---
title: Accounts Configuration
slug: extensions/accounts-configuration
docTags: 
createdAt: 2026-09-22T18:20:22.602Z
---

Account Protection extends Forter's fraud check to three customer-account events: sign-up, login, and profile updates (email, phone, address, payment method, or password change). All of its settings, including the `forterAccountProtectionEnabled` toggle (default `false`), live under `Merchant Tools > Site Preferences > Site Custom Preferences > Forter - Account Protection`, also reachable from the `Forter > Account Protection` menu in Business Manager. Each event's response actions are then configured independently within that group.

## Response actions

Each event has its own action for each of Forter's outcomes, in preferences named `forterAccountProtection{Event}{Outcome}` — for example, `forterAccountProtectionLoginDeclined`. `{Event}` is `SignUp`, `Login`, or `Profile`. Which actions are available depends on the outcome:

| Outcome                                      | Preference suffix | Available actions                                          |
| -------------------------------------------- | ----------------- | ---------------------------------------------------------- |
| Declined                                     | `Declined`        | No action, trigger custom action, block customer           |
| Approved                                     | `Approved`        | No action, trigger custom action                           |
| Not Reviewed                                 | `NotReviewed`     | No action, trigger custom action                           |
| Verification Required (SMS recommendation)   | `Sms`             | No action, trigger custom action, notify customer by SMS   |
| Verification Required (Email recommendation) | `Email`           | No action, trigger custom action, notify customer by email |

Every outcome defaults to No action. Enabling Account Protection alone makes the API calls and records Forter's decision, without changing any customer-facing behavior until you configure at least one action.

For Declined, only Block Customer actually stops the request. Trigger Custom Action fires a notification but doesn't affect the outcome. The request still succeeds exactly as if No Action were selected.

Verification Required is a distinct outcome from Approved, Declined, and Not Reviewed. Forter recommends a follow-up channel (SMS or email) rather than deciding outright, and each recommendation is configured separately.

Trigger custom action, notify customer by SMS, and notify customer by email all call into `forterNotifications.js`. Block customer stops the action and shows the event's decline message (`forterAccountProtectionSignUpDeclinedMessage`, `...LoginDeclinedMessage`, or `...ProfileDeclinedMessage`). See [Accounts Controllers](https://docs.forter.com/extensions/accounts-controllers) for which controllers render that message automatically and which need a frontend change.

## Notification delivery

The cartridge never sends an email or SMS on its own. Every action other than no action and block customer calls into `scripts/lib/forter/forterNotifications.js`, which ships with `sendEmail`, `sendSMS`, and `handleVerificationRequired` as no-ops.

To deliver real notifications, place your own cartridge ahead of `int_forter_sfra` in the cartridge path and provide your own `forterNotifications.js` implementing those three functions. A sample email template ships at `templates/default/email/forterAccountProtectionEmail.isml` as a starting point.

`handleVerificationRequired` is what runs for trigger custom action on a Verification Required outcome. It can return `{ block: true }` to hold the action until your own verification challenge completes.