# Risk assessment
> The four risk levels the engine returns (fraud, high_risk, low_risk, unknown_risk) and the device, location, and IP evidence that supports each assessment.
URL: https://docs.ironchip.com/en/fraude/conceptos/evaluacion-de-riesgo/
Ironchip evaluates every operation that arrives from the SDK and assigns it a risk level. The level summarizes how confident the engine is that the legitimate user performed the action from a usual context.
## Risk levels
Ironchip can return four types of risk assessments.
[Image: Risk assessment block in the console showing the High risk level and the assessment summary]
| Level | Meaning | Recommendation |
| -------------- | ---------------------------------------------------------------- | -------------------------------------------------- |
| `fraud` | The action is considered fraudulent or part of an ongoing fraud. | Block the operation and review the case. |
| `high_risk` | The action is potentially fraudulent. | Ask for additional verification before continuing. |
| `low_risk` | The action is safe. | Continue as usual. |
| `unknown_risk` | There is not enough data to assess. | Apply the application's default policy. |
The level reaches the customer in the `event.risk_assignment` field of the [report](https://docs.ironchip.com/en/fraude/api/) and comes with the [evidence and decisions](https://docs.ironchip.com/en/fraude/conceptos/evidencias-y-decisiones/) that justify it.
## Evidence
Ironchip bases its risk assessments on evidence, which comes from different analyses through distinct lenses. The console groups the evidence into five blocks. For the sensor match types and the decisions that accompany an assessment, see [Evidence and decisions](https://docs.ironchip.com/en/fraude/conceptos/evidencias-y-decisiones/). To interpret the behaviors, warnings, and frauds the engine detects, see the [user guide](https://docs.ironchip.com/en/fraude/consola/guia-de-usuario/).
### Device integrity
Shows whether the device data can be trusted.
[Image: Device Integrity block in the console with Root / Jailbreak, Emulator, and GPS Spoofing]
| Evidence | Description | Possible values |
| ---------------- | --------------------------------------------------------------- | -------------------------- |
| Root / Jailbreak | Indicates whether the device has root access or a jailbreak. | `Detected`, `Not detected` |
| Emulator | Indicates whether the device is an emulator or simulator. | `Detected`, `Not detected` |
| GPS Spoofing | Indicates whether the device has an app that can fake GPS data. | `Detected`, `Not detected` |
### Device reputation
Provides data about the device's reputation, based on the Ironchip network effect and the device's behavior.
[Image: Device reputation block in the console with Behavior reputation, Fraud reputation, and Official store]
| Evidence | Description | Possible values |
| ------------------- | ----------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Behavior reputation | Indicates whether the device behaves suspiciously or is a trusted device. | `Suspect`: behaves like high-risk devices but is not associated with any known fraud.
`Allowed`: was set as the main device of an account.
`Unknown`: Ironchip has neither a positive nor a negative impression of the device. This is the default when data is insufficient. |
| Fraud reputation | Indicates whether the device was previously linked to a fraud report or was verified. | `Confirmed fraud`: related to previously detected or reported fraud. This is a global status.
`Allowed`: its relation to a given account was reported as verified through the feedback APIs. This status is local to the customer.
`Unknown`: Ironchip has neither a positive nor a negative impression of the device. This is the default when data is insufficient. |
| Official store | Indicates whether the mobile app was installed from an official store such as Google Play or the App Store. | `Yes`, `No` |
### Location behavior
Provides information about the device's location behavior and its relation to the associated account.
[Image: Location behavior block in the console with Descriptive location, Trusted hotspot, distance, and last timestamp]
| Evidence | Description |
| ------------------------------ | ----------------------------------------------------------------------------------------------------------- |
| Descriptive location | To be documented. |
| Trusted hotspot | To be documented. |
| Distance from trusted location | Indicates the distance from the device to the closest location the associated account is known to frequent. |
| Last location timestamp | Indicates the timestamp of the device location that is considered to match the trusted location. |
### Location sensors
Indicates which device sensors were used for the location-related evidence.
[Image: Location sensors block in the console with Location services and Sensor match type]
| Evidence | Description | Possible values |
| ----------------- | ----------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Location services | Indicates whether the user allows location services. | `Enabled`: the user allowed the app to access location services.
`Disabled`: the user rejected the request to access location services. |
| Sensor match type | Indicates which type of sensor match was used to compare location data. | `GPS`: comparisons are made with GPS data.
`WiFi`: comparisons are made with Wi-Fi sensors.
`Connected WiFi`: comparisons are made with the Wi-Fi network the user is connected to.
`Mobile Networks`: comparisons are made with connected mobile networks. |
### IP reputation
Provides information about the device's behavior and the declared address.
[Image: IP block in the console with Reputation, VPN, and TOR]
| Evidence | Description | Possible values |
| ---------- | -------------------------------------------------------------------------- | ------------------------------------- |
| Reputation | Indicates whether a detected IP address is suspected of being fraudulent. | `High risk`, `Medium`, `Low risk` |
| VPN | Indicates whether a detected IP address was going through a VPN or proxy. | `Detected`, `Not detected`, `Unknown` |
| TOR | Indicates whether a detected IP address was going through the TOR network. | `Detected`, `Not detected`, `Unknown` |