Sardine links behavioral fraud signals to models and investigations

Sardine brings device intelligence, machine-learning fraud models, rules and investigation tools into one financial-risk platform. Its value proposition starts before a payment is attempted: how an account was created, which device is operating it and how the session behaves can affect the eventual decision. It also offers AI agents for the analyst work that follows an alert. Those are related capabilities, but a predictive risk score and an agent-written case summary require different forms of validation.

01 / ProductOne platform connects session evidence with risk operations

Sardine’s company overview identifies banks, fintechs, marketplaces and merchants as its audience. The company spans onboarding, fraud prevention and anti-money-laundering operations rather than selling a single general-purpose chatbot. That breadth is useful when the same suspicious identity appears at account creation, funding and withdrawal, provided the organization can preserve a consistent identifier across those events.

The device and behavior product collects signals through an SDK, including device characteristics, network context and interaction patterns. Sardine describes detecting automation, remote access and deviations from a customer’s normal behavior. These are risk indicators, not proof of criminal intent: a legitimate user can change devices, use a VPN or receive remote technical help. A useful strategy combines the signal with the action being attempted.

The machine-learning offering includes consortium-trained models, custom training and customer models hosted in Model Garden. Its public material describes feature-level explanations and integration with the rules engine. The architectural implication is that a company can retain some proprietary scoring while using Sardine for signal collection and decision execution. The exact model packaging and operational responsibility still need agreement.

02 / AudienceDigital businesses with connected onboarding and payment risk

A fintech offering account funding is a plausible fit when stolen identities, account takeovers and abusive payments currently reach different teams. A merchant may instead focus on promotion or refund abuse. The shared requirement is a digital journey with usable signals and a concrete response: request another check, route an alert, or change the treatment of a transaction under an approved policy.

For comparison, the Feedzai blueprint explains risk operations around transaction fraud, scams and AML. The Sift blueprint provides context for digital abuse and payment-risk decisions. The choice should turn on the institution’s required signals and operating workflow. Product breadth alone does not establish that either alternative provides equivalent coverage of a specific attack.

Sardine is less compelling as a simple replacement for a document store or a one-off identity lookup. Its connected approach creates most value when several events can be evaluated together. If the application cannot reliably attach a session to the account and transaction it belongs to, SDK deployment by itself will not create an investigation-ready history.

03 / WorkflowA proposed account-funding pilot from session to case

Consider a fintech concerned that apparently legitimate accounts are being funded and rapidly used for suspicious transfers. This is a proposed evaluation, not a test performed by Sequenced. Begin with one funding route and distinguish stolen payment credentials, a compromised account and a legitimate new customer moving money quickly. Those situations may look similar at the transaction level but need different evidence and customer treatment.

Instrument the relevant journey with the agreed SDK configuration and map the account, session and funding identifiers. Record which observations exist before the funding decision and which arrive afterward. A device connection discovered during a later investigation is useful for subsequent activity, but it cannot be counted as information that an earlier decision actually had. Preserve this timing in the test dataset.

Create a proposed strategy using a risk score together with explicit conditions for the particular funding route. Sardine’s rules engine describes a no-code builder, natural-language rule creation, historical backtests, shadow mode and A/B testing. Use those controls to compare a candidate rule with the existing decision path. A generated rule should still be inspected for the intended field, threshold and missing-data behavior.

Keep the first live comparison in shadow mode so that the team can observe disagreements without immediately changing customer outcomes. Separate cases where the model adds useful context from cases where it repeats an existing block. Review ordinary but unusual behavior, such as a customer replacing a phone while traveling, alongside confirmed fraud. Otherwise the evaluation rewards sensitivity without revealing unnecessary intervention.

For escalated cases, assess the AML agents on evidence gathering and summaries. The product describes entity research, link analysis, screening review and SAR narrative drafting. Give reviewers the original transaction trail and require them to check whether the summary distinguishes observed facts from inferences. Drafting a suspicious activity report is a separate task from deciding that the report should be filed.

Close the loop with explicit outcomes. An alert dismissed for insufficient information should not become a verified legitimate example by accident. Track investigation time, customer disruption and losses by the same funding population. The useful expansion question is whether connected session context changes decisions in a defensible way, not whether the demonstration produces an impressive number of risk features.

04 / PricingCommercial scope follows the signals and workflows selected

The reviewed contact page offers a personalized demonstration. It does not publish a universal per-seat price, transaction tariff or included production allowance. Treat device intelligence, model hosting, identity checks and agent workflows as commercial scope to resolve, rather than assuming that a platform demonstration includes every product.

For a funding pilot, obtain a proposal tied to the event volume and exact decision route. Distinguish collection events from scored transactions and analyst work, since those are different workloads even when they concern one customer. The table below is a scoping aid, not an assertion that Sardine bills using each listed dimension. Public product pages establish the capabilities; the contract establishes the charging basis.

05 / DistinctionsRules, predictive models and agents do different jobs

The model’s role is to estimate risk from available signals. A rule expresses an explicit operational condition. An agent can gather evidence or prepare a case narrative. Combining these components creates a shorter path from detection to action, but it does not make them interchangeable. An eloquent case summary cannot repair an incorrectly joined transaction history, and a high risk score does not decide which customer intervention is appropriate.

Sardine’s deployment flexibility is also significant for organizations with their own fraud research. A team can evaluate its existing model inside the vendor’s operational environment rather than making model replacement a prerequisite. That comparison should hold the available data and response timing constant. If the new route gets additional device signals, attribute any improvement to the whole configuration instead of crediting the algorithm alone.

Network intelligence can reveal activity outside one institution’s experience, but the useful question is coverage of the relevant customer population and attack type. The company’s public scale and efficiency claims are vendor claims. They are not independent estimates of the loss reduction a new merchant or bank will achieve.

06 / QuestionsDevice context needs a careful interpretation

Behavioral variation has innocent explanations. Accessibility tools, autofill, travel and shared equipment can all change a session’s appearance. Ask the implementation team which signals are collected, what the score means and how missing or restricted telemetry affects it. Review the institution’s actual browser and mobile mix rather than assuming a demonstration represents every supported customer journey.

For agent workflows, verify which actions merely produce recommendations and which can change a case or rule. Sardine describes human oversight alongside automation; the evaluation needs the specific permissions, approval points and retained evidence for the configuration being purchased. Sequenced has not inspected private integration documentation, measured model accuracy or verified a customer deployment. Those remain deployment-specific questions.

07 / DecisionChoose the first point where better context can change an action