Skip to main content
Every FLAGGED result from FraudTrace carries two key risk signals: a confidence score that tells you how certain the system is that a VPA is a mule account, and a cluster ID that links it to a broader network of related accounts. Understanding how to interpret both signals — and how they interact — lets your risk team set precise automated rules rather than treating every flag as a binary block decision.

​
Confidence scores

The confidence score is a float between 0.0 and 1.0 that represents FraudTrace’s certainty that the queried VPA is actively involved in fraud. It is computed from signals including:
  • Number of independent sources where the VPA has appeared
  • Category and reliability of those sources (e.g., a VPA on a known gambling deposit page is stronger evidence than a single unverified forum mention)
  • Frequency and recency of sightings (last_seen relative to first_seen)
  • Cluster membership and the average confidence of co-clustered VPAs
  • Volume of co-appearing VPAs from the same fraud operation
A higher score means more and stronger evidence. A score of null is returned only for CLEARED responses — VPAs with no evidence in the database. Use this table to map confidence scores to your operational workflow:
These thresholds are recommendations, not hard rules. Your risk appetite, customer segment, and regulatory obligations should inform how you configure automated actions. You can adjust the thresholds in your integration logic without any changes to the FraudTrace API.

​
Clusters

A cluster is a named group of UPI VPAs that FraudTrace has determined are linked to the same fraud operation or actor network. Cluster IDs follow the format MC-XXXX (for example, MC-2104), where MC stands for Mule Cluster.

​
How VPAs are grouped into clusters

FraudTrace uses several signals to determine cluster membership:
  • Co-appearance on the same source: Two VPAs posted as deposit addresses on the same gambling site on the same day are likely operated by the same fraud gang.
  • Shared device fingerprints: Evidence metadata may reveal that multiple VPAs were registered or activated from the same device.
  • Network graph linkage: When VPA A frequently forwards funds to VPA B, and VPA B co-appears with VPA C on fraud sites, all three may be merged into a cluster.
  • Behavioural patterns: Matching activation timelines, dormancy cycles, and source category overlap across VPAs.
Cluster membership is updated continuously. A VPA may be added to an existing cluster or cause a cluster merge as new evidence arrives.

​
Why clusters matter for your risk decisions

The cluster signal is most valuable when you encounter a VPA with a low or medium confidence score — a newly activated mule that has only appeared on one or two sources so far. If that VPA is already a member of MC-2104, and MC-2104 has 47 members with an average confidence of 0.91, the individual VPA’s low score understates the true risk. Your integration should factor in cluster confidence alongside the VPA’s individual score.
When building automated decisioning rules, consider a combined condition: flag any VPA where confidence >= 0.60 OR (cluster_id is not null AND cluster average confidence ≥ 0.80). This catches newly minted mule accounts that have not yet accumulated enough individual evidence.

​
Cluster fields in the API response

Cluster IDs are stable — once assigned, MC-2104 always refers to the same cluster. This means you can build internal records or case-management references using the cluster ID without risk of it changing underneath you.
cluster_size reflects the count at query time and can increase as new evidence links additional VPAs to the cluster. Do not cache cluster size for decision logic; always use the live API response.

​
Frequently asked questions

Yes. FraudTrace continuously re-evaluates confidence scores as new evidence arrives or existing evidence ages. A VPA flagged six months ago may have a lower score today if it has not appeared on any source since then and the original sources are no longer active. The last_seen field tells you when the most recent sighting occurred, which is a useful freshness indicator alongside the confidence score.If you believe a specific VPA has been incorrectly flagged, you can raise a dispute through the FraudTrace dashboard. The intelligence team will manually review the underlying evidence and, if appropriate, adjust or remove the record.
FraudTrace flags are based solely on observable evidence from public and semi-public fraud infrastructure — the system does not make judgements about account holders. If you receive a FLAGGED result for a VPA that you have independent reason to believe is legitimate, you have two options:
  1. Override at your layer: Your integration controls the final decision. You can choose to allow the transaction and log the override for your compliance audit trail.
  2. Raise a review request: Submit the VPA for manual review via the FraudTrace dashboard. Include any supporting context (e.g., the VPA belongs to a known merchant you have KYC-verified). The intelligence team will re-examine the source evidence and respond within two business days.
Legitimate VPAs are occasionally caught in scrapes of fraud sites where fraudsters have impersonated real businesses or pasted third-party VPAs as decoys. These cases are rare but real, and the dispute process exists precisely to handle them.