Allow, no bonus, review or KYC: risk verdicts
Not every risky sign-up should be blocked. For each registration InlineShield tells you whether to allow it, allow it without the bonus, hold it for review or KYC, or block it, so you keep the real players and stop paying the abusers.
Last updated
Five answers instead of yes or no
A yes-or-no fraud check forces a bad choice. Block too much and you turn away paying players. Block too little and the welcome budget leaks to people with ten accounts.
InlineShield answers with a verdict (ALLOWED, QUARANTINED or BLOCKED), a risk score from 0 to 100, the triggers that fired, plain-language reasons, and a recommendedAction that says what to do with the account and the bonus.
| recommendedAction | When you get it | What you can do |
|---|---|---|
| allow | Verdict ALLOWED with a risk score below 25. | Create the account and give the normal welcome offer. |
| allow_no_bonus | Verdict ALLOWED, but with a risk score of 25 or higher. | Create the account and let the player deposit and play, but hold back the sign-up bonus or free bet. |
| review | Verdict QUARANTINED: the sign-up is held for review. | Create the account as pending, or keep it from logging in, until you approve or reject it in the review queue. |
| block | Verdict BLOCKED, or a held sign-up you rejected (signup.rejected webhook). | Refuse the sign-up. No account, no bonus. |
| require_kyc | A held sign-up you approved (signup.approved webhook) whose hold involved an inbox alias, a VPN, a time-zone mismatch or similar signals. | Keep the account, but ask for identity verification before paying out. |
Withhold the bonus, keep the player
allow_no_bonus is the answer a yes-or-no check can't give you. The sign-up looks a little off: a risk score of 25 or more, but not enough to hold it. A generic role address such as info@, say. Not enough to turn the person away, enough to think twice about the free money.
So the account is created, the player can deposit and play, and the sign-up bonus or free bet is simply not credited. A genuine player loses very little. An abuser loses the only thing they came for.
{
"success": true,
"decision": "ALLOWED",
"riskScore": 25,
"reasons": [
"Generic administrative role prefix detected (\"info\")."
],
"requestId": "…",
"action": "allow",
"recommendedAction": "allow_no_bonus"
}switch (result.recommendedAction) {
case 'allow': createAccount({ welcomeBonus: true }); break;
case 'allow_no_bonus': createAccount({ welcomeBonus: false }); break;
case 'review': createAccount({ status: 'pending', reviewId: result.reviewId }); break;
default: rejectSignup(); // block
}Review and KYC without slowing anyone down
A QUARANTINED sign-up goes to the review queue in the console. Your server can create the account as pending and wait. When someone on your team approves or rejects it, InlineShield sends a signed webhook, signup.approved or signup.rejected, and the account is released or closed.
An approved hold that involved an inbox alias, a VPN, a datacenter IP, a time-zone mismatch, a scripted client or a machine-made address comes back with require_kyc. That is the moment to ask for documents: only for the players who earned a second look, not for everyone at the door.
Every answer is advice. recommendedAction is sent next to action, never instead of it, and what you do with it is your call. Your decisions also feed back into InlineShield's learning, and anything beyond a hold needs your approval first. All plans include every verdict; see pricing.
Frequently asked questions
What is the difference between decision, action and recommendedAction?
decision is the verdict (ALLOWED, QUARANTINED or BLOCKED). action is the simple instruction: allow, hold or block. recommendedAction adds the bonus and KYC advice: allow, allow_no_bonus, review, block or require_kyc.
When do I get allow_no_bonus?
When the verdict is ALLOWED but the risk score is 25 or higher. The sign-up is fine to accept, but the signals are strong enough that a bonus is a risk.
When do I get require_kyc?
On the signup.approved webhook, when the held sign-up was held for signals such as an inbox alias, a VPN or datacenter IP, a time-zone mismatch, a scripted client or a machine-made address.
Do I have to follow the recommendation?
No. It is advice for your own code and your team. You can start by logging it next to your current decision, and switch on bonus withholding once you are happy with what you see.
Can I hold sign-ups without changing my registration flow much?
Yes. Create the account as pending when the answer is review, and release it when the webhook arrives. On WordPress the plugin does this for you.
Are these verdicts available on the Free plan?
Yes. Every plan has the same checks and verdicts. Plans differ only in monthly volume and request rate.
Screen your next sign-up for free
The Free plan includes 1,000 screenings a month. Create an account, add your keys and see real verdicts on your own traffic. No card, no sales call, no setup fee.