Accounts Configuration

account protection extends forter's fraud check to three customer account events sign up, login, and profile updates (email, phone, address, payment method, or password change) all of its settings, including the forteraccountprotectionenabled toggle (default false ), live under merchant tools > site preferences > site custom preferences > forter account protection , also reachable from the forter > account protection menu in business manager each event's response actions are then configured independently within that group response actions each event has its own action for each of forter's outcomes, in preferences named forteraccountprotection{event}{outcome} — for example, forteraccountprotectionlogindeclined {event} is signup , login , or profile which actions are available depends on the outcome outcome preference suffix available actions declined declined no action, trigger custom action, block customer approved approved no action, trigger custom action not reviewed notreviewed no action, trigger custom action verification required (sms recommendation) sms no action, trigger custom action, notify customer by sms verification required (email recommendation) email no action, trigger custom action, notify customer by email every outcome defaults to no action enabling account protection alone makes the api calls and records forter's decision, without changing any customer facing behavior until you configure at least one action for declined, only block customer actually stops the request trigger custom action fires a notification but doesn't affect the outcome the request still succeeds exactly as if no action were selected verification required is a distinct outcome from approved, declined, and not reviewed forter recommends a follow up channel (sms or email) rather than deciding outright, and each recommendation is configured separately trigger custom action, notify customer by sms, and notify customer by email all call into forternotifications js block customer stops the action and shows the event's decline message ( forteraccountprotectionsignupdeclinedmessage , logindeclinedmessage , or profiledeclinedmessage ) see accounts controllers # for which controllers render that message automatically and which need a frontend change notification delivery the cartridge never sends an email or sms on its own every action other than no action and block customer calls into scripts/lib/forter/forternotifications js , which ships with sendemail , sendsms , and handleverificationrequired as no ops to deliver real notifications, place your own cartridge ahead of int forter sfra in the cartridge path and provide your own forternotifications js implementing those three functions a sample email template ships at templates/default/email/forteraccountprotectionemail isml as a starting point handleverificationrequired is what runs for trigger custom action on a verification required outcome it can return { block true } to hold the action until your own verification challenge completes