# Risk property codes
When building risk rules for [Fraud Detection](https://www.checkout.com/docs/business-operations/prevent-fraud.md) and [Fraud Detection Pro](https://www.checkout.com/docs/business-operations/prevent-fraud/upgrade-to-pro.md), you can use the following properties before the authentication stage (pre-auth) and/or after the authorization stage (post-auth).
---
## Account name inquiry properties
| Property | Description | Stage |
| --- | --- | --- |
| `account_name_inquiry_full_name_match`
`string`
`Pro` | The result of the account name inquiry match for the customer's full name.
This can be one of:
- `full_match`
- `no_match`
- `partial_match`
- `unverified` | Post-auth |
| `account_name_inquiry_first_name_match`
`string`
`Pro` | The result of the account name inquiry match for the customer's first name.
This can be one of:
- `full_match`
- `no_match`
- `partial_match`
- `unverified` | Post-auth |
| `account_name_inquiry_middle_name_match`
`string`
`Pro` | The result of the account name inquiry match for the customer's middle name.
This can be one of:
- `full_match`
- `no_match`
- `partial_match`
- `unverified` | Post-auth |
| `account_name_inquiry_last_name_match`
`string`
`Pro` | The result of the account name inquiry match for the customer's last name.
This can be one of:
- `full_match`
- `no_match`
- `partial_match`
- `unverified` | Post-auth |
---
## Address Verification Service properties
The [Address Verification Service (AVS) codes](https://www.checkout.com/docs/developer-resources/codes/avs-codes.md) correlate to the following properties:
| Property | Description | Stage |
| --- | --- | --- |
| `avs_address_not_verified`
`boolean` | AVS code `O`
The address could not be verified. | Post-auth |
| `avs_cardholder_name_and_zip_match`
`boolean` | AVS code `AE5`
For American Express (Amex), the cardholder's name and the ZIP code or post code match. | Post-auth |
| `avs_cardholder_name_and_street_and_zip_match`
`boolean` | AVS code `AE6`
For Amex, the cardholder's name, street, and ZIP code or post code match. | Post-auth |
| `avs_cardholder_name_incorrect_but_street_match_only`
`boolean` | AVS code `AE3`
For Amex, the cardholder's name is incorrect, but the street matches. | Post-auth |
| `avs_cardholder_name_incorrect_but_zip_and_street_match`
`boolean` | AVS code `AE2`
For Amex, the cardholder's name is incorrect, but the street and ZIP code or post code match. | Post-auth |
| `avs_cardholder_name_incorrect_but_zip_match`
`boolean` | AVS code `AE1`
For Amex, the cardholder's name is incorrect, but the ZIP code or post code matches. | Post-auth |
| `avs_cardholder_name_match`
`boolean` | AVS code `AE4`
For Amex, the cardholder's name matches. | Post-auth |
| `avs_cardholder_name_street_match`
`boolean` | AVS code `AE7`
For Amex, the cardholder's name and the street match. | Post-auth |
| `avs_code`
`string` | The AVS code.
Example – `AE1` | Post-auth |
| `avs_match_error`
`boolean` | AVS code `E`
AVS system error | Post-auth |
| `avs_match_not_capable`
`boolean` | AVS code `U`
The address was not verified due to lack of issuer support or system malfunction. | Post-auth |
| `avs_no_match`
`boolean` | AVS code `N`
The street address and the ZIP code or post code do not match. | Post-auth |
| `avs_not_available`
`boolean` | AVS code `R`
The service is unavailable. Retry the AVS check. | Post-auth |
| `avs_not_supported`
`boolean` | AVS code `S`
AVS is not supported. | Post-auth |
| `avs_not_verified_or_supported`
`boolean` | AVS code `S`
The address was not verified or AVS is not supported. | Post-auth |
| `avs_street_and_zip_match`
`boolean` | AVS code `Y`
The post code and corresponding address match. | Post-auth |
| `avs_street_and_zip_not_verified`
`boolean` | AVS code `C`
The street address and post code do not match. | Post-auth |
| `avs_street_match_but_zip_not_verified`
`boolean` | AVS code `B`
The street address matches, but the ZIP code or post code could not verified, likely due to incorrect formatting. | Post-auth |
| `avs_street_match_only`
`boolean` | AVS code `A`
The street address matches, but the ZIP code or post code does not. | Post-auth |
| `avs_street_not_verified_but_zip_match`
`boolean` | AVS code `P`
The ZIP code or post code matches, but the street address could not be verified, likely due to incorrect formatting. | Post-auth |
| `avs_zip_match_only`
`boolean` | AVS code `Z`
The ZIP code or post code matches, but the street does not. | Post-auth |
---
## Billing and shipping address properties
| Property | Description | Stage |
| --- | --- | --- |
| `billing_address_city`
`string` | The billing address city. | Pre- and post-auth |
| `billing_address_state`
`string` | The billing address state.
This value is extracted from the payment request without validation. The rule this property is used in is only assessed if the value is an exact match to what the customer provided at checkout. | Pre- and post-auth |
| `billing_address_country`
`string` | The billing address country.
Standard – [ISO alpha-2 country code](https://www.checkout.com/docs/developer-resources/testing/codes/country-codes.md)
Example – `US` | Pre- and post-auth |
| `billing_address_line1`
`string` | The first line of the billing address.
This value is extracted from the payment request without validation. The rule this property is used in is only assessed if the value is an exact match to what the customer provided at checkout.
| Pre- and post-auth |
| `billing_address_line2`
`string` | The second line of the billing address.
This value is extracted from the payment request without validation. The rule this property is used in is only assessed if the value is an exact match to what the customer provided at checkout.
| Pre- and post-auth |
| `billing_address_postal_code`
`string` | The ZIP or post code of the billing address.
This value is extracted from the payment request without validation. The rule this property is used in is only assessed if the value is an exact match to what the customer provided at checkout.
| Pre- and post-auth |
| `billing_address_is_valid`
`boolean` | Indicates whether the billing address is deemed to be a real address, checked against a global list.
The reliability of this check depends on the region. | Pre- and post-auth |
| `shipping_address_city`
`string` | The shipping address city. | Pre- and post-auth |
| `shipping_address_state`
`string` | The shipping address state.
This value is extracted from the payment request without validation. The rule this property is used in is only assessed if the value is an exact match to what the customer provided at checkout.
| Pre- and post-auth |
| `shipping_address_country`
`string` | The shipping address country.
Standard – [ISO alpha-2 country code](https://www.checkout.com/docs/developer-resources/testing/codes/country-codes.md)
Example – `US` | Pre- and post-auth |
| `shipping_address_is_valid`
`boolean` | Indicates whether the shipping address is deemed to be a real address, checked against a global list.
The reliability of this check depends on the region. | Pre- and post-auth |
| `shipping_address_line1`
`string` | The first line of the shipping address.
This value is extracted from the payment request without validation. The rule this property is used in is only assessed if the value is an exact match to what the customer provided at checkout. | Pre- and post-auth |
| `shipping_address_line2`
`string` | The second line of the shipping address.
This value is extracted from the payment request without validation. The rule this property is used in is only assessed if the value is an exact match to what the customer provided at checkout. | Pre- and post-auth |
| `shipping_address_postal_code`
`string` | The ZIP or post code of the shipping address.
This value is extracted from the payment request without validation. The rule is only assessed if the value is an exact match. | Pre- and post-auth |
---
## Card properties
| Property | Description | Stage |
| --- | --- | --- |
| `bin`
`string` | The bank identification number (BIN), which is the first four to six numbers that appear on a credit card. | Pre- and post-auth |
| `bin_8`
`string` | The first eight BIN numbers that appear on a credit card. | Pre- and post-auth |
| `card_brand`
`string` | The card scheme.
This can be one of:
- `AMEX`
- `cartes_bancaires`
- `DINERS`
- `DISCOVER`
- `JCB`
- `MASTERCARD`
- `upi`
- `VISA`
For [alternative payment methods (APMs)](https://www.checkout.com/docs/payments/add-payment-methods.md), this is empty or `null`.
The enum values are case insensitive. | Pre- and post-auth |
| `card_country`
`string` | The country where the card was issued.
Standard – [ISO alpha-2 country code](https://www.checkout.com/docs/developer-resources/testing/codes/country-codes.md)
Example – `US` | Pre- and post-auth |
| `card_fingerprint`
`string` | Checkout.com's unique encoded representation of the card.
Example – `9F3BAD2E48C6C8579F2F5DC0710B7C11A8...` | Pre- and post-auth |
| `card_issuer_name`
`string` | The name of the bank that issued the card, from the card's metadata.
Example – `Capital One` | Pre- and post-auth |
| `card_type`
`string` | The type of card.
This can be one of:
- `Credit`
- `Debit`
- `Prepaid`
- `Deferred Debit`
- `Charge`
- `Network Token` | Pre- and post-auth |
| `cardholder_name`
`string` | The cardholder's name.
Example – `Hannah Bret` | Pre- and post-auth |
| `cvv_check_passed`
`boolean` | Indicates whether the card verification value (CVV) was successfully verified. | Post-auth |
| `cvv_code`
`string` | The CVV provided by the customer. | Post-auth |
| `payment_account_reference`
`string` | The unique reference to the underlying card for network tokens. For example, for Apple Pay and Google Pay.
Example – `AB010101010101010101010101010`
For more information about how post-auth velocity properties behave, see [Post-auth velocities](https://www.checkout.com/docs/business-operations/prevent-fraud/create-risk-rules-and-lists.md#Post-auth_velocities). | Post-auth |
---
## Customer properties
| Property | Description | Stage |
| --- | --- | --- |
| `customer_name`
`string` | The customer's name. | Pre- and post-auth |
| `email`
`string` | The customer's email address.
Example – `hannah.bret@example.com` | Pre- and post-auth |
| `email_domain`
`string` | The domain of the customer's email address.
Example – `domain.com` | Pre- and post-auth |
| `email_is_valid`
`boolean` | Indicates whether the customer's email address is a valid format.
This rule does not require any operators or values. | Pre- and post-auth |
| `phone`
`string` | The customer's phone number.
Format – E.164
Example – `+14155552671` | Pre- and post-auth |
| `phone_country`
`string` | The country of the customer's phone number.
Standard – [ISO alpha-2 country code](https://www.checkout.com/docs/developer-resources/testing/codes/country-codes.md)
Example – `US` | Pre- and post-auth |
---
## Device properties
| Property | Description | Stage |
| --- | --- | --- |
| `device_fingerprint`
`string` | The unique Checkout.com device fingerprint for each browser. | Pre- and post-auth |
| `device_ip`
`string` | The device's IP address.
Example – `192.0.2.0` | Pre- and post-auth |
| `device_ip_city`
`string` | The city that the device IP address originates from.
Example – `London` | Pre- and post-auth |
| `device_ip_country`
`string` | The country that the device IP address originates from.
Standard – [ISO alpha-2 country code](https://www.checkout.com/docs/developer-resources/testing/codes/country-codes.md)
Example – `US` | Pre- and post-auth |
| `device_ip_timezone`
`string` | The timezone of the device IP address.
Example – `Europe/London` | Pre- and post-auth |
| `device_timezone`
`string` | The timezone of the device that the payment originates from.
Example – `Asia/Seoul` | Pre- and post-auth |
| **Pro properties** | | |
| `device_browser`
`string`
`Pro` | The device browser the payment originates from.
Example – `Chrome`, `Mobile Safari` | Pre- and post-auth |
| `device_browser_is_incognito`
`boolean`
`Pro` | The device browser is in incognito mode. | Pre- and post-auth |
| `device_browser_version`
`string`
`Pro` | The version of the device browser. | Pre- and post-auth |
| `device_ip_is_bogon`
`boolean`
`Pro` | Indicates whether the device's IP address originated from a known bogon IP. | Pre- and post-auth |
| `device_ip_is_proxy`
`boolean`
`Pro` | Indicates whether the device's IP address originated from a known proxy IP. | Pre- and post-auth |
| `device_ip_is_tor`
`boolean`
`Pro` | Indicates whether the device's IP address originated from a known Tor IP. | Pre- and post-auth |
| `device_ip_is_vpn`
`boolean`
`Pro` | Indicates whether the device's IP address originated from a known virtual private network (VPN) IP. | Pre- and post-auth |
| `device_model`
`string`
`Pro` | The type of device the payment originates from.
Example – `iPhone`, `Other` | Pre- and post-auth |
| `device_os`
`string`
`Pro` | The operating system of the device the payment originates from.
Example – `Mac OS X`, `Android`, `Windows` | Pre- and post-auth |
| `device_os_version`
`string`
`Pro` | The version of the device's operating system.
Example – `10.4` | Pre- and post-auth |
---
## Payment properties
| Property | Description | Stage |
| --- | --- | --- |
| `amount`
`number` | The amount of the payment.
Format – Numeric value that supports the following operators:
- `<` `>`
- `<=` `>=`
- `=`
- `!=`
- `IN`
- `CONTAINS`
Example – `137.35` | Pre- and post-auth |
| `currency`
`string` | The currency in which the payment was made.
Standard – [ISO 4217 code](https://www.checkout.com/docs/developer-resources/testing/codes/currency-codes.md)
Example – `USD` | Pre- and post-auth |
| `description`
`string` | A description of the payment, or the goods or services. | Pre- and post-auth |
| `has_liability_shift`
`boolean` | Indicates whether [liability](https://www.checkout.com/docs/payments/authenticate-payments/3d-secure.md#Liability_shift) for the payment shifted to the issuer following 3D Secure (3DS) authentication. | Post-auth |
| `is_3ds_authenticated`
`boolean` | Indicates whether the payment was authenticated using 3DS. | Post-auth |
| `is_aft`
`boolean` | Indicates whether the payment is an [Account Funding Transaction (AFT)](https://www.checkout.com/docs/payments/manage-payments/perform-an-account-funding-transaction.md). | Pre- and post-auth |
| `is_apm`
`boolean` | Indicates whether the payment uses an APM. | Pre- and post-auth |
| `is_merchant_initiated`
`boolean` | Indicates whether the payment is a merchant-initiated transaction. | Pre- and post-auth |
| `payment_ip`
`string` | The IP address used to make the payment.
Example – `168.16.10.2` | Pre- and post-auth |
| `payment_ip_city`
`string` | The city that the payment IP address originates from. | Pre- and post-auth |
| `payment_ip_country`
`string` | The country that the payment IP address originates from.
Standard – [ISO alpha-2 country code](https://www.checkout.com/docs/developer-resources/testing/codes/country-codes.md)
Example – `US` | Pre- and post-auth |
| `payment_ip_timezone`
`string` | The timezone of the payment IP address.
Example – `America/New York` | Pre- and post-auth |
| `processing_channel_id`
`string` | The [processing channel's](https://www.checkout.com/docs/business-operations/use-the-dashboard/manage-processing-channels.md) unique identifier, prefixed with `pc_`. | Pre- and post-auth |
| `reference`
`string` | Your reference for the payment. | Pre- and post-auth |
| `source_type`
`string` | The source of the payment request.
This can be one of:
- `card`
- `customer`
- `id`
- `network_token`
- `token` | Pre- and post-auth |
| `token_type`
`string` | The type of token used for the payment.
This can be one of:
- `ApplePay`
- `GooglePay` | Pre- and post-auth |
| `wallet_type`
`string` | The type of wallet used for the payment.
This can be one of:
- `ApplePay`
- `GooglePay` | Pre- and post-auth |
| **Pro properties** | | |
| `card_category`
`string`
`Pro` | The category of card.
This can be one of:
- `Commercial`
- `Consumer`
For APMs, this is empty or `null`.
The enum values are case insensitive. | Pre- and post-auth |
| `eci_value`
`string`
`Pro` | The [Electronic Commerce Indicator (ECI)](https://www.checkout.com/docs/developer-resources/codes/eci-values.md#Non-Mastercard_liability_shift) value.
Example – `01` | Post-auth |
| `flow_type`
`string`
`Pro` | The [3DS flow](https://www.checkout.com/docs/payments/authenticate-payments/3d-secure.md) the payment went through.
This can be one of:
- `Challenged`
- `Frictionless` | Post-auth |
| `payment_ip_is_proxy`
`boolean`
`Pro` | Indicates whether the payment IP address originated from a known proxy IP. | Pre- and post-auth |
| `payment_ip_is_tor`
`boolean`
`Pro` | Indicates whether the payment IP address originated from a known Tor IP. | Pre- and post-auth |
| `payment_ip_is_vpn`
`boolean`
`Pro` | Indicates whether the payment IP address originated from a known VPN IP. | Pre- and post-auth |
| `payment_ip_is_bogon`
`boolean`
`Pro` | Indicates whether the payment IP address originated from a known bogon IP. | Pre- and post-auth |
| `payment_type`
`string`
`Pro` | The type of payment.
This can be one of:
- `Installment`
- `Recurring`
- `Regular`
- `MOTO`
- `Unscheduled` | Pre- and post-auth |
| `sub_entity_ids`
`array of strings`
`Pro` | The list of sub-entities that the payment is processed on behalf of, prefixed with `ent_`.
The rule returns `True` if one or more sub-entities appears on Checkout.com's high-risk list. | Pre- and post-auth |
---
## Risk score property
| Property | Description | Stage |
| --- | --- | --- |
| `score`
`number`
`Pro` | The payment's [risk score](https://www.checkout.com/docs/business-operations/prevent-fraud/upgrade-to-pro.md#Risk_scores) from zero to 100.
Example – `42` | Pre- and post-auth |