RiskOS™ Dashboard Setup

Set up Sigma First-Party Fraud in the RiskOS™ Dashboard

Before you start

Make sure you have the following:

Access to the RiskOS™ Dashboard with the Sigma First-Party Fraud enrichment enabled.

Your account owner or administrator can enable this for you. If you're unsure who to contact, reach out to support for assistance.

A basic understanding of RiskOS™ workflows and components.

If this is your first time working with workflows, review the Workflow overview to understand inputs, enrichments, routing logic, and decisions.

How it works

Sigma First-Party Fraud is a fraud detection enrichment available in RiskOS™. It evaluates identity and account attributes against consortium data to identify signals associated with first-party abuse.

Sigma First-Party Fraud returns:

Fraud risk scores: Indicate the likelihood of first-party abuse.
Risk signals: Surface relevant behavioral patterns and anomalies.
Reason codes: Explain the contributing factors behind the assessed risk.

These outputs can be used to inform routing, review, or escalation decisions in your workflows.

How Sigma First-Party Fraud fits into a workflow

In RiskOS™, workflows are built by connecting reusable components. Sigma First-Party Fraud is added as an Enrichment step.

Once the enrichment runs, its outputs are available to downstream workflow components, including:

Conditions
Decision rules
Rule score cards
Manual review steps
Final decisions

For more detail on these components, see Workflow Steps.

Execution flow in RiskOS™

Sigma First-Party Fraud runs synchronously as part of a RiskOS™ workflow. There is no user handoff or pause in execution.

flowchart LR
    A[Input]
    B[First-Party Fraud]
    C[Routing logic]
    D[Decision]

    A --> B --> C --> D

At a high level, the execution flow looks like this:

Input
You call the Evaluation API with identity and account attributes.
Sigma First-Party Fraud enrichment
RiskOS™ evaluates the provided attributes against consortium data and returns fraud risk scores, signals, and reason codes.
Routing logic
The workflow evaluates risk scores, signals, and reason codes.
Decision
The workflow returns a final outcome (for example, Accept, Review, or Reject).

Workflow components used by Sigma First-Party Fraud

Sigma First-Party Fraud uses a subset of standard RiskOS™ workflow components.

Component	Purpose	Typical input	Output / What to use next
Input	Start an evaluation	Identity and account attributes	Workflow execution begins
Enrichment	Detect first-party fraud	—	Risk score, signals, reason codes
Condition	Branch based on risk or signals	Fraud risk outputs	Route to appropriate path
Decision Rule / Score Card	Apply policy or scoring logic	Fraud risk outputs	Pass/fail or cumulative risk classification
Decision	Emit final outcome	Routed value	Accept / Review / Reject

Configure Sigma First-Party Fraud

Add Sigma First-Party Fraud to a workflow

In the RiskOS™ Dashboard, go to Workflows and create a new workflow or open an existing one.
On the workflow canvas, select the plus (+) icon.
Add an Enrichment step and select Sigma First-Party Fraud.

After the enrichment is added, its outputs can be referenced by downstream workflow logic.

Configure inputs and routing

Sigma First-Party Fraud evaluates the identity and account attributes provided by your workflow. Providing complete and consistent inputs improves matching accuracy and risk assessment.

You can use Sigma First-Party Fraud outputs—including risk scores, signals, and reason codes—to configure routing logic that supports outcomes such as Accept, Review, or Reject.

Routing strategies should align with your organization’s fraud policy and risk tolerance.

Save and publish

Once your workflow is configured, publish it to go live.

Workflow testing checklist

Use this checklist to confirm accuracy, resilience, and completeness before going live.

Required identity attributes are collected and passed correctly

Workflow routing aligns with your fraud policy and risk tolerance

Review and escalation paths are clearly defined

Scores and reason codes are accessible to relevant teams