Use untrusted threshold to reduce potential false positives from single support calls