> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fraudtraceai.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Screen Merchants at Onboarding Using UPI Risk Signals

> Use FraudTrace AI to screen merchant settlement VPAs at KYC, pre-activation, and periodic re-screening stages to catch fraudulent merchants early.

Payment aggregators and banks are required to perform due diligence on merchants before activating them for payment acceptance. FraudTrace AI lets you screen a merchant's settlement UPI VPA against a continuously updated database of mule accounts, fraud networks, and illegal platforms — giving your onboarding team an evidence-backed risk signal before you approve a single transaction. This guide explains how to embed that check into your merchant onboarding workflow.

## When to screen

Screening at a single point is better than nothing, but a layered approach gives you the strongest coverage:

| Stage                     | What to screen                                      | Why                                                                                 |
| ------------------------- | --------------------------------------------------- | ----------------------------------------------------------------------------------- |
| **KYC / application**     | Settlement VPA submitted on the application form    | Catch fraudulent merchants before any manual review begins                          |
| **Pre-activation**        | Settlement VPA again, just before account goes live | Catch VPAs that became flagged between application and activation                   |
| **Periodic re-screening** | All active merchant settlement VPAs                 | Detect merchants whose VPAs appear in newly discovered fraud networks post-approval |

<Info>
  Periodic re-screening is especially important for high-volume or high-value
  merchants. A VPA that was clean at onboarding can be linked to fraud activity
  months later.
</Info>

## Screen the merchant's settlement VPA

Use the single VPA lookup endpoint with the merchant's settlement UPI VPA:

```bash curl theme={null}
curl -G https://api.fraudtraceai.com/v1/verify/upi \
  --data-urlencode "upi=merchant_settlement@okhdfc" \
  -H "Authorization: Bearer YOUR_API_KEY"
```

A flagged response will look like this:

```json theme={null}
{
  "upi": "merchant_settlement@okhdfc",
  "status": "FLAGGED",
  "confidence": 0.91,
  "risk_category": "gambling",
  "cluster_id": "MC-3892",
  "cluster_size": 4,
  "first_seen": "2025-09-03T11:00:00Z",
  "last_seen": "2026-03-28T09:15:00Z",
  "sources": [
    {
      "url": "https://spinfast-india.com",
      "category": "gambling",
      "captured_at": "2026-02-10T08:00:00Z",
      "screenshot_available": true
    }
  ],
  "evidence_count": 2
}
```

## Onboarding decision table

Map the API response directly to an onboarding action:

| Result    | Confidence | Action                                                            |
| --------- | ---------- | ----------------------------------------------------------------- |
| `CLEARED` | —          | Proceed with onboarding                                           |
| `FLAGGED` | ≥ 0.85     | **Reject** the application and document the FraudTrace response   |
| `FLAGGED` | 0.60–0.84  | Initiate **enhanced due diligence** before proceeding             |
| `FLAGGED` | \< 0.60    | Approve with **additional monitoring** and scheduled re-screening |

<Warning>
  A `CLEARED` status means the VPA is not present in the FraudTrace database at
  the time of screening. It is **not** a clearance certificate. Always use
  FraudTrace alongside your existing KYC, business verification, and document
  checks — never as a standalone signal.
</Warning>

## Domain screening (coming soon)

For merchants who operate websites, FraudTrace will soon offer domain-level screening via the CyberTrace endpoint:

```
GET /v1/cyber/check
```

This endpoint will flag merchant domains associated with phishing pages, illegal gambling operations, and fake lending sites. Contact your account manager to join the early access programme.

## Logging for audit trail

Indian payment regulations require acquirers and banks to maintain verifiable records of the due diligence performed on merchants. Log the full FraudTrace API response — not just the decision — as part of your onboarding record.

At minimum, store the following fields alongside the merchant's KYC record:

```json theme={null}
{
  "screened_at": "<ISO 8601 timestamp of API call>",
  "upi": "<merchant settlement VPA>",
  "status": "<FLAGGED | CLEARED>",
  "confidence": "<score or null>",
  "cluster_id": "<cluster ID or null>",
  "risk_category": "<category or null>",
  "evidence_count": "<integer>",
  "fraudtrace_request_id": "<request ID from response headers>"
}
```

<Tip>
  FraudTrace returns a unique request ID in the `X-Request-Id` response header.
  Store this with every screening record so you can retrieve the original API
  response during a regulatory audit or dispute.
</Tip>

## Re-screening active merchants

For periodic re-screening of your active merchant portfolio, use the batch endpoint to process large lists efficiently without making hundreds of individual API calls. See [Batch UPI Verification](/guides/batch-lookup) for implementation details.