FraudEG Behavioral Analysis: ATO and Bot Detection

Behavioral analysis examines how a user interacts with your application during a session, not just what they do. While a stolen credential can impersonate a user’s identity, it cannot easily replicate the unique way they type, move a mouse, or navigate a page. FraudEG captures these interaction patterns in real time, builds a behavioral profile for each user, and surfaces anomalies when a session deviates from that baseline — detecting account takeover attempts, scripted bots, and social engineering attacks that traditional signal-based rules miss.

Signals Collected

FraudEG’s behavioral engine captures the following interaction signals passively through the JavaScript snippet or mobile SDK — no additional instrumentation is required beyond including the snippet on your pages:

Typing cadence — keystroke timing, inter-key delay intervals, and error correction patterns across form fields.
Mouse movement patterns — trajectory smoothness, acceleration, and movement entropy (human mouse movement is irregular; bot movement is geometrically precise).
Session duration — time spent on each page and the overall session length relative to the user’s historical baseline.
Page navigation sequence — the order in which pages are visited and whether it follows expected user journeys.
Copy-paste behavior — whether form fields (especially password, card number, and email) are filled via keyboard input or paste operations.
Form interaction — field focus/blur timing, tab key navigation, and autocomplete usage patterns.

What Behavioral Analysis Detects

Threat	How Behavioral Analysis Identifies It
Account takeover (ATO)	An attacker using stolen credentials types differently, navigates unfamiliar pages more slowly, and lacks the user’s learned form interaction patterns.
Scripted bots	Automated scripts fill forms at non-human speeds, skip typical mouse movement entirely, and follow rigid, repetitive navigation sequences.
Social engineering	A victim being coached by a fraudster over the phone hesitates unusually, copies and pastes unfamiliar data, and navigates at an irregular pace driven by external instruction.
Credential stuffing	High-volume login attempts from the same device show identical timing patterns that don’t match any single user’s baseline.

Attaching Behavioral Data to Transactions

Behavioral data is linked to transactions via the session_id created when the FraudEG device session is initialized. When you include a session_id in your POST /v1/transactions/score request, FraudEG automatically retrieves the behavioral data collected during that session and incorporates it into the risk score.

{
  "user_id": "usr_8f3k2p",
  "amount": 1250.00,
  "currency": "USD",
  "payment_method": {
    "type": "card",
    "token": "tok_visa_xxxx4242"
  },
  "session_id": "sess_7Tz3mKpR9vLq"
}

No additional API calls are needed to attach behavioral data — the session_id is the only link required.

The `behavioral_anomaly` Signal

When the behavioral engine detects that a session deviates significantly from a user’s established interaction baseline, it surfaces the behavioral_anomaly signal in the transaction’s signals array. This signal elevates the transaction risk score and can trigger a challenge or block rule depending on your configuration. behavioral_anomaly is triggered by a combination of factors rather than a single threshold. Common combinations that trigger it include:

Typing cadence outside two standard deviations of the user’s baseline and heavy copy-paste usage on the password field.
Navigation sequence that skips expected steps and an unusually short session duration.
Completely absent mouse movement (headless browser indicator) and form fill speed below 50ms per field.

Behavioral Signal Reference

Signal	Meaning
`behavioral_anomaly`	Session interaction pattern deviates significantly from this user’s baseline.
`typing_bot_pattern`	Keystroke timing matches automated input rather than human typing rhythm.
`copy_paste_credential`	Password or sensitive field was filled via paste rather than keyboard input.
`no_mouse_movement`	No mouse movement detected during the session — consistent with headless browsers.
`session_too_short`	Session duration is abnormally brief relative to the user’s historical average.
`navigation_skip`	Expected navigation steps in the user journey were skipped or reordered.
`coached_interaction`	Hesitation and copy-paste patterns consistent with a user being guided by a third party.

Use Cases

Login risk scoring — Detect account takeover at the point of authentication before the attacker reaches any sensitive functions.
Checkout anomaly detection — Identify whether the person checking out is the account owner or an attacker using stored payment methods.
High-value transfer validation — Add behavioral confidence to wire transfers and large withdrawals where the cost of a false negative is high.
New account fraud — Detect scripted account creation at onboarding before the account is used for fraud downstream.

Enabling Behavioral Analysis

Behavioral analysis activates automatically when you include the FraudEG JavaScript snippet or mobile SDK in your application. No separate configuration is required. Attach the snippet to all pages that precede a critical action to maximize the behavioral signal quality.

Attach the FraudEG snippet (or mobile SDK session) to every critical page in your user journey — not just the final action page. Behavioral profiles are richer when FraudEG has observed navigation patterns across the login page, account dashboard, and checkout flow together. A snippet only on the checkout page misses the upstream behavioral context that makes anomaly detection most accurate.

Data Handling and Privacy

Behavioral data is ephemeral by design. FraudEG processes interaction signals in real time to produce behavioral features and risk scores, but does not store raw behavioral recordings, keystroke logs, or mouse trajectories as persistent records. No behavioral data is classified as personally identifiable information (PII). Behavioral profiles are stored as statistical models, not event logs, and cannot be reversed to reconstruct a user’s raw session activity.

Behavioral data processing complies with GDPR, CCPA, and PECR. Because raw interaction data is not retained, there is no behavioral data to fulfill in subject access requests beyond the aggregated risk signals already visible in your transaction log.

Get Started

Core Concepts

Guides

Platform

FraudEG Behavioral Analysis: ATO and Bot Detection

Signals Collected

What Behavioral Analysis Detects

Attaching Behavioral Data to Transactions

The `behavioral_anomaly` Signal

Behavioral Signal Reference

Use Cases

Enabling Behavioral Analysis

Data Handling and Privacy

​Signals Collected

​What Behavioral Analysis Detects

​Attaching Behavioral Data to Transactions

​The behavioral_anomaly Signal

​Behavioral Signal Reference

​Use Cases

​Enabling Behavioral Analysis

​Data Handling and Privacy

Signals Collected

What Behavioral Analysis Detects

Attaching Behavioral Data to Transactions

The `behavioral_anomaly` Signal

Behavioral Signal Reference

Use Cases

Enabling Behavioral Analysis

Data Handling and Privacy