PPay Sentinel

Fraud detection
built for Pakistan

A three-layer hybrid system, deterministic rules, unsupervised anomaly detection, and LLM reasoning, with signals calibrated for Pakistan's unique payment landscape.

View Architecture ↓
● <0.5ms rule latency 🛡️ Transparent decisions
🛡️
Architecture

Three layers. One decision.
Fully explained.

Each layer is independently inspectable. No black box. We explicitly document what is currently live in our engine versus what is on the engineering roadmap.

📐
Phase 1, Live
Rules Engine (Layer 1)
Deterministic, config-driven rules that run synchronously on the checkout critical path in under 0.5ms. No ML required, just pure signal.
  • → Velocity checks (email/IP/card)
  • → Denylist lookups (hashed)
  • → Card-testing sequence detection
  • → Geo / currency mismatch
  • → PKR round-number structuring
🧠
Phase 2, Architected
Anomaly Model (Layer 2)
Isolation Forest, learns what's normal for each merchant. Explicitly inert until a data threshold is met to prevent cold-start misfires. Honest by design.
  • → Per-merchant normality baseline
  • → Ramadan Sehri/Iftar aware
  • → Salary-cycle spike detection
  • → Cold-start threshold protection
  • → Auto-retraining pipeline
💬
Phase 3, Designed
LLM Reasoner (Layer 3)
Never a scorer. Never on the critical path. Runs async only on REVIEW transactions to produce a human-readable narrative for the human reviewer.
  • → Async background task
  • → Explains signals in plain Urdu/English
  • → Related-transaction cross-reference
  • → Risk narrative for human reviewer
  • → Cost-efficient (flagged only)
Context-Aware

Signals that understand how Pakistan actually pays

Generic fraud tools are calibrated for Western payment behaviour. We designed Sentinel around Pakistani realities, from JazzCash SIM prefixes to Raast velocity patterns.

📱
JazzCash / Telenor Prefix Velocity
Detects wallet-onboarding fraud rings by monitoring burst registrations from known carrier SIM prefixes.
🕌
Ramadan Sehri/Iftar Clustering
Normal in Pakistan: transaction spikes at 3am (Sehri) and 7pm (Iftar) during Ramadan. Sentinel learns not to penalise this.
💰
PKR Round-Number Structuring
Detects repeated exactly-round PKR amounts (e.g. ₨50,000) below reporting thresholds.
API Response

Full transparency in every response

Every risk decision includes the raw signal inputs, triggered rules, and anomaly score. No hidden black box.

sentinel_response.json
{
  "transaction_id": "txn_01J3...",
  "risk_score": 82,
  "decision": "REVIEW",
  "signals": {
    "rules_triggered": [
      "card_velocity_exceeded",
      "disposable_email",
      "geo_currency_mismatch"
    ],
    "anomaly_score": null,
    "anomaly_status": "cold_start_pending"
  },
  "latency_ms": 0.34,
  "created_at": "2024-01-15T14:32:00Z"
}

Test Sentinel in Sandbox

Use our test cards and wallets to intentionally trigger velocity and geo rules to see Sentinel in action.

View Test Cards →