Label Contexts

Label contexts are optional additional metadata strings attached to labels. They can be thought of as Tags or label sub-categories.

They add detail beyond the label name itself, such as how confident you are in the marking, where it came from, or what type of fraud or industry it relates to.

Contexts are passed as an array when adding or checking labels.

checkLabel("account_takeover", [profiling.device.identifier], ["confirmed"])

Some contexts are auto-assigned (Industry), while others optionally supplied when a label is created.

Label Add API body with contexts and metadata

{
  "id": "promo_abuse",
  "attributes": [
    {
      "name": "identity['ACCOUNT'].email['PERSONAL'].email",
      "value": "test@test.com"
    }
  ],
  "contexts": ["signup_bonus", "probably"],
  "metadata": "{\"analyst\":\"analyst@example.com\",\"notes\":\"Optional metadata notes\"}"
}

Contexts

List (add method)

manual_add
automated_add

Distinguishes whether an identifier was placed on a list (passlist, blocklist, watchlist) by a human analyst or by an automated process such as a rule or integration.

Source (of label add)

rule
analyst
data_feed
model
api

Records how the label was originally created. Use this to distinguish between labels added by automated rule logic, analyst review, ML model output, bulk data feeds, or direct API calls.

Confidence

confirmed
probably
reasonable
slight

Indicates how certain you are that the label is accurate, from most to least confident. This lets you apply labels more liberally without needing 100% certainty - for example, rules can treat a confirmed fraud label differently from a slight one.

Evidence

authority
victim
shared
detected

Describes the basis for the label.

• authority means a law enforcement or regulatory body provided the information.
• victim means the affected party reported it.
• shared means the information came from an external intelligence source.
• detected means your internal monitoring (eg. including Darwinium) flagged it as suspicious.

Money Mule Rating (awaiting release)

mule_unwitting
mule_complicit
mule_recruited

Classifies the level of involvement of a money mule. unwitting means the account holder doesn't know they're being used. complicit means they're knowingly participating. recruited means they were actively brought into the scheme.

Claims Fraud

non_disclosure_inadvertent
non_disclosure_deliberate
premeditated
exaggeration

Categorises insurance claims fraud by type. Ranges from inadvertent non-disclosure (forgetting to mention something) through to premeditated fraud (staged or fabricated claims) and exaggeration of legitimate claims.

Scam Method

scam_phone
scam_messaging
scam_social
scam_rat
scam_email

Records the channel through which a scam was conducted. Use this to track whether victims were contacted by phone, messaging apps, social media, remote access tools (RAT), or email.

Promo Abuse

loyalty_discounts
referral_bonus
signup_bonus

Identifies which type of promotion was abused. Covers loyalty discount exploitation, referral bonus farming, and repeated sign-up bonus claims using multiple identities.

Spam

keyword_stuffing_spam
hidden_text_spam
content_spam
referrer_log_spam
comment_spam
url_redirection_spam
fake_post_spam
hidden_link_spam
link_spam
article_spinning_spam
machine_translation_spam
wiki_spam

Classifies the specific spam technique used. Broadly split into content spam (keyword stuffing, hidden text, fake posts, article spinning, machine translation, URL redirection) and link spam (comment links, hidden links, referrer log manipulation, wiki spam).

Gaming

problem_gambling

Flags users identified as problem gamblers. Used in gambling and gaming contexts to trigger responsible gambling interventions or restrict promotional offers.

General

ip_activity
ip_classification

General-purpose IP-related contexts. ip_activity relates to behavioural patterns observed from an IP address. ip_classification relates to the type of IP (e.g. residential, datacenter, VPN).

Primary Industry

accommodation
construction
education
entertainment
finance
government
health_care
information
insurance
leasing
manufacturing
real_estate
retail_trade
transport
wholesale

Top-level industry classification for an entity or account. Use this to tag labels with the broad sector an organisation operates in.

Secondary Industry

airlines
apparel
automotive
beverage
brokerage
buildings
chemical
civilian
commercial_banking
communications
computer
consumer_goods
credit_union
crowdfunding
data_processing
defence
dental
digital_currency
durable_goods
electronics
energy
financial_investments
food_and_beverage
funds_and_trusts
furniture
gambling
gaming
general
health
home_services
hospitals
intangible_assets
intelligence
laboratories
leather
lending
life
machinery
medical_equipment
money_transfer
motion_picture
motor_vehicle
newspaper
non_durable_goods
nursing
other
outpatient
paint
payments
personal_finance
pharmaceutical
physician
plastics
platform
printing
property
radio_broadcasting
rail
realtors
retail
semiconductor
services
social_assistance
software_publisher
sound_recording
speciality
specialty_trade
streaming_media
telecommunication_resellers
telecommunications
television
textile
ticketing
tobacco
travel
travel_agency
travellers
vehicle
wired_communications
wireless_communications
wood

More granular industry sub-classification. Pairs with Primary Industry to give a two-level taxonomy for the sector an entity belongs to.