What this tab shows

Players / Fraud Detection combines several fraud-review tools for one player:

• stored or on-demand fraud risk assessment
• related fraud-report rows
• login IP analysis
• geolocation and proxy/VPN context
• MaxMind report archive and raw-response inspection
• aggregated risk-band, common-risk-factor, and per-IP score summaries built from stored fraud-check history

When to use it

Use this tab when you need to:

• check whether the player shares suspicious signals with other accounts
• review IP and geolocation anomalies
• compare local vs identity-graph matches
• inspect the MaxMind result behind a stored risk score
• decide whether the player needs escalation for fraud review

How to read it

The tab has three major blocks:

1. Fraud Risk Assessment for running or reviewing risk checks.
2. Related Fraud Reports table with source-mode filtering.
3. IP Address Analysis and optional map view for the player's login IPs.

Inside Fraud Risk Assessment, the FE renders two distinct read blocks when history exists:

• Risk Score Analysis: overall average score, risk-band counts, trend, per-IP averages, and common risk factors
• MaxMind Reports List: stored raw report history behind the same fraud-check flow

Filters and controls

Run New Fraud Check and Run New Check (Uses Credits) are the same action. The tab asks for confirmation before the request because it can call MaxMind and consume provider credits. The action is disabled until the player has at least one login IP.

Load Missing Locations appears only when some login IPs do not already have location data. It enriches missing IPs and stores successful lookups so later tab loads can show cached location and anonymizer context.

View on Map opens a map dialog for IPs that have coordinates. The map requires the Mapbox API key in System Settings. Without that key, the map dialog shows a configuration warning while the IP list remains usable.

The Combined, Local, and Identity Graph buttons affect only the Related Fraud Reports table. They do not change the MaxMind risk history or the IP cards.

The MaxMind Reports Archive has local tabs for all reports, high-risk reports, reports with security flags, and the latest 10 reports. Expanding a report row shows report details, security flags, risk reasons, warnings, and JSON response controls.

Known caveats

• Combined, Local, and Identity Graph are filter modes on the fraud-report dataset, not separate player statuses.
• IP analysis can load additional location data after the first render. Operators may see a partial view before enrichment finishes.
• Running a new fraud check can consume an external risk-check flow; it is not just a UI refresh.
• Run New Fraud Check and Run New Check (Uses Credits) are the same MaxMind-backed action. The wording explicitly warns operators that a new provider check can consume credits.
• The risk analysis blocks are computed from stored fraud-check history, not directly from the related-fraud-report table. The table and the risk summary can therefore move independently.
• Related fraud reports combine local matching, optional Identity Graph matching, and external fraud-database tags. If Identity Graph is not configured or unavailable, local matches can still be shown.
• The MaxMind history endpoint returns the latest stored checks first. The FE-side risk trend compares the most recent five valid scores with the previous five valid scores only when at least ten history rows exist.
• The map can be unavailable when Mapbox system settings are missing, even if the IP list itself is present.