Pre-transaction risk control for financial and high-velocity platforms.
Observe-first, on-premise. Install it in your own environment today. See weak fraud signals earlier — before onboarding, payment, or payout workflows create irreversible exposure.
Most controls decide after the request already cost you something.
Onboarding, payment, and payout logic typically screens for risk after a request has already entered application logic, triggered external checks, or reached a workflow that's expensive or irreversible to unwind. That's a poor fit for instant and account-to-account rails, where money — once sent — is gone. Cloud-hosted fraud vendors add a second problem: they need your sensitive data to leave your environment.
Earlier in the path
WoWyrd sits after your trusted edge/TLS termination but before expensive processing — so a risk signal can inform a decision while it's still cheap to act on.
Inside your environment
Runs on-premise / in the operator environment. Raw operational data can stay local — nothing has to leave to get a risk read.
Complementary, not a replacement
Sits alongside KYC, AML, sanctions screening, and existing fraud tooling — a signal layer that helps route what deserves deeper review, not a substitute for any of it.
Six areas, one explainable rule layer.
Deterministic rules, not a black-box score — every flag names the exact pattern it caught.
Bots & anonymous traffic
Tor, VPN, proxy, and datacenter origins; known-bad reputation lists; upstream WAF bot labels.
New accounts & multi-accounting
A brand-new account moving high value fast, or one device/IP behind many distinct accounts.
Account takeover
A payout right after a password reset, a contact-detail change, or a new beneficiary — the classic account-takeover sequence.
Card testing & payment abuse
Clustered declines, repeat failures sharing the same decline code, and bank-decline bursts ahead of a high-value attempt.
Money mules
Both sides of the pattern: a payout destination shared across accounts on the way out, and — new — many first-time senders or a rapid pass-through on the way in.
Scams (APP)
A payout draining most of an account's balance to a beneficiary added minutes earlier — the "safe account" authorised-push-payment pattern.
Three planes: Signal, Risk, Control.
Deterministic and explainable by design — every plane produces something a human can read and check.
Signal Plane
Ingests what you already trust — no need to see raw client packets behind Cloudflare or an ALB.
- Edge headers & logs (Cloudflare, WAF, ALB)
- Application & payment callback events
- Out-of-box threat-intel feeds
- Optional eBPF/runtime agent, later
Risk Plane
Normalizes events, resolves entities, and correlates weak signals into an evidence timeline.
- Trust model per header source
- Velocity counters per entity & combination
- Deterministic, explainable rule pack
- Correlates independent weak signals (automation/bot labels, threat-intel, account-lifecycle) into one explainable compound reason
- Evidence timeline + human-readable reasons
Control Plane
Starts at observe and report. Anything stronger needs an operator's explicit approval before it can activate — off by default.
- Observe → evidence report
- Manual review / step-up / hold routing
- Controlled enforcement, only after evidence review
- Optional later: eBPF enforcement (patent application pending)
Your own blocks and lists
- Block an IP, a customer ID, a device fingerprint, a card BIN or an email at any time.
- Give each block a reason and, if you want, an expiry.
- Remove a block just as easily. Every block records who added it.
- Send your own list of confirmed fraud identifiers in one API call.
- Send it again whenever it changes: new entries are blocked; entries you removed stay blocked and are flagged for your review.
- Planned: import your fraud team's existing rules as a rule pack.
The regulatory and payment-rail backdrop is shifting underneath this problem.
Discovery context, not a compliance claim — WoWyrd doesn't make you compliant with any of the below.
Narrow, observe-only, and reviewed together.
The first useful deployment is deliberately small: one stream, one owner, one measurable risk question. Framed as shadow-mode / champion-challenger validation — language your model-risk team already uses.
Pick one stream
Merchant onboarding, payout/withdrawal, payment initiation, account-opening/KYC step, beneficiary creation/change, instant-payment initiation, or a suspicious login→payment sequence.
Deploy observe-only, inside your environment
2–4 weeks. Mirror/observe mode — no inline decision on day one. Data-boundary agreed up front: what stays local, what (if anything, hashed or aggregated) leaves.
Review evidence weekly, together
Which early signals appeared before business-impacting events, which were useful vs. noisy, and measured — not claimed — latency and resource impact.
Get a decision report
Not a dashboard promise — a report a non-engineer can read: top triggered rules, evidence timeline, false-positive candidates, suggested calibration, and an enforcement-readiness recommendation: no-go, continue observe-only, or controlled-enforcement candidate.
Not a replacement for KYC, AML, sanctions screening, payment-fraud tooling, bot products, or case management. A pre-transaction signal layer that helps decide what deserves deeper review, routing, throttling, or — later, deliberately — controlled enforcement.
Anywhere a request precedes an irreversible transaction.
Target operators: payment processors & orchestrators, ACH third-party senders, embedded-finance platforms, merchant-onboarding & payout providers, crypto-fiat on/off-ramps, and bank/FI fraud-risk innovation teams (narrow pilot only).
Self-hosted. Install it in your own environment with Docker.
WoWyrd runs inside your own infrastructure — there's no hosted service to sign up for. Start from wowyrd-pub's quick-start for a Docker Compose evaluation stack, on your own hardware or VM.
Two install profiles. Full (PostgreSQL + Redis) is the profile for a pilot on your own data: the evidence report and the confirmed-fraud comparison need it. Lite (embedded SQLite, no database to set up) gives a quick look at live scoring and the case queue, and also runs on macOS. Some rules need data that only Full keeps, so detection on Lite is not the same as on Full. Use Lite to try the product, and Full for a pilot.
| Mode | What stays where |
|---|---|
| Isolated (default) | Your transaction data stays in your environment. Licensed by daily evaluation volume. |
| Network (opt-in, planned) | A future, opt-in addition — not required to run WoWyrd. |
Talk to us about one stream, one owner, one question.
No deck required first — tell us the stream you're worried about and who owns the decision, and we'll scope a narrow, observe-only pilot around it.