The institution's rules
Amounts, merchant categories, countries and time windows your team defines from the console, each amount in its own currency.
Cortex Shield · card fraud prevention
Catch card fraud at the moment of authorization.
Shield scores every card purchase and answers approve, review or decline, with its reasons. It is installed in the institution's own data center, and the institution stays in charge: Cortex decides, explains and alerts; it does not block cards or touch the core.
- On-premise
- Every decision explained
- The card number is never stored
Incoming purchase
- Card
- tok_7f3a…c91e
- Amount
- S/ 1,850.00
- Merchant
- Electronics · Lima
- Entry
- Magnetic stripe
Cortex's answer
Review
- The card has a chip, but the purchase came in by magnetic stripe
- Amount far above this card's habit
- First purchase by this card at this merchant
Cortex Shield
Card fraud prevention, at the moment of authorization
The institution's switch sends each purchase to Cortex as JSON, with the ISO 8583 fields it already handles. Cortex scores it and answers with a decision and its reasons. The institution stays in control: Cortex decides, explains and alerts; it does not block cards or touch the core.
-
1
The purchase arrives
The switch sends the authorization. The card number is replaced by a token as soon as it comes in, and the original is discarded.
-
2
It is scored in layers
The institution's rules, usage velocity, that card's habits and a model trained on the bank's own history.
-
3
The answer goes back
Approve Review Decline with the reasons in plain language. Whatever goes to review reaches the analyst's queue with its case file.
What it looks at in every purchase
Velocity and bursts
Recognizes card testing: many small attempts in a short time, at one merchant or spread across several.
Each card's habits
A per-card memory learns with every approved purchase where, how much and how its cardholder buys, without waiting for a retraining.
Your own supervised model
Trained on the institution's labeled history. It can start in shadow mode: it reports its opinion alongside each decision without changing it.
Card present and cloning
Signals such as a chip card that comes in by magnetic stripe, or ATM and POS uses that don't fit the cardholder.
Impossible travel
Purchases in different countries separated by less time than it takes to travel between them.
Common point of purchase
When several cards with fraud went through the same merchant, it flags it as a possible origin and lists the exposed cards.
Cases and chargebacks
Analyst queue with the case file for each alert. A confirmed chargeback corrects what the card had learned.
Alerts
Email with validated TLS and webhooks signed under the open Standard Webhooks specification, configurable from the console.
Performance
Built to answer while the purchase is being authorized
Shield runs on commodity servers and returns each decision with its reasons. How it performs under your institution's load is not promised from a web page: it is measured on your own hardware.
It answers while the purchase is being authorized. In the lab it does so in a few milliseconds; the time under each institution's load is measured on its server.
Runs on standard x86 processors, in containers on enterprise Linux. Capacity is measured with each institution's hardware and traffic.
Approve, review or decline: every answer carries its written reasons and is recorded, for the analyst and for audit.
It remembers how each cardholder buys and updates with every approved purchase, to tell the usual from the unusual.
How we measure: Today's measurements come from the lab, with simulated purchases, which is why this page publishes no detection or capacity figures. The ones that count are those obtained with each institution's data and hardware, through a procedure that can be repeated.
Three approaches that complement each other
Shield does not replace rules or trained models: it combines them with a per-card memory. Each approach covers what the others find hard.
| Criterion | The institution's rules | Model trained on history | Per-card memory |
|---|---|---|---|
| What it needs to start | Someone who knows the fraud and writes the rules | History with the fraud already identified | Each card's first purchases |
| How it keeps up to date | By hand, rule by rule | By retraining every so often | On its own, with every approved purchase |
| What it explains about a decision | Which rule fired | A risk score | Where the purchase departed from that card's habits |
| Where it struggles | Fraud nobody anticipated | Cards with no history and fraud unlike the training data | The cardholder who changes habits, as on a trip |
| In Cortex Shield | Your team defines them from the console | Trained on the institution's history of confirmed fraud | Updated with every approved purchase, with no retraining |
Security
What Shield also takes care of
On top of Cortex's shared controls: your own perimeter, keys under custody, roles, audit, retention and TLS. See the shared controls →
The card number is not stored
On arrival it is replaced by an HMAC-SHA256 token with the institution's own key. Expiry date, CVV2, PIN and track data are not stored either: only the result of their verification.
Protection doesn't stop on a date
If the license expires, Shield keeps scoring purchases and alerting. Nobody is left without detection because of paperwork.
Start in parallel
Because Cortex recommends and the institution decides, it can run alongside the current authorization and be measured with your own data before it influences anything.
Frequently asked questions
What people usually ask about Shield
Does Cortex block cards?
No. It returns a recommendation with its reasons and the institution's authorizer decides what to do with it. Cortex does not touch the core or change the status of any card.
What does it take to connect it?
The switch sends each authorization as JSON with the ISO 8583 fields it already handles.
How does it learn?
In two ways. Each card has a memory that is updated with every approved purchase. Separately, the supervised model is trained on the institution's own history of confirmed fraud, and can first run in shadow mode.
Can it be tried without risk?
Yes. Since the final decision belongs to the institution, Cortex can run in parallel with the current authorization and be measured with your own data before its answer is used.
Want to see Shield with your own data?
We arrange a demo and a trial in parallel with your current authorization.