> ## Documentation Index > Fetch the complete documentation index at: https://docs.fraudtraceai.com/llms.txt > Use this file to discover all available pages before exploring further. # Interpreting FraudTrace API Responses: Fields and Signals > Learn what every FraudTrace response field means — status, confidence score, risk category, cluster data, evidence sources, and recency timestamps. The FraudTrace API returns more than a binary pass/fail signal. Each response contains a layered set of signals — confidence scores, risk categories, cluster membership, evidence source URLs, and temporal markers — that together give your fraud team the context needed to make a well-informed decision. This guide walks through every field in the response and explains how to translate it into action. ## Full response reference Here is a complete flagged response for reference: ```json theme={null} { "upi": "xxxxx@ybl", "status": "FLAGGED", "confidence": 0.94, "risk_category": "mule", "cluster_id": "MC-2104", "cluster_size": 7, "first_seen": "2025-11-14T08:22:00Z", "last_seen": "2026-04-01T16:45:00Z", "sources": [ { "url": "https://bet-quick-in.com", "category": "gambling", "captured_at": "2025-12-01T10:00:00Z", "screenshot_available": true }, { "url": "https://spinwin-247.net", "category": "gambling", "captured_at": "2026-01-15T14:30:00Z", "screenshot_available": true } ], "evidence_count": 3 } ``` *** ## Status field The `status` field is the top-level classification. It will always be one of two values: | Value | Meaning | | --------- | ------------------------------------------------------------------------------------------------------ | | `FLAGGED` | The VPA has been found on one or more fraud, gambling, phishing, or scam sources tracked by FraudTrace | | `CLEARED` | The VPA is not present in the FraudTrace database at the time of the request | When `status` is `CLEARED`, all risk fields (`confidence`, `cluster_id`, `risk_category`, `sources`) return as `null` or empty. *** ## Confidence score The `confidence` field is a floating-point number between 0.0 and 1.0 that represents how strongly the evidence supports the flagged classification. It is only present when `status` is `FLAGGED`. | Range | Risk level | Recommended action | | --------- | ---------- | ------------------------------------------------------------------- | | 0.85–1.0 | **High** | Block the transaction or reject the onboarding application outright | | 0.60–0.84 | **Medium** | Route to manual review; do not auto-approve | | 0.0–0.59 | **Low** | Allow with enhanced monitoring; schedule re-screening | A medium-confidence flag still warrants attention. It can indicate a VPA that has recently appeared on fraud infrastructure, where the evidence corpus is still growing. Treat medium flags as "pending investigation" rather than "probably fine." *** ## Risk category The `risk_category` field describes the nature of the fraud activity the VPA has been linked to. | Category | What it means | | -------------------- | --------------------------------------------------------------------------------------------------------------- | | `mule` | The VPA appears as a deposit address on fraud or gambling sites — it is being used to receive and launder funds | | `phishing` | The VPA has been used in phishing campaigns to solicit payments from victims under false pretences | | `scam` | The VPA is linked to advance-fee fraud, fake investment schemes, or job scams | | `gambling` | The VPA is listed as a payment address on illegal online gambling platforms | | `nbfc_impersonation` | The VPA is associated with websites impersonating legitimate NBFCs or lending apps to harvest loan repayments | A single VPA can be linked to multiple categories across different evidence sources. The `risk_category` field reflects the primary or highest-severity category detected. *** ## Cluster membership When a VPA is part of a coordinated fraud network, it is assigned to a **cluster** — a group of VPAs that appear together across multiple fraud sources, share infrastructure, or exhibit correlated behaviour. | Field | What it tells you | | -------------- | --------------------------------------------------------- | | `cluster_id` | A unique identifier for the cluster (e.g. `MC-2104`) | | `cluster_size` | The number of VPAs currently associated with this cluster | A large `cluster_size` (e.g. 7 or more VPAs) suggests an organised fraud operation rather than an isolated bad actor. Use the `cluster_id` to pull the full cluster via the cluster endpoint: ```bash theme={null} curl https://api.fraudtraceai.com/v1/verify/upi/cluster/MC-2104 \ -H "Authorization: Bearer YOUR_API_KEY" ``` This returns all VPAs in the cluster, allowing your fraud team to block the entire network rather than reacting to one VPA at a time. *** ## Evidence sources The `sources` array contains the individual pieces of evidence that contributed to the flag. Each entry represents a specific web page or platform on which the VPA was found. | Field | Description | | ---------------------- | --------------------------------------------------------------- | | `url` | The URL of the page where the VPA was captured | | `category` | The category of the source site (e.g. `gambling`, `phishing`) | | `captured_at` | ISO 8601 timestamp of when FraudTrace captured this evidence | | `screenshot_available` | Whether a screenshot of the source page is available for review | When `screenshot_available` is `true`, contact your account manager or use the FraudTrace dashboard to retrieve the screenshot. Screenshots are useful when escalating a case internally or filing a complaint with NPCI or law enforcement. The `evidence_count` field reflects the total number of distinct evidence items for this VPA, which may be higher than the number of entries in the `sources` array if some sources are withheld for operational security reasons. *** ## first\_seen and last\_seen These timestamps tell you when FraudTrace first and most recently observed the VPA on fraud infrastructure. | Signal | Interpretation | | ---------------------------------- | ------------------------------------------------------------------------------------------ | | `last_seen` within the last 7 days | The VPA is **actively in use** — high operational urgency | | `last_seen` 1–3 months ago | Recently active — still treat as high risk | | `last_seen` more than 6 months ago | May be dormant, but a long `cluster_size` or high `confidence` should still override this | | `first_seen` very recent | Newly emerged fraud infrastructure — may still have low confidence as evidence accumulates | Use `last_seen` as a recency signal to prioritise your review queue: a VPA last seen yesterday is a more urgent case than one last seen eight months ago with the same confidence score. *** ## CLEARED caveats A `CLEARED` response means FraudTrace has no evidence of this VPA in its database **at the time of the request**. It does not mean the VPA is safe. **CLEARED is not a clearance certificate.** New mule VPAs are set up every day. A VPA can be clean today and appear on a fraud site tomorrow. FraudTrace continuously indexes new sources, so a VPA that returns `CLEARED` now may return `FLAGGED` on a future screening. Schedule periodic re-screening for high-value beneficiaries and active merchants. Always combine FraudTrace results with your existing KYC, transaction monitoring, and behavioural analytics. FraudTrace is a powerful signal — it is most effective as one layer of a defence-in-depth strategy. *** ## Frequently asked questions Do not auto-approve or auto-reject. Route the case to a human reviewer with the full FraudTrace response — particularly the `sources` array and `cluster_id`. Medium confidence often reflects a VPA that has appeared recently on fraud infrastructure where evidence is still accumulating. Your reviewer should check the merchant's or customer's profile for other risk signals before making a decision. If in doubt, request additional documentation before proceeding. Yes, false positives are possible. A VPA is flagged when it appears on fraud or gambling infrastructure, but there are edge cases — for example, a legitimate business whose VPA was harvested and re-posted by a fraudulent site without their knowledge. The confidence score and evidence sources help you assess the likelihood: multiple independent sources, a large cluster, and recent `last_seen` timestamps increase confidence that a flag is genuine. When you believe a result is a false positive, use the FraudTrace dashboard to submit a dispute — confirmed false positives are reviewed and removed promptly. FraudTrace continuously crawls fraud sites, gambling platforms, phishing pages, and scam infrastructure. New VPAs discovered during a crawl are typically indexed within a few hours of capture. For time-critical use cases — such as large-value real-time payments — combine FraudTrace screening with your own transaction velocity and behavioural checks, since a VPA that went live on a fraud site minutes ago may not yet be indexed. `CLEARED` means the queried VPA does not appear in the FraudTrace database at the moment you made the request. It reflects the absence of evidence, not the presence of safety. The database is comprehensive but not exhaustive — new fraud infrastructure is discovered continuously. Treat `CLEARED` as "no known risk signal" and continue applying your standard due diligence processes alongside it.