> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fraudeg.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Catálogo de flags

> Los códigos públicos de flags[].code y decision.reason

Este es el catálogo único de códigos públicos de riesgo. Aparece en `flags[].code` y, como
string, en `decision.reason`. Programa contra estos valores; no contra el mecanismo interno
del motor.

Cada entrada de `flags` trae cuatro campos: `code`, `category`, `severity` (`low` /
`medium` / `high`) y `description` (inglés, el idioma del contrato). Varias señales internas
pueden colapsar al mismo `code` cuando le cuentan al comercio la misma historia: en
`flags` queda **una** entrada por código.

`decision.reason` usa este mismo vocabulario, más dos formas cuando la decisión la elevó
algo tuyo: `custom_rule:<id>` y `entity_block:<kind>:<value>`. Ver
[Formato de respuesta](/referencia/respuesta).

No confundas este catálogo con los [códigos de error](/referencia/codigos-de-error) de la
API.

## Códigos

| `code`                        | `category`          | `severity` | `description`                                                   |
| ----------------------------- | ------------------- | ---------- | --------------------------------------------------------------- |
| `AUTH_3DS_FAILED`             | authentication      | high       | 3DS authentication explicitly failed                            |
| `AUTH_3DS_MISSING`            | authentication      | medium     | 3DS authentication was not completed                            |
| `AUTH_CVV_MISMATCH`           | authentication      | high       | CVV/CVC verification failed or was not provided                 |
| `AUTH_PIN_FAILED`             | authentication      | high       | PIN verification did not succeed                                |
| `CARD_TESTING_PATTERN`        | payment             | high       | Card-testing behaviour around this card, BIN or checkout        |
| `PAYMENT_METHOD_RISK`         | payment             | medium     | Payment path with reduced protection or irreversible settlement |
| `RETURN_ABUSE_PATTERN`        | payment             | medium     | Transaction matches a return or refund abuse pattern            |
| `GEO_CARD_ORIGIN_MISMATCH`    | geo                 | medium     | Card origin and transaction origin do not match                 |
| `GEO_HIGH_RISK_ORIGIN`        | geo                 | medium     | Origin country or corridor with elevated fraud rates            |
| `GEO_IMPOSSIBLE_TRAVEL`       | geo                 | high       | Card used in distant locations within an implausibly short time |
| `NETWORK_ANONYMIZED_ORIGIN`   | network             | medium     | Connection through an anonymizing network                       |
| `NETWORK_SHARED_ORIGIN`       | network             | low        | Network origin shared by unrelated users or merchants           |
| `VELOCITY_DEVICE_BURST`       | velocity            | low        | Unusual burst of transactions in a short period                 |
| `DEVICE_SHARED_BY_MANY_USERS` | device              | medium     | Device shared by several unrelated accounts                     |
| `DEVICE_NEW_OR_CHANGED`       | device              | medium     | Transaction from a device not seen before for this account      |
| `ACCOUNT_TAKEOVER_PATTERN`    | user                | high       | Session or credential activity consistent with account takeover |
| `IDENTITY_NEW_ACCOUNT`        | user                | low        | Recently created account or first activity                      |
| `IDENTITY_SYNTHETIC_SIGNALS`  | user                | medium     | Contact details consistent with a synthetic identity            |
| `AMOUNT_ANOMALY`              | core                | medium     | Amount or timing outside the normal pattern                     |
| `CARD_REPORTED_COMPROMISED`   | core                | high       | Card flagged as lost, stolen or compromised by the issuer       |
| `SHIPPING_ADDRESS_MISMATCH`   | shipping            | medium     | Shipping and billing addresses do not match                     |
| `HISTORY_PRIOR_CHARGEBACKS`   | chargeback\_history | high       | Prior chargeback history on this user or merchant               |
| `FUNDS_LAUNDERING_PATTERN`    | other               | high       | Fund movement consistent with laundering or mule activity       |
| `CREDIT_EXPOSURE_STACKING`    | other               | medium     | Credit exposure accumulating faster than expected               |
| `INSIDER_OR_DOCUMENT_FRAUD`   | other               | high       | Payout or document inconsistency consistent with insider fraud  |

Son 25 códigos. Puedes hacer `switch` sobre `code` con confianza: cuando una señal nueva
cuenta la misma historia, se agrega a un código existente.

<Note>
  Puede aparecer un código adicional, `RISK_SIGNAL_OTHER` (categoría `other`, severidad
  `low`, descripción `Risk signal without a published code`), como respaldo cuando una señal
  todavía no tiene código público propio. No lo trates como parte del catálogo estable de 25
  — es el valor de respaldo. Si llega un `code` que no reconoces, trátalo como señal genérica
  y actúa sobre [`decision.type`](/conceptos/decisiones), nunca sobre la razón suelta.
</Note>