Challenge fraud and abuse faster.

Verify a risky session instead of blocking it. Hosted, branded challenge flows that any policy can trigger.

Book a demo Log in
CrexiHouzz ProManatalVyondAgorapulseSmartScoutBreaking Into Wall Streetiwd.ioSketchyTettraDesignfilesPrep101Cheddar UpNorth DataStealthWriterPharmAchieve
CrexiHouzz ProManatalVyondAgorapulseSmartScoutBreaking Into Wall Streetiwd.ioSketchyTettraDesignfilesPrep101Cheddar UpNorth DataStealthWriterPharmAchieve

The engine

A challenge is the end of a decision, not the whole product.

Your policies decide who gets asked. The challenge engine runs the part your users see, and hands back a result you can act on.

1Trigger

Any policy can raise a challenge.

Rupt evaluates every enabled policy on a login, a signup or an in-product action, and the highest priority match wins. Challenge is one of six verdicts it can return, so the same rules that verify a session can also allow it, list it, deny it or suspend it.

Challenge /Policy
Live

account-sharing-device-limits

Event Login Sign up Access
Match all of
device_count>2
and
impossible_travelistrue
and
concurrent_sessionsistrue
Verdict Challenge
Type
Account sharing
Cooldown
24 hours

Challenge config

Verification channels

Email SMS

Requirement

Require allVerify every channelRequire any oneAny single channel passes

Require in order

1. Email2. SMS

Maximum active devices

Overall 2 devices Computers 2 devices Tablets No limit Mobile 1 device
Skips allowed1

Branding

LogoPrimary #151B85 Domaintrust.rupt.dev

Challenge lifecycle

createdpresentedcode sentawaiting phoneverifiedcompleted

Off the happy path

failedskippedoverridden
Code expires in
10 minutes
Attempts per code
5
Codes per challenge
5
Cooldown before re-challenge
24 hours
policy actions
6 policy actions
event types
3 event types
condition fields
30+ condition fields

2Verify

The screens are already built, on a domain that is yours.

Rupt sends the code by email or SMS, in the order you set, and hosts everything behind it: the device review, the six box code entry, the resend countdown, the expiry. Four languages, your logo, your colour, and trust.rupt.dev or a CNAME of your own.

Challenge /Verification
Live

account-sharing-device-limits

Event Login Sign up Access
Match all of
device_count>2
and
impossible_travelistrue
and
concurrent_sessionsistrue
Verdict Challenge
Type
Account sharing
Cooldown
24 hours

Challenge config

Verification channels

Email SMS

Requirement

Require allVerify every channelRequire any oneAny single channel passes

Require in order

1. Email2. SMS

Maximum active devices

Overall 2 devices Computers 2 devices Tablets No limit Mobile 1 device
Skips allowed1

Branding

LogoPrimary #151B85 Domaintrust.rupt.dev

Challenge lifecycle

createdpresentedcode sentawaiting phoneverifiedcompleted

Off the happy path

failedskippedoverridden
Code expires in
10 minutes
Attempts per code
5
Codes per challenge
5
Cooldown before re-challenge
24 hours
delivery channels
2 delivery channels
languages
4 languages
screens to build
0 screens to build

3Settle

Every challenge ends somewhere you can report on.

Verified, completed, failed, skipped, or superseded by a newer challenge. Nine states, all recorded against the policy that raised them, with a cooldown so a customer who just passed is not asked again on their next page view.

Challenge /Lifecycle
Live

account-sharing-device-limits

Event Login Sign up Access
Match all of
device_count>2
and
impossible_travelistrue
and
concurrent_sessionsistrue
Verdict Challenge
Type
Account sharing
Cooldown
24 hours

Challenge config

Verification channels

Email SMS

Requirement

Require allVerify every channelRequire any oneAny single channel passes

Require in order

1. Email2. SMS

Maximum active devices

Overall 2 devices Computers 2 devices Tablets No limit Mobile 1 device
Skips allowed1

Branding

LogoPrimary #151B85 Domaintrust.rupt.dev

Challenge lifecycle

createdpresentedcode sentawaiting phoneverifiedcompleted

Off the happy path

failedskippedoverridden
Code expires in
10 minutes
Attempts per code
5
Codes per challenge
5
Cooldown before re-challenge
24 hours
code lifetime
10 min code lifetime
tries per code
5 tries per code
cooldown
24 hrs cooldown

Graduated response

One evaluation, six possible verdicts.

Blocking is the last thing the engine reaches for. Nearly every request ends at allow, where nothing is shown and nothing is asked, which is what a paying customer should experience.

Least frictionMost friction

Allow

Most traffic

always

Nothing above it matched.

What the user gets

Nothing shown, nothing asked. The session carries on and your app never pauses.

Add to list

fingerprint_user_count > 1

One browser carrying several accounts.

What the user gets

Nothing shown. The account joins a list with a TTL you set, ready for a later rule or a human.

Challenge

is_new_fingerprint is true

A login from a device nobody has seen.

What the user gets

A hosted verification screen and a six digit code by email or SMS. Pass it and the session continues.

Deny

email_is_disposable is true

A signup on a throwaway inbox.

What the user gets

The request is refused. On in-product access Rupt serves a hosted access denied page.

Suspend

in_list "confirmed-abuse"

An account your team already ruled on.

What the user gets

The account is held, with a hosted suspension page pointing the person at your support route.

The sixth action runs the ladder backwards

Remove from list takes an account back off a watch list the moment it clears, so one bad afternoon does not follow a customer around for a month.

You are never forced to use our page

Deny and suspend render a hosted page for in-product access. On login and signup the verdict comes back on the API response and your own code decides what the person sees.

Challenge types

Four flows, each written for a different kind of abuse.

A policy points at one of them. They share the same delivery, retry and cooldown machinery, and land the person on a different screen.

Account sharing

account_sharing

For users sharing accounts across too many devices. Shows device review, optional verification, and device limit enforcement.

What the user lands on

Too many devices using this account, with every live session listed by operating system, location and last seen, and a log out button on each row.

Account takeover

account_takeover

For logins from unfamiliar devices or locations. Verifies the user's identity via email or SMS code.

What the user lands on

Unrecognized login detected, with the reason named on the page, new browser or unfamiliar location, and a choice of email or text.

Identity verification

fake_account

For new signups or suspicious accounts. Verifies identity via email or SMS code before allowing access.

What the user lands on

Account verification required. With ordering on, the second step reads one more step and keeps a check against the channel already cleared.

Linked accounts

linked_accounts

For signups reusing a phone number. Verifies email, then collects and verifies a phone number, and refuses numbers already tied to too many accounts.

What the user lands on

Let's secure your account, then add your phone number. Virtual and internet numbers are turned away, and so is a number already carrying too many accounts.

Biometric Soon

Face, fingerprint or passkey on the device the person is already holding, as another way to satisfy the same challenge. Not available yet, and not something you can turn on today.

Questions teams ask about the challenge engine:

Ship step-up verification this week.

Drop in the SDK, point one policy at a challenge type, and Rupt hosts the rest on your own domain. Nothing to design, nothing to migrate, and you can turn it off from the dashboard the moment you want to.

Book a demo Log in