Identity Insights - Advisor [Developer Preview]

Identity Insights returns telecom signals that can be difficult to translate into decisions. The challenge surfaces across 3 areas:

• Relevant Insights: Which signals matter for your use case?
• Interpreting Data: How do signals affect your use case?
• Decision Making: What decision should you make based on positive, negative, and missing signals?

What is Advisor?

Advisor is a capability within the Identity Insights API that evaluates raw telecom signals and produces recommendations, removing the need to interpret individual signals or build decision logic from scratch.

Advisor exposes the underlying signals used in each evaluation and explains its assessments. allowing you to validate its output against your business context.

Advisor has three interconnected components:

• Models: Each model defines recommended Insights, signal definitions based on attribute values, and attribute ranges. Predefined models cover common use cases and industries, so you do not need to identify relevant signals, establish thresholds, or maintain decision criteria over time.
• Signal Interpretation: Advisor evaluates each signal in the context of the model and returns a natural-language assessment. The assessment explains raw values for business and operations teams.
• Model Advice: Advisor evaluates relevant signals and individual advice values—positive, negative, warning, and missed—and produces a POSITIVE, WARNING, or NEGATIVE recommendation. You receive a recommendation instead of a set of values to reconcile.

Models

Advisor organizes signals into predefined models that align with specific risk or business objectives.

Account Takeover (ATO)

Definition: Detects the risk that an unauthorized party accesses or controls an existing account.

Account takeover involves unauthorized access to a legitimate user's account or authentication method. It can follow impersonation or phishing and includes account sharing and mule accounts used to launder money. Attackers can hijack a phone number through a SIM swap to intercept two-factor authentication (2FA), steal a phone, or steal a SIM card.

Examples:

• After a SIM swap, an attacker resets a bank-account password and logs in.
• Someone steals a SIM card, obtains the personal identification number (PIN), and uses it in another device.

Typical Scenarios:

• Login and authentication.
• Password reset.
• High-risk transactions, such as a fund transfer to a new beneficiary.

Synthetic Identity

Definition: Evaluates whether an identity is artificially created from a combination of real and false data.

A synthetic identity combines real and false information to create a person who does not exist. Fraudsters can use these identities to open accounts, obtain promotions, or commit fraud over time. Artificially Inflated Traffic (AIT) can use synthetic identities to manipulate telecom traffic. In some cases, signals that suggest a synthetic identity reflect an error made by a legitimate customer.

Examples:

• A real phone number, fake name, and fake date of birth.
• A random number, valid name, and fake email address.
• A nonmobile number that cannot be associated with an individual.

Typical Scenarios:

• User onboarding for unverified users.
• Account creation.
• Promotions and promotional abuse.

Impersonation

Definition: Detects whether a user is pretending to be an existing person without access to that person's devices or accounts.

Impersonation aims to convince systems or people that an attacker is someone else. It often uses stolen personal data and social engineering.

Examples:

• A fraudster calls a mobile carrier and pretends to be the account holder: "Hi, I lost my phone. Can you transfer my number to a new SIM?" The fraudster uses stolen personal details, such as a name, date of birth, and the last four digits of an identification (ID) number, to pass verification.
• A fraudster obtains a person's name, date of birth, and address, then uses a personal phone number to apply for credit. When the lender queries Identity Insights, the Subscriber Match check identifies that the phone number is not registered to the supplied name and address. This flags the application as a likely impersonation attempt before the lender extends credit.

Typical Scenarios:

• User onboarding.
• Account recovery.
• Weak authentication contexts, for example, hard-to-validate or scanned ID documents.

Customer Experience

Definition: Focuses on optimizing the user experience rather than detecting fraud.

This model helps you make context-aware decisions when communicating with or serving customers. It helps answer these questions:

• Is this phone number likely associated with one individual?
• Is this a good time to contact the customer?
• Should you send a Short Message Service (SMS), make a call, or send an app notification?
• Should you account for roaming in your sales or service approach?

Typical Scenarios:

• Detect nonmobile numbers before sending a one-time password (OTP) during account creation. A landline or Voice over Internet Protocol (VoIP) number requires voice fallback, which can increase drop-off. Use Advisor to select a more suitable authentication channel or tell the user that the OTP will arrive by voice.
• At order placement, assess whether a phone number is likely valid. This helps you ask customers to correct invalid numbers before dispatch without adding authentication friction at checkout.
• Adjust outbound communication timing or channel based on a customer's country, time zone, or potential call costs.

Signal Interpretation

For each model, Advisor reads the attributes returned by Identity Insights, compares their values with model-specific definitions and thresholds, and generates an interpretation for each signal:

• Advice: A categorical assessment of what the signal means in the context of the model.
• Assessment: A natural-language explanation of why Advisor assigned that advice in the context of the use case.

You do not need to interpret the raw meaning of each attribute value or determine whether it represents risk or a positive signal.

Advice Values

Examples

Account Takeover Model — SIM Swap Detected

{
  "attribute": "sim_swap.is_swapped",
  "attribute_value": TRUE,
  "advice": "NEGATIVE",
  "assessment": "A SIM swap represents a high risk of account takeover."
}

Synthetic Identity Model — Mobile Number Confirmed

{
  "attribute": "current_carrier.network_type",
  "attribute_value": "MOBILE",
  "advice": "POSITIVE",
  "assessment": "The phone number is assigned to a mobile carrier. While this does not mean the phone number is assigned to a subscriber or reachable, this is a positive signal to mitigate different sort of frauds."
}

Impersonation Model — Subscriber Name Mismatch

{
  "attribute": "subscriber_match.given_name_match, subscriber_match.family_name_match",
  "attribute_value": "Neither is EXACT or HIGH",
  "advice": "NEGATIVE",
  "assessment": "Impersonation risk is high because several key attributes do not match the telco operator's records."
}

Customer Experience Model — Invalid Phone Number Format

{
  "attribute": "format.format_valid",
  "attribute_value": FALSE,
  "advice": "NEGATIVE",
  "assessment": "Do not trust phone numbers with invalid format."
}

Coverage Gaps and Missed Insights

Advisor also identifies recommended Insights that were not included in the request or are unavailable for a phone number. When a recommended Insight is missing, Advisor generates a MISSED_INSIGHT signal:

{
  "attribute": "sim_swap",
  "advice": "MISSED_INSIGHT",
  "assessment": "This Insight is recommended for the Advisor account takeover model."
}

Each model defines recommended Insights, which are the attributes most relevant to that use case. This identifies coverage gaps that can reduce evaluation reliabilit, and helps you optimize your Insights requests over time. The insights_completeness_ratio in the next section reflects the effect of missing signals on evaluation confidence.

Model Advice

After Advisor interprets all signals, it aggregates them into a model-level recommendation: POSITIVE, WARNING, or NEGATIVE. This recommendation summarizes the overall signal profile for the evaluated use case.

Metrics

Advisor exposes metrics that describe the composition and quality of the signal evaluation. These metrics inform the final model advice and help you assess the confidence and decisiveness of the outcome.

Insights Completeness Ratio

The ratio of available, non-missing Insights to the total number of recommended Insights for the model. A low ratio means Advisor evaluated the model with limited data, which reduces reliability.

insights_completeness_ratio = available insights / recommended insights

For example, the synthetic_identity model has format, original_carrier, and subscriber_match as recommended Insights. If only format is available, the ratio is one out of three:

{
  "insights_completeness_ratio": 0.33
}

Advice Ratios

Three complementary ratios describe the distribution of outcomes across evaluated signals in the model. MISSED_INSIGHT signals are excluded from this calculation. Only POSITIVE, WARNING, and NEGATIVE signals count toward the denominator.

Given the following signals:

{
  "signals": [
    {
      "attribute": "format.is_format_valid",
      "advice": "POSITIVE",
      "assessment": "According to the global and local numbering standard this number can be legitimately assigned by carriers to subscribers."
    },
    {
      "attribute": "current_carrier.network_type",
      "advice": "WARNING",
      "assessment": "Insight original_carrier is recommended if current_carrier.network_type is not mobile or available."
    },
    {
      "attribute": "roaming",
      "advice": "MISSED_INSIGHT",
      "assessment": "Insight missed - This Insight is recommended to evaluate advisor synthetic_identity model."
    }
  ]
}

The ratios are calculated over the two non-missed signals:

{
  "positive_ratio": 0.5,
  "warning_ratio": 0.5,
  "negative_ratio": 0.0
}

Weighted Ratio

A single normalized score captures overall signal quality by applying fixed weights to each advice outcome:

POSITIVE → 1
WARNING → 0.5
NEGATIVE → 0

The weighted sum is then divided by the total number of non-missed signals. For example, given 10 POSITIVES, 3 WARNINGS, and 2 NEGATIVES:

(10 × 1) + (3 × 0.5) + (2 × 0) = 10 + 1.5 + 0 = 11.5

Total signals, excluding MISSED_INSIGHT: 10 + 3 + 2 = 15

weighted_ratio: 11.5 / 15 = 0.77

A weighted ratio close to 1.0 reflects a predominantly positive signal profile. A value close to 0.0 indicates a profile dominated by risk or negative signals.

Advice Criteria

Advisor supports three aggregation criteria. Choose the criterion that best fits your risk appetite and data availability.

Worst-Case (model_advice.worst_case)

The overall advice is the most negative individual signal in the evaluation. A single NEGATIVE signal makes the model advice NEGATIVE, regardless of how many positive signals are present. If all signals are MISSED_INSIGHT, the advice defaults to WARNING.

Use this conservative approach for high-security contexts, such as financial transactions or account recovery, where the cost of missed fraud significantly outweighs the cost of added friction.

Completeness-Based (model_advice.completeness)

Advisor derives the overall advice from the insights_completeness_ratio, which reflects how much of the recommended signal set is available. This criterion treats data availability as a risk indicator because an evaluation with few signals is less reliable.

Use this criterion when incomplete data must trigger caution or when you need a minimum signal-coverage threshold before acting on a recommendation.

Weighted-Based (model_advice.weighted_ratio)

Advisor derives the overall advice from the weighted_ratio, which balances POSITIVE, WARNING, and NEGATIVE signals. If all signals are MISSED_INSIGHT, the advice defaults to WARNING.

Use this criterion when a strong positive signal profile must not be overridden by a single ambiguous result and when you want to reduce unnecessary friction for legitimate users.

Adaptive Security

The Model Advice produced by Advisor should always be treated as one input within a broader decision engine, not as a standalone verdict. Telecom-derived signals are probabilistic indicators, not proof of fraud or legitimacy. For maximum effectiveness, you should combine Advisor output with non-telecom signals, such as device intelligence, behavioral analytics, transaction context, and internal risk history. No single signal should drive a decision in isolation, and risk workflows should be designed to combine multiple inputs and apply conservative fallbacks when key information is absent or incomplete.

Use adaptive security to apply an appropriate level of friction based on the detected risk. A low-risk profile with a well-covered model can support a near-frictionless experience. A medium-risk profile with ambiguous or missing signals can trigger a step-up action, such as an OTP, silent authentication, or biometric check. A high-risk profile with multiple NEGATIVE signals, a low completeness ratio, or indicators such as a recent SIM swap and subscriber mismatch can trigger transaction review, further verification, or rejection. Advisor provides the telecom-derived dimension of this risk picture: passive, real-time, and independent of data the user can manipulate.

Identity Insights and Advisor are most powerful when embedded within a decision engine that the brand controls and continuously refines. Advisor removes the hardest part — interpreting raw telecom signals and translating them into a model-specific risk assessment — while leaving the final decision logic, threshold configuration, and business rules in your hands. Over time, as you build confidence in specific signals and models, the decision engine can be tuned to weight telecom signals more heavily in the journeys where they consistently prove decisive, and more lightly in contexts where other signals dominate. The result is a fraud and experience strategy that is both principled and adaptive — one that gets sharper with every interaction.