Quick access
Identity & Access Abuse
Procurement & Vendor Fraud
Logistics & Inventory Manipulation
Marketplace & Data Integrity
Compliance Quality & Safety
Identity & Access Abuse
Ato Login Activity By Region Hour
New logins from unfamiliar regions immediately before PO approvals or price updates.
Failed Vs Successful Logins
Spike of failed logins followed by a successful one (ATO credential testing).
Devices Supplier Accounts Coordination
Many supplier accounts tied to the same device/IP submitting RFQs — evidence of a multi-account ring.
Device Fingerprint Reuse Across Supplier Tax Ids
Reused device fingerprints across distinct VAT/EIN tax IDs.
| device_id | supplier_ids | tax_ids |
|---|---|---|
| Dev-1 | S132 | 100000118 |
| Dev-2 | S103 | 100000060 |
| Dev-3 | S100 | 100000035 |
| Dev-4 | S104, S105 | 100000027, 100000044 |
| Dev-5 | S121 | 100000007, 100000056 |
| Dev-6 | S133 | 100000045, 100000111 |
| Dev-7 | S119 | 100000060 |
| Dev-8 | S134 | 100000117 |
| Dev-9 | S103, S109, S115 | 100000003 |
| Dev-10 | S116, S123 | 100000091 |
Device-fingerprint solution: Identifies reused devices across supplier tax IDs. See: https://www.crossclassify.com/solutions/device-fingerprint/
Contact Change Password Reset Coupling
Email or phone change followed by password/MFA reset within minutes — indicates social engineering of support.
MFA solution: Enforces stronger checks during password recovery flows. See: https://www.crossclassify.com/solutions/account-takeover/
Support Ticket Credential Change Proximity
Support tickets immediately preceding credential changes — potential social engineering bypass.
| ticket_id | channel | change_event | minutes_before_change |
|---|---|---|---|
| T1 | chat | pwd_reset | 5 |
| T2 | phone | email_change | 15 |
| T3 | pwd_reset | 60 | |
| T4 | chat | mfa_reset | 7 |
| T5 | phone | pwd_reset | 3 |
| T6 | chat | pwd_reset | 120 |
| T7 | email_change | 30 | |
| T8 | phone | pwd_reset | 4 |
| T9 | chat | email_change | 9 |
| T10 | mfa_reset | 6 |
Procurement & Vendor Fraud
Document Hash Reuse Across Suppliers
COI/COA/ISO document fingerprint/hash reuse across suppliers — evidence of document forgery.
| doc_hash | suppliers_using |
|---|---|
| H1 | 3 |
| H2 | 5 |
| H3 | 9 |
| H4 | 5 |
| H5 | 3 |
| H6 | 4 |
| H7 | 3 |
| H8 | 5 |
| H9 | 5 |
| H10 | 5 |
Account-opening solution: Prevents counterfeit supplier onboarding. See: https://www.crossclassify.com/solutions/account-opening/
Email Domain Age New Suppliers
Newly registered or low-reputation email domains on applications — potential fake supplier indicators.
Po Amount Changes After Approval
PO amount materially increased after approval — potential manipulation and fraud.
| po_id | approved_amount | final_amount | delta |
|---|---|---|---|
| PO1 | 59612.84 | 12824.77 | -46788.07 |
| PO2 | 82132.64 | 39528.45 | -42604.19 |
| PO3 | 18471.98 | 23754.45 | 5282.47 |
| PO4 | 88501.95 | 103501.95 | 15000 |
| PO5 | 49859.27 | 68816.85 | 18957.58 |
| PO6 | 11566.36 | 55242.38 | 43676.02 |
| PO7 | 60213.27 | 78811.5 | 18598.23 |
| PO8 | 44503.5 | 87484.93 | 42981.43 |
| PO9 | 71661.94 | 32501.92 | -39160.02 |
| PO10 | 26450.14 | 87970.04 | 61519.9 |
Duplicate Invoice Number Occurrences
Duplicate invoice numbers across suppliers — potential invoice manipulation and fraud.
Bank Change Large Payout 24h
Beneficiary bank change followed by large payout within 24 hours — potential payout diversion.
MFA solution: Enforces multi-factor checks for bank detail edits. See: https://www.crossclassify.com/solutions/account-takeover/
Same Bank Account Multiple Suppliers
Same bank account used by multiple suppliers — potential payout diversion and fraud.
Logistics & Inventory Manipulation
Asn Vs Received Quantity Variance
ASN quantity deviates from received quantity — potential tampering or mis-shipments.
Behavioral-biometrics solution: Detects manipulation during ASN entries. See: https://www.crossclassify.com/solutions/behavioral-biometrics/
Asn Edit Bursts Truck Arrival
ASN edits spike minutes before truck arrival — potential last-minute tampering.
Inventory Adjustments Night Shift Hotspots
Repeated high-value adjustments concentrated in night shifts — potential fraud indicators.
Behavioral-biometrics solution: Detects insider fraud via suspicious adjustment patterns. See: https://www.crossclassify.com/solutions/behavioral-biometrics/
Adjustment Operators Spanning Warehouses
Same user/device performing adjustments across many warehouses — potential coordinated fraud.
| user_device | warehouses_spanned |
|---|---|
| U1-D1 | 7 |
| U2-D2 | 1 |
| U3-D3 | 3 |
| U4-D4 | 1 |
| U5-D5 | 2 |
| U6-D6 | 1 |
| U7-D7 | 3 |
| U8-D8 | 3 |
| U9-D9 | 2 |
| U10-D10 | 2 |
Gps Speed Anomaly Over Time
Speeds beyond policy thresholds — potential GPS/IoT telemetry spoofing.
Distance Between Consecutive Pings
Large distance between consecutive pings ('teleport' jumps) — potential location spoofing.
Marketplace & Data Integrity
Requests Per User Agent Group
Excessive requests from headless or script user-agents — potential price scraping activity.
Bot-attack solution: Stops automated scraping of supplier data. See: https://www.crossclassify.com/solutions/bot-attack/
Search To Rfq Ratio By Ip Range
High search-to-RFQ ratios from certain IP ranges — potential botting activity.
| ip_range | searches | rfqs | ratio |
|---|---|---|---|
| Block-1 | 2975 | 195 | 15.26 |
| Block-2 | 1334 | 82 | 16.27 |
| Block-3 | 437 | 163 | 400 |
| Block-4 | 2322 | 26 | 89.31 |
| Block-5 | 1054 | 85 | 12.4 |
| Block-6 | 810 | 68 | 11.91 |
| Block-7 | 1786 | 149 | 11.99 |
| Block-8 | 251 | 112 | 2.24 |
| Block-9 | 426 | 1 | 426 |
| Block-10 | 997 | 42 | 23.74 |
Bot-attack solution: Blocks reconnaissance-heavy IP ranges during RFQs. See: https://www.crossclassify.com/solutions/bot-attack/
Review Volume By Account Cohort
Review bursts from new accounts on the same day — potential coordinated manipulation.
Ips Profiles Coordinated Review
IP clusters posting across multiple vendor/product profiles — potential coordinated fraud.
Quoted Vs Charged Price Delta
Mismatch between quoted and charged price — potential parameter tampering.
| quote_id | quoted_price | charged_price | delta |
|---|---|---|---|
| Q1 | 2765.76 | 2590.34 | -175.42 |
| Q2 | 1932.06 | 1506.81 | -425.25 |
| Q3 | 4785.6 | 2203.91 | -2581.69 |
| Q4 | 4952.81 | 898.62 | -4054.19 |
| Q5 | 3978.35 | 4328.35 | 350 |
| Q6 | 682.55 | 2426.97 | 1744.42 |
| Q7 | 1657.61 | 1519.89 | -137.72 |
| Q8 | 4806.18 | 1423.66 | -3382.52 |
| Q9 | 2808.32 | 1265.41 | -1542.91 |
| Q10 | 565.47 | 1986.32 | 1420.85 |
Unsupported Parameters Requests
Unsupported parameters/codes in requests — potential deep link tampering.
Compliance Quality & Safety
Certificate Days To Expiry
Expired COI/COA/ISO used with shipments or tenders — potential document fraud.
| supplier | doc_type | days_to_expiry |
|---|---|---|
| S1 | COI | 54 |
| S2 | COA | -19 |
| S3 | ISO9001 | -38 |
| S4 | MSDS | -13 |
| S5 | COI | 73 |
| S6 | COA | 36 |
| S7 | ISO9001 | 29 |
| S8 | COA | -22 |
| S9 | COI | 4 |
| S10 | MSDS | 80 |
Account-opening solution: Blocks expired or fraudulent certificates during onboarding. See: https://www.crossclassify.com/solutions/account-opening/
Pdf Fingerprint Reuse Suppliers
PDF document fingerprint reuse across suppliers — potential document forgery.
| doc_hash | suppliers_reused |
|---|---|
| H1 | 4 |
| H2 | 8 |
| H3 | 4 |
| H4 | 3 |
| H5 | 4 |
| H6 | 2 |
| H7 | 3 |
Inspection Submissions Per Minute
Burst of inspection submissions in a single minute — potential QC falsification.
Bot-attack solution: Prevents automated falsification of inspections. See: https://www.crossclassify.com/solutions/bot-attack/
Inspection Geofence Hit Site
Inspections recorded outside the site geofence — potential location falsification.
| inspection_id | site | geofence_hit |
|---|---|---|
| I1 | Plant-1 | Yes |
| I2 | Plant-1 | No |
| I3 | Plant-1 | Yes |
| I4 | Plant-1 | Yes |
| I5 | Plant-1 | No |
| I6 | Plant-1 | Yes |
| I7 | Plant-1 | Yes |
| I8 | Plant-1 | No |
| I9 | Plant-1 | Yes |
| I10 | Plant-1 | Yes |
Chain Of Custody Timestamp Violations
Chain-of-custody timestamps out of order — potential provenance integrity issues.
Provenance Path Anomalies
Unusual path anomalies in provenance graph — potential process flow manipulation.