> ## Documentation Index
> Fetch the complete documentation index at: https://docs.riseworks.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Security Events

> Webhook events related to security, fraud detection, and compliance monitoring

Security events are triggered when potentially suspicious activities are detected or when security-related account actions occur. These events help you monitor and respond to security threats in real-time.

## Overview

Rise supports the following security-related webhook events:

<CardGroup cols={1}>
  <Card title="withdraw_account.duplicated_detected" icon="shield-exclamation" href="#withdraw-account-duplicated-detected">
    Duplicate withdrawal account detected for security review
  </Card>
</CardGroup>

***

## withdraw\_account.duplicated\_detected

When the system detects that a user is attempting to use a withdrawal account that's already associated with another user or has been flagged for suspicious activity, this event is triggered. This is part of Rise's fraud prevention and compliance monitoring.

### Field reference

<ParamField path="object" type="string" required>
  The type of object this webhook represents (always "event")
</ParamField>

<ParamField path="created" type="number" required>
  The Unix timestamp when the event was created
</ParamField>

<ParamField path="event_type" type="string" required>
  The type of event that occurred
</ParamField>

<ParamField path="event_version" type="string" required>
  The version of the event schema
</ParamField>

<ParamField path="request_id" type="string">
  A unique identifier for the API request that triggered this event (optional)
</ParamField>

<ParamField path="idempotency_key" type="string" required>
  A unique key to ensure the webhook is processed only once
</ParamField>

<ParamField path="account" type="object" required>
  Account information for the affected user
</ParamField>

<Expandable title="account" defaultOpen>
  <ParamField path="user_id" type="string" required>
    The unique identifier for the user whose account was affected
  </ParamField>

  <ParamField path="account_status_v2" type="string" required>
    The new status of the account (suspended, under\_review, etc.)
  </ParamField>
</Expandable>

<RequestExample>
  ```json withdraw_account.duplicated_detected (v1) theme={null}
  {
    "object": "event",
    "created": 1751590453,
    "request_id": "req-1751590452487",
    "event_type": "withdraw_account.duplicated_detected",
    "event_version": "1.0",
    "idempotency_key": "85420805-0b5e-4b11-b7f4-c6f05db7120b",
    "account": {
      "user_id": "us-testWebhook1",
      "account_status_v2": "active"
    }
  }
  ```
</RequestExample>

***

## Implementation Notes

<Warning>
  **Immediate action required**: When this event is triggered, the affected account is immediately suspended to prevent potential fraud. Manual review is required to restore access.
</Warning>

<Info>
  **Compliance reporting**: These events should be logged for compliance purposes and may need to be reported to regulatory authorities depending on your jurisdiction.
</Info>

<Tip>
  **User communication**: Consider implementing automated notifications to inform affected users about the account suspension and next steps for resolution.
</Tip>

### Account Status Values

<AccordionGroup>
  <Accordion title="suspended" icon="ban">
    Account is temporarily suspended pending review due to security concerns
  </Accordion>

  <Accordion title="under_review" icon="magnifying-glass">
    Account is under investigation but still operational with limited functionality
  </Accordion>

  <Accordion title="flagged" icon="flag">
    Account has been marked for attention but remains fully operational
  </Accordion>
</AccordionGroup>

### Security Response Workflow

When this event is triggered, consider implementing the following response workflow:

1. **Immediate Response**
   * Log the security event for audit purposes
   * Notify your security team or compliance officer
   * Suspend any pending transactions for the affected user

2. **Investigation**
   * Review the duplicate account details
   * Check for patterns of suspicious activity
   * Verify user identity through additional KYC procedures

3. **Resolution**
   * If legitimate: Restore account access and update internal records
   * If fraudulent: Maintain suspension and report to authorities if required
   * Document the investigation outcome for future reference

### Common Triggers

This event is typically triggered by:

* **Bank account reuse** - Same bank account linked to multiple user profiles
* **Identity overlap** - Similar personal information across different accounts
* **Device fingerprinting** - Same device used for multiple account setups
* **Behavioral patterns** - Similar transaction patterns suggesting coordinated activity

<Note>
  **False positives**: Legitimate cases include family members sharing bank accounts or users creating new accounts after account issues. Always provide an appeal process for affected users.
</Note>