> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fraudeg.com/llms.txt
> Use this file to discover all available pages before exploring further.

# FraudEG Behavioral Analysis: ATO and Bot Detection

> Discover how FraudEG analyzes user session behavior, typing patterns, and navigation signals to detect account takeover and social engineering attacks.

Behavioral analysis examines *how* a user interacts with your application during a session, not just *what* they do. While a stolen credential can impersonate a user's identity, it cannot easily replicate the unique way they type, move a mouse, or navigate a page. FraudEG captures these interaction patterns in real time, builds a behavioral profile for each user, and surfaces anomalies when a session deviates from that baseline — detecting account takeover attempts, scripted bots, and social engineering attacks that traditional signal-based rules miss.

## Signals Collected

FraudEG's behavioral engine captures the following interaction signals passively through the JavaScript snippet or mobile SDK — no additional instrumentation is required beyond including the snippet on your pages:

* **Typing cadence** — keystroke timing, inter-key delay intervals, and error correction patterns across form fields.
* **Mouse movement patterns** — trajectory smoothness, acceleration, and movement entropy (human mouse movement is irregular; bot movement is geometrically precise).
* **Session duration** — time spent on each page and the overall session length relative to the user's historical baseline.
* **Page navigation sequence** — the order in which pages are visited and whether it follows expected user journeys.
* **Copy-paste behavior** — whether form fields (especially password, card number, and email) are filled via keyboard input or paste operations.
* **Form interaction** — field focus/blur timing, tab key navigation, and autocomplete usage patterns.

## What Behavioral Analysis Detects

| Threat                     | How Behavioral Analysis Identifies It                                                                                                                                           |
| -------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Account takeover (ATO)** | An attacker using stolen credentials types differently, navigates unfamiliar pages more slowly, and lacks the user's learned form interaction patterns.                         |
| **Scripted bots**          | Automated scripts fill forms at non-human speeds, skip typical mouse movement entirely, and follow rigid, repetitive navigation sequences.                                      |
| **Social engineering**     | A victim being coached by a fraudster over the phone hesitates unusually, copies and pastes unfamiliar data, and navigates at an irregular pace driven by external instruction. |
| **Credential stuffing**    | High-volume login attempts from the same device show identical timing patterns that don't match any single user's baseline.                                                     |

## Attaching Behavioral Data to Transactions

Behavioral data is linked to transactions via the `session_id` created when the FraudEG device session is initialized. When you include a `session_id` in your `POST /v1/transactions/score` request, FraudEG automatically retrieves the behavioral data collected during that session and incorporates it into the risk score.

```json theme={null}
{
  "user_id": "usr_8f3k2p",
  "amount": 1250.00,
  "currency": "USD",
  "payment_method": {
    "type": "card",
    "token": "tok_visa_xxxx4242"
  },
  "session_id": "sess_7Tz3mKpR9vLq"
}
```

No additional API calls are needed to attach behavioral data — the `session_id` is the only link required.

## The `behavioral_anomaly` Signal

When the behavioral engine detects that a session deviates significantly from a user's established interaction baseline, it surfaces the `behavioral_anomaly` signal in the transaction's `signals` array. This signal elevates the transaction risk score and can trigger a challenge or block rule depending on your configuration.

`behavioral_anomaly` is triggered by a combination of factors rather than a single threshold. Common combinations that trigger it include:

* Typing cadence outside two standard deviations of the user's baseline *and* heavy copy-paste usage on the password field.
* Navigation sequence that skips expected steps *and* an unusually short session duration.
* Completely absent mouse movement (headless browser indicator) *and* form fill speed below 50ms per field.

## Behavioral Signal Reference

| Signal                  | Meaning                                                                                  |
| ----------------------- | ---------------------------------------------------------------------------------------- |
| `behavioral_anomaly`    | Session interaction pattern deviates significantly from this user's baseline.            |
| `typing_bot_pattern`    | Keystroke timing matches automated input rather than human typing rhythm.                |
| `copy_paste_credential` | Password or sensitive field was filled via paste rather than keyboard input.             |
| `no_mouse_movement`     | No mouse movement detected during the session — consistent with headless browsers.       |
| `session_too_short`     | Session duration is abnormally brief relative to the user's historical average.          |
| `navigation_skip`       | Expected navigation steps in the user journey were skipped or reordered.                 |
| `coached_interaction`   | Hesitation and copy-paste patterns consistent with a user being guided by a third party. |

## Use Cases

* **Login risk scoring** — Detect account takeover at the point of authentication before the attacker reaches any sensitive functions.
* **Checkout anomaly detection** — Identify whether the person checking out is the account owner or an attacker using stored payment methods.
* **High-value transfer validation** — Add behavioral confidence to wire transfers and large withdrawals where the cost of a false negative is high.
* **New account fraud** — Detect scripted account creation at onboarding before the account is used for fraud downstream.

## Enabling Behavioral Analysis

Behavioral analysis activates automatically when you include the FraudEG JavaScript snippet or mobile SDK in your application. No separate configuration is required. Attach the snippet to all pages that precede a critical action to maximize the behavioral signal quality.

<Tip>
  Attach the FraudEG snippet (or mobile SDK session) to **every critical page** in your user journey — not just the final action page. Behavioral profiles are richer when FraudEG has observed navigation patterns across the login page, account dashboard, and checkout flow together. A snippet only on the checkout page misses the upstream behavioral context that makes anomaly detection most accurate.
</Tip>

## Data Handling and Privacy

<Note>
  Behavioral data is **ephemeral by design**. FraudEG processes interaction signals in real time to produce behavioral features and risk scores, but does not store raw behavioral recordings, keystroke logs, or mouse trajectories as persistent records. No behavioral data is classified as personally identifiable information (PII). Behavioral profiles are stored as statistical models, not event logs, and cannot be reversed to reconstruct a user's raw session activity.
</Note>

Behavioral data processing complies with GDPR, CCPA, and PECR. Because raw interaction data is not retained, there is no behavioral data to fulfill in subject access requests beyond the aggregated risk signals already visible in your transaction log.