SignUp---SignIn¶
SendSignInCallOut (Who calls this endpoint?)
| Step | Operation | Block User | Comment | Synchronous |
|---|---|---|---|---|
| 1 | Request Themis User_Sms | does not use the result from risk | True | |
| 2 | if Msisdn country is allowed | the same as User_Sms decision point | ||
| 3 | Otp Velocity check |
SendSignInSms (Who calls this endpoint?)
|Step| Operation| Block User| Comment| Synchronous |
|--|--|--|--|--|
|1 |Request Themis User_Sms|| User does not use the result from risk||
|2 |if Msisdn country is allowed ||the same as User_Sms decision point||
|3 |Otp Velocity check ||||
SignUp
|Step| Operation| Block User| Comment| Synchronous |
|--|--|--|--|--|
|1| Request Themis "User_SignUp"|||
|2| Check is Msisdn Country is allowed|| User_SignUp is doing this also|
|3| Create User|||
|4| Request Themis "Msisdn_Fraudulent"| Block User| Why not check this before creating user?|
SignIn
|Step| Operation| Block User| Comment| Synchronous |
|--|--|--|--|--|
|1| Retry velocity check|It does not touch user's block status but the state remains and keep user account blocked actually|if user retries with wrong sms code or password too many times|
|2| Check User Status|||
|3| Request Themis User_SignIn |||
|4| Check simCountry and networkCountry |BlockUserByFraud||
|5| Check if device is blocked |||
|6| Check allowedDevicesPerUser |||
KycSuccessfullyVerifiedEvent
|Step | Operation |Block User| Comment| Synchronous |
|--|--|--|--|--|
|1| Request Themis IpAddress_Fraudulent| Block by fraud||
|2| Request Themis Msisdn_Fraudulent| Block by fraud||
|3| Request Device_Fraudulent| Block by fraud||
|4| Check DuplicatedIdNumber| Block by duplicate Id| Why not check this first? This parameter comes from Kyc event directly.|
EvaluateFraudCheckMessage
|Step | Operation| Block User| Comment| Synchronous |
|--|--|--|--|--|
|1| Request Themis IpAddress_Fraudulent |||
|2| Request Themis Msisdn_Fraudulent |||
|3| Request Device_Fraudulent || Pay attention, all these checks request risk decision points. But these checks does not block User. If we change risk decision point to send BlockUser action. Then this will be affected.|