Whether it's an account takeover or a mule handoff, the signal is the same — a new person is operating the account. Our behavioral map tracks every account over time and surfaces the moment control shifts, before any damage is done.
Every confirmed bad operator carves out a region of the behavioral map that is now permanently theirs. Flag those regions and you stop them at the door — the moment any new account starts behaving like one of the criminals you've already caught, it's caught too.
Watch the test sessions arrive: each one drifts into the map and turns red the instant it lands inside a flagged region.
We detect when accounts share the same operator, when groups coordinate across accounts, and when behavioral patterns reveal organized activity. We can map the full shape of a fraud ring from a single confirmed case.
When someone is being coerced, their behavior changes. The behavioral map encodes these signals continuously — projecting every session along a stress and duress axis — so your fraud team can distinguish a willing user from a coerced one before an irreversible transaction goes through.
AI agents can now mimic human behavior convincingly enough to fool traditional detection. In the behavioral map, they don't. Automated sessions cleanly occupy distinct regions from human ones.
Let's analyze the activity on the account you see on the screen . Each individual human being — regardless of which account they use — will form a unique cluster in the behavioral map.
A typical pattern in fraudulent/abusive accounts is a handoff: the account gets sold from one party to another or taken over. Watch the timeline — the sessions suddenly occupy a completely new region.
This immediately becomes suspicious - a new person is operating this account.
Let's inspect the region surrounding the new handler's cluster for this account.
Scroll to reveal nearby accounts.
The second operator also controls two other accounts .
Let us investigate the activity of these two newly suspicious accounts.
By integrating with other platform data such as transaction history, device data, we see that these accounts interacted with three new accounts .
Those accounts are now suspicious themselves — they interacted with accounts controlled by a suspected bad actor.
One link reveals the next, and the next, and the next. From a single suspicious account, fraud teams follow behavioral handoffs to the actors behind them, jump from those actors to every other account they operate, cross into transaction edges to find their counterparties, and return to the behavioral map to find who's behind those — until the full topology of the criminal network has surfaced. The investigation no longer ends at the case, but the edges of the network.
Once the criminal network has surfaced, the regions it occupies in the behavioral map can be flagged. From this point on, any new account whose behavior lands inside one of these regions is the same operator — under a new identity.
Watch the test sessions arrive: each one drifts into the map and turns red the moment it falls inside a flagged region.
Every platform faces different fraud topologies — mule handoffs, coordinated rings, ATO after authentication. Rather than a black box risk score, we expose the behavioral map as a composable, programmable API that your fraud team integrates directly into your own stack — combining behavioral signals with your transaction history, customer records, and business rules to express investigation logic that no external vendor could replicate.
If you think Incandor can help you fight fraud, contact us at info@incandor.com for early access.
Our proprietary models learn what every user on your platform looks like from how they physically interact with your app — mouse movement, keystroke timing, scroll patterns, touch behavior. Each session is then placed by these models in the map.
Every unique human creates a unique cluster on this map. Aside from identity, intent and state of mind are all encoded in this map.
Query it. Program it. Investigate fraud the way a detective would.
Scroll for some example use cases.
incandor