Suspension reason codes | ID.me Developer

Some FEN events include a reason field, the full list of current reason codes is included below. Reason codes can be added as new fraud rules are implemented by ID.me.

Tables are sorted by is_fraud by default. Select a column header to sort by reason_code or is_fraud.

Manual

The following sample Account disabled events show how these fields appear for a non-fraud suspension (reason code 30005) and a fraud suspension (reason code 30007).

Sample account-disabled event (is_fraud false)

{
  "iss": "https://events.id.me",
  "jti": "756E69717565206964656E746966696572",
  "iat": 1508184845,
  "aud": "636C69656E745F6964",
  "events": {
    "https://schemas.openid.net/secevent/risc/event-type/account-disabled": {
      "subject": {
        "format": "iss_sub",
        "iss": "https://events.id.me",
        "sub": "user-uuid-1234"
      },
      "reason": "Manual suspension: Member unfamiliar with wallet",
      "is_fraud": false,
      "reason_code": 30005
    }
  }
}

Sample account-disabled event (is_fraud true)

{
  "iss": "https://events.id.me",
  "jti": "756E69717565206964656E746966696572",
  "iat": 1508184845,
  "aud": "636C69656E745F6964",
  "events": {
    "https://schemas.openid.net/secevent/risc/event-type/account-disabled": {
      "subject": {
        "format": "iss_sub",
        "iss": "https://events.id.me",
        "sub": "user-uuid-1234"
      },
      "reason": "Manual suspension: Flagged for fraudulent activity",
      "is_fraud": true,
      "reason_code": 30007
    }
  }
}

reason_code	reason	is_fraud
`30005`	Manual suspension: Member unfamiliar with wallet	`FALSE`
`30006`	Manual suspension: Duplicate wallet	`FALSE`
`30010`	Manual suspension: Member no longer interested in ID.me	`FALSE`
`30002`	Manual suspension: Wallet sharing	`TRUE`
`30004`	Manual suspension: Bulk suspension	`TRUE`
`30007`	Manual suspension: Flagged for fraudulent activity	`TRUE`
`30008`	Manual suspension: Member-reported hacking	`TRUE`

Real Time

The following sample Account disabled events show how these fields appear for a non-fraud suspension (reason code 20002) and a fraud suspension (reason code 20001).

Sample account-disabled event (is_fraud false)

{
  "iss": "https://events.id.me",
  "jti": "756E69717565206964656E746966696572",
  "iat": 1508184845,
  "aud": "636C69656E745F6964",
  "events": {
    "https://schemas.openid.net/secevent/risc/event-type/account-disabled": {
      "subject": {
        "format": "iss_sub",
        "iss": "https://events.id.me",
        "sub": "user-uuid-1234"
      },
      "reason": "SMS consent denied",
      "is_fraud": false,
      "reason_code": 20002
    }
  }
}

Sample account-disabled event (is_fraud true)

{
  "iss": "https://events.id.me",
  "jti": "756E69717565206964656E746966696572",
  "iat": 1508184845,
  "aud": "636C69656E745F6964",
  "events": {
    "https://schemas.openid.net/secevent/risc/event-type/account-disabled": {
      "subject": {
        "format": "iss_sub",
        "iss": "https://events.id.me",
        "sub": "user-uuid-1234"
      },
      "reason": "Fraud detected during document verification",
      "is_fraud": true,
      "reason_code": 20001
    }
  }
}

reason_code	reason	is_fraud
`20002`	SMS consent denied	`FALSE`
`20001`	Fraud detected during document verification	`TRUE`
`20005`	Too many failed attempts for password or MFA	`TRUE`
`20006`	1:N face match fraud detected	`TRUE`
`20007`	1:1 face match fraud detected	`TRUE`
`20008`	Wallet suspended because an IP address outside of the US, or a residential proxy, was detected during the in-person flow	`TRUE`
`20009`	OFAC sanctions code returned for unauthorized user	`TRUE`
`20013`	Wallet suspended due to anomalies detected during in-person registration attempt	`TRUE`
`20014`	Wallet creation activity matched known fraudulent patterns	`TRUE`
`20015`	Wallet creation activity matched known fraudulent patterns	`TRUE`
`20016`	Login behavior matched patterns associated with unauthorized access	`TRUE`
`20017`	Device indicators were associated with fraud	`TRUE`
`20018`	MFA setup and network indicators were associated with fraud	`TRUE`
`20019`	Verification shifted across devices in a pattern consistent with fraud	`TRUE`
`20020`	Identity details were reused across wallets	`TRUE`
`20021`	Network indicators were associated with fraud	`TRUE`
`20022`	Device indicators were associated with fraud	`TRUE`

Batch

All current batch reason codes are fraud suspensions. The following sample Account disabled event shows how these fields appear for reason code 10001.

Sample account-disabled event (is_fraud true)

{
  "iss": "https://events.id.me",
  "jti": "756E69717565206964656E746966696572",
  "iat": 1508184845,
  "aud": "636C69656E745F6964",
  "events": {
    "https://schemas.openid.net/secevent/risc/event-type/account-disabled": {
      "subject": {
        "format": "iss_sub",
        "iss": "https://events.id.me",
        "sub": "user-uuid-1234"
      },
      "reason": "Device indicators were associated with fraud",
      "is_fraud": true,
      "reason_code": 10001
    }
  }
}

reason_code	reason	is_fraud
`10001`	Device indicators were associated with fraud	`TRUE`
`10002`	Wallet access shifted across devices, networks, or locations in a way consistent with unauthorized access	`TRUE`
`10003`	Login behavior matched patterns associated with unauthorized access	`TRUE`
`10004`	Email attributes matched repeated or automated wallet creation patterns	`TRUE`
`10005`	Email domain characteristics matched known fraudulent use	`TRUE`
`10006`	MFA setup used a device linked to prior fraud	`TRUE`
`10007`	Email and device attributes were associated with fraud	`TRUE`
`10009`	Email domain characteristics matched known fraudulent use, and identity, device, or MFA setup indicators were associated with fraud	`TRUE`
`10012`	Identity and device attributes were reused across wallets in a pattern associated with fraud	`TRUE`
`10013`	Identity details changed across verification attempts, and network signals were associated with fraud	`TRUE`
`10014`	MFA, device, network, and identity indicators were associated with fraud	`TRUE`
`10016`	Several contact, device, network, and document indicators were associated with fraud	`TRUE`
`10020`	MFA recovery used a device or network associated with fraud	`TRUE`
`10026`	MFA setup or use occurred with device or network indicators associated with fraud	`TRUE`
`10029`	MFA setup or use occurred with phone or network indicators associated with fraud	`TRUE`
`10030`	Wallet access shifted across devices, networks, or locations in a way consistent with unauthorized access	`TRUE`
`10032`	MFA setup and use occurred with device and network indicators associated with fraud	`TRUE`
`10035`	Device and network signals were associated with fraud	`TRUE`
`10042`	Phone number and network signals were associated with fraud	`TRUE`
`10043`	Email and device attributes matched repeated or automated wallet creation patterns	`TRUE`
`10046`	Device and network signals were associated with fraud	`TRUE`
`10047`	Wallet access shifted across devices, networks, or locations in a way consistent with unauthorized access	`TRUE`
`10048`	Wallet access shifted across devices, networks, or locations in a way consistent with unauthorized access	`TRUE`
`10049`	Identity details conflicted across verification attempts	`TRUE`
`10050`	Email, phone, and verification indicators were associated with fraud	`TRUE`
`10051`	Device, phone, email, and verification indicators were associated with fraud	`TRUE`
`10052`	Document details and phone number were associated with fraud	`TRUE`
`10055`	Email address changes occurred at a velocity associated with fraud	`TRUE`
`10056`	Identity attributes were reused across wallets in a pattern associated with fraud	`TRUE`
`10057`	Device and network signals were associated with fraud	`TRUE`
`10061`	Login behavior, device, and network indicators matched credential compromise or phishing patterns	`TRUE`
`10062`	Network location changed unexpectedly during identity verification, in a pattern associated with fraud	`TRUE`
`10063`	Email, MFA, phone, and document indicators were associated with fraud	`TRUE`
`10064`	User-reported location and network signals were associated with fraud	`TRUE`
`10065`	Device indicators were associated with fraud	`TRUE`
`10066`	Supervised verification showed device, network, and identity inconsistencies associated with fraud	`TRUE`
`10067`	Phone number was reused across wallets in a pattern associated with fraud	`TRUE`
`10071`	MFA setup and document quality issues were associated with fraud	`TRUE`
`10072`	Device or network telemetry linked the wallet to prior fraud or coordinated activity	`TRUE`
`10073`	Device signals were linked to prior fraud or coordinated activity	`TRUE`
`10074`	Email attributes and document quality issues were associated with fraud	`TRUE`
`10076`	Remote access infrastructure and device signals were associated with fraud	`TRUE`
`10078`	Document quality or consistency issues and device telemetry were associated with fraud	`TRUE`
`10080`	MFA setup or use occurred with device or network indicators associated with fraud	`TRUE`
`10083`	Device signals were linked to prior fraud or coordinated activity	`TRUE`
`10084`	Multiple identity and email indicators were associated with fraud	`TRUE`
`10085`	Multiple identity and email indicators were associated with fraud	`TRUE`
`10086`	Multiple identity, email, and login behavior indicators were associated with fraud	`TRUE`
`10088`	MFA setup and use, device, and network indicators matched credential compromise patterns	`TRUE`
`10089`	Device signals and failed verification patterns across wallets were associated with fraud	`TRUE`
`10094`	Wallet creation activity matched automated shell wallet patterns	`TRUE`
`10095`	Document attributes were reused or failed validation patterns across wallets	`TRUE`
`10098`	Email attributes matched repeated or automated wallet creation patterns, and verification checks failed	`TRUE`
`10099`	Wallet revocation occurred after device or network indicators associated with fraud	`TRUE`
`10100`	Phone number was reused across wallets in a pattern associated with fraud	`TRUE`
`10101`	MFA setup involved a device, method, and phone number that were reused across multiple wallets	`TRUE`
`10103`	Wallet creation activity matched automated shell wallet patterns	`TRUE`
`10104`	MFA setup and use occurred with device and network indicators associated with fraud	`TRUE`
`10106`	Wallet creation activity matched automated shell wallet patterns	`TRUE`
`10108`	MFA setup used a device associated with fraud	`TRUE`
`10109`	Email attributes matched repeated or automated wallet creation patterns, and device signals were associated with fraud	`TRUE`
`10110`	Document attributes were reused or failed validation patterns across wallets	`TRUE`
`10111`	Remote access or network anonymization infrastructure was used during wallet activity in a pattern associated with phishing	`TRUE`
`10113`	MFA use, device, and network signals were linked to prior fraud or coordinated activity	`TRUE`
`10114`	MFA setup used a device associated with fraud	`TRUE`
`10115`	Wallet creation activity matched automated shell wallet patterns	`TRUE`
`10116`	Device signals, MFA setup, email attributes, or document verification issues were associated with fraud	`TRUE`
`10117`	MFA behavior matched patterns associated with credential compromise	`TRUE`
`10118`	Wallet activity was linked to a known phishing site network	`TRUE`
`10119`	Login and MFA behavior matched credential compromise patterns	`TRUE`
`10120`	Identity details were reused across wallets, and device or network indicators were associated with fraud	`TRUE`
`10122`	Phone, device, and wallet-linkage patterns matched coordinated fraud activity	`TRUE`
`10124`	MFA setup, device, and network indicators were associated with fraud	`TRUE`
`10125`	MFA setup, device, and network indicators were associated with fraud	`TRUE`
`10126`	Device or network telemetry linked the wallet to prior fraud or coordinated activity	`TRUE`
`10127`	Device or network telemetry linked the wallet to prior fraud or coordinated activity	`TRUE`
`10128`	Wallet creation activity matched automated shell wallet patterns	`TRUE`
`10129`	Wallet creation activity matched automated shell wallet patterns	`TRUE`
`10130`	Wallet creation activity matched automated shell wallet patterns	`TRUE`
`10131`	Wallet creation activity matched automated shell wallet patterns	`TRUE`
`10132`	Device and network indicators were associated with fraud	`TRUE`
`10133`	Device signals were linked to prior fraud or coordinated activity	`TRUE`
`10134`	MFA setup and device patterns matched coordinated fraud activity	`TRUE`
`10135`	Email attributes matched repeated or automated wallet creation patterns, and device or network signals were associated with fraud	`TRUE`
`10136`	Remote access or network anonymization infrastructure was used during wallet activity in a pattern associated with phishing	`TRUE`
`10137`	Login and MFA setup behavior matched patterns associated with unauthorized access	`TRUE`
`10138`	Device and network telemetry linked the wallet to prior fraud or coordinated activity	`TRUE`
`10139`	Wallet creation activity matched automated shell wallet patterns	`TRUE`
`10140`	Verification-attempt and network telemetry matched patterns associated with coordinated abuse	`TRUE`
`10141`	Wallet creation activity matched automated shell wallet patterns	`TRUE`
`10142`	Email attributes matched automated wallet creation patterns and registration signals were associated with fraud	`TRUE`
`10143`	Wallet activity matched revenue share fraud patterns	`TRUE`
`10144`	Associated with SSN Probing	`TRUE`
`10145`	MFA setup and use occurred with device and network indicators associated with fraud	`TRUE`
`10146`	MFA setup or use occurred with device or network indicators associated with fraud	`TRUE`
`10147`	Account activity matched patterns associated with coordinated fraud	`TRUE`
`10148`	Remote access or network anonymization infrastructure was used during wallet activity in a pattern associated with phishing	`TRUE`