How to identify AI agents, device farms and automation fraud with suspicious flags

Suspicious flags are among the strongest fraud indicators in SEON. They are returned in the suspicious_flags field of the Fraud API response and are triggered by known fraud patterns, device and browser anomalies and behaviors consistent with malicious activity. These flags allow you to gain a deeper understanding of user behavior and identify high-risk transactions with greater precision.

This page serves as a comprehensive reference for all available suspicious flags across SEON's device intelligence features, grouped by use cases.

With suspicious flags, you can create powerful custom rules in the Scoring Engine, allowing you to tailor risk scoring and fraud prevention strategies based on the specific flags that are most relevant to your business.

1. Go to the Scoring Engine page in SEON.
2. Open the Custom rules tab.
3. Click Create new rule.
4. Provide a descriptive name for your rule (e.g., “AI agent detected” or “Possible vishing activity”).
5. For the parameter type, select Compare.
6. For the value, select Suspicious browser profile.
7. Choose the Contains operator.
8. In the text field, enter the specific flag you want to target (e.g., potential_ai_agent or possible_vishing).
9. Define the action you want to take, such as increasing the risk score or changing the transaction state.
10. Click Create rule to save and activate it.

AI agent and automation

This category of flags helps you detect the emerging threat of AI agents that can autonomously browse websites, fill forms and execute workflows without human interaction. These are critical for preventing automated account creation abuse, checkout automation and workflow exploitation.

Device farm and virtualization

These flags are designed to identify fraud infrastructure, such as cloud-hosted Android device farms. Attackers use these tools to spin up thousands of virtual devices simultaneously to automate abuse at scale. By detecting the infrastructure layer rather than individual behaviors, you can better surface coordinated abuse patterns.

Behavioral

Behavioral flags identify non-human patterns in how a user interacts with your site or app. They are effective at catching a wide variety of fraud, including bot attacks, account takeover and social engineering. For a detailed breakdown of use cases like bot detection, vishing and payment fraud, please see our full guide on understanding behavioral data signals with device intelligence.

Remote access

These flags help detect the use of remote access tools like AnyDesk or TeamViewer. While these tools have legitimate uses, they are increasingly leveraged in cyber attacks to take over user devices, bypass security controls and commit fraud. For more information, please see our full guide on remote access detection with SEON's device intelligence SDKs.

VPN and proxy

This category of flags identifies users who are attempting to conceal their true IP address and location using VPNs or proxy services. This is a common tactic used to bypass geo-restrictions and engage in activities like carding, account takeover and phishing. For more information, please see our full guide on residential proxy and VPN detection.