Skip to main content
The FraudTrace Intelligence Database is the continuously updated, real-time store of fraud-actor entities that your API queries every time you call /v1/verify/upi. It is not a static blocklist assembled from incident reports — it is a live intelligence corpus built by an automated OSINT pipeline that monitors the places where fraud actually happens: Telegram channels, gambling and betting sites, scam forums, dark-web dumps, and rogue mobile apps. Understanding what the database is, how it is built, and what it deliberately does not contain will help you trust the signals it returns and communicate them clearly to your risk and compliance teams.

​
What the database contains

The Intelligence Database indexes fraud-actor entities — identifiers that have appeared in a fraud context — across four entity types:

UPI VPAs

Virtual Payment Addresses found on deposit pages, scam channels, and phishing sites. The primary entity type queried by the FraudTrace UPI API.

Phone Numbers

Mobile numbers linked to fraud registrations, Telegram fraud-channel admins, and scam app sign-ups.

Domains

Web domains hosting illegal betting platforms, investment scam landing pages, or NBFC impersonation portals.

App Packages

Android package names (com.example.fakeinvest) of fraudulent APKs distributed outside the Play Store.

​
Key statistics

These numbers grow continuously as the OSINT pipeline ingests new sources.

​
How the database is built

The database is populated entirely by FraudTrace’s automated ingestion pipeline. No manual blocklist submission, no crowdsourced reports, and no data from customer bank systems ever enters this pipeline.
1

Source discovery

FraudTrace’s discovery layer continuously finds new fraud infrastructure through keyword monitoring, domain registration feeds, Telegram channel graph traversal, and referral links between known fraud sites.
2

Crawling and monitoring

Discovered sources are added to the crawl queue. Active sources are re-crawled at regular intervals. Telegram channels are monitored in near-real time. The current corpus covers 18,330+ unique sources.
3

Entity extraction

Each crawled page or message is parsed to extract structured entities: UPI VPAs (matched against the @psp pattern), phone numbers, domains, and APK package names. Context metadata — page category, surrounding text, timestamp — is captured alongside each entity.
4

Enrichment

Extracted entities are enriched with cross-source correlation. A VPA seen on five different gambling sites receives richer metadata than one seen once. Domain WHOIS, app store data, and Telegram channel membership signals augment the raw extraction.
5

Confidence scoring

Each entity receives a confidence score (0.0–1.0) that reflects the strength of evidence for its fraud classification. Multiple independent sightings, high-confidence source types, and cluster membership all raise the score. See Confidence Scores and Mule Clusters for details.
6

Clustering

VPAs that share device fingerprints, co-appear on the same fraud sites, or are linked through network graph analysis are grouped into clusters (prefixed MC-). Cluster membership is updated continuously as new evidence arrives.
7

Indexing for query

Processed records are written to the query index. From this point forward, any call to /v1/verify/upi for that VPA returns the enriched, scored, clustered result in under 200 ms.

​
Update frequency

Ingestion is continuous and real-time. There is no nightly batch window. When a VPA appears on a newly discovered fraud site, it is typically indexed and queryable within minutes. This is critical for fast-moving fraud campaigns where a mule VPA may be live for only a few hours before being rotated.

​
What the database does NOT contain

FraudTrace is built to detect fraud-actor entities, not to store data about victims or customers of financial institutions. The following data is explicitly not present in the Intelligence Database:
  • Personal data of fraud victims (names, Aadhaar, PAN, addresses)
  • Bank account numbers or IFSC codes
  • Transaction histories or payment amounts
  • Balances or account statements
  • Any data originating from customer bank systems, core banking platforms, or CBS exports
  • Any data provided by your API integration beyond the VPA you query
Your call to /v1/verify/upi with a VPA sends only that identifier. FraudTrace does not log or retain the VPA you query for purposes beyond serving the immediate API response.

​
How you query the database

All access to the Intelligence Database is through a single REST endpoint:
Response time: <200 ms (p99)
Authentication: Bearer token in the Authorization header
Rate limit: Defined per plan; see your dashboard for current limits For the full response schema, see Evidence Schema: What FraudTrace Returns.
Data residency: All FraudTrace infrastructure — ingestion pipeline, database, and API — runs exclusively on AWS Mumbai (ap-south-1). No data leaves Indian cloud infrastructure. This supports your compliance with RBI data localisation requirements.