# Fraud rules

Fraud rules evaluate one activity and return **Allow**, **Review** or **Block**. They can apply to transactions, logins, sign-ups, password resets, beneficiary changes, payouts and withdrawals.

[Ongoing monitoring](/developers/documentation/monitoring-policies) is separate. It decides who is checked again over time and when a material change should reach your team.

## Start with the rule library

Open **Rules & Policies → Fraud rules → Rule library**. Search or filter, then select **Install**.

Installation publishes version 1 for the current organisation and environment. Repeating the same installation does not create a duplicate. Disabling a rule keeps its decision history.

## Test before you publish

Use **Test against last 30 days** before publishing a custom rule. The test does not change activities, create alerts or create charges.

## Publish with control

Publishing creates an immutable version. Later edits create another version so an earlier decision always points to the exact rule that produced it.

## Decision settings

Open **Settings** to configure review and block thresholds, money limits and advanced scoring. These settings combine matched rules into the final decision. They are not a second rule library.

## API response

Read `assessment.summary` first:

```json
{
  "assessment": {
    "summary": {
      "outcome": "review",
      "title": "Review required",
      "reason": "A high-risk transaction rule matched.",
      "score": 82,
      "riskLevel": "high",
      "matchedRules": 1,
      "nextAction": { "type": "review_activity", "label": "Review transaction" }
    }
  }
}
```

Use `summary.outcome` to branch and `summary.nextAction` for the next workflow step. Detailed rules, screening, billing and Travel Rule evidence remain available when you need them.

## Webhook

Subscribe to `fraud.transaction.assessed` or `fraud.activity.assessed`. Both return the same `data.summary` shape. Deduplicate by the webhook envelope `id`. Use your `externalActivityId` and `externalTransactionId` to correlate the result.

Do not recalculate the decision from score or detailed evidence. A later `fraud.decision.changed` event carries a new summary when the effective decision changes.