Mules activate after approval
The account opens clean, stays quiet, then turns into a pass-through for stolen funds weeks later.
One customer. Thousands of sessions. Cortex watches all of them
ScreenX decided who came in. Cortex watches who they become — continuous device, behavioural and network monitoring across every active account, surfacing mule formation, account takeover and behavioural drift before the first transfer.
A clean account today can be a mule account tomorrow
Most controls make one decision at signup and never revisit it. A genuine account at signup can still be compromised later. Onboarding judged them right; Cortex watches in case they change.
Takeovers wear the right credentials
A genuine login, the real password, a session driven by someone who isn't the customer.
Rings hide in plain sight
Each account looks normal on its own. The pattern only surfaces when you watch the links between them.
Risk surfaces too late
By the time a transaction rule fires, the first transfer has usually already cleared.
Fraud rarely arrives in one move. It assembles over hours, days, weeks. The signal is there long before the money leaves.
ScreenX reads every one of themOnboarding was the start. Cortex covers everything after it
Cortex runs continuously on every active account, not only at moments of friction, every customer, every session, across the entire lifecycle. It works in three layers.
Observe
Device, behavioural, and network signals are read on every session and matched against the account's own baseline, the profile of how this user actually behaves.
Detect
A dynamic risk-scoring engine with 60+ rules surfaces the assembly as it happens: a mule ring forming, an account takeover in progress, a synthetic identity warming up, a behavioural drift away from the norm.
Act
Risk-based adaptive authentication responds in proportion: low risk passes frictionless, medium risk steps up, high risk is blocked, with the full signal history attached to every flag.
What Cortex watches on every session
Three signal layers, read continuously and scored together, the same sensing modalities that power onboarding, now running for the life of the account. Account takeovers break the pattern within seconds; mules drift from it over time.
Onboarding asks one question once. Cortex asks it on every session, against a baseline that belongs to the individual account, not a global threshold that treats every customer the same. Each account's signals are resolved on Sign3's unified customer graph and scored by a dynamic engine of 60+ rules, and the score carries the reason with it.
Device Intelligence
Behavioural Biometrics
Network
Everything Cortex returns on every account
One continuous score, and the full context behind it — structured for your systems to act on in real time.
Live risk score
A risk score per account, updated each session, rising and falling as behaviour changes.
Threat flags
Mule formation, account takeover, behavioural drift and fraud-ring membership — each surfaced before the first transfer.
Authentication action
Frictionless, step-up or block — mapped to the score on your thresholds, so genuine customers feel nothing.
Network linkage
The accounts, devices and numbers connected to a flagged account, ready for investigation.
The signal history
Every session and signal behind a flag, logged and attached, so any action is reproducible later.
Four threats that only appear after approval
Cortex is the monitoring layer for everything that goes wrong after approval. The same continuous score answers four questions across the life of the account.
Money mule detection
Surface accounts that open clean and turn into pass-throughs — and the rings they belong to — before funds start moving.
Account takeover
Catch the genuine credentials driven by the wrong hands — a session that breaks the customer's behavioural pattern within seconds.
Fraud-ring detection
Map the links between accounts, devices and numbers to expose coordinated abuse invisible at the single-account level.
Behavioural drift
Detect the slow change — a synthetic identity warming up, an account being groomed — long before a transaction rule would fire.
Watched continuously. Proven in production
Findings from a live fraud-ring analysis across a personal-loan onboarding journey, and from monitoring deployments across BFSI.
6.01%in organised fraud rings
Of users found to belong to organised fraud rings in a single week of live traffic (NBFC analysis).
40%of rings on a single device
A clear, high-ROI rule for device-based monitoring.
70%+of fraud in the top 4% of devices
The highest-value targets to watch.
503distinct fraud rings surfaced
From 69,646 numbers in one analysis window, patterns invisible account by account.
60+rules in the scoring engine
Driving low / step-up / block decisions automatically.
<200msp95 decisioning latency
So monitoring never adds friction for genuine customers.
A clean account today can be a mule account tomorrow
Most controls make one decision at signup and never revisit it. A genuine account at signup can still be compromised later. Onboarding judged them right; Cortex watches in case they change.
Mules activate after approval
The account opens clean, stays quiet, then turns into a pass-through for stolen funds weeks later.
Takeovers wear the right credentials
A genuine login, the real password, a session driven by someone who isn't the customer.
Rings hide in plain sight
Each account looks normal on its own. The pattern only surfaces when you watch the links between them.
Risk surfaces too late
By the time a transaction rule fires, the first transfer has usually already cleared.
Fraud rarely arrives in one move. It assembles over hours, days, weeks. The signal is there long before the money leaves.
ScreenX reads every one of themOnboarding was the start. Cortex covers everything after it
Cortex runs continuously on every active account, not only at moments of friction, every customer, every session, across the entire lifecycle. It works in three layers.
Book a demoObserve
Device, behavioural, and network signals are read on every session and matched against the account's own baseline, the profile of how this user actually behaves.
Detect
A dynamic risk-scoring engine with 60+ rules surfaces the assembly as it happens: a mule ring forming, an account takeover in progress, a synthetic identity warming up, a behavioural drift away from the norm.
Act
Risk-based adaptive authentication responds in proportion: low risk passes frictionless, medium risk steps up, high risk is blocked, with the full signal history attached to every flag.
What Cortex watches on every session
Three signal layers, read continuously and scored together, the same sensing modalities that power onboarding, now running for the life of the account. Account takeovers break the pattern within seconds; mules drift from it over time.
Onboarding asks one question once. Cortex asks it on every session, against a baseline that belongs to the individual account, not a global threshold that treats every customer the same. Each account's signals are resolved on Sign3's unified customer graph and scored by a dynamic engine of 60+ rules, and the score carries the reason with it.
Device Intelligence
Behavioural Biometrics
Network
Everything Cortex returns on every account
One continuous score, and the full context behind it — structured for your systems to act on in real time.
Live risk score
A risk score per account, updated each session, rising and falling as behaviour changes.
Threat flags
Mule formation, account takeover, behavioural drift and fraud-ring membership — each surfaced before the first transfer.
Authentication action
Frictionless, step-up or block — mapped to the score on your thresholds, so genuine customers feel nothing.
Network linkage
The accounts, devices and numbers connected to a flagged account, ready for investigation.
The signal history
Every session and signal behind a flag, logged and attached, so any action is reproducible later.
Four threats that only appear after approval
Cortex is the monitoring layer for everything that goes wrong after approval. The same continuous score answers four questions across the life of the account.
Money mule detection
Surface accounts that open clean and turn into pass-throughs — and the rings they belong to — before funds start moving.
Account takeover
Catch the genuine credentials driven by the wrong hands — a session that breaks the customer's behavioural pattern within seconds.
Fraud-ring detection
Map the links between accounts, devices and numbers to expose coordinated abuse invisible at the single-account level.
Behavioural drift
Detect the slow change — a synthetic identity warming up, an account being groomed — long before a transaction rule would fire.
Watched continuously. Proven in production
Findings from a live fraud-ring analysis across a personal-loan onboarding journey, and from monitoring deployments across BFSI.
6.01%in organised fraud rings
Of users found to belong to organised fraud rings in a single week of live traffic (NBFC analysis).
40%of rings on a single device
A clear, high-ROI rule for device-based monitoring.
70%+of fraud in the top 4% of devices
The highest-value targets to watch.
503distinct fraud rings surfaced
From 69,646 numbers in one analysis window, patterns invisible account by account.
60+rules in the scoring engine
Driving low / step-up / block decisions automatically.
<200msp95 decisioning latency
So monitoring never adds friction for genuine customers.