Skip to main content
Networks automatically groups applicants, businesses, and transaction parties in your organization that share device, IP, biometric, document, or contact signals, so a ring of fraudulent accounts surfaces as one investigation instead of dozens of unrelated flags.

​
What a network is

A network is a cluster of subjects (vendor users, vendor businesses, or transaction parties) connected through one or more shared signals. Didit builds networks continuously as verification sessions, business sessions, and transactions complete, clustering organization-wide across every application in your organization so a fraud ring that touches two of your products still surfaces as one network. Each application only sees the networks that include at least one of its own subjects.
Clustering runs on production data only. Sandbox applications are excluded entirely, sandbox sessions never create or join a network.

​
Signal types

A network forms when two or more subjects match on any of these signals: A potential biometric match is evidence for review, not confirmation that two accounts belong to the same person. Signal references do not expose the underlying hashed value. Authorized reviewers can open their own linked source records to inspect the evidence they already hold. A signal that links an unusually large number of subjects (a shared office IP, a kiosk device, a data-center IP) is flagged as a hub rather than treated as automatic fraud evidence, hub signals are common in legitimate high-traffic settings and are surfaced for review, not auto-declined.

​
Viewing a network

The Networks list is a table of every network visible to your application: network id, name, status, risk, the patterns and signals detected, and first/last activity, with the same status, signal, pattern, and risk-band filters as the API, plus free-text search by network name, member name, or network id. Opening a network keeps the network queue beside the detail pane on desktop. The detail pane starts with Overview and provides six views:

Overview

Review why the network exists, its application scope, activity dates, and signal coverage. A shared signal is a reason to investigate, not proof of fraud.

Connections

Subject and signal nodes connected by edges. Focus on one applicant and bound the view to 1, 2, or 3 hops to isolate their immediate connections instead of the whole network.

Accounts

Every member as a row, with outcome status, risk, tags, and signal coverage, for scanning or exporting a large network.

Geography

Geographic points where members’ addresses and locations converge, useful for spotting a ring anchored on one address or city.

Activity timeline

Chronological history of the network: when it was first detected, when each signal was observed, and every status change with its reason.

Shared intelligence

Review the aggregate evidence available through your organization’s fraud-signal sharing participation. Manage participation in Organization settings, under Fraud signals.

​
Private notes and exports

Open Notes in the detail header to discuss the investigation with your team. Notes remain within your organization and never enter shared intelligence. Reading notes requires read:networks; adding notes requires write:networks. Only a note’s author can delete it, and deletion is irreversible. A failed send keeps the draft so you can retry it, and notes follow the surviving investigation when two networks merge. Use Download PDF to export the current network, its review status, connected accounts, source references, and shared signals. The PDF states its scope and generation time. It excludes global intelligence and private notes, and explicitly identifies any account or signal list capped at 500 entries. Each account includes up to six source references, with an explicit count when more are available in the console. Choose Export CSV from the overflow menu for the account list. Neither export changes the network’s review status.

​
Lifecycle

A network moves through exactly four statuses: Every status change is recorded with a reason and the acting analyst, forming the network’s audit trail alongside its signal and detection history.
Network status describes the investigation, not any one member. Each member also carries its own outcome status inside the network (Approved, In review, Declined, Not completed), which is that applicant’s own verification decision. A network can be Active while individual members are already Approved or Declined.

​
Acting on a network

From a network’s detail page you can:
  • Create a case to hand the network to your compliance team for a formal investigation, anchored to the network rather than a single subject.
  • Add to blocklist a member’s identity, or the signal itself, so future sessions matching it are automatically declined.
  • Change status to move the network to In review, Resolved, or Dismissed, with a required reason.
  • Dismiss a network in one step when it is clearly not fraud, this also closes out an active review if one is open.

List networks

Retrieve networks for your organization through the API.

Network membership lookup

Look up which networks a session, user, business, or transaction belongs to.

Blocklist users

How blocklisting a document, face, phone, or email affects future sessions.

Cases

Investigate a network case through to resolution.