What is signup fraud prevention with an email footprint?

Scoring a new account on the history of the email address it was created with. Fake and bulk signups use fresh or disposable addresses that exist nowhere else. A footprint check surfaces that in the socialMatches count, the breaches array and webMentions, so the score can be applied before the account does anything.

Will a footprint check slow down my signup flow?

Not if you use instant mode. ?instant=true holds the lookup to a wall-clock ceiling of 600 milliseconds by default and returns whatever answered in time, with platformsPending saying how many did not. Standard and deep lookups take longer and suit a queue after the account is created.

Should I block signups with no digital footprint?

Usually not on that alone. A thin footprint is also what a privacy-conscious person or a new domain looks like. Use it to raise a score and add friction - a confirmation step, a second factor, a manual review - rather than as a hard block.

Verify an email at signup with a digital footprint check

Updated 2026-08-30

Deliverability tells you a mailbox exists; it does not tell you a person does. A digital footprint check at signup returns which platforms the address is registered on, whether it has breach history and whether it appears on the public web - in one call, bounded in time, without adding a step for the user.

Why verify an email at signup with a footprint, not just a mailbox check

Syntax validation and an MX record prove that mail can be delivered. A confirmation link proves someone can read the mailbox. Neither proves that the address belongs to a person with any history, and history is what separates a real signup from the ninety-ninth account a script created this hour. Disposable addresses pass deliverability checks by design. A digital footprint check asks the question the others cannot: has this address been used anywhere? Registered on Instagram or Spotify? Present in a breach from years ago? Mentioned on a public page? Each answer is a fact confirmed at source and timestamped, not a reputation score with a hidden model behind it.

The signup call: instant mode, one request

Signup is latency-sensitive, so use ?instant=true. It runs the highest-signal subset of platforms for an email - 25 of the 887 in the standard band - under a wall-clock ceiling of 600 milliseconds by default, and returns whatever answered in time. Anything still in flight when the deadline fires is omitted, and platformsPending tells you how many that was. It is always synchronous, so there is no job to poll. Make the call from your server, never the browser: the API key must not reach the client.

POST /v1/lookup?instant=true

curl -X POST "https://api.digifootprint.dev/v1/lookup?instant=true" \
  -H "Authorization: Bearer dfp_your_key" \
  -H "Content-Type: application/json" \
  -d '{"email": "new.user@example.com"}'

Response (abridged)

{
  "query": "new.user@example.com",
  "instant": true,
  "deadlineMs": 600,
  "platformsChecked": 25,
  "platformsPending": 2,
  "matches": 1,
  "socialMatches": 0,
  "derivedMatches": 0,
  "servedFromCache": false,
  "results": [
    { "platform": "google",    "registered": true,  "method": "domain_derived", "checkedAt": "2026-08-30T14:05:09.311Z", "mailboxProvider": true },
    { "platform": "instagram", "registered": false, "method": "public_api",     "checkedAt": "2026-08-30T14:05:09.402Z" },
    { "platform": "spotify",   "registered": false, "method": "public_api",     "checkedAt": "2026-08-30T14:05:09.455Z" },
    { "platform": "github",    "registered": false, "method": "public_api",     "checkedAt": "2026-08-30T14:05:09.498Z" }
  ],
  "breaches": [],
  "webMentions": [],
  "phoneDetails": null
}

This address has a Google mailbox and nothing else: no social accounts among the platforms that answered, no breach history, no web mentions. That is the shape of a brand-new address. Two platforms had not answered by the deadline, and the response says so rather than reporting them as negatives.

Turning the response into a signup fraud signal

Score on socialMatches, not matches. The Google result above is mailboxProvider: true: the account came with the address rather than being signed up for, so it is true of every Gmail address and says nothing about this one. socialMatches already excludes it. Then read breaches: the earliest date is a lower bound on how long the address has existed, and an address that was in a 2016 breach is not one someone minted for this signup. Finally, webMentions with matchConfidence: "confirmed" mean the exact address appears on a public page - a company site, a conference listing, a repository.

Keep the three states apart. [] is checked and empty; null is not checked for your account; a platform missing from results is unknown, not negative. A score that treats unknown as negative will punish an address on a day a platform is slow. Results marked derivedFrom came from the handle before the @, tried as a username, and belong at a lower weight than a direct hit. The lookup reference has every field.

A thin footprint is a signal, not a verdict

The address above should not be rejected. It should cost a little more friction - a confirmation link it would otherwise skip, a second factor, a lower initial limit, a place in the review queue - and the account should earn its way out as it behaves normally. Privacy-minded people, new domains, corporate addresses provisioned last week and people in markets where the platforms we check are less common all produce a thin footprint honestly. What the check gives you is a cheap, early, explainable signal that is very hard for a script to fake at volume, because a footprint has to be lived. The detail is on what a thin digital footprint means, and the broader fraud prevention and trust and safety pages cover where else the same score applies.

Instant at signup, deeper afterwards

Instant mode is sized for the request path. Once the account exists, a standard lookup with ?wait=true - or an async job you poll - runs the full 887-platform band and gives the review queue the complete picture without the user waiting for it. Results are cached with their real checkedAt, so the second call reuses what the first established and fills in the rest. The differences between the three depths, and which one fits which point in a flow, are on instant, standard and deep lookups. Free lookups to start - see pricing.

Frequently asked questions

How do I verify an email address at signup without a confirmation link?: Run a footprint lookup on the address server-side when the form is submitted. The response says which platforms the address is registered on, whether it has breach history and whether it appears on the public web. An address with an established footprint is very likely real; one with none deserves more friction. It complements a confirmation link rather than replacing it.
What is signup fraud prevention with an email footprint?: Scoring a new account on the history of the email address it was created with. Fake and bulk signups use fresh or disposable addresses that exist nowhere else. A footprint check surfaces that in the socialMatches count, the breaches array and webMentions, so the score can be applied before the account does anything.
Will a footprint check slow down my signup flow?: Not if you use instant mode. ?instant=true holds the lookup to a wall-clock ceiling of 600 milliseconds by default and returns whatever answered in time, with platformsPending saying how many did not. Standard and deep lookups take longer and suit a queue after the account is created.
Should I block signups with no digital footprint?: Usually not on that alone. A thin footprint is also what a privacy-conscious person or a new domain looks like. Use it to raise a score and add friction - a confirmation step, a second factor, a manual review - rather than as a hard block.

Start free Try a lookup