Krino derives extra signals from the incoming event. All of them are read from lists held inside your infrastructure — no per-transaction call goes out. Signals are used in a rule like any other field: pick the field, apply the operator.

​
IP

Datacenter ranges cover most VPN and proxy egress. Not proof of anything on its own; it gains weight in combination with other signals.

​
Email

Variants built with dots and plus-addressing collapse to one address, so ten accounts that look different count as one.

​
Phone

Virtual and VoIP numbers are flagged as their own category.

​
Device and browser

The device fingerprint is a stable identifier derived from what the browser reports. Clear the cookies, end the session, open a private tab — the same device still appears under the same trace. You send it as a field and use it in velocity rules: how many distinct cards did this device try in the last 24 hours.

​
Domain

​
Why the lists are offline

Privacy

Every outbound query tells a third party what this customer is doing right now.

Latency

A decision inside a payment flow cannot wait on three external responses.

Cost

Per-query pricing makes teams trim their rules as volume grows.
A scheduled job refreshes the lists regularly. The download only pulls the list; which customer matched what never leaves.