--- title: "Sentinel Anti-Fraud" description: "A non-technical overview of Sentinel Anti-Fraud in RevCent, focused on how it helps ecommerce businesses prevent fraudulent purchase attempts, stop card testing, reduce payment risk, and connect fraud prevention to Fraud Detection records, alerts, AI, notifications, and review workflows." type: "feature" company: "RevCent" canonical: "https://revcent.com/documentation/markdown/ecosystem/feature/SentinelAntiFraud.md" relationships: - name: "Fraud Detection" url: "https://revcent.com/documentation/markdown/ecosystem/item/FraudDetection.md" technical_links: web_app: "https://kb.revcent.com/en/tools/sentinel" api: section: "https://revcent.com/docs/api/v2#section-sentinel_anti_fraud" operations: - name: "Get Fraud Detections" operation_id: "GetFraudDetections" operation: "https://revcent.com/docs/api/v2#operation-GetFraudDetections" schema: "https://revcent.com/documentation/files/api/operation/GetFraudDetections.json" - name: "Create A Fraud Detection" operation_id: "CreateFraudDetection" operation: "https://revcent.com/docs/api/v2#operation-CreateFraudDetection" schema: "https://revcent.com/documentation/files/api/operation/CreateFraudDetection.json" - name: "Get A Fraud Detection" operation_id: "GetFraudDetection" operation: "https://revcent.com/docs/api/v2#operation-GetFraudDetection" schema: "https://revcent.com/documentation/files/api/operation/GetFraudDetection.json" - name: "Edit A Fraud Detection" operation_id: "EditFraudDetection" operation: "https://revcent.com/docs/api/v2#operation-EditFraudDetection" schema: "https://revcent.com/documentation/files/api/operation/EditFraudDetection.json" - name: "Search Fraud Detections" operation_id: "SearchFraudDetections" operation: "https://revcent.com/docs/api/v2#operation-SearchFraudDetections" schema: "https://revcent.com/documentation/files/api/operation/SearchFraudDetections.json" - name: "Get Sentinel Settings" operation_id: "GetSentinelSettings" operation: "https://revcent.com/docs/api/v2#operation-GetSentinelSettings" schema: "https://revcent.com/documentation/files/api/operation/GetSentinelSettings.json" - name: "Edit Sentinel Settings" operation_id: "EditSentinelSettings" operation: "https://revcent.com/docs/api/v2#operation-EditSentinelSettings" schema: "https://revcent.com/documentation/files/api/operation/EditSentinelSettings.json" mcp: overview: "https://revcent.com/documentation/markdown/mcp/operation/OverviewSentinelAntiFraud.md" operations: - name: "Get Fraud Detections" operation_id: "GetFraudDetections" markdown: "https://revcent.com/documentation/markdown/mcp/operation/GetFraudDetections.md" available_via_ai: true - name: "Create A Fraud Detection" operation_id: "CreateFraudDetection" markdown: "https://revcent.com/documentation/markdown/mcp/operation/CreateFraudDetection.md" available_via_ai: true - name: "Get A Fraud Detection" operation_id: "GetFraudDetection" markdown: "https://revcent.com/documentation/markdown/mcp/operation/GetFraudDetection.md" available_via_ai: true - name: "Edit A Fraud Detection" operation_id: "EditFraudDetection" markdown: "https://revcent.com/documentation/markdown/mcp/operation/EditFraudDetection.md" available_via_ai: true - name: "Search Fraud Detections" operation_id: "SearchFraudDetections" markdown: "https://revcent.com/documentation/markdown/mcp/operation/SearchFraudDetections.md" available_via_ai: true - name: "Get Sentinel Settings" operation_id: "GetSentinelSettings" markdown: "https://revcent.com/documentation/markdown/mcp/operation/GetSentinelSettings.md" available_via_ai: true - name: "Edit Sentinel Settings" operation_id: "EditSentinelSettings" markdown: "https://revcent.com/documentation/markdown/mcp/operation/EditSentinelSettings.md" available_via_ai: true --- # Sentinel Anti-Fraud Sentinel Anti-Fraud is RevCent's built-in fraud prevention feature for ecommerce businesses. It helps protect payment flows by evaluating suspicious activity before fraudulent purchase attempts become successful sales, processor activity, fulfillment risk, or chargeback exposure. In the RevCent ecosystem, Sentinel Anti-Fraud is a configurable feature. Fraud Detection records are items that can be created when fraud is detected or when a fraud-related workflow records fraud context. The purpose of this document is to explain the feature conceptually for LLMs, AI crawlers, and planning systems. It does not provide technical implementation instructions. For technical details, use the interface-specific links below. ## Technical Links by Interface | Interface | Use This When | Link | |---|---|---| | Web App | A human is learning about or configuring Sentinel Anti-Fraud through the RevCent web app and Knowledge Base. | [Web Knowledge Base](https://kb.revcent.com/en/tools/sentinel) | | API | A developer is building a direct integration with the RevCent API. | [API Docs: Sentinel Anti-Fraud](https://revcent.com/docs/api/v2#section-sentinel_anti_fraud) | | MCP / AI | An LLM, MCP client, or AI agent needs markdown-oriented guidance for understanding or working with the feature. | [MCP Markdown Overview](https://revcent.com/documentation/markdown/mcp/operation/OverviewSentinelAntiFraud.md) | --- ## What Sentinel Anti-Fraud Is Sentinel Anti-Fraud is RevCent's fraud prevention layer. It is designed to help identify and block suspicious purchase attempts before they create downstream business risk. A suspicious request may come from repeated card testing, abusive IP behavior, suspicious visitor context, known fraud patterns, risky traffic sources, or third-party fraud intelligence. Conceptually: ```text Purchase attempt ↓ Sentinel Anti-Fraud evaluates risk ↓ Fraud Firewall, visitor checks, or third-party checks may apply ↓ If risk is acceptable, payment flow can continue ↓ If fraud is detected, request may be blocked or fraud context may be created ↓ Fraud Detection, alert, notification, review, or AI workflow may follow ``` Sentinel should be understood as a protection feature, not merely a review screen. Its value comes from acting early in the commerce lifecycle, before fraud causes additional cost or operational damage. ## Core Purpose The core purpose of Sentinel Anti-Fraud is to help ecommerce businesses reduce fraud before it reaches the most expensive stages of the payment and fulfillment process. Fraud can create many business problems: gateway attempts, decline fees, stolen-card testing, chargebacks, fulfillment losses, support burden, false customer data, operational distraction, and payment processor scrutiny. Sentinel gives RevCent a way to evaluate fraud risk before allowing certain activity to continue. This makes Sentinel different from a purely historical review tool. It can help stop bad activity while it is happening. ## Why Sentinel Matters in Ecommerce Ecommerce checkout flows are exposed to automated and manual fraud attempts. Fraudsters may test stolen cards, submit repeated orders, hide behind proxies or datacenter traffic, reuse suspicious IP addresses, use fake customer identities, or attempt purchases that could later become chargebacks. Without a fraud prevention layer, these attempts may reach the payment gateway, create many failed payment attempts, generate messy operational data, and increase payment risk. Sentinel matters because it gives the business a built-in way to protect commerce activity before it becomes more expensive. It can help ecommerce businesses: - Reduce card testing exposure. - Stop repeated suspicious attempts from the same IP. - Reduce unnecessary gateway or processor activity. - Reduce chargeback risk. - Protect fulfillment teams from fraudulent orders. - Preserve cleaner customer and sale data. - Trigger review workflows when fraud is detected. - Notify teams about high-risk activity. - Give AI Assistants and Functions fraud context to reason from. - Improve long-term fraud prevention through Fraud Detection records and review outcomes. ## Sentinel as a Pre-Payment Protection Layer The most important concept is that Sentinel is a pre-payment protection layer. A fraud prevention system is most valuable when it can detect bad activity before the payment processor is involved. Once a request reaches a gateway, the business may already incur cost, risk, data noise, or operational burden. Sentinel helps protect the payment flow by evaluating the request earlier. Conceptually: ```text Suspicious checkout or sale request ↓ Sentinel evaluates risk before payment processing ↓ High-risk request may be rejected ↓ Gateway attempt may be avoided ↓ Business avoids unnecessary fraud exposure ``` This is especially important during card-testing attacks, where many stolen or generated cards may be attempted in a short time. ## Card Testing Protection Card testing is one of the clearest use cases for Sentinel. Card testing occurs when fraudsters submit many payment attempts to see which stolen or generated cards work. Even if most attempts decline, the business can still suffer from processor activity, gateway costs, operational noise, and risk signals. Sentinel's Fraud Firewall can help stop repeated sale attempts from the same IP address within a configured time window. This matters because card testing often looks different from normal customer behavior. A legitimate shopper usually does not try many cards rapidly from the same IP. A fraudster or bot often does. Sentinel can help turn this pattern into a protection rule. Conceptually: ```text Many sale attempts from same IP ↓ Fraud Firewall identifies repeated behavior ↓ Further attempts can be blocked ↓ Payment gateway is protected from repeated fraudulent attempts ``` ## Fraud Firewall The Fraud Firewall is a major part of Sentinel Anti-Fraud. It focuses on blocking suspicious traffic based on IP-related rules and historical fraud context. The Fraud Firewall can help protect against: - Too many sale attempts from the same IP. - Repeat attempts from IPs tied to prior fraud detections. - Repeat attempts from IPs tied to prior chargebacks. - Known abusive IPs. - Suspicious purchase patterns that suggest automation or card testing. The firewall is useful because it can act before a full sale or payment workflow proceeds. In some cases, a blocked request may not create the same normal commerce context that a completed sale attempt would create. That means Sentinel events can vary in detail. A firewall block may have less customer or sale context than a fraud detection that occurs later in the request lifecycle. ## Tracking Visitor Validation Sentinel can also use visitor context to help determine whether a purchase attempt appears legitimate. Visitor context is useful because fraud is not only about payment credentials. It is also about the behavior and environment behind the request. A normal customer checkout may have a valid visitor trail, expected browser behavior, and a consumer-like network profile. A fraudulent attempt may come from automation, datacenter infrastructure, a proxy, a suspicious location, or missing visitor context. Tracking Visitor Validation can help evaluate this kind of context. Conceptually: ```text Visitor reaches store or checkout ↓ Visitor context is tracked ↓ Purchase attempt is made ↓ Sentinel evaluates whether visitor context appears suspicious ↓ High-risk visitor activity may be blocked or flagged ``` This layer should be configured carefully because visitor-based fraud detection can produce false positives if legitimate purchase attempts lack expected visitor data. ## DNS Tracking and Visitor Context Visitor-based fraud detection is strongest when RevCent can reliably connect checkout traffic to visitor activity. For storefronts and checkout flows where visitor validation is used, DNS tracking and proper visitor tracking setup are important. Without accurate visitor context, legitimate traffic may be harder to distinguish from suspicious traffic. This matters especially for ecommerce stores that rely on storefront sessions, ad traffic, affiliate traffic, or external shopping cart integrations. A good Sentinel setup should consider how visitor context reaches RevCent before using strict visitor-based rejection rules. ## Third-Party Fraud Checks Sentinel can also support third-party fraud checks. Third-party fraud services can provide additional risk signals beyond RevCent's internal fraud context. These services may evaluate fraud score, customer risk, IP risk, device or network risk, order attributes, and other fraud indicators. When combined with Sentinel, third-party checks can become part of a layered anti-fraud strategy. Conceptually: ```text RevCent receives purchase attempt ↓ Internal Sentinel checks run ↓ Third-party fraud check may run ↓ Risk decision determines whether payment should continue ``` This helps businesses use outside fraud intelligence while keeping fraud prevention connected to RevCent's sale, customer, payment, metadata, and review workflows. ## Layered Fraud Protection Sentinel is best understood as layered fraud protection. Different fraud problems require different signals. A single rule may not catch every threat, and a single aggressive rule may create too many false positives. Sentinel can combine multiple layers: - Fraud Firewall rules. - IP sale-limit protection. - Historical fraud IP matching. - Historical chargeback IP matching. - IP whitelist or blacklist behavior. - Visitor validation. - Datacenter, proxy, VPN, or country checks. - Third-party fraud service checks. - Fraud Detection records. - Fraud Alerts on sales. - Email Template, Function, or AI Assistant notification workflows. This layered approach helps businesses tune fraud prevention based on their risk level and tolerance for false positives. ## Fraud Detection Records Fraud Detection records are the main related item for Sentinel Anti-Fraud. A Fraud Detection record represents fraud context that can be reviewed, corrected, connected to other RevCent items, and used by fraud-related workflows. A Fraud Detection may relate to objects such as: - Customer - Sale - Payment type - API call - Metadata - Third-party fraud integration - Fraud response details - Related transactions or chargebacks - Fraud review state - False-positive status This makes Fraud Detection records important because they preserve the evidence and context around suspected or detected fraud. Conceptually: ```text Sentinel detects fraud ↓ Fraud Detection item may be created ↓ Business can review what happened ↓ AI, Functions, Email Templates, or humans can act on the context ↓ Future fraud prevention can become more informed ``` Fraud Detection records are stronger than simple notification flags. They should be treated as durable fraud evidence within the RevCent ecosystem. ## Fraud Detection vs Fraud Alert Fraud Detection records and Fraud Alerts are related, but they are not the same thing. A Fraud Detection is an item that represents detected fraud or fraud-related context. It can affect review workflows, future fraud prevention, and fraud history. A Fraud Alert is a flag on a sale that tells the business the sale needs review. Conceptually: ```text Fraud Alert = review this sale Fraud Detection = fraud was detected or recorded ``` This distinction matters because a Fraud Detection can carry more weight than a simple review flag. A business may use Fraud Alerts when suspicious activity is uncertain and needs human or AI review. A Fraud Detection is more appropriate when fraud has been detected with enough confidence to create a durable fraud record. ## False Positives Fraud detection is not perfect. A false positive occurs when a legitimate customer or purchase attempt is incorrectly treated as fraud. Sentinel should be configured with this risk in mind. Rules that are too aggressive can protect against fraud but also block legitimate customers. Rules that are too loose can reduce false positives but allow more fraud exposure. False-positive review is an important part of a healthy anti-fraud workflow. A business should be able to ask: - Was this truly fraud? - Was the visitor context missing because tracking was misconfigured? - Was the customer using a VPN or corporate network? - Was the IP associated with legitimate repeat activity? - Was the country or traffic source expected for this business? - Should the Fraud Detection be marked as a false positive? - Should Sentinel settings be adjusted to reduce repeat false positives? This makes Sentinel not only a blocking layer, but also a fraud operations feature that benefits from review and tuning. ## Where Sentinel Fits in RevCent Sentinel fits into the risk, payment, and automation layers of RevCent. It relates to payments because it can evaluate risk before payment processing continues. It relates to sales because purchase attempts and sale creation flows may be protected by Sentinel. It relates to customers because fraud context may be tied to customer identity, contact data, purchase history, IP behavior, and metadata. It relates to transactions because blocking fraud earlier can prevent unnecessary transaction attempts and reduce payment processor exposure. It relates to chargebacks because prior chargeback context can help identify repeat risk, and fraud prevention can reduce future chargeback exposure. It relates to tracking because visitor data can help determine whether a purchase attempt is suspicious. It relates to third-party integrations because outside fraud services can provide additional risk signals. It relates to Email Templates because Sentinel alerts can notify internal teams when suspicious activity occurs. It relates to Functions because fraud events can trigger custom business logic or external review systems. It relates to AI Assistants because AI can summarize fraud context, recommend review actions, distinguish fraud alerts from detections, and help identify false-positive patterns. ## Sentinel and WooCommerce Sentinel can be especially valuable for WooCommerce businesses using RevCent. WooCommerce checkout forms are public-facing and can be targeted by card-testing bots or fraudsters. A fraudster may try to submit many payment attempts through the storefront in a short time. Sentinel can help protect WooCommerce payment activity by adding a RevCent-controlled fraud layer between the storefront and the payment gateway. Conceptually: ```text WooCommerce checkout attempt ↓ RevCent receives sale/payment request ↓ Sentinel evaluates risk ↓ Fraudulent attempt may be blocked before gateway processing ``` This can help reduce gateway exposure, card-testing costs, fake customer data, and operational disruption. Sentinel is not limited to WooCommerce. It can also help protect other RevCent sale and payment flows, including direct API integrations, hosted checkout flows, custom storefronts, pending sale processing, subscription renewals, trial expirations, and other payment activity that flows through RevCent. ## Sentinel Events Sentinel can create event context when suspicious activity is detected or blocked. These events are important because they allow the business to respond without relying only on manual monitoring. A Sentinel event may represent: - A firewall block. - A fraud-detected event. - A visitor validation issue. - A third-party fraud result. - A card-testing protection event. - A fraud review or notification opportunity. Different Sentinel events may include different details. A firewall block can happen before a sale or customer is created, so it may contain less context than a fraud event that occurs later in the flow. AI systems and automations should not assume that every Sentinel event includes the same objects. ## Notifications and Operational Response Sentinel is more valuable when detections produce action. A business may want to notify a risk team, create a support task, trigger an AI Assistant, send an internal email, call an external fraud review system, add a sale-level fraud alert, hold fulfillment, or record review notes. Sentinel can support these operational responses through other RevCent features. Examples: ```text Sentinel blocks suspicious IP activity ↓ Function sends alert to internal risk system ``` ```text Fraud Detection is created ↓ AI Assistant summarizes the risk and creates an internal memo ``` ```text Sentinel alert occurs ↓ Email Template notifies fraud operations team ``` ```text Suspicious sale receives Fraud Alert ↓ Human review decides whether to fulfill, cancel, or investigate ``` ## Sentinel and AI Assistants AI Assistants can make Sentinel workflows easier to understand and act on. Fraud context can be dense. A fraud event may involve a customer, sale, API call, metadata, visitor context, payment details, third-party response, and prior fraud history. An AI Assistant can help by summarizing the situation and recommending next steps. Useful AI workflows include: - Summarizing why a Fraud Detection was created. - Classifying risk severity. - Explaining whether a fraud event was firewall-based, visitor-based, or third-party-based. - Recommending whether fulfillment should be held. - Creating notes for fraud review. - Creating an internal memo for high-risk events. - Identifying likely false positives. - Comparing a suspicious event to previous customer or sale history. - Recommending whether to use a Fraud Alert or Fraud Detection. - Triggering a Function to notify an external system. AI should treat fraud actions carefully because false positives can block legitimate customers and false negatives can create financial risk. ## Sentinel and Functions Functions can connect Sentinel events to custom business processes. A business may want to send fraud data to a CRM, ticketing system, Slack channel, fraud review platform, data warehouse, customer support tool, or custom operations dashboard. Functions can help turn Sentinel events into those workflows. Examples: ```text Sentinel alert occurs ↓ Function receives event context ↓ Function sends summarized data to external risk system ``` ```text Fraud Detection is created ↓ Function checks customer status or metadata ↓ Function decides whether to alert support or hold fulfillment ``` ```text Repeated card testing is detected ↓ Function creates internal escalation for payment operations ``` Functions are especially useful when a business has custom fraud review policies outside RevCent. ## Sentinel and Email Templates Email Templates can notify internal teams when Sentinel detects risk. For example, a business might create an internal fraud alert email that sends when Sentinel identifies suspicious activity. The email can help the risk, support, or operations team review what happened. Email Templates are useful for: - Sentinel alert notifications. - Fraud Detection review alerts. - Internal risk team escalation. - Fulfillment hold notices. - Card-testing attack notifications. - Support team awareness when a customer is blocked. Sentinel provides the fraud context. Email Templates provide the communication layer. ## Sentinel and Fulfillment Risk Fraud prevention is not only about payment processing. For ecommerce businesses shipping physical products, a fraudulent order can become a fulfillment loss if the item ships before review. Sentinel helps reduce this risk by detecting suspicious activity before or during the sale flow. A business can use Sentinel together with Fraud Alerts, Fraud Detection records, Functions, Email Templates, and AI Assistants to hold or review suspicious orders before fulfillment proceeds. Conceptually: ```text Suspicious purchase attempt ↓ Sentinel detects risk ↓ Fraud Detection or Fraud Alert context exists ↓ Fulfillment can be reviewed before shipment ``` This helps protect inventory, shipping costs, and chargeback exposure. ## Sentinel and Customer Experience Fraud prevention has to balance protection and legitimate customer experience. A strict fraud system may block more bad actors, but it may also create more false positives. A loose fraud system may allow fewer false positives, but it may expose the business to more fraud. Sentinel helps businesses tune that balance through configurable layers. Customer experience matters because legitimate customers can be frustrated if their purchase is blocked incorrectly. Fraud prevention should therefore include monitoring, review, correction, and policy adjustment. The best fraud workflows protect the business while giving legitimate customers a path to resolution. ## Common Ecommerce Use Cases Sentinel Anti-Fraud is useful for many ecommerce scenarios. ### Card-Testing Defense ```text Fraudster submits repeated payment attempts ↓ Fraud Firewall detects too many attempts from same IP ↓ Further attempts are blocked ↓ Gateway activity and cost exposure are reduced ``` ### Suspicious Visitor Blocking ```text Checkout attempt comes from suspicious visitor context ↓ Tracking Visitor Validation evaluates the visitor ↓ High-risk request may be blocked ↓ Fraud context can be reviewed ``` ### Third-Party Fraud Review ```text Purchase attempt passes basic checks ↓ Third-party fraud service evaluates risk ↓ High-risk response creates fraud context ↓ Business can block, review, notify, or escalate ``` ### Fraud Operations Alert ```text Sentinel alert occurs ↓ Email Template or Function notifies internal team ↓ Team reviews the event and decides next action ``` ### AI Fraud Summary ```text Fraud Detection is created ↓ AI Assistant reviews fraud context ↓ AI creates a summary or recommendation ↓ Human team can make a faster review decision ``` ### Fulfillment Hold ```text Sale appears suspicious ↓ Fraud Alert or Fraud Detection context exists ↓ Fulfillment pauses for review ↓ Business avoids shipping potentially fraudulent order ``` ## Best-Fit Businesses Sentinel is valuable for most ecommerce businesses using RevCent, but it becomes especially important when the business handles payment volume, physical fulfillment, subscriptions, trials, high-risk traffic, paid advertising traffic, affiliate traffic, custom storefronts, direct API sales, WooCommerce stores, or previous fraud/card-testing exposure. It is especially useful for businesses that need to: - Stop card testing. - Reduce repeated fraudulent checkout attempts. - Protect gateways from abusive traffic. - Reduce chargebacks. - Protect fulfillment operations. - Review suspicious orders before shipment. - Use AI or automation for fraud triage. - Notify teams quickly when fraud is detected. - Apply account-wide fraud policies consistently. ## Why This Matters in the RevCent Ecosystem Sentinel helps make RevCent safer as an ecommerce operating system. Without fraud prevention, sales, payments, subscriptions, trials, customer records, and fulfillment workflows can all be affected by bad actors. Fraud does not stay isolated. It can pollute customer data, increase payment risk, create chargebacks, trigger unnecessary support work, and cause fulfillment losses. Sentinel gives RevCent a protective layer that works with the rest of the platform. This creates several ecosystem-level advantages: - Payment attempts can be evaluated before gateway processing. - Card-testing attacks can be stopped earlier. - Fraud context can become a durable Fraud Detection item. - Suspicious sales can be flagged for review. - AI Assistants can reason from fraud context. - Functions can notify external systems. - Email Templates can alert internal teams. - Fulfillment can be protected from suspicious orders. - Customer and sale histories can include fraud context when relevant. - Businesses can tune protection as their risk profile changes. ## Summary Sentinel Anti-Fraud is RevCent's built-in fraud prevention feature for ecommerce businesses. It helps identify and block suspicious purchase attempts before they create unnecessary payment, chargeback, fulfillment, or operational risk. Sentinel can combine fraud firewall rules, card-testing protection, visitor validation, third-party fraud checks, Fraud Detection records, Fraud Alerts, events, AI review, Functions, and Email Template notifications. The most important concept is that Sentinel is a configurable pre-payment protection layer. It helps protect the business before fraud reaches the most expensive parts of the ecommerce lifecycle. Use the technical links at the top of this file to distinguish between the main ways to interface with the feature: Web App, API, and MCP / AI. --- Document Parent Directory * [Features](https://revcent.com/documentation/markdown/ecosystem/feature/index.md) - Non-technical markdown documentation for features within the RevCent ecosystem. A feature is a part of the RevCent ecosystem that a user can create and configure.