# Handling Fraud Alarms

This page describes how to process and respond to alarms received from the BankID Antifraud Event System.

## Events

The `data` field of each event adheres to a specific schema depending on the event type.

| Event Type                              | Schema                                       |
| --------------------------------------- | -------------------------------------------- |
| `no.bankid.antifraud.alarm.dispatch.v2` | Schema provided upon request                 |
| `no.bankid.antifraud.alarm.dispatch.v1` | Deprecated - refer to previous documentation |

## Processing alarms

Alarms are categorized by codes each with different implications such as:

- What we believe has happened
- What actions we recommend
- Expected rate of false positives

Example alarm codes: `ID01`, `ID02`, etc.
The document describing each alarm type will be provided upon request.

> **Before automating actions**
>
> Before performing automatic actions based on an alarm, always check the `data` field to identify which alarms were triggered. Review the descriptions and recommendations for each alarm type.

## Special alarm types

The system includes special alarm types used for testing and monitoring:

| Alarm Type       | Description                                                                                                                                  |
| ---------------- | -------------------------------------------------------------------------------------------------------------------------------------------- |
| `IDX1_TEST`      | A test alarm manually triggered by the BankID anti-fraud team. Used for testing features with real recipients in the production environment. |
| `IDX2_HEARTBEAT` | A periodic alarm used to monitor the internal workings of the alarm dispatch system and the integration with each individual recipient.      |

> **Handling test alarms**
>
> When you receive an `IDX1_TEST` or `IDX2_HEARTBEAT` alarm, you may choose not to trigger any further processing.
> Make sure these alarms are not counted toward any real fraud statistics.