Evidence that arrives
after the credits
The fifth account is only provably linked after it already got credits. When that link appears, Nolgard sends your backend a signed webhook naming the linked accounts, and your backend decides whether to revoke the credits. Nolgard never touches your ledger.
What Nolgard sends
Example ยท a later fraud label
- BeforeFive accounts received trial grants.
- New evidenceOne is labelled fraud. Local device or email links connect the others.
- Event
account.flaggedfor previously granted siblings. - Your actionYour backend reviews the link and revokes unused credits if you want to.
How it works
Label fraud
Send feedback through the API or label an account in the dashboard.
Receive signed evidence
Nolgard queues a signed webhook for other linked accounts with a previous positive grant.
Re-check before payout
Ask for the account's current risk before a payout, upgrade or new credit grant.
Check before a payout
GET /v1/accounts/user_5
Authorization: Bearer SITE_SECRET
{"accountId":"user_5","risk":"high","clusterSize":5,
"fraudLabels":1,"devices":2,"lastDecision":"allow",
"flags":["reported_fraud"],"recommendedAction":"revoke_credits"}This reads what Nolgard knows about the account now, which can differ from the original signup decision. recommendedAction is advice for your backend to act on or ignore. The Node SDK exposes getAccountRisk(accountId).
Limits
- Nolgard recommends an action. It does not debit your ledger or revoke credits itself.
- Device and email links are not proof of a person. Review shared-device cases. Network-only neighbours never trigger these events.
- Local links cover 30 days. Fresh identities and devices can evade linkage.
- A positive grant records Nolgard's recommendation; it is no confirmation that credits were issued.
- Delivery is at least once and can be delayed. Deduplicate by event id; re-check at sensitive actions.
- Risk thresholds and retry waits are logical defaults and carry no measured guarantee.