1Layer

Product

Fraud detection, built on shared intelligence.

Transactions are scored in real time using merchant intelligence and behavioral baselines aggregated across banks on the network. When something looks anomalous, we send an alert to your webhook so you can reach the customer directly — without your team building a detection model from scratch.

Anomaly Detection
Every transaction is scored against learned behavioral baselines the moment it happens
Merchant Intelligence
Clean merchant identity, category, and history feed directly into every risk score
Cross-Bank Patterns
Trends aggregated across the network — not just what one institution has seen
Alert Webhooks
Flagged transactions push an event to your endpoint the instant they are detected
Risk Scoring
A structured, confidence-scored result — not a black box you have to trust blindly
Case Management
Investigate any flagged transaction with full context in one workspace

Score

Every transaction, scored the moment it happens.

Send a transaction as it occurs and get a risk score back synchronously — informed by merchant intelligence and the account's own history, not amount thresholds alone.

request
POST /v1/transactions
Authorization: Bearer sk_live_••••••••
 
{
  "ref": "txn_9f21c",
  "account_id": "acc_5521a",
  "merchant_id": "mch_7d013",
  "amount": 1840.00,
  "currency": "EUR",
  "channel": "card_not_present",
  "occurred_at": "2026-07-10T09:14:00Z"
}
response
200 OK
 
{
  "ref": "txn_9f21c",
  "risk_score": 0.87,
  "flagged": true,
  "reasons": [
    "amount_deviation",
    "merchant_pattern_match"
  ],
  "network_match": "known_scheme_2026-06"
}

Alert

Flagged transactions reach you before the customer calls.

The moment a transaction is flagged, we push an event to your registered webhook — with the score, the reasons, and a recommended action — so your systems can notify the customer, hold the funds, or escalate.

webhook: transaction.flagged
POST https://your-bank.example/webhooks/1layer
X-1Layer-Event: transaction.flagged
 
{
  "event": "transaction.flagged",
  "ref": "txn_9f21c",
  "account_id": "acc_5521a",
  "risk_score": 0.87,
  "reasons": ["amount_deviation", "merchant_pattern_match"],
  "recommended_action": "customer_confirmation",
  "flagged_at": "2026-07-10T09:14:01Z"
}

API Reference

A small, predictable surface.

Score transactions, query network patterns, and manage cases through a handful of REST endpoints — no proprietary SDK required.

POST/v1/transactionsSubmit a transaction for real-time anomaly scoring
GET/v1/transactions/:id/riskFetch the risk score and contributing signals for a transaction
GET/v1/patternsQuery aggregated fraud patterns and trends observed across the network
GET/v1/merchants/:id/risk-profileMerchant-level risk history and classification from shared intelligence
POST/v1/casesOpen an investigation case tied to a flagged transaction
GET/v1/cases/:idCase status, evidence, and audit trail
POST/v1/webhooksRegister an endpoint to receive flagged-transaction and case events

How it works

A common knowledge center, without the learning phase.

1
Aggregate

Transaction and merchant signals across participating banks build shared behavioral baselines and fraud patterns — no single institution starts from zero.

2
Detect

Every transaction is scored in real time against those network baselines plus your own account history, using merchant intelligence to cut down false positives.

3
Alert

Flagged transactions fire a webhook immediately, so you can confirm with the customer, hold funds, or open a case — no polling required.

Why shared intelligence

Fraud patterns rarely stay within one bank.

We aggregate trends and patterns across the banks on the network, so every participant benefits from what the others have already seen — instead of each institution running its own, costly learning phase in isolation.

Data stays yours
Alerts and scores are delivered to your systems via webhook and API. Only aggregated, anonymized patterns are shared back into the network — never raw account or customer data.
No cold-start problem
A pattern identified anywhere in the network strengthens detection for every participating bank immediately, instead of each institution relearning it independently.
Built for automation
Webhooks and a REST API plug directly into your existing customer-alerting and case-management workflows — no new console for your team to operate.
Banks build things like
Customer fraud alertsCard blocking workflowsChargeback preventionRisk-based authenticationCompliance reportingMerchant risk reviews