Fraud risk scoring API with explainable rules

Updated 2026-09-29

Score a sign-up, a payment or a login on the email, phone and IP behind it - and always see why. The score is the total of named signals, and every rule is yours to tune.

One call, one score, every reason

POST /v2/lookup?wait=true
curl -X POST "https://api.digifootprint.dev/v2/lookup?wait=true" \
  -H "Authorization: Bearer dfp_your_key" \
  -H "Content-Type: application/json" \
  -d '{
    "email": "signup@newco-mail.io",
    "phone": "+14155552671",
    "ip": "45.83.91.1",
    "checks": { "email": true, "phone": true, "ip": true, "riskSignals": true,
                "footprint": { "early": true } }
  }'
200 OK (abridged)
{
  "risk": {
    "score": 55,
    "signals": [
      { "id": "email.fresh_domain", "module": "email", "label": "Domain was registered less than 30 days ago", "points": 20, "severity": "medium" },
      { "id": "ip.vpn", "module": "ip", "label": "Address belongs to a VPN service", "points": 15, "severity": "medium" },
      { "id": "ip.datacenter", "module": "ip", "label": "Address is hosted in a datacenter, not an ISP", "points": 10, "severity": "medium" },
      { "id": "cross.phone_ip_country", "module": "cross", "label": "Phone country and IP country differ", "points": 10, "severity": "medium" }
    ]
  },
  "email": { "...": "...", "risk": { "score": 20 } },
  "phone": { "...": "...", "risk": { "score": 0 } },
  "ip": { "...": "...", "risk": { "score": 25 } }
}

20 + 15 + 10 + 10 = 55. Each module has its own score, and the overall score is the total of every signal that fired, capped at 100 - so the number always adds up to the reasons shown.

Signup fraud detection

The most useful moment to score a user is at signup, before a bonus is paid, a listing goes live or money moves. Send the email, the phone number and the signup IP together: the email's age and footprint, the phone's line type and the IP's proxy and datacenter flags are scored in one call, with an overall score across all three. The fake account detection page covers how teams tier the response.

Rules you own

The default rules cover email, phone, IP and cross-module patterns. On the dashboard’s Risk rules page you can switch any of them off, change its points, or change its values - “domain younger than 60 days” instead of 30 - for your account only, and reset any time. Build your own rules from the same facts in a few clicks. Details in the risk reference.

Frequently asked questions

What is a signup fraud detection API?
A signup fraud detection API checks a new account before it is activated. Digital Footprint takes the email, phone number and IP from the signup form in one request and returns a risk score for each, an overall score, and the named signals behind them - so a risky signup can be stopped or sent to verification while real customers pass straight through.
What is an explainable fraud risk score?
A score you can take apart. In the Digital Footprint API the overall risk score is the total of the named signals that fired - for example 20 for a domain registered last week plus 15 for a VPN - capped at 100, and every signal is returned with its id, label and points.
Can I change the fraud rules?
Yes. Every default rule can be switched off, re-weighted or given different values for your account only, reset to the default at any time, and you can write your own rules from the same facts, such as IP country is one of a list.
Which signals does the risk score use?
Email (disposable, undeliverable, new or mail-less domains, breach history, no online presence), phone (invalid, disposable, VOIP, SIM swap, no linked accounts), IP (Tor, VPN, proxy, residential proxy, datacenter, compromised) and cross-checks such as phone country against IP country.
Is the risk score available on the free plan?
Risk scores are included on every plan. The named signals behind them are included on pay as you go and every subscription.

Related

Start free with 15 lookupsTry a lookup