Skip to main content
The FraudTrace API returns more than a binary pass/fail signal. Each response contains a layered set of signals — confidence scores, risk categories, cluster membership, evidence source URLs, and temporal markers — that together give your fraud team the context needed to make a well-informed decision. This guide walks through every field in the response and explains how to translate it into action.

​
Full response reference

Here is a complete flagged response for reference:

​
Status field

The status field is the top-level classification. It will always be one of two values: When status is CLEARED, all risk fields (confidence, cluster_id, risk_category, sources) return as null or empty.

​
Confidence score

The confidence field is a floating-point number between 0.0 and 1.0 that represents how strongly the evidence supports the flagged classification. It is only present when status is FLAGGED. A medium-confidence flag still warrants attention. It can indicate a VPA that has recently appeared on fraud infrastructure, where the evidence corpus is still growing. Treat medium flags as “pending investigation” rather than “probably fine.”

​
Risk category

The risk_category field describes the nature of the fraud activity the VPA has been linked to. A single VPA can be linked to multiple categories across different evidence sources. The risk_category field reflects the primary or highest-severity category detected.

​
Cluster membership

When a VPA is part of a coordinated fraud network, it is assigned to a cluster — a group of VPAs that appear together across multiple fraud sources, share infrastructure, or exhibit correlated behaviour. A large cluster_size (e.g. 7 or more VPAs) suggests an organised fraud operation rather than an isolated bad actor. Use the cluster_id to pull the full cluster via the cluster endpoint:
This returns all VPAs in the cluster, allowing your fraud team to block the entire network rather than reacting to one VPA at a time.

​
Evidence sources

The sources array contains the individual pieces of evidence that contributed to the flag. Each entry represents a specific web page or platform on which the VPA was found. When screenshot_available is true, contact your account manager or use the FraudTrace dashboard to retrieve the screenshot. Screenshots are useful when escalating a case internally or filing a complaint with NPCI or law enforcement. The evidence_count field reflects the total number of distinct evidence items for this VPA, which may be higher than the number of entries in the sources array if some sources are withheld for operational security reasons.

​
first_seen and last_seen

These timestamps tell you when FraudTrace first and most recently observed the VPA on fraud infrastructure. Use last_seen as a recency signal to prioritise your review queue: a VPA last seen yesterday is a more urgent case than one last seen eight months ago with the same confidence score.

​
CLEARED caveats

A CLEARED response means FraudTrace has no evidence of this VPA in its database at the time of the request. It does not mean the VPA is safe.
CLEARED is not a clearance certificate. New mule VPAs are set up every day. A VPA can be clean today and appear on a fraud site tomorrow. FraudTrace continuously indexes new sources, so a VPA that returns CLEARED now may return FLAGGED on a future screening. Schedule periodic re-screening for high-value beneficiaries and active merchants.
Always combine FraudTrace results with your existing KYC, transaction monitoring, and behavioural analytics. FraudTrace is a powerful signal — it is most effective as one layer of a defence-in-depth strategy.

​
Frequently asked questions

Do not auto-approve or auto-reject. Route the case to a human reviewer with the full FraudTrace response — particularly the sources array and cluster_id. Medium confidence often reflects a VPA that has appeared recently on fraud infrastructure where evidence is still accumulating. Your reviewer should check the merchant’s or customer’s profile for other risk signals before making a decision. If in doubt, request additional documentation before proceeding.
Yes, false positives are possible. A VPA is flagged when it appears on fraud or gambling infrastructure, but there are edge cases — for example, a legitimate business whose VPA was harvested and re-posted by a fraudulent site without their knowledge. The confidence score and evidence sources help you assess the likelihood: multiple independent sources, a large cluster, and recent last_seen timestamps increase confidence that a flag is genuine. When you believe a result is a false positive, use the FraudTrace dashboard to submit a dispute — confirmed false positives are reviewed and removed promptly.
FraudTrace continuously crawls fraud sites, gambling platforms, phishing pages, and scam infrastructure. New VPAs discovered during a crawl are typically indexed within a few hours of capture. For time-critical use cases — such as large-value real-time payments — combine FraudTrace screening with your own transaction velocity and behavioural checks, since a VPA that went live on a fraud site minutes ago may not yet be indexed.
CLEARED means the queried VPA does not appear in the FraudTrace database at the moment you made the request. It reflects the absence of evidence, not the presence of safety. The database is comprehensive but not exhaustive — new fraud infrastructure is discovered continuously. Treat CLEARED as “no known risk signal” and continue applying your standard due diligence processes alongside it.