> For the complete documentation index, see [llms.txt](https://docs.1kosmos.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.1kosmos.com/identity-verification/monitoring-and-analytics/risk-signals.md).
# Risk Signals
### Overview
Passing standard identity verification checks (document authenticity, face match, and liveness) does not, by itself, rule out fraud. A session can pass those checks and still show risky attributes or behavior, such as using a virtual camera during the selfie, a document whose issuing country doesn't match the useris connection locationa virtual camera used during the selfie, a document whose issuing country doesn't match where the user is connecting from, or the same identity appearing with different faces across attempts.
A risk signal flags one of these risky attributes or behaviors for administrator review. Signals are evaluated at the end of a verification session and reported for review.
{% hint style="info" %}
**Phase 1 is report-only.** Detected signals are informational: they are surfaced for administrator review and do not automatically change, delay, or block the verification outcome.
{% endhint %}
Each session carries an overall Risk Level and a count of Signals Detected, which appear on the Sessions page so you can see and investigate why a session looks risky.
#### Navigation
In AdminX, go to **Verification → Risk Signals**.
The page lists all supported signals, with a short description of what each detects, plus a summary of how many are enabled and how many fall into each risk level.
### Configuring a signal
For each signal in the list, you can:
* **Enable or disable it** using the toggle. Only enabled signals are evaluated and reported.
* **Set its risk level** to Low, Medium, or High using the Risk Level dropdown.
{% hint style="warning" %}
Changes take effect when you save. They apply to sessions created after the change is saved. In-progress sessions keep the configuration they started with, and completed sessions are not re-evaluated.
{% endhint %}
### Available signals
| Signal | What it detects |
| ------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------- |
| Document & IP Country Mismatch | The issuing country of the presented document differs from the user's IP geolocation country |
| Different User Detected on Same ID | The same face is seen across verification sessions under a different identity (name/DOB) |
| Geolocation Change Between Sessions | The same identity (first name, last name, DOB) verifies from a location more than 500 miles from any of its recent prior sessions |
| Identity Mismatch With Authoritative Source | The extracted identity (first name, last name, DOB) does not match the authoritative identity on file |
| Virtual Camera Detected | A virtual or manipulated camera source is used during verification |
Signals fall into two kinds:
* **Session-level signals** are determined from the current session alone, for example, Virtual Camera Detected and Document & IP Country Mismatch.
* **Cross-session signals** are determined by comparing the session against the same user's other attempts, for example, different User Detected on Same ID and Geolocation Change Between Sessions.
### How is the overall risk level determined?
Each detected signal contributes to the risk level you configured for it. When a session detects more than one signal, the session's overall Risk Level is the highest level among the detected signals. Multiple signals at the same level don't raise it further; for example, two Low signals still result in an overall Low risk level.
### Reviewing signals on the Sessions page
On the Sessions page, each session shows its **Risk Level** and its **Signals Detected** count. Open a session to see the individual signals that were detected, so you can understand why it received its risk level and decide how to act.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.1kosmos.com/identity-verification/monitoring-and-analytics/risk-signals.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
