License & Deployment Mix: 17 tools – 3 OSS, 14 SaaS. (OSS and SaaS counts can overlap when an open-source tool also offers a vendor-hosted edition.)
What Is Fraud Detection?
Fraud detection is the practice of identifying and preventing unauthorized, deceptive, or criminal transactions and activities in real time or near-real time. Modern fraud detection systems combine rule engines, machine learning models, device fingerprinting, behavioural analytics, and identity verification to score transactions and flag suspicious activity before financial loss occurs.
The fraud detection landscape spans several domains:
- Transaction monitoring – real-time scoring of payment transactions against rules and ML models to detect anomalies, velocity abuse, and known fraud patterns
- Anomaly detection – statistical and ML-based identification of deviations from normal behaviour across accounts, devices, and networks
- Identity verification (KYC) – verifying that a person is who they claim to be using document checks, biometrics, liveness detection, and database lookups
- Rule engines – configurable business rules that flag or block transactions matching specific criteria (amount thresholds, geo-velocity, device mismatches)
- ML scoring – trained models that assign risk scores to transactions, accounts, or sessions based on historical patterns
- Real-time decisioning – sub-second approve/ decline/review decisions at the point of transaction
- Chargeback prevention – tools that intercept and resolve disputes before they become chargebacks, reducing financial losses and processor penalties
- KYC/AML – Know Your Customer and Anti-Money Laundering compliance checks including watchlist screening, PEP (Politically Exposed Person) checks, and sanctions monitoring
Fraud detection is not SIEM or security monitoring (see SIEM & Log Analytics for those evaluations). While both detect anomalies, fraud detection focuses on financial transactions and identity verification, whereas SIEM focuses on security events and infrastructure threats.
The information on these pages was researched by a combination of human review and large language models. To suggest an addition or correction, please contact us. Prepared by Rhodium Systems Inc., author of the ResorsIT platform — a unified IT operations management platform for IT teams and MSPs that integrates a curated suite of open-source, commercial, and SaaS applications into a single system with shared identity, single sign-on, access control, and a common audit trail. Use this catalogue only as a starting point for your own research, and review any tool carefully against your own requirements before relying on it. Catalogue data version 2026.197.
Comparison
See also Payment Processing for payment gateway evaluations and SIEM & Log Analytics for security monitoring.
SSO / OIDC Comparison
OIDC is the preferred SSO protocol.
| Tool | OIDC | SAML | SCIM | Authentik Notes |
|---|---|---|---|---|
| Apache Flink | N/A | N/A | N/A | Framework; no user-facing auth; Kerberos for cluster security |
| Kafka Streams | N/A | N/A | N/A | Library; no user-facing auth; Kafka ACLs for access control |
| Fingerprint | Yes | No | No | Dashboard OIDC; API uses API keys; Authentik as IdP for dashboard |
| Ory Kratos | Yes | No | No | Native OIDC provider; integrates as identity peer with Authentik |
| Featurespace | Yes* | Yes | No | Enterprise SSO; SAML primary; OIDC via custom config |
| Feedzai | Yes | Yes | Yes | Full SSO suite; Authentik as IdP; SCIM directory sync |
| NICE Actimize | No | Yes | Yes | SAML primary; SCIM provisioning; no native OIDC |
| SAS Fraud Mgmt | Yes* | Yes | No | SAS Viya OIDC; SAML for legacy; Authentik as IdP |
| Sift | Yes | Yes | No | Console SSO; OIDC and SAML; API uses API keys |
| Signifyd | Yes | Yes | No | Dashboard SSO; OIDC supported; API uses API keys |
| Riskified | No | Yes | No | SAML SSO for portal; API uses HMAC auth |
| Forter | Yes | Yes | No | Dashboard SSO; OIDC and SAML; API uses API keys |
| Kount | No | Yes | No | SAML SSO via Equifax; no native OIDC |
| Jumio | Yes | Yes | No | Portal SSO; OIDC and SAML; API uses OAuth2 client credentials |
| Onfido | Yes | Yes | No | Dashboard SSO; OIDC supported; API uses API tokens |
| Sumsub | Yes | Yes | No | Dashboard SSO; OIDC and SAML; API uses app tokens |
* = requires specific tier, configuration, or custom integration
Best SSO support: Feedzai (OIDC, SAML, SCIM), Sift (OIDC, SAML), Jumio (OIDC, SAML), Sumsub (OIDC, SAML)
SAML only: NICE Actimize, Riskified, Kount
No user-facing auth: Apache Flink, Kafka Streams (frameworks, not user-facing applications)
API Comparison
| Tool | API Type | Auth | Webhooks | SDKs | Real-Time Scoring |
|---|---|---|---|---|---|
| Apache Flink | Java/Scala API | N/A (framework) | N/A | Java, Scala, Python | Yes (stream processing) |
| Kafka Streams | Java API | N/A (library) | N/A | Java | Yes (stream processing) |
| Fingerprint | REST + JS agent | API key | Yes | JS, Android, iOS, Flutter | Yes (device ID) |
| Ory Kratos | REST + gRPC | API key, OAuth2 | Yes | Go, JS, Python, Rust | Yes (identity checks) |
| Featurespace | REST | OAuth2, API key | Yes | Java, Python | Yes (sub-50ms) |
| Feedzai | REST + streaming | OAuth2, API key | Yes | Java, Python | Yes (sub-10ms) |
| NICE Actimize | REST + SOAP | API key, cert | Yes | Java, .NET | Yes (configurable) |
| SAS Fraud Mgmt | REST (Viya) | OAuth2 | Yes | Python (sasctl), R | Yes (real-time + batch) |
| Sift | REST | API key | Yes | Python, Ruby, Java, PHP | Yes (sub-100ms) |
| Signifyd | REST | API key (HMAC) | Yes | Java, PHP, Ruby | Yes (guaranteed decision) |
| Riskified | REST | HMAC | Yes | Ruby, Python, PHP | Yes (guaranteed decision) |
| Forter | REST | API key | Yes | JS, Python, Java, Ruby | Yes (sub-100ms) |
| Kount | REST | API key | Yes | PHP, .NET, Java | Yes (sub-300ms) |
| Jumio | REST | OAuth2 | Yes | iOS, Android, Web | Yes (identity only) |
| Onfido | REST | API token | Yes | iOS, Android, Web, React | Yes (identity only) |
| Sumsub | REST | App token, webhook sig | Yes | iOS, Android, Web, React | Yes (identity only) |
Fraud Detection Features
| Tool | Rules Engine | ML/AI | Real-Time | Device FP | Behavioural | KYC/AML | Chargeback | Case Mgmt | Graph Analytics |
|---|---|---|---|---|---|---|---|---|---|
| Apache Flink | CEP library | Custom (build) | Yes | No | No | No | No | No | No |
| Kafka Streams | Custom rules | Custom (build) | Yes | No | No | No | No | No | No |
| Fingerprint | No | No | Yes | Yes (core) | Limited | No | No | No | No |
| Ory Kratos | Limited | No | Yes | No | No | Limited | No | No | No |
| Featurespace | Yes | Yes (ARIC) | Yes | Yes | Yes | Yes | Yes | Yes | Yes |
| Feedzai | Yes | Yes (AutoML) | Yes | Yes | Yes | Yes | Yes | Yes | Yes |
| NICE Actimize | Yes | Yes | Yes | Yes | Yes | Yes (full) | Yes | Yes | Yes |
| SAS Fraud Mgmt | Yes | Yes (advanced) | Yes | Yes | Yes | Yes | Yes | Yes | Yes |
| Sift | Yes | Yes (ensemble) | Yes | Yes | Yes | No | Yes | Yes | Yes |
| Signifyd | Limited | Yes | Yes | Yes | Yes | No | Yes (guarantee) | Yes | Yes |
| Riskified | Limited | Yes | Yes | Yes | Yes | No | Yes (guarantee) | Yes | Yes |
| Forter | Limited | Yes (Identity) | Yes | Yes | Yes | No | Yes | Yes | Yes |
| Kount | Yes | Yes | Yes | Yes (core) | Yes | No | Yes | Yes | Yes |
| Jumio | No | Yes (doc AI) | Yes | No | No | Yes (core) | No | Limited | No |
| Onfido | No | Yes (Atlas AI) | Yes | No | No | Yes (core) | No | Limited | No |
| Sumsub | Yes | Yes | Yes | Yes | No | Yes (core) | No | Yes | No |
Full-stack fraud platforms: Featurespace, Feedzai, NICE Actimize, SAS Fraud Management (rules + ML + KYC/AML + case management + graph analytics)
Payment fraud specialists: Sift, Signifyd, Riskified, Forter, Kount (strong ML + device FP + chargeback management)
Identity specialists: Jumio, Onfido, Sumsub (KYC/AML focused, limited transaction fraud)
Build-your-own: Apache Flink, Kafka Streams (stream processing frameworks requiring custom fraud logic)
Deployment and Licensing
| Tool | License | Self-Hosted | Language | Docker | Min RAM | Pricing |
|---|---|---|---|---|---|---|
| Apache Flink | Apache-2.0 | Yes | Java/Scala | Yes | 2 GB | Free (OSS) |
| Kafka Streams | Apache-2.0 | Yes | Java | Yes | 1 GB | Free (OSS) |
| Fingerprint | BSL (core) | No (SaaS) | TypeScript | N/A | N/A | Free tier / $200+/mo |
| Ory Kratos | Apache-2.0 | Yes | Go | Yes | 128 MB | Free (OSS) / Cloud |
| Featurespace | Proprietary | On-prem + SaaS | Java | N/A | N/A | Enterprise (contact) |
| Feedzai | Proprietary | On-prem + SaaS | Java | N/A | N/A | Enterprise (contact) |
| NICE Actimize | Proprietary | On-prem + SaaS | Java/.NET | N/A | N/A | Enterprise (contact) |
| SAS Fraud Mgmt | Proprietary | On-prem + SaaS | SAS/Python | N/A | N/A | Enterprise (contact) |
| Sift | Proprietary | No (SaaS) | N/A | N/A | N/A | Volume-based pricing |
| Signifyd | Proprietary | No (SaaS) | N/A | N/A | N/A | Volume-based / % GMV |
| Riskified | Proprietary | No (SaaS) | N/A | N/A | N/A | Volume-based / % GMV |
| Forter | Proprietary | No (SaaS) | N/A | N/A | N/A | Volume-based pricing |
| Kount | Proprietary | No (SaaS) | N/A | N/A | N/A | Volume-based pricing |
| Jumio | Proprietary | No (SaaS) | N/A | N/A | N/A | Per-verification |
| Onfido | Proprietary | No (SaaS) | N/A | N/A | N/A | Per-verification |
| Sumsub | Proprietary | No (SaaS) | N/A | N/A | N/A | Per-verification / $199+/mo |
Self-hosted options: Apache Flink, Kafka Streams, Ory Kratos (fully open source); Featurespace, Feedzai, NICE Actimize, SAS (on-prem enterprise deployments)
SaaS only: Sift, Signifyd, Riskified, Forter, Kount, Fingerprint, Jumio, Onfido, Sumsub
Pricing models: enterprise contract (transaction fraud), volume-based or % of GMV (payment fraud), per-verification (igap/KYC)
Monitoring Integration
| Tool | Prometheus Metrics | Structured Logs | Grafana Dashboards |
|---|---|---|---|
| Apache Flink | Yes (native) | Log4j2 structured | Community |
| Kafka Streams | Yes (JMX/Prometheus) | Log4j structured | Community |
| Fingerprint | No (SaaS) | N/A | API polling only |
| Ory Kratos | Yes (/metrics) | JSON stdout | Community |
| Featurespace | Yes (enterprise) | Structured logs | Custom |
| Feedzai | Yes (enterprise) | JSON structured | Custom |
| NICE Actimize | JMX (Jolokia) | Log4j files | Custom |
| SAS Fraud Mgmt | Yes (Viya) | SAS logs | Custom |
| Sift | No (SaaS) | N/A | Webhook-based alerts |
| Signifyd | No (SaaS) | N/A | Webhook-based alerts |
| Riskified | No (SaaS) | N/A | Webhook-based alerts |
| Forter | No (SaaS) | N/A | Webhook-based alerts |
| Kount | No (SaaS) | N/A | Webhook-based alerts |
| Jumio | No (SaaS) | N/A | Callback-based alerts |
| Onfido | No (SaaS) | N/A | Webhook-based alerts |
| Sumsub | No (SaaS) | N/A | Webhook-based alerts |
Best monitoring integration: Apache Flink, Kafka Streams, Ory Kratos (native Prometheus endpoints with structured logging)
Enterprise on-prem: Featurespace, Feedzai, SAS (Prometheus or JMX metrics when deployed on-prem)
SaaS tools: monitoring limited to webhook delivery tracking, API availability checks, and fraud metric ingestion via Telegraf HTTP input
Tools
16 tools.
Apache Flink
Apache Flink is a distributed stream and batch processing framework designed for stateful computations over unbounded and bounded data streams.
License: Apache-2.0 (OSS) · Kind: web · Deploy: native · SSO: none
Apache Kafka Streams
Apache Kafka Streams is a client library for building stream processing applications and microservices on top of Apache Kafka.
License: Apache-2.0 (OSS) · Kind: web · Deploy: native · SSO: none
Featurespace
Featurespace is a leading enterprise fraud and financial crime prevention company known for its ARIC (Adaptive Real-time Individual Change- identification) Risk Hub platform.
License: Proprietary (proprietary) · Kind: web · Deploy: native, saas · SSO: none
Feedzai
Feedzai is an AI-first financial crime prevention platform that provides real-time risk scoring for transactions, payments, and account activities.
License: Proprietary (proprietary) · Kind: web · Deploy: native, saas · SSO: none
Fingerprint
Fingerprint (formerly FingerprintJS) is a device identification platform that generates highly accurate browser and device fingerprints for fraud prevention, bot detection, and user identification.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
Forter
Forter is a real-time fraud decisioning platform for e-commerce that provides fully automated, instant approve/decline decisions on every online transaction.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
Jumio
Jumio is an AI-powered identity verification and eKYC platform that provides document verification, biometric authentication, and identity proofing for fraud prevention and regulatory compliance.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
Kount (Equifax)
Kount is a digital fraud prevention and identity trust platform that was acquired by Equifax in 2021 for $640M.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
NICE Actimize
NICE Actimize is the financial crime and compliance division of NICE Systems, providing enterprise-grade solutions for fraud prevention, anti-money laundering (AML), compliance, and market surveillance.
License: Proprietary (proprietary) · Kind: web · Deploy: native, saas · SSO: none
Onfido (Entrust)
Onfido is an AI-powered identity verification platform that provides document verification, biometric authentication, and fraud detection for digital onboarding.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
Ory Kratos
Ory Kratos is a cloud-native, API-first identity management system built in Go. It handles user registration, login, account recovery, settings, and multi-factor authentication.
License: Apache-2.0 (OSS) · Kind: web · Deploy: native, saas · SSO: none
Riskified
Riskified is an e-commerce fraud prevention platform that uses machine learning to provide guaranteed chargeback protection for online merchants.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
SAS Fraud Management
SAS Fraud Management is an enterprise fraud detection and prevention platform from SAS Institute, the analytics software company founded in 1976.
License: Proprietary (proprietary) · Kind: web · Deploy: native, saas · SSO: none
Sift
Sift is a digital trust and safety platform that provides fraud prevention across payment fraud, account takeover, content abuse, and promotion abuse.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
Signifyd
Signifyd is a commerce protection platform that provides guaranteed fraud prevention for e-commerce merchants.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
Sumsub
Sumsub is an all-in-one verification platform that provides KYC (Know Your Customer), KYB (Know Your Business), AML screening, transaction monitoring, and fraud prevention in a single integrated service.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
