The victim says yes. The device says scam.

Coached-approval scams run on your customer's trust and the scammer's hardware. TrustSig Pro scores the device that starts the authentication against the account's own history, and blocks it before the push goes out.

Talk to an expertSee how it works
Nothing to coach the victim throughFan-out caught across accountsOwner's devices stay untouched
Push confirmation requestedu_20748loginone-time pushjust now
Types the details
Device
ent_4b90d2e1
First seen
44 seconds ago
Accounts tried, 7 days
9
Network
620 km from every session
Would get the push
Device
the owner's phone
First seen
March 2025
Sessions on account
312
Network
home provider, Tartu
91/100Scam risk at initiation
What fired
Account has never seen this hardware+34
9 accounts from this device, 7 days+28
Details typed clean, no autofill+17
Network far from every prior login+12
Blocked before the push left

Already in production

Publishing platforms, fintech and national charities across Europe already run TrustSig on their forms.

PublitPrint-on-demand and digital book distribution for publishers.Publishing · SwedenLEI SystemOfficial Legal Entity Identifier registration agent.Fintech · EstoniaDisability Sport WalesNational charity for inclusive and disability sport.Charity · Wales
And many more across Europe
Case studyHow LEI System eliminated API abuse & form spamRead the case studyAPI abuse, eliminatedZero false positivesLive in five minutes
01The scam

Everything is right except the machine

A coached-approval scam defeats credentials, MFA and the push dialog, because the person confirming is real. It cannot move the session onto the victim's hardware.

01The callYour customer answers a caller who knows the script, some of their data, and exactly what the confirmation dialog will say.
02The entryThe scammer types the victim's details into your real login form. No malware, no phishing site, and the credentials are correct.
03The pushYour own system sends the confirmation, so it arrives from a sender the victim already trusts.
04The yesCoached through the dialog, the victim approves a session they never started, and every authentication check records a clean pass.
02The evidence

Scored on the device, before the push is sent

You send the initiation as one event, and the verdict comes back with its reasons before your confirmation goes out.

01Fan-outOne device starting authentications across many accounts is the marker per-account rate limits never see.
02First-seen hardwareThe owner has a device history. A push requested from hardware that never appears in it is weighed against everything else on the attempt.
03Entry statisticsOwners autofill, hesitate and mistype. Details typed cleanly off a list, at a steady working cadence, read as someone running a script.
04Graph historyThe device keeps its record through a fingerprint rewrite, and that record reaches back up to 12 months.
send-push.tsbefore the push
const e = await pro.submitEvent({  kind: "login",  user_id: account.id,  request_id: v.request_id,});
if (e.decision === "BLOCK") return deny();   // push never sentif (e.decision === "REVIEW") return hold();  // verify out of bandawait sendPushConfirmation(account);
03The spree

The spree ends part-way down the list

One scammer works a call list, and statistical memory turns each attempt into evidence against the next.

  • A declined push is evidence: the owner saying no raises the device's risk on the next attempt.
  • Blocks land on the scammer's hardware, so the victim's own phone and laptop keep working untouched.
  • The device stays on the hotlist through fingerprint rewrites, caught by the same linkage that beats anti-detect browsers.
  • Every attempt is logged with its reasons, one timeline per device, ready for your fraud team's case file.
ent_4b90d2e1
14:02u_55810, push declined by the owner
14:19u_60244, push approved on a call
14:31u_60244, payout held at the action
14:44u_71203, blocked at initiation, no push
14:57u_88356, blocked at initiation, no push
Accounts dialled
5 in 55 minutes
Pushes after 14:31
none sent
What tied them together
Same hardware, every attempt+40
No victim shares history with it+26
One working cadence, 12 to 17 min+15

Put a verdict on the device that started the session.

Talk to an expert
04 Questions

Scams and social engineering, answered

TrustSig Pro scores the hardware and the statistics around the attempt. The account's history already knows which devices belong to its owner, and the scammer's machine is first-seen or known from other victims. Fan-out across accounts, entry cadence and network distance carry weight too.

A caller poses as your service, enters the victim's details into your real login, and your own system sends the confirmation push. The victim, still on the phone, is talked into approving. Credentials, MFA and the push all pass, because the only forged part is who holds the session.

Yes. You send the initiation as an event, and the verdict comes back with its reasons before you send the push. A blocked initiation means the customer never sees a push to be talked through.

A first-seen device on its own does not block, and known-good history carries negative weight. Blocks come from combinations: unknown hardware plus cross-account fan-out, scripted entry, or a device already tied to fraud. The ambiguous middle routes to REVIEW, where you verify through a channel a caller cannot script.

Yes. Repeated initiations against one account count as device velocity, and each push the owner declines raises the score of the next attempt.

A rewritten fingerprint links back to the hardware it left, through the same coherence and linkage evidence that catches anti-detect browsers. Behavioural memory holds for up to twelve months, so a device seen on one victim is still known on the next.

05More of the platform

Ask the same platform a different question

Every page below runs on the same telemetry, the same device identity and the same detection catalog.

01Spoofed devices & ban evasionA new fingerprint is not a new device.Anti-detect browsers02Multi-account & alt detectionName the account it is an alt of.Linked accounts03Account takeover protectionScore the login against the account's own history.Login risk04Signup & trial-abuse protectionMatch a new signup back to the machine behind it.Serial signups05Account sharing detectionSee which seats are carrying five people.Shared seats06Bots, scrapers & AI agentsSort the crawler from the scraper from the human.Automation evidence07Privacy & data architectureNo cookies. Not one.Cookie-free
06Get started

Bring us your scam pattern

Tell us how the calls run and what an approved scam costs you. We will reply by email to set up access for your team.

  • EU-hosted and GDPR-native
  • Cookie-free device identity
  • Training mode before anything enforces