Device, behavior, velocity, and relationship signals answer different questions

Four lenses

Device signals describe the environment used for an action. Behavioral signals describe how a sequence unfolds. Velocity measures how often related actions occur within a window. Relationship signals connect accounts, devices, payment instruments, addresses, recipients, or other entities.

Correlation is not identity

A shared device can belong to a household or workplace. Fast activity can reflect a sale or payroll event. A relationship link can be legitimate commerce. Behavioral deviation can reflect accessibility needs, travel, injury, or a new device. Signals require purpose, consent, data quality, population context, and outcome validation.

Why context matters

These signals become useful only when they are collected with permission, compared with stable customer behavior, tied to reliable outcomes and monitored for error and harm. A device match, behavior change or relationship link can support an investigation, but no signal alone proves identity or fraud.

Example: one device serves many legitimate users

A library computer, family tablet, workplace terminal or network gateway can connect activity from unrelated people. A shared technical marker can therefore be a useful relationship signal and a poor identity conclusion at the same time. Combine it with authorized account and event context, and preserve the possibility that infrastructure—not collusion—explains the link.