verifence ← All posts
· 4 min read

Why a fraud firewall should fail open

A fraud firewall sits in your signup path. When it goes down, it must let signups through. A wrong block is worse than a missed send — and that single asymmetry decides how the whole system behaves under failure.

Fail-open vs fail-closed

Fail-closed means: if the guard can't reach a verdict, deny. That's the right default for a bank vault, where the cost of wrongly allowing dwarfs the cost of wrongly blocking.

A verification firewall is the opposite. If Verifence can't decide, blocking means turning away real customers at the exact moment they're trying to sign up. There is no bounded cost to that — you don't know how many, you don't know who, and you can't get them back. So the default flips: when in doubt, allow.

Availability can't depend on us

The rule follows from where the service lives. We're one HTTP call in front of your OTP send. If our being up were a precondition for your signups working, we'd have added a single point of failure to your critical path — and traded a rare fraud problem for a rare total-outage problem, which is worse.

So availability of your signup flow must never depend on Verifence being up. That's a hard constraint, not a nice-to-have.

Degraded mode

Concretely: if Redis is unreachable, the decision doesn't error. It returns allow with a degraded: true flag. The velocity and reputation layers need the cache; when it's gone, they can't run, so the request is allowed on the strength of the layers that still can (the free destination-shape check still rejects garbage).

A cache outage never turns into a 500. A decision endpoint that 500s in the signup path is a fail-closed firewall wearing a fail-open costume — the caller still can't send.

Loud, not silent

Failing open silently would be its own bug. You'd be unprotected and not know it.

So degraded mode is loud: every fail-open decision emits an unconditional log line with a fixed marker string, meant to be wired straight to an alert. Operators learn instantly that the firewall is coasting, and for how long.

The math that justifies it

The nuance people miss: fraud that slips during a rare, short outage is cheap. It's bounded by the outage window and the attacker's luck in hitting it. Blocked real signups are expensive — unbounded, invisible, and permanent.

Optimize for the expensive failure. Let a little fraud through when you're blind, shout that you're blind, and fix the blindness fast. Never hold real users hostage to your own uptime.

Related reading

Put a firewall in front of your SMS spend.

250 checks a month, free. Make your first call in minutes.

Get started free