Create detection rules in seconds. Your risk team changes thresholds without raising a single engineering ticket. Rules go live in under one second — no deployment, no downtime, no waiting.
vcurd's rule engine is designed for risk teams, not engineers. No JSON editing, no deployments — just build, set, and enable.
Choose from a rich library of transaction attributes: amount thresholds, velocity windows, time-of-day filters, device signals, VPA blacklists, and card network metadata. All conditions within a rule are ANDed together — every condition must match for the rule to trigger.
11+ condition typesChoose the action your rule applies — BLOCK, FLAG, DELAY, or REQUIRE_2FA — and assign a priority (lower number = higher priority). When multiple rules trigger on a single transaction, vcurd applies the most severe action first. A BLOCK always wins.
Priority-based orderingFlip the toggle in the dashboard. The rule is pushed to the Redis cache and is active for all incoming transactions in under one second — no deployment, no code change, no restart. Disable just as quickly when conditions change.
Live in < 1 secondEvery condition type supported by the vcurd rule engine. Multiple conditions in a single rule are evaluated with AND logic — all must match for the rule to trigger.
| Condition | Type | Example Value | Description |
|---|---|---|---|
| amount_gt | Number | 50000 | Triggers when transaction amount exceeds the threshold (in INR) |
| amount_lt | Number | 100 | Triggers when transaction amount is below the threshold (micro-transaction detection) |
| velocity_1h_gt | Integer | 5 | Triggers when the sender has made more than N transactions in the past 1 hour |
| velocity_24h_gt | Integer | 20 | Triggers when the sender has made more than N transactions in the past 24 hours |
| is_new_device | Boolean | true | Triggers when the transaction originates from a device not seen before for this account |
| is_new_beneficiary | Boolean | true | Triggers when the recipient VPA has never received a payment from this sender before |
| is_round_amount | Boolean | true | Triggers when the amount is a round number (10000, 50000) — common in structuring fraud |
| receiver_vpa_blacklisted | Boolean + List | true, blacklist: ["fraud@upi"] | Triggers when the receiver VPA is on the platform blacklist or an inline blocklist |
| card_network_in | String[] | ["AMEX", "DINERS"] | Triggers when the card network matches one of the specified networks |
| is_international | Boolean | true | Triggers when the card is issued outside India (non-IN country code) |
| is_commercial | Boolean | true | Triggers when the card is a commercial/corporate card (higher risk for odd-hour transactions) |
| hour_in | Integer[] | [0, 1, 2, 3, 4] | Triggers when the transaction falls within specified hours of the day (0–23, IST) |
| category_in | String[] | ["gambling", "crypto"] | Triggers when the merchant category matches one of the specified categories |
When a transaction matches multiple rules, vcurd applies the most severe action. BLOCK always overrides everything. The severity order is: BLOCK > DELAY > REQUIRE_2FA > FLAG.
The transaction is immediately rejected. No funds move. A BLOCK decision is final and cannot be overridden by lower-severity rules. A full rule log entry is created for the audit trail, and an alert is raised for the risk team.
The transaction is held in a pending state for manual review by the risk operations team. Common for large-value transactions to new beneficiaries where additional verification is warranted before funds release.
The transaction requires the user to complete a second factor of authentication before proceeding. Applied to suspicious-but-not-definitive signals — new device with moderate amount, odd-hour corporate card transaction, etc.
The transaction proceeds but is marked for review in the analytics dashboard. An alert is created for analyst follow-up. Useful for monitoring patterns over time without impacting transaction flow for borderline cases.
vcurd's LLM layer continuously analyses recent fraud patterns, flagged transactions, and emerging attack vectors to suggest new rules your risk team should consider enabling.
Suggestions arrive pre-configured — with conditions, actions, and priority already set based on what's working across the platform. Your analyst reviews the rationale and accepts with one click. No rule-building from scratch.
Powered by OpenAI GPT-4o, Anthropic Claude, or your own local model via Ollama — switchable from the admin panel without any code changes.
See it in ActionTalk to us about deploying vcurd's rule engine for your financial institution.