Amazon Fraud Detector is no longer open to new customers as of November 7, 2025. For capabilities similar to Amazon Fraud Detector, explore Amazon SageMaker, AutoGluon, and AWS WAF.
# Variables
Variables represent data elements that you want to use in a fraud prediction. These variables can be taken from the event dataset that you prepared for training your model, from your Amazon Fraud Detector model's risk score outputs, or from Amazon SageMaker AI models. For more information about variables taken from the event dataset, see [Get event dataset requirements using the Data models explorer](create-event-dataset.md#prepare-event-dataset).
The variables you want to use in your fraud prediction must first be created and then added to the event when creating your event type. Each variable you create must be assigned a datatype, a default value, and optionally a variable type. Amazon Fraud Detector enriches some of the variables that you provide such as IP addresses, bank identification numbers (BINs), and phone numbers, to create additional inputs and boost performance for the models that use these variables.
## Data types
Variables must have a data type for the data element that the variable represents and can optionally be assigned one of the predefined [Variable types](#variable-types). For variables that are assigned to a variable type, the data type is pre-selected. Possible data types include the following types :
| Data type | Description | Default value | Example values |
| --- | --- | --- | --- |
| String | Any combination of letters, whole numbers, or both | | abc, 123, 1D3B |
| Integer | Positive or negative whole numbers | 0 | 1, -1 |
| Boolean | True or False | False | True, False |
| DateTime | Date and time specified in the ISO 8601 standard UTC format only | | 2019-11-30T13:01:01Z |
| Float | Numbers with decimal points | 0.0 | 4.01, 0.10 |
## Default value
Variables must have a default value. When Amazon Fraud Detector generates fraud predictions, this default value is used to run a rule or model if Amazon Fraud Detector doesn't receive a value for a variable. Default values you provide must match the selected data type. In the AWS Console, Amazon Fraud Detector assigns the default value of `0` for integers, `false` for Booleans, `0.0` for floats, and (empty) for strings. You can set a custom default value for any of these data types.
## Variable types
When you create a variable, you can optionally assign the variable to a variable type. Variable type represents the common data elements that are used to train models and to generate fraud predictions. Only variables with an associated variable type can be used for model training. As part of the model training process, Amazon Fraud Detector uses the variable type associated with the variable to perform variable enrichments, feature engineering, and risk scoring.
Amazon Fraud Detector has pre-defined the following variable types that can be used to assign to your variables.
[\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/frauddetector/latest/ug/variables.html)
### Assigning variable to a variable type
If you are planning to use a variable for training your model, it is important that you choose a right variable type to assign to the variable. Incorrect variable type assignment can negatively impact your model performance. It can also become very difficult for you change the assignment later, especially if multiple models and events have used the variable.
You can assign your variable any one of the pre-defined variable types or one of the custom variable types – `FREE_FORM_TEXT`, `CATEGORICAL`, or `NUMERIC`.
**Important notes for assigning variables to the right variable types**
1. If the variable matches one of predefined variable types, use it. Make sure the variable type corresponds to the variable. For example, if you assign an *ip\$1address* variable to `EMAIL_ADDRESS` variable type, the ip\$1address variable will not get enriched with enrichments such as ASN, ISP, geo-location, and risk score. For more information, see [Variable enrichments](#variable-enrichments).
1. If the variable doesn’t match any of predefined variable types, follow the recommendations listed below to assign one of the custom variable types.
1. Assign `CATEGORICAL` variable type to variables that typically do not have natural ordering and can be put into categories, segments, or groups. The dataset you are using to train your model might have ID variables such as, *merchant\$1id*, *campaign\$1id*, or *policy\$1id*. These variables represent groups (for example, all customers with same policy\$1id represent a group). Variables that have the following data must be assigned CATEGORICAL variable type -
+ Variables that contain data such as *customer\$1ID*, *segment\$1ID*, *color\$1ID*, *department\$1code*, or *product\$1ID*.
+ Variables that contain Boolean data with true, false, or null values.
+ Variables that can be put into groups or categories such as company name, product category, card type, or referral medium.
**Note**
`ENTITY_ID` is a reserved variable type used by Amazon Fraud Detector to assign to ENTITY\$1ID variable. The ENTITY\$1ID variable is the ID of the entity initiating the action you want to evaluate. If you are creating a Transaction Fraud Insight (TFI) model type, you are required to provide ENTITY\$1ID variable. You will need to decide which variable in your data uniquely identifies the entity initiating the action and pass it on as ENTITY\$1ID variable. Assign CATEGORICAL variable type to all the other IDs in your dataset, if they are present and if you are using them for model training. Examples of other IDs that are not an entity in your dataset can be *merchant\$1ID*, *policy\$1ID*, and *campaign\$1ID*.
1. Assign `FREE_FORM_TEXT` variable type to variables that contain a block of text. Examples of FREE\$1FORM\$1TEXT variable types are – *user reviews*, *comments*, *dates*, and *referral codes*. The FREE\$1FORM\$1TEXT data contains multiple tokens separated by a delimiter. The delimiters can be any character other than alpha-numeric and underscore symbol. For example, user reviews and comments can be separated by “space” delimiter, dates and referral codes can use hyphens as delimiters to separate out prefix, suffix, and intermediate parts. Amazon Fraud Detector uses the delimiters to extract data from FREE\$1FORM\$1TEXT variables.
1. Assign *NUMERIC* variable type to variables that are real numbers and have inherent ordering. Examples of NUMERIC variables include *day\$1of\$1the\$1week*, *incident\$1severity*, *customer\$1rating*. Although, you can assign CATEGORICAL variable type to these variables, we strongly recommend to assign all real number variables with inherent order to NUMERIC variable type.
## Variable enrichments
Amazon Fraud Detector enriches some of the raw data elements that you provide such as IP addresses, bank identification numbers (BINs), and phone numbers, to create additional inputs and boost performance for the models that use these data elements. The enrichment helps identify potentially suspicious situations and help the models to capture more fraud.
### Phone number enrichment
Amazon Fraud Detector enriches phone number data with additional information that relates to geolocation, the original carrier, and the validity of the phone number. Phone number enrichment is automatically enabled for all the models that are trained on or after *December 13, 2021* and have a phone number that includes a country code (\$1xxx). If you have included phone number variable in your model and have trained it before *December 13, 2021*, retrain your model so it can take advantage of this enrichment.
We highly recommend that you use the following format for phone number variables to ensure that your data is enriched successfully.
| Variable | Format | Description |
| --- | --- | --- |
| PHONE\$1NUMBER | The [E.164](https://en.wikipedia.org/wiki/E.164) standard | Make sure to include country code (\$1xxx) with the phone number. |
| BILLING\$1PHONE and SHIPPING\$1PHONE | The [E.164](https://en.wikipedia.org/wiki/E.164) standard | Make sure to include country code (\$1xxx) with the phone number. |
### Geolocation enrichment
Starting on *February 8, 2022* Amazon Fraud Detector calculates the physical distance between the IP\$1ADDRESS, BILLING\$1ZIP, and SHIPPING\$1ZIP values that you provide for an event. The calculated distances are used as inputs to your fraud detection model.
To enable geolocation enrichment, your event data must include at least two of the three variables: IP\$1ADDRESS, BILLING\$1ZIP, or SHIPPING\$1ZIP. In addition, each BILLING\$1ZIP and SHIPPING\$1ZIP value must have a valid BILLING\$1COUNTRY code and SHIPPING\$1COUNTRY code respectively. If you have a model that was trained before *February 8, 2022* and it includes these variables, you must retrain the model to enable the geolocation enrichment.
If Amazon Fraud Detector can't determine the location that's associated with the IP\$1ADDRESS, BILLING\$1ZIP ,or SHIPPING\$1ZIP values for an event due to the data being not valid, a special placeholder value is used instead. For example, suppose that an event has valid IP\$1ADDRESS and BILLING\$1ZIP values, but SHIPPING\$1ZIP value isn't valid. In this case, enrichment is done only for IP\$1ADDRESS–> BILLING\$1ZIP. The enrichment isn't done for IP\$1ADDRESS–>SHIPPING\$1ZIP and BILLING\$1ZIP–>SHIPPING\$1ZIP . Instead, the placeholder values are used in their place. No matter if geolocation enrichment is enabled for your model or not, the performance of your model doesn't change.
You can opt out of geolocation enrichment by mapping your BILLING\$1ZIP and SHIPPING\$1ZIP variables to the CUSTOM\$1CATEGORICAL variable type. Changing the variable type doesn't affect your model's performance.
**Geolocation variable format**
We highly recommend that you use the following format for geolocation variables to ensure that your location data is enriched successfully.
| Variable | Format | Description |
| --- | --- | --- |
| IP\$1ADDRESS | [IPv4](https://en.wikipedia.org/wiki/IP_address#IPv4_addresses) address | For example - 1.1.1.1 |
| BILLING\$1ZIP and SHIPPING\$1ZIP | The [ISO 3166-1 alpha-2](https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2) postal code for the specified country | For more information, see the Country and territory codes section in this topic. |
| BILLING\$1COUNTRY and SHIPPING\$1COUNTRY | The [ISO 3166-1 alpha-2](https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2) two-letter standard country code | For more information, see the Country and territory codes section in this topic. Amazon Fraud Detector tries to match all the common variations of a country's name to their ISO 3166-1 two-letter standard country code. However, we cannot guarantee they will be matched correctly. |
#### Country and territory codes
The following table provides a complete list of the countries and territories that are supported by Amazon Fraud Detector for geolocation enrichment. Each country and territory has an assigned country code (specifically, the ISO 3166-1 alpha-2 two-letter country code) and a postal code.
**Postal code format**
+ 9 - number
+ a - letter
+ [X] - X is optional. For example, Guersney "GY9[9] 9aa" means both "GY9 9aa" and "GY99 9aa" are valid. Use one format.
+ [X/XX] - either X or XX can be used. For example, Bermuda "aa[aa/99]" means both "aa aa" and "aa 99" are valid. Use either one of these formats, but *do not* use both.
+ Some countries have fixed prefix. For example, the postal code for Andorra is AD999. This means the country code must start with letters *AD* followed by three numbers.
| Code | Name | Postal code |
| --- | --- | --- |
| AD | Andorra | AD999 |
| AR | Netherlands Antilles | 9999 |
| AT | Austria | 9999 |
| AU | Australia | 9999 |
| AZ | Azerbaijan | AZ 9999 |
| BD | Bangladesh | 9999 |
| BE | Belgium | 9999 |
| BG | Bulgaria | 9999 |
| BM | Bermuda | aa[aa/99] |
| BY | Belarus | 999999 |
| CA | Canada | a9a 9a9 |
| CH | Switzerland | 9999 |
| CL | Chile | 9999999 |
| CO | Colombia | 999999 |
| CR | Costa Rica | 99999 |
| CY | Cyprus | 9999 |
| CZ | Czechia | 999 99 |
| DE | Germany | 99999 |
| DK | Denmark | 9999 |
| DO | Dominican Republic | 99999 |
| DZ | Algeria | 99999 |
| EE | Estonia | 99999 |
| ES | Spain | 99999 |
| FI | Finland | 99999 |
| FM | Federated States of Micronesia | 99999 |
| FO | Faroe Islands | 999 |
| FR | France | 99999 |
| GB | United Kingdom | a[a]9[a/9] 9aa |
| GG | Guernsey | GY9[9] 9aa |
| GL | Greenland | 9999 |
| GP | Guadeloupe | 99999 |
| GT | Guatemala | 99999 |
| GU | Guam | 99999 |
| HR | Croatia | 99999 |
| HU | Hungary | 9999 |
| IE | Ireland | a99[a/9][a/9][a/9][a/9] |
| IM | Isle of Man | IM9[9]9aa |
| IN | India | 999999 |
| IS | Iceland | 999 |
| IT | Italy | 99999 |
| JE | Jersey | JE9[9]9aa |
| JP | Japan | 999-9999 |
| KR | Republic of Korea | 99999 |
| LI | Liechtenstein | 9999 |
| LK | Sri Lanka | 99999 |
| LT | Lithuania | 99999 |
| LU | Luxembourg | L-9999 |
| LV | Latvia | LV-9999 |
| MC | Monaco | 99999 |
| MD | Republic of Moldova | 9999 |
| MH | Marshall Islands | 99999 |
| MK | North Macedonia | 9999 |
| MP | North Mariana Islands | 99999 |
| MQ | Matinique | 99999 |
| MT | Malta | aaa 9999 |
| MX | Mexico | 99999 |
| MY | Malaysia | 99999 |
| NL | Netherlands | 9999 aa |
| NO | Norway | 9999 |
| NZ | New Zealand | 9999 |
| PH | Philippines | 9999 |
| PK | Pakistan | 99999 |
| PL | Poland | 99-999 |
| PR | Puerto Rico | 99999 |
| PT | Portugal | 9999-999 |
| PW | Palau | 99999 |
| RE | Reunion | 99999 |
| RO | Romania | 999999 |
| RU | Russian Federation | 999999 |
| SE | Sweden | 999 99 |
| SG | Singapore | 999999 |
| SI | Slovenia | 9999 |
| SK | Slovakia | 999 99 |
| SM | San Marino | 99999 |
| TH | Thailand | 99999 |
| TR | Turkey | 99999 |
| UA | Ukraine | 99999 |
| US | United States | 99999 |
| UY | Uruguay | 99999 |
| VI | Virgin Islands, US | 99999 |
| WF | Wallis and Futuna | 99999 |
| YT | Mayotte | 99999 |
| ZA | South Africa | 9999 |
### Useragent enrichment
If you create the Account Takeover Insights (ATI) model, you must provide a variable of the `useragent` variable type in your dataset. This variable contains the browser, device, and OS data of a login event. Amazon Fraud Detector enriches the useragent data with additional information such as `user_agent_family` `OS_family`, and `device_family`.
# Create a variable
You can create variables in the Amazon Fraud Detector console, using the [create-variable](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/frauddetector/create-variable.html) command, using the [CreateVariable](https://docs.aws.amazon.com/frauddetector/latest/api/API_CreateVariable.html), or using the AWS SDK for Python (Boto3)
## Create a variable using the Amazon Fraud Detector console
This example creates two variables, `email_address` and `ip_address`, and assigns them to the corresponding variable types (`EMAIL_ADDRESS` and `IP_ADDRESS`). These variables are used as examples. If you are creating variables to use for your model training, use the variables from your dataset that are appropriate for your use case. Make sure to read about [Variable types](variables.md#variable-types) and [Variable enrichments](variables.md#variable-enrichments) before you create your variables.
**To create a variable,**
1. Open the [AWS Management Console](https://console.aws.amazon.com) and sign in to your account.
1. Navigate to Amazon Fraud Detector, choose **Variables** in the left navigation, then choose **Create**.
1. In the **New variable** page, enter `email_address` as the variable name. Optionally, enter a description of the variable.
1. In the **Variable type**, choose **Email Address**.
1. Amazon Fraud Detector automatically selects the data type for this variable type because this variable type is predefined. If your variable is not automatically assigned a variable type, select a variable type from the list. For more information, see [Variable types](variables.md#variable-types).
1. If you want to provide a default value for your variable, select **Define a custom default value** and enter a default value for your variable. Skip this step if you are following this example.
1. Choose **Create**.
1. In the **email\$1address** overview page, confirm the details of the variable you just created.
If you need to update, choose **Edit** and provide the updates. Choose **Save changes**.
1. Repeat the process to create another variable `ip_address` and choose **IP Address** for the variable type.
1. The **Variables** page shows the newly created variables.
**Important**
We recommend that you create as many variables as you want from your dataset. You can decide later when creating your event type which variables you want to include for training your model to detect fraud and to generate fraud detections.
## Create a variable using the AWS SDK for Python (Boto3)
The following example shows requests for the [CreateVariable](https://docs.aws.amazon.com/frauddetector/latest/api/API_CreateVariable.html) API. The example creates two variables, `email_address` and `ip_address`, and assigns them to the corresponding variable types (`EMAIL_ADDRESS` and `IP_ADDRESS`).
These variables are used as examples. If you are creating variables to use for your model training, use the variables from your dataset that are appropriate for your use case. Make sure to read about [Variable types](variables.md#variable-types) and [Variable enrichments](variables.md#variable-enrichments) before you create your variables.
Be sure to specify a variable source. It helps to identify where the variable value is derived. If the variable source is **EVENT**, the variable value is sent as part of the [GetEventPrediction](https://docs.aws.amazon.com/frauddetector/latest/api/API_GetEventPrediction.html) request. If the variable value is `MODEL_SCORE`, it's populated by an Amazon Fraud Detector. If `EXTERNAL_MODEL_SCORE`, the variable value is populated by an imported SageMaker AI model.
```
import boto3
fraudDetector = boto3.client('frauddetector')
#Create variable email_address
fraudDetector.create_variable(
name = 'email_address',
variableType = 'EMAIL_ADDRESS',
dataSource = 'EVENT',
dataType = 'STRING',
defaultValue = ''
)
#Create variable ip_address
fraudDetector.create_variable(
name = 'ip_address',
variableType = 'IP_ADDRESS',
dataSource = 'EVENT',
dataType = 'STRING',
defaultValue = ''
)
```
# Delete a variable
When you delete a variable, Amazon Fraud Detector permanently deletes that variable and the data is no longer stored in Amazon Fraud Detector.
You can't delete variables that are included in an event type in Amazon Fraud Detector. You will have to first delete the event type the variable is associated with and then delete the variable.
You can't delete Amazon Fraud Detector model output variables and SageMaker AI model output variables manually. Amazon Fraud Detector automatically deletes model output variables when you delete the model.
You can delete variable in Amazon Fraud Detector console, using the [delete-variable](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/frauddetector/delete-variable.html) CLI command, using the [DeleteVariable](https://docs.aws.amazon.com/frauddetector/latest/api/API_DeleteVariable.html) API, or using the AWS SDK for Python (Boto3)
## Delete variable using the console
**To delete a variable,**
1. Sign in to the AWS Management Console and open the Amazon Fraud Detector console at [https://console.aws.amazon.com/frauddetector](https://console.aws.amazon.com/frauddetector).
1. In the left navigation pane of the Amazon Fraud Detector console, choose **Resources**, then choose **Variables**.
1. Choose the variable that you want to delete.
1. Choose **Actions**, and then choose **Delete**.
1. Enter the variable name, and then choose **Delete variable**.
## Delete variable using the AWS SDK for Python (Boto3)
The following code sample deletes a variable *customer\$1name* using the [DeleteVariable](https://docs.aws.amazon.com/frauddetector/latest/api/API_DeleteVariable.html) API.
```
import boto3
fraudDetector = boto3.client('frauddetector')
fraudDetector.delete_variable (
name = 'customer_name'
)
```