Dispositions describes the overall outcome of the alert/case.
Dispositions are standardized on the Unit21 platform using categories.
A disposition can be called: "BLOCKED", "FRIENDLY FRAUD", "OUTLIER", "BAD RULE", or "FRAUD" but it must be categorized as UNDER INVESTIGATION, NOT APPLICABLE, TRUE POSITIVE or FALSE POSITIVE.
For example, "FRIENDLY FRAUD" would typically be categorized as a TRUE POSITIVE. The "BAD RULE" disposition is likely categorized as a FALSE POSITIVE and so on.
By default, all pre-exiting dispositions or API inserted dispositions are categorized as UNKNOWN (i.e Not yet classified).
What are the benefits of labelling dispositions?
- Alert Scores are very accurate when alerts are disposed correctly in the Unit21 system.
- Your organization can easily view alert outcome/performance metrics in Dashboards (Insights).
What do the disposition categories mean?
- TRUE POSITIVE-> Behavior that is (Fraud, AML, but also for KYC and other use cases - anything corresponding to a positive finding and an action outside of the platform, denying/restricting a user, etc)
- FALSE POSITIVE-> Anything where the ultimate resolution was no action
- UNDER INVESTIGATION-> Anything where the ultimate action still is not decided. I.e. even if a case is created, but the ultimate decision might still be to do nothing.
- NOT APPLICABLE-> Anything where a low-context decision is made. Giving up on very old alerts that are no longer relevant, bulk actions in particular, etc
How do I use dispositions?
- Your organization must setup dispositions.
- Your organization must create workflow buttons to dispose alerts and cases.
An alert/case can be disposed only using a workflow button configured in the Workflow Buttons section of your dashboard. Each workflow buttons can have only one disposition.
Dispositions can be viewed in the Summary section of a alert/case view: