What the Backend Actually Checks.
A "Golden Payload" has to survive every stage below, in order, before it's trusted — not one pattern-match on a JSON blob. The same pipeline also carries 50+ real fraud-pattern vectors, from digital-arrest coercion signatures to SIM-swap and mule-account correlation.
Token & Header Validation
Parses the signed request token, enforces ±60s clock skew, ≥256-bit nonce entropy, expiry, and an allowlisted action string — before anything downstream is trusted.
Replay Rejection
In-process 300-second replay window, then a cross-instance nonce check against Redis so a captured request can't be replayed from a different edge node.
Signature Verification
ECDSA P-256-SHA256 signature over the canonical request, checked against that specific device's registered public key — not a shared secret.
Crypto Gate — 8-Element Trust Orchestration
Asserts public key registry lookup, hardware attestation, device-binding token, signature, nonce + timestamp, decision log entry, policy version, and orchestrator identity — all eight, fail-closed — before a verified request is ever released.
Certificate Revocation
Live OCSP check on every non-root certificate in the chain — fails hard on a definitive REVOKED response.
IP / ASN Reputation
Blocks Tor exit nodes, anonymous VPNs and hosting-provider ASNs against a maintained hostile-ASN table, cached 10 minutes at the edge.
Geo-Velocity & GPS-vs-IP Cross-Check
Haversine velocity between consecutive locations flags impossible travel at ≥900 km/h; device-reported GPS is separately cross-checked against edge-derived IP geolocation.
Bot & Automation Scoring
Composite 0–100 score from request-burst rate, User-Agent fingerprinting, and missing-SDK-header checks — fused downstream, never a standalone block.
Evidence Write
Only after every check above does the decision get hash-chained and dual-signed (device + server ECDSA) into the immutable evidence ledger.
Watch the Attack Fail.
The Verdict.
"Feedzai and Riskified are Pattern Matchers. NonaShield is a Truth Verifier"[cite: 411].