Understand tier downgrades

A downgrade transitions your Google Cloud Fraud Defense project to a lower product tier. A downgrade occurs when a project no longer meets the eligibility criteria for its current tier.

Why projects are downgraded

A tier transition typically happens for one of the following reasons:

• Enterprise to Premium: Your Enterprise subscription has expired, lapsed, or is no longer active, or the project was unlinked from an account with an active subscription.
• Premium to Essentials: The billing account associated with your Google Cloud project has been unlinked, disabled, or has billing issues, such as outstanding payments.

Grace period

Fraud Defense provides a 30-day grace period for Enterprise to Premium downgrades. During this time, you retain access to Enterprise features so you can resolve billing issues or update your integration. After the 30-day grace period expires, access to Enterprise-exclusive features is removed.

Impact on features

A downgrade reduces the features that are available in your project to match the target tier:

• Downgrades to Premium: You lose access to Enterprise-exclusive features. For a side-by-side comparison of features, see the features comparison table.
• Downgrades to Essentials: You lose access to Premium features, and your monthly free assessment limit is capped at 10,000. Assessments beyond this limit return the HTTP 429 (Resource Exhausted) error.

Impact on existing integrations

Depending on the features you use, a downgrade can cause API errors or user interface changes:

• Advanced reason codes: The CreateAssessment response no longer contains advanced reasons in the extended_verdict_reasons field. If your backend relies on these codes, update it to use standard classification reasons.
• Related accounts API: Calls to related account endpoints return a PERMISSION_DENIED error. You must stop calling these APIs.
• Transaction defense: If you request transaction assessments without sending a frontend token, the API returns a PERMISSION_DENIED error. To continue using Transaction defense, you must implement a frontend integration.
• ATO analytics: The accountTakeoverVerdict field is empty or missing from the accountDefenderAssessment response. Backend logic expecting this field must be updated to avoid errors.
• UI-only features: Features such as Site-specific fraud reports and Attack investigations no longer appear in the Google Cloud console.

• Policy Engine: Depending on the target tier, a downgrade affects your policies as follows:

  • Downgrades to Premium: Any existing policies with more than three rules (the maximum allowed in the Premium tier) remain active and continue to enforce all rules without changes. However, any attempt to create a new policy or update an existing policy with more than three rules returns a PERMISSION_DENIED error. To update a policy that exceeds this limit, you must first delete excess rules until the policy contains three or fewer rules.
  • Downgrades to Essentials: Any existing policies remain active and continue to enforce all rules. However, you cannot create new policies or update existing ones. To modify these policies, you can only delete them.

  Example

  You have a policy with five rules and downgrade to the Premium tier. The policy continues applying all five rules. However, if you later try to update an existing rule or create a new policy with five rules, the API returns a PERMISSION_DENIED error.

Verify your feature usage

To determine whether your integrations will be affected by a downgrade, verify the following:

• Check the backend code for references to extended_verdict_reasons or accountTakeoverVerdict. For details, see Interpret assessments for websites. Also see Detect and prevent account takeovers.
• Check whether your backend calls any Related accounts API endpoints.
• Check whether you are making transaction assessments without frontend tokens. For details, see Install transaction defense.
• Check whether any Policy Engine policies have more than three rules. For details, see Set up Policy Engine with a Universal key. If your project transitions to the Premium tier, you must reduce the rule count in a policy to three or fewer before updating it. If your project transitions to the Essentials tier, you cannot update policies.

Prevent or restore from a downgrade

To prevent service disruption or restore access to features, resolve the billing or subscription issues:

• Restore Enterprise status: Associate your project with an active billing account that has a valid Fraud Defense subscription. If you need a new subscription, contact your Google Cloud sales representative or Google Cloud sales.
• Restore Premium status: Ensure your project is linked to an active, valid Google Cloud billing account.