> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.id.me/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.id.me/_mcp/server.

# Suspension reason codes

> Reference list of the reason codes ID.me includes in Fraud Event Notification (FEN) events.

Some FEN events include a `reason` field, the full list of current reason codes is included below. Reason codes can be added as new fraud rules are implemented by ID.me.

Tables are sorted by `is_fraud` by default. Select a column header to sort by `reason_code` or `is_fraud`.

## Manual

The following sample Account disabled events show how these fields appear for a non-fraud suspension (reason code `30005`) and a fraud suspension (reason code `30007`).

**`Sample account-disabled event (is_fraud false)`**

```json Sample account-disabled event (is_fraud false)
{
  "iss": "https://events.id.me",
  "jti": "756E69717565206964656E746966696572",
  "iat": 1508184845,
  "aud": "636C69656E745F6964",
  "events": {
    "https://schemas.openid.net/secevent/risc/event-type/account-disabled": {
      "subject": {
        "format": "iss_sub",
        "iss": "https://events.id.me",
        "sub": "user-uuid-1234"
      },
      "reason": "Manual suspension: Member unfamiliar with wallet",
      "is_fraud": false,
      "reason_code": 30005
    }
  }
}
```

**`Sample account-disabled event (is_fraud true)`**

```json Sample account-disabled event (is_fraud true)
{
  "iss": "https://events.id.me",
  "jti": "756E69717565206964656E746966696572",
  "iat": 1508184845,
  "aud": "636C69656E745F6964",
  "events": {
    "https://schemas.openid.net/secevent/risc/event-type/account-disabled": {
      "subject": {
        "format": "iss_sub",
        "iss": "https://events.id.me",
        "sub": "user-uuid-1234"
      },
      "reason": "Manual suspension: Flagged for fraudulent activity",
      "is_fraud": true,
      "reason_code": 30007
    }
  }
}
```

<table>
  <thead>
    <tr>
      <th data-sort="number">
        reason_code
      </th>

      <th>
        reason
      </th>

      <th data-sort="text">
        is_fraud
      </th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>
        `30005`
      </td>

      <td>
        Manual suspension: Member unfamiliar with wallet
      </td>

      <td>
        `FALSE`
      </td>
    </tr>

    <tr>
      <td>
        `30006`
      </td>

      <td>
        Manual suspension: Duplicate wallet
      </td>

      <td>
        `FALSE`
      </td>
    </tr>

    <tr>
      <td>
        `30010`
      </td>

      <td>
        Manual suspension: Member no longer interested in ID.me
      </td>

      <td>
        `FALSE`
      </td>
    </tr>

    <tr>
      <td>
        `30002`
      </td>

      <td>
        Manual suspension: Wallet sharing
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `30004`
      </td>

      <td>
        Manual suspension: Bulk suspension
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `30007`
      </td>

      <td>
        Manual suspension: Flagged for fraudulent activity
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `30008`
      </td>

      <td>
        Manual suspension: Member-reported hacking
      </td>

      <td>
        `TRUE`
      </td>
    </tr>
  </tbody>
</table>

## Real Time

The following sample Account disabled events show how these fields appear for a non-fraud suspension (reason code `20002`) and a fraud suspension (reason code `20001`).

**`Sample account-disabled event (is_fraud false)`**

```json Sample account-disabled event (is_fraud false)
{
  "iss": "https://events.id.me",
  "jti": "756E69717565206964656E746966696572",
  "iat": 1508184845,
  "aud": "636C69656E745F6964",
  "events": {
    "https://schemas.openid.net/secevent/risc/event-type/account-disabled": {
      "subject": {
        "format": "iss_sub",
        "iss": "https://events.id.me",
        "sub": "user-uuid-1234"
      },
      "reason": "SMS consent denied",
      "is_fraud": false,
      "reason_code": 20002
    }
  }
}
```

**`Sample account-disabled event (is_fraud true)`**

```json Sample account-disabled event (is_fraud true)
{
  "iss": "https://events.id.me",
  "jti": "756E69717565206964656E746966696572",
  "iat": 1508184845,
  "aud": "636C69656E745F6964",
  "events": {
    "https://schemas.openid.net/secevent/risc/event-type/account-disabled": {
      "subject": {
        "format": "iss_sub",
        "iss": "https://events.id.me",
        "sub": "user-uuid-1234"
      },
      "reason": "Fraud detected during document verification",
      "is_fraud": true,
      "reason_code": 20001
    }
  }
}
```

<table>
  <thead>
    <tr>
      <th data-sort="number">
        reason_code
      </th>

      <th>
        reason
      </th>

      <th data-sort="text">
        is_fraud
      </th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>
        `20002`
      </td>

      <td>
        SMS consent denied
      </td>

      <td>
        `FALSE`
      </td>
    </tr>

    <tr>
      <td>
        `20001`
      </td>

      <td>
        Fraud detected during document verification
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `20005`
      </td>

      <td>
        Too many failed attempts for password or MFA
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `20006`
      </td>

      <td>
        1:N face match fraud detected
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `20007`
      </td>

      <td>
        1:1 face match fraud detected
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `20008`
      </td>

      <td>
        Wallet suspended because an IP address outside of the US, or a residential proxy, was detected during the in-person flow
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `20009`
      </td>

      <td>
        OFAC sanctions code returned for unauthorized user
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `20013`
      </td>

      <td>
        Wallet suspended due to anomalies detected during in-person registration attempt
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `20014`
      </td>

      <td>
        Wallet creation activity matched known fraudulent patterns
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `20015`
      </td>

      <td>
        Wallet creation activity matched known fraudulent patterns
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `20016`
      </td>

      <td>
        Login behavior matched patterns associated with unauthorized access
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `20017`
      </td>

      <td>
        Device indicators were associated with fraud
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `20018`
      </td>

      <td>
        MFA setup and network indicators were associated with fraud
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `20019`
      </td>

      <td>
        Verification shifted across devices in a pattern consistent with fraud
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `20020`
      </td>

      <td>
        Identity details were reused across wallets
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `20021`
      </td>

      <td>
        Network indicators were associated with fraud
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `20022`
      </td>

      <td>
        Device indicators were associated with fraud
      </td>

      <td>
        `TRUE`
      </td>
    </tr>
  </tbody>
</table>

## Batch

All current batch reason codes are fraud suspensions. The following sample Account disabled event shows how these fields appear for reason code `10001`.

**`Sample account-disabled event (is_fraud true)`**

```json Sample account-disabled event (is_fraud true)
{
  "iss": "https://events.id.me",
  "jti": "756E69717565206964656E746966696572",
  "iat": 1508184845,
  "aud": "636C69656E745F6964",
  "events": {
    "https://schemas.openid.net/secevent/risc/event-type/account-disabled": {
      "subject": {
        "format": "iss_sub",
        "iss": "https://events.id.me",
        "sub": "user-uuid-1234"
      },
      "reason": "Device indicators were associated with fraud",
      "is_fraud": true,
      "reason_code": 10001
    }
  }
}
```

<table>
  <thead>
    <tr>
      <th data-sort="number">
        reason_code
      </th>

      <th>
        reason
      </th>

      <th data-sort="text">
        is_fraud
      </th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>
        `10001`
      </td>

      <td>
        Device indicators were associated with fraud
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10002`
      </td>

      <td>
        Wallet access shifted across devices, networks, or locations in a way consistent with unauthorized access
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10003`
      </td>

      <td>
        Login behavior matched patterns associated with unauthorized access
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10004`
      </td>

      <td>
        Email attributes matched repeated or automated wallet creation patterns
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10005`
      </td>

      <td>
        Email domain characteristics matched known fraudulent use
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10006`
      </td>

      <td>
        MFA setup used a device linked to prior fraud
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10007`
      </td>

      <td>
        Email and device attributes were associated with fraud
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10009`
      </td>

      <td>
        Email domain characteristics matched known fraudulent use, and identity, device, or MFA setup indicators were associated with fraud
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10012`
      </td>

      <td>
        Identity and device attributes were reused across wallets in a pattern associated with fraud
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10013`
      </td>

      <td>
        Identity details changed across verification attempts, and network signals were associated with fraud
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10014`
      </td>

      <td>
        MFA, device, network, and identity indicators were associated with fraud
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10016`
      </td>

      <td>
        Several contact, device, network, and document indicators were associated with fraud
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10020`
      </td>

      <td>
        MFA recovery used a device or network associated with fraud
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10026`
      </td>

      <td>
        MFA setup or use occurred with device or network indicators associated with fraud
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10029`
      </td>

      <td>
        MFA setup or use occurred with phone or network indicators associated with fraud
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10030`
      </td>

      <td>
        Wallet access shifted across devices, networks, or locations in a way consistent with unauthorized access
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10032`
      </td>

      <td>
        MFA setup and use occurred with device and network indicators associated with fraud
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10035`
      </td>

      <td>
        Device and network signals were associated with fraud
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10042`
      </td>

      <td>
        Phone number and network signals were associated with fraud
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10043`
      </td>

      <td>
        Email and device attributes matched repeated or automated wallet creation patterns
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10046`
      </td>

      <td>
        Device and network signals were associated with fraud
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10047`
      </td>

      <td>
        Wallet access shifted across devices, networks, or locations in a way consistent with unauthorized access
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10048`
      </td>

      <td>
        Wallet access shifted across devices, networks, or locations in a way consistent with unauthorized access
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10049`
      </td>

      <td>
        Identity details conflicted across verification attempts
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10050`
      </td>

      <td>
        Email, phone, and verification indicators were associated with fraud
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10051`
      </td>

      <td>
        Device, phone, email, and verification indicators were associated with fraud
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10052`
      </td>

      <td>
        Document details and phone number were associated with fraud
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10055`
      </td>

      <td>
        Email address changes occurred at a velocity associated with fraud
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10056`
      </td>

      <td>
        Identity attributes were reused across wallets in a pattern associated with fraud
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10057`
      </td>

      <td>
        Device and network signals were associated with fraud
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10061`
      </td>

      <td>
        Login behavior, device, and network indicators matched credential compromise or phishing patterns
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10062`
      </td>

      <td>
        Network location changed unexpectedly during identity verification, in a pattern associated with fraud
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10063`
      </td>

      <td>
        Email, MFA, phone, and document indicators were associated with fraud
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10064`
      </td>

      <td>
        User-reported location and network signals were associated with fraud
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10065`
      </td>

      <td>
        Device indicators were associated with fraud
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10066`
      </td>

      <td>
        Supervised verification showed device, network, and identity inconsistencies associated with fraud
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10067`
      </td>

      <td>
        Phone number was reused across wallets in a pattern associated with fraud
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10071`
      </td>

      <td>
        MFA setup and document quality issues were associated with fraud
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10072`
      </td>

      <td>
        Device or network telemetry linked the wallet to prior fraud or coordinated activity
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10073`
      </td>

      <td>
        Device signals were linked to prior fraud or coordinated activity
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10074`
      </td>

      <td>
        Email attributes and document quality issues were associated with fraud
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10076`
      </td>

      <td>
        Remote access infrastructure and device signals were associated with fraud
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10078`
      </td>

      <td>
        Document quality or consistency issues and device telemetry were associated with fraud
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10080`
      </td>

      <td>
        MFA setup or use occurred with device or network indicators associated with fraud
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10083`
      </td>

      <td>
        Device signals were linked to prior fraud or coordinated activity
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10084`
      </td>

      <td>
        Multiple identity and email indicators were associated with fraud
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10085`
      </td>

      <td>
        Multiple identity and email indicators were associated with fraud
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10086`
      </td>

      <td>
        Multiple identity, email, and login behavior indicators were associated with fraud
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10088`
      </td>

      <td>
        MFA setup and use, device, and network indicators matched credential compromise patterns
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10089`
      </td>

      <td>
        Device signals and failed verification patterns across wallets were associated with fraud
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10094`
      </td>

      <td>
        Wallet creation activity matched automated shell wallet patterns
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10095`
      </td>

      <td>
        Document attributes were reused or failed validation patterns across wallets
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10098`
      </td>

      <td>
        Email attributes matched repeated or automated wallet creation patterns, and verification checks failed
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10099`
      </td>

      <td>
        Wallet revocation occurred after device or network indicators associated with fraud
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10100`
      </td>

      <td>
        Phone number was reused across wallets in a pattern associated with fraud
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10101`
      </td>

      <td>
        MFA setup involved a device, method, and phone number that were reused across multiple wallets
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10103`
      </td>

      <td>
        Wallet creation activity matched automated shell wallet patterns
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10104`
      </td>

      <td>
        MFA setup and use occurred with device and network indicators associated with fraud
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10106`
      </td>

      <td>
        Wallet creation activity matched automated shell wallet patterns
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10108`
      </td>

      <td>
        MFA setup used a device associated with fraud
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10109`
      </td>

      <td>
        Email attributes matched repeated or automated wallet creation patterns, and device signals were associated with fraud
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10110`
      </td>

      <td>
        Document attributes were reused or failed validation patterns across wallets
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10111`
      </td>

      <td>
        Remote access or network anonymization infrastructure was used during wallet activity in a pattern associated with phishing
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10113`
      </td>

      <td>
        MFA use, device, and network signals were linked to prior fraud or coordinated activity
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10114`
      </td>

      <td>
        MFA setup used a device associated with fraud
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10115`
      </td>

      <td>
        Wallet creation activity matched automated shell wallet patterns
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10116`
      </td>

      <td>
        Device signals, MFA setup, email attributes, or document verification issues were associated with fraud
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10117`
      </td>

      <td>
        MFA behavior matched patterns associated with credential compromise
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10118`
      </td>

      <td>
        Wallet activity was linked to a known phishing site network
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10119`
      </td>

      <td>
        Login and MFA behavior matched credential compromise patterns
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10120`
      </td>

      <td>
        Identity details were reused across wallets, and device or network indicators were associated with fraud
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10122`
      </td>

      <td>
        Phone, device, and wallet-linkage patterns matched coordinated fraud activity
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10124`
      </td>

      <td>
        MFA setup, device, and network indicators were associated with fraud
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10125`
      </td>

      <td>
        MFA setup, device, and network indicators were associated with fraud
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10126`
      </td>

      <td>
        Device or network telemetry linked the wallet to prior fraud or coordinated activity
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10127`
      </td>

      <td>
        Device or network telemetry linked the wallet to prior fraud or coordinated activity
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10128`
      </td>

      <td>
        Wallet creation activity matched automated shell wallet patterns
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10129`
      </td>

      <td>
        Wallet creation activity matched automated shell wallet patterns
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10130`
      </td>

      <td>
        Wallet creation activity matched automated shell wallet patterns
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10131`
      </td>

      <td>
        Wallet creation activity matched automated shell wallet patterns
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10132`
      </td>

      <td>
        Device and network indicators were associated with fraud
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10133`
      </td>

      <td>
        Device signals were linked to prior fraud or coordinated activity
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10134`
      </td>

      <td>
        MFA setup and device patterns matched coordinated fraud activity
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10135`
      </td>

      <td>
        Email attributes matched repeated or automated wallet creation patterns, and device or network signals were associated with fraud
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10136`
      </td>

      <td>
        Remote access or network anonymization infrastructure was used during wallet activity in a pattern associated with phishing
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10137`
      </td>

      <td>
        Login and MFA setup behavior matched patterns associated with unauthorized access
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10138`
      </td>

      <td>
        Device and network telemetry linked the wallet to prior fraud or coordinated activity
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10139`
      </td>

      <td>
        Wallet creation activity matched automated shell wallet patterns
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10140`
      </td>

      <td>
        Verification-attempt and network telemetry matched patterns associated with coordinated abuse
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10141`
      </td>

      <td>
        Wallet creation activity matched automated shell wallet patterns
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10142`
      </td>

      <td>
        Email attributes matched automated wallet creation patterns and registration signals were associated with fraud
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10143`
      </td>

      <td>
        Wallet activity matched revenue share fraud patterns
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10144`
      </td>

      <td>
        Associated with SSN Probing
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10145`
      </td>

      <td>
        MFA setup and use occurred with device and network indicators associated with fraud
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10146`
      </td>

      <td>
        MFA setup or use occurred with device or network indicators associated with fraud
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10147`
      </td>

      <td>
        Account activity matched patterns associated with coordinated fraud
      </td>

      <td>
        `TRUE`
      </td>
    </tr>

    <tr>
      <td>
        `10148`
      </td>

      <td>
        Remote access or network anonymization infrastructure was used during wallet activity in a pattern associated with phishing
      </td>

      <td>
        `TRUE`
      </td>
    </tr>
  </tbody>
</table>