT_CREDENTIAL_RESET",
"NEW_DEVICE",
"DEVICE_FANOUT",
"NEW_BENEFICIARY"
],
"review_sla": "15m",
"case_packet": "case_31a..."
}Deploy beside your payment processor, wallet, identity provider, or case-management stack.