Fraud Detection

The Float Service runs a series of fraud checks during float creation. Checks are controlled by configuration and GrowthBook feature flags, so individual checks can be toggled without a code deployment.

Check Sequence

Fraud checks run as part of POST /{user_id}/floats, after subscription validation and before underwriting. Checks run in order; the first failing check rejects the float. A disabled check is skipped and treated as passed.

App Version — build version below the configured minimum → ErrAppVersionInvalid.
Float Amount — requested amount above the configured maximum → ErrFloatAmount.
Recent Floats — float taken in the last 24 hours → ErrRecentFloat; outstanding float exists → ErrOutstandingFloat; an ACHSENT most-recent float with a matching early-advance clearance is allowed through.
Active Installment Loans — an OPEN or DEFAULTED LOC loan exists → ErrOutstandingLoan.
Payments Service fraud check — check failure or connectivity error (ErrConnectivity) → reject.

After the attempt, check results are saved back to the Payments Service regardless of approval or denial — skipped for bypassed users and on a Payments connectivity error.

Checks Reference

Check What it validates External call

Check	What it validates	External call
App Version	The requesting app’s build version meets a configured minimum.	None — validated against a configured value.
Float Amount	The requested amount does not exceed the configured maximum.	None — validated against a configured value.
Recent Floats	No float was taken in the last 24 hours and no outstanding float exists for the user. An in-processing (`ACHSENT`) float is allowed through only when it is the user’s most recent float and the underwriting eligibility response clears an early advance against that specific float — `EarlyAdvanceEligible` is true and `EarlyAdvanceFloatId` matches that float’s ID. Any other outstanding `ACHSENT` float blocks.	RDS — queries the floats table directly. Underwriting Service — `GetEligibilityCheck()` when an `ACHSENT` float is present.
Active Installment Loans	No `OPEN` or `DEFAULTED` installment loans exist for the user.	LOC Service — `ListLoansForUser()`
Payments Service	External fraud check using user context: account ID, float type, install ID, user ID, zip code.	Payments Service — `FloatFraudCheck()`

App Version

The requesting app’s build version meets a configured minimum.

None — validated against a configured value.

Float Amount

The requested amount does not exceed the configured maximum.

None — validated against a configured value.

Recent Floats

No float was taken in the last 24 hours and no outstanding float exists for the user. An in-processing (ACHSENT) float is allowed through only when it is the user’s most recent float and the underwriting eligibility response clears an early advance against that specific float — EarlyAdvanceEligible is true and EarlyAdvanceFloatId matches that float’s ID. Any other outstanding ACHSENT float blocks.

RDS — queries the floats table directly. Underwriting Service — GetEligibilityCheck() when an ACHSENT float is present.

Active Installment Loans

No OPEN or DEFAULTED installment loans exist for the user.

LOC Service — ListLoansForUser()

Payments Service

External fraud check using user context: account ID, float type, install ID, user ID, zip code.

Payments Service — FloatFraudCheck()

Bypass

Users with an active requirements bypass record (see Requirements Bypass) have the Bypassed flag set to true when fraud checks are invoked. In bypass mode the underwriting eligibility check is skipped entirely; individual fraud checks may still run depending on configuration, and the Bypassed flag is passed to the Payments Service fraud check, which may apply different rules for bypassed users.

Fraud check results are not saved back to the Payments Service for bypassed users.

Feature Flags

GrowthBook flags evaluated during float creation are cataloged in GrowthBook Flags.