Attribute Cards are the building blocks of the Decision Overview. Each card summarizes one core identity signal (Phone, Primary Address, Secondary Address, Email, or IP Address) and displays the underlying Attribute Details that make up that signal.
This article breaks down every Attribute Card, the Attribute Details inside each one, and how to interpret the Details Panel for deeper investigation.
How Attribute Cards Are Structured #
Decision Console organizes identity data in two layers:
- Attribute Cards: Depending on the inputs provided, Decision Console will return Attribute Cards for the following entities: Phone, Primary Address, Secondary Address, Email, and IP Address.
- Attribute Details: These are the individual data points displayed inside each card. For example, the Phone card contains attribute details like validity, line type, phone-to-name match, Phone Activity Score, and more.
Attribute Details are color coded: Green if the data is verifiable and consistent, and red if it’s invalid or potentially risky. Below is a breakdown of every Attribute Card and the details they return.
Phone #
Typically the phone provided at signup.
| Attribute Detail | What it tells you |
| Validity | Whether the phone syntax is valid and assigned to a carrier. False values indicate medium to high risk. |
| Subscriber Name | Whether the input name matches the subscriber name Trestle has for that phone. No-match indicators warrant a closer look. Includes demographic information such as the age and gender of the person, as well as a date that indicates when the phone number was first linked with the subscriber’s name. |
| Phone Activity Score | A 0-100 score indicating whether the phone is actively used. Scores 30 or below indicate likely disconnected or inactive numbers. |
| Phone Fraud Flagged | Whether the phone has been associated with phishing campaigns or known fraud. True values indicate high risk. |
| Phone Disposable | Whether the phone is a temporary or disposable number (e.g., used for 2FA on public services). True values indicate high risk. |
| Phone Line Type | The line type of the phone (Mobile, Landline, Fixed VoIP, Non-fixed VoIP, Tollfree, Premium, Other). Non-fixed VoIP, Tollfree, Premium, and Other are higher-risk indicators. |
| Subscriber Address | Whether the phone subscriber’s location lines up with the input address. Returns the level at which the two match (Match, Street Match, Postal Match, City State Match, or Metro Match), or No Match if they don’t. A no-match on an otherwise valid phone is worth investigating. |
| Social Profiles | The number of social profiles linked to the phone number. |
Primary Address #
Typically the primary address provided at signup or the billing address in an e-commerce transaction.
| Attribute Detail | What it tells you |
| Resident Name | Whether the input name is valid and matches any residents on file. Includes demographic information such as the age and gender of the person, as well as a date that indicates when the address was first linked with the subscriber’s name. |
| Warnings | Indicators of address invalidity or input errors (invalid house number, missing unit number, etc.). Worth checking for typos. |
| Is Commercial | Whether the address is associated with a business. Depending on the use case, this may be a risk indicator. |
| Location Type | The address type: Single Unit, Multi Unit, or P.O. Box. P.O. Boxes are higher-risk. For Multi Unit buildings, confirm the apartment or unit number is accurate. |
| Shared with Primary | Whether the secondary and primary address have been historically linked to the same person. |
| Is Freight Forwarder | Whether the address is a known freight forwarding address. True values typically indicate high risk. |
Secondary Address #
Typically the secondary address provided at sign-up or the shipping address in an e-commerce transaction. The Secondary Address card returns the same set of attributes as the Primary Address card: Validity, Warnings, Address to Name Match, Is Commercial, Delivery Point, and Is Freight Forwarder. The interpretation logic is similar, though context matters. For example, a freight forwarder shipping address on a high-value order is a strong negative signal. The Secondary Address Card also returns an Attribute Detail called Shared With Primary, which indicates whether the two addresses provided have been historically linked to the same person.
Email #
Typically the email address provided at signup or during a transaction.
| Attribute Detail | What it tells you |
| Validity and Deliverability | Whether the email syntax is valid and whether messages sent to it will be delivered. False values for either indicate high risk. |
| Email Warnings | Indicates email quality issues (i.e., tumbled email, privacy email, spam trap, role-based email, undeliverable, catch-all domain, etc.). |
| Email is Disposable | Whether the email domain is a known temporary email provider. True values indicate high risk. |
| Email Age Score | A 0-100 score indicating how long the email has been active. Scores 30 or below are higher risk; scores below 100 but above 30 are medium risk. It also provides the date in which the email was first actively seen. |
| Associated Name | Whether the input name matches any names Trestle has associated with that email. |
| Domain Age | How long the email’s domain has been active. Domain age under 180 days could indicate risk. |
| Domain Organization | The organization registered in the WhoIs records for the domain. |
| Domain Country | The country registered in the WhoIs records for the domain. |
| Social Profiles | The number of social profiles linked to the email address. |
| Data Breach Report | How many times the email has appeared in a data breach and when the first and most recent breach both occurred. |
IP Address #
Typically the IP address from which the signup or transaction originated.
| Attribute Detail | What it tells you |
| Validity | Whether the IP address is valid. Localhost IPs indicate the IP was not extracted correctly from the transaction. |
| Location | Geolocation of the IP at the city, state, and country level. Specific locations may carry higher risk depending on the business. |
| IP Trust Score | A 0-100 score indicating how reliable the signup or transaction is based on the IP. Scores below 30 are high risk. |
| Connection Type | The type of internet connection (Residential, Mobile, Privacy Relay, Hosting, VPN, etc.). Hosting and Hosting VPN are high-risk. |
| Internet Service Provider | The company providing the internet service. |
| IP Abuse Report | The total number of abuse reports and the most frequently reported category of abuse. |
Dive Deeper with the Detail Panels #
For Phone, Address, and Email cards, clicking View Details → opens the Details Panel. The Details Panel is a slide-out drawer that surfaces a reverse lookup on the input, along with associated owners, residents, addresses, and historical linkages.
Phone Details Panel #
A Reverse Phone lookup view for the phone number provided. Includes phone metadata (similar to the dashboard view), an ordered list of owners associated with the phone ranked by Trestle’s confidence with the association, and linked social profiles.
For each owner, the panel surfaces:
- The date the phone has been linked to the owner
- Owner name, age range, and gender (when available)
- Current and historical addresses with link dates
- Alternate phones and emails associated with the owner
- Associated social media profiles linked to the phone number
Each address, alternate phone, and email is clickable, triggering a reverse lookup on that entity. You can also edit the input fields in the Details Panel to run a reverse lookup directly in the slide-out drawer. This allows reviewers to chain investigations and uncover identity connections. For example, confirming that a primary and secondary party in an e-commerce transaction historically shared the same address.
Associated social media profiles are listed at the bottom. They include the platform (such as LinkedIn, Facebook, X, etc.), the name on the profile, and a direct link. Social Profiles are a supplementary signal that don’t feed into the Identity Score. It’s important to note that a thin or missing social presence is not a fraud signal, and a strong one isn’t proof of legitimacy. However, a profile listing the same city as the address on file is one more point of corroboration agents can factor when closely reviewing an identity.
Address Details Panel #
A Reverse Address lookup view for any address provided. Includes address metadata plus an ordered list of residents at that address, sorted by latest linkage data.
Each clickable element triggers a reverse lookup on that entity, enabling the same chained investigation pattern as the Phone Details panel.
Email Details Panel #
A Reverse Email lookup view for the email provided. Includes email and domain metadata plus an ordered list of identities associated with the email. Each clickable element triggers a reverse lookup on that entity. The bottom of the Email Details Panel may include a list of social media profiles associated with that email address, if any are found.
Below the Social Profiles section is the Email Breach History report. This lists the five most recent data breaches tied to that email address and includes the organization whose database was breached, when the breach occurred, and the type of personal data exposed in the breach (e.g., email addresses, passwords, phone numbers, or IP addresses).
In all three Details Panels, the input box is editable, so reviewers can adjust the search for typos or start an entirely new lookup without leaving the panel.
For more information on Decision Console, check out the articles below: