Fraud doesn't often show up as a single signal; instead, it reveals itself through many small ones: a device that looks off, a network that could be considered risky, a cluster of accounts in the same place.
RF-1 is Radar’s new proprietary risk model for users and devices. It is built on Radar's Location Intelligence Graph drawing on more than 100 billion location observations a year, using machine learning trained on labeled outcomes to score each location check from 0 to 100 at track time.
Because the Graph reads each check alongside the devices around it, RF-1 can catch coordinated and nuanced fraud that no single signal reveals. You can click into any score to see the factors behind it, and send Radar labeled data to tune it to the fraud you see.
Instead of judging each location check alone, RF-1 scores a check in the context of nearby devices, shared networks, and patterns Radar has seen before, which means it can surface fraud that shows up as many small signals. Here we'll dive into what goes into the score, what the number means, and how it fits the fraud workflow you already have.
What is RF-1, and why did we build it?
RF-1 is a machine learning model that produces a risk score from 0 to 100 for each location check. Detecting spoofed locations and other basic manipulation is a requirement of geo-compliance, and Radar's geo-compliance checks continue to do that. RF-1 is built for what compliance does not require: signals of sophisticated, coordinated fraud, such as risky devices, accounts that move together, and patterns that only show up across many users, devices, and places. It learns from the labeled outcomes you send to Radar.
A higher RF-1 score means higher risk. It is a proprietary Radar score, and it ranks risk, which is different from a probability, as the section on what a score means explains.
What goes into the RF-1 risk score?
The score reflects several kinds of input:
- Warning reasons, and combinations of them: individual signals matter, and so does how they appear together.
- Context from the graph: for example, how a device looks next to other devices transacting at the same physical location or street address. Hotspots are one of these factors, and as the graph grows, more of what it learns flows into RF-1.
- Strong known signals: some combinations are clear indicators, such as a jailbroken device on an unusual proxy, and our fraud team scores those directly.
- Your labeled outcomes: tell Radar which users and devices were fraudulent or legitimate, and the model learns from them.
Device context carries real signal. Devices associated with multiple users or location hotspots were 10x more likely to exhibit multiple distinct Radar fraud signals.
What does an RF-1 score mean?
Risk scores are on a scale from 0 to 100, where 0-39 is considered low risk, 40-69 is medium risk, and 70+ is high risk. The scale is for ranking risk, not for reading as a percentage.
RF-1 is not a probability that a user is fraudulent. It is Radar’s own score, and it reflects patterns in labeled outcomes, so an individual user can score lower or higher than you might expect. Treat it as a way to prioritize and investigate, and use the factors to judge each case.
Inside Radar, teams will see more users with low or medium scores, creating a more nuanced map of risk. Click into a score to see the factors that produced it. From a device with many users, open the network graph to see other users and devices, then go further by clicking on those to see their risk scores.
For example, a user within about 150 meters of a city center, with a suspicious location accuracy reading and many users on the same device, earns a score of 80. Opening the score shows all the factors that drove the scoring, so your team can decide what to do. You see why a user scored the way they did, not just that they did.
How do labels, suggested rules, and backtesting work with RF-1?
They help you teach Radar what fraud means for your business and act on what you find.
- Labels: mark users and devices as fraudulent or legitimate, and tag the type, such as promo abuse, account takeover, or a chargeback.
- Suggested rules: Radar proposes rules in plain if-then logic from your labeled outcomes, so you can see exactly what triggers each one.
- Backtesting: test a rule against past activity to see its effect before you turn it on.
Who are RF-1 risk scores for?
With RF-1, fraud analysts get a way to organize their work and explain a decision. Fraud leaders get a clearer picture of where risk sits. Teams that run their own real-time models can use the score as one more input. It is built to work alongside the device, identity, and network tools you already use, to further strengthen your risk stance.
Frequently asked questions
Do existing customers need to change their fraud rules?
No. Radar still returns low, medium, and high levels, so rules you already have keep working. Existing projects stay on their current risk scores until they opt in to RF-1.
What does Radar add beyond what iOS and Android already provide?
iOS and Android give you a location and a few basic flags, such as whether it was simulated by software. Radar adds spoofing and emulator detection, plus signals from the graph such as hotspots and RF-1, so you can see patterns across accounts and not just a single check.
Does Radar share fraud signals across customers?
We do not share individual user or device records across customers, and a block by one customer does not become a block for another. We do use anonymized, aggregated learnings across eligible customers to improve how risk is scored.
How do you get RF-1?
RF-1 is opt-in for existing projects. Contact our fraud operations team at fraud-ops@radar.com to learn more, book a demo, or join our 11/19 session on the fraud you can uncover with Radar.
